IT 3300 : Virtualization

Kubernetes — Security

Namespaces

  • Virtual clusters inside one cluster

  • Isolate teams/apps; scope names, quotas, and permissions

      kubectl create namespace dev
  kubectl get pods -n dev

  • Not a hard security boundary by itself, but the unit of organization

RBAC — who can do what

  • Role / ClusterRole — a set of allowed actions
  • RoleBinding / ClusterRoleBinding — grant a role to a user/service
  • Namespace-scoped (Role) vs. cluster-wide (ClusterRole)
  • Principle: least privilege

RBAC sketch

kind: Role
metadata:
  namespace: dev
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  • Bind it to a user/service account with a RoleBinding

Service accounts

  • Pods authenticate to the API as a service account
  • Give workloads their own SA with only the access they need
  • Don't run everything as default with broad rights

Pod Security Standards

  • Replaced the old PodSecurityPolicy
  • Three levels: privileged, baseline, restricted
  • Enforce per namespace to block root/privileged pods
  • Aim for restricted where you can

Resource requests & limits

  • requests — what a pod is guaranteed (used for scheduling)

  • limits — the hard ceiling

  • Prevents one pod from starving a node

      resources:
    requests: { cpu: "100m", memory: "128Mi" }
    limits:   { cpu: "500m", memory: "256Mi" }

Health probes

  • liveness — restart the container if it's broken

  • readiness — hold traffic until it's ready to serve

  • startup — give slow starters time before liveness kicks in

      readinessProbe:
    httpGet: { path: /healthz, port: 80 }

Network policies

  • By default, all pods can talk to all pods
  • NetworkPolicy restricts pod-to-pod traffic (allow-list)
  • Needs a CNI that supports it (Calico, Cilium)
  • Segment your app tiers (web can reach db; nothing else can)

Defense in depth

  • Scan images (Unit 2) + restrict pods + RBAC + NetworkPolicy
  • No single control is enough; layer them
  • Keep the cluster and nodes patched

Lab goals

  • Create a namespace and a read-only Role bound to a test user
  • Add requests/limits and a readiness probe to your app
  • (Stretch) Write a NetworkPolicy isolating your database