Kubernetes hardening

Kubernetes orchestrates containers at scale and its attack surface is huge: API server, RBAC, pod networking, secrets, and the runtime. A misconfigured cluster lets you escalate from a compromised pod to full control. This card covers hardening the critical points.

Surface and critical points

API server     the brain; exposing it or a lax RBAC = cluster control
etcd           store of EVERYTHING (incl. secrets); encrypt and restrict access
kubelet        on each node; its poorly protected API gives node execution
RBAC           who can do what; excess permissions is the #1 flaw
network        by default EVERY pod talks to all -> needs NetworkPolicies

RBAC and service accounts

- least privilege in Roles/ClusterRoles; avoid cluster-admin and wildcards (*)
- a ServiceAccount per workload, don't mount the token if unused (automountServiceAccountToken: false)
- beware dangerous verbs (create pods, exec, secrets get) -> escalation paths
- audit permissions: `kubectl auth can-i`, tools (rbac-tool, kubescape)

Pod Security and admission

Pod Security Standards (PSS)   baseline/restricted via Pod Security Admission
  -> no privileged, no hostPath/hostNetwork, no root, drop capabilities (see dso-containers)
Admission control (OPA Gatekeeper / Kyverno)  policies: signed images only, labels,
  resource limits, no :latest, allowed registries

Network and secrets

NetworkPolicies   default-deny between pods/namespaces -> microsegmentation (see def-red)
Secrets           base64 != encrypted: encrypt etcd at rest, external-secrets/sealed-secrets (dso-secrets)
Ingress/mTLS      TLS at the edges; service mesh (mTLS) for east-west traffic if applicable

Typical attack paths (that hardening closes)

- compromised pod + SA with broad permissions -> take the cluster via the API
- privileged/hostPath container -> escape to the node (see dso-containers)
- cloud metadata from the pod (IMDS) -> node credentials (see cloud)
- exposed etcd or kubelet; dashboards without auth

Tools

Posture     kube-bench (CIS), kubescape, kube-hunter, Trivy (misconfig)
Policies    OPA Gatekeeper, Kyverno
Runtime     Falco; API server auditing (audit logs -> def-siem)

Blue Team / AppSec

Least-privilege RBAC (no cluster-admin or *) and SA without a token if unused: it’s the #1 flaw.
Pod Security restricted + admission (Gatekeeper/Kyverno): no privileged, no root, signed images only.
Default-deny NetworkPolicies (microsegmentation) and etcd/secret encryption.
Assess posture with kube-bench/kubescape and audit the API server to the SIEM.

CVEs and real-world cases

Tesla (2018): an exposed Kubernetes dashboard without auth → cryptojacking in their cluster.
Attacks that pivot from a pod to the cloud IMDS to steal node credentials (see cloud).
Kubernetes CVEs (e.g. CVE-2018-1002105, API server escalation) underscore patching the control plane.

Testing checklist

Least-privilege RBAC; no cluster-admin/wildcards; audit can-i
ServiceAccounts without automounted token if unused
Pod Security restricted + admission (Gatekeeper/Kyverno)
Default-deny NetworkPolicies (microsegmentation)
etcd encrypted; secrets managed (Secrets management)
API server/kubelet/etcd not exposed; dashboards with auth
Posture with kube-bench/kubescape; audit logs to the SIEM
Signed images only (CI/CD security/Container security)