1
10 steps
Kubernetes orchestrates your containerized workloads but introduces its own attack surface through the API server, etcd datastore, scheduler, and inter-component communication. Misconfigured RBAC, overly permissive pod specs, and missing network policies can give an attacker cluster-wide access. These steps help you harden Kubernetes clusters from the control plane down to individual pods.
Apply Pod Security Admission (PSA) with the restricted profile at the namespace level to block privileged containers, host namespace access, and privilege escalation. Migrate from the deprecated PodSecurityPolicy to PSA for forward-compatible enforcement.
Create a default-deny ingress and egress NetworkPolicy in every namespace. Explicitly allow only the traffic paths required by each workload. Use labels to define fine-grained pod-to-pod and namespace-to-namespace communication rules.
Audit all ClusterRole and Role bindings. Remove cluster-admin bindings from service accounts and CI/CD pipelines. Create narrow, workload-specific roles instead of broad wildcard permissions. Regularly review RBAC permissions with tools like rakkess or kubectl auth can-i.
Enable and configure admission controllers (OPA Gatekeeper, Kyverno, or built-in controllers) to enforce organizational policies. Require image provenance verification, resource limits, non-root containers, and approved registries before pods are admitted to the cluster.
Enable encryption at rest for the etcd datastore using EncryptionConfiguration. Integrate external secret management (HashiCorp Vault, AWS Secrets Manager CSI driver) instead of relying solely on native Kubernetes Secrets. Never store secrets in ConfigMaps, environment variables, or image layers.
Restrict API server access with strong authentication (OIDC, service account tokens with audience binding). Enable audit logging with a policy that captures metadata for all requests. Limit API server network exposure to internal networks and disable anonymous authentication.
Configure a comprehensive audit policy that logs authentication events, RBAC decisions, secret access, and workload modifications. Forward audit logs to a centralized, tamper-resistant log store. Alert on suspicious patterns such as secret enumeration or privilege escalation attempts.
Use a hardened container runtime (containerd with minimal attack surface). Apply CIS Benchmark hardening to worker nodes. Enable seccomp and AppArmor profiles on pods. Restrict kubelet API access and disable read-only kubelet ports.
Require signed container images verified by admission controllers. Use image policy webhooks or Kyverno policies to block unsigned or unscanned images. Maintain an allowlist of approved registries and enforce digest pinning in deployment manifests.
Configure an audit policy that records metadata for most requests and full request bodies for sensitive resources. Ship audit logs to a central SIEM outside the cluster, and alert on pod exec, secret reads by unusual identities, RBAC changes, and anonymous requests.