Cloud Native Security: Securing Kubernetes Infrastructures

Kubernetes brought flexibility, but also a new set of attack vectors. Security must be integrated into the pipeline, from image build to execution on the cluster.

Main Security Layers

Supply-Chain, scanning for vulnerabilities in Docker] images.
Access Control (RBAC), minimum permissions per service account.
Network Policies, NetworkPolicy to isolate pods.
Runtime Security, Falco, OPA Gatekeeper to detect anomalous behavior.
Data Security, Secrets encrypted with KMS, volume encryption.

Kubernetes Security Checklist

Enable PodSecurityPolicy or Pod Security Standards.
Define Roles and RoleBindings with the principle of least privilege.
Apply NetworkPolicy to limit intra-namespace traffic.
Scan images with Trivy or Clair in CI.
Implement OPA Gatekeeper for validation policies.
Configure Falco to monitor suspicious syscalls.
Rotate Secrets regularly.
Audit API Server logs with audit policy.

Example of Restricted RBAC

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: prod
  name: read-only-role
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-only-binding
  namespace: prod
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: prod
roleRef:
  kind: Role
  name: read-only-role
  apiGroup: rbac.authorization.k8s.io

Simple Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all-except-frontend
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend

Image Scanning in CI

## .gitlab-ci.yml
stages:
  - scan
  - build
  - deploy

scan_image:
  stage: scan
  image: aquasec/trivy:latest
  script:
    - trivy image --severity HIGH,CRITICAL myapp:latest

Runtime Monitoring with Falco

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: falco
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: falco
  template:
    metadata:
      labels:
        app: falco
    spec:
      containers:
      - name: falco
        image: falcosecurity/falco:latest
        securityContext:
          privileged: true
        volumeMounts:
        - name: devfs
          mountPath: /host/dev
        - name: procfs
          mountPath: /host/proc
        - name: sysfs
          mountPath: /host/sys
      volumes:

        hostPath:
          path: /proc
      - name: sysfs
        hostPath:
          path: /sys

Conclusion

Security in Kubernetes is an ongoing process. By applying layers of defense, from image build to runtime policies, you dramatically reduce the attack surface and increase confidence in production environments.

What security practices have you already adopted in your cluster? Share in the comments!