Kubernetes Security Policies Implement defense-in-depth security for Kubernetes clusters. Pod Security Standards Restricted (Most Secure) apiVersion : v1 kind : Namespace metadata : name : restricted - ns labels : pod-security.kubernetes.io/enforce : restricted pod-security.kubernetes.io/audit : restricted pod-security.kubernetes.io/warn : restricted Secure Pod Configuration apiVersion : v1 kind : Pod metadata : name : secure - pod spec : securityContext : runAsNonRoot : true runAsUser : 1000 fsGroup : 1000 seccompProfile : type : RuntimeDefault containers : - name : app image : myapp : 1.0 securityContext : allowPrivilegeEscalation : false readOnlyRootFilesystem : true capabilities : drop : - ALL Network Policies Default Deny All apiVersion : networking.k8s.io/v1 kind : NetworkPolicy metadata : name : default - deny - all spec : podSelector : { } policyTypes : - Ingress - Egress Allow Frontend to Backend apiVersion : networking.k8s.io/v1 kind : NetworkPolicy metadata : name : allow - frontend - to - backend spec : podSelector : matchLabels : app : backend ingress : - from : - podSelector : matchLabels : app : frontend ports : - protocol : TCP port : 8080 Allow DNS Egress apiVersion : networking.k8s.io/v1 kind : NetworkPolicy metadata : name : allow - dns spec : podSelector : { } policyTypes : - Egress egress : - to : - namespaceSelector : matchLabels : name : kube - system ports : - protocol : UDP port : 53 RBAC Configuration Role (Namespace-scoped) apiVersion : rbac.authorization.k8s.io/v1 kind : Role metadata : name : pod - reader rules : - apiGroups : [ "" ] resources : [ "pods" ] verbs : [ "get" , "watch" , "list" ] RoleBinding apiVersion : rbac.authorization.k8s.io/v1 kind : RoleBinding metadata : name : read - pods subjects : - kind : ServiceAccount name : my - app namespace : production roleRef : kind : Role name : pod - reader apiGroup : rbac.authorization.k8s.io OPA Gatekeeper Policies Required Labels Constraint apiVersion : templates.gatekeeper.sh/v1 kind : ConstraintTemplate metadata : name : k8srequiredlabels spec : crd : spec : names : kind : K8sRequiredLabels targets : - target : admission.k8s.gatekeeper.sh rego : | package k8srequiredlabels violation[{"msg": msg}] { provided := {label | input.review.object.metadata.labels[label]} required := {label | label := input.parameters.labels[_]} missing := required - provided count(missing) > 0 msg := sprintf("missing labels: %v", [missing]) } Service Mesh Security (Istio) Strict mTLS apiVersion : security.istio.io/v1beta1 kind : PeerAuthentication metadata : name : default spec : mtls : mode : STRICT Best Practices Pod Security Standards at namespace level Network Policies for segmentation Least-privilege RBAC for all service accounts Run containers as non-root Read-only root filesystem Drop all capabilities unless needed Enable audit logging Regular image scanning Troubleshooting

Check RBAC permissions

kubectl auth can-i list pods --as system:serviceaccount:default:my-sa

Debug NetworkPolicy

kubectl describe networkpolicy < name

kubectl get networkpolicy -A