[ SRE_ARENA ]
← BACK TO ROADMAP
K8S SECURITY

K8s Security: Deny Everything

DOWNLOADING CONCEPT: 1. THE PRINCIPLE OF LEAST PRIVILEGE...
  • ↳Out of the box, Kubernetes is designed for developer velocity, not security.
  • ↳A flat network where any pod can talk to any other pod.
  • ↳Pods running as the root user.
  • ↳Unencrypted secrets.
  • ↳To run K8s in production, you must adopt a 'Zero Trust' mindset.
  • ↳Deny everything by default, and explicitly allow only what is absolutely necessary.
▲ LIVE INCIDENTA security scanner reports a critical container breakout vulnerability on the frontend pod.
sre@arena:~/k8s-security
sre@arena:~$ kubectl get pod frontend-0 -o yaml | grep -A 5 securityContext