// Master Kubernetes security, RBAC, network policies, pod security, and compliance. Learn to secure clusters and enforce access control.
| name | security |
| description | Master Kubernetes security, RBAC, network policies, pod security, and compliance. Learn to secure clusters and enforce access control. |
# ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-user
---
# Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: app-reader
rules:
- apiGroups: [""]
resources: ["pods", "services"]
verbs: ["get", "list"]
---
# RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: app-user-reader
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: app-reader
subjects:
- kind: ServiceAccount
name: app-user
namespace: default
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
containers:
- name: app
image: myapp:1.0
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: app-policy
spec:
podSelector:
matchLabels:
app: myapp
policyTypes:
- Ingress
- Egress
ingress:
- from:
- namespaceSelector:
matchLabels:
name: production
ports:
- protocol: TCP
port: 8080
# Check pod security standards
kubectl label namespace default pod-security.kubernetes.io/enforce=restricted
# Verify compliance
kubectl get pods -A -o json | jq '.items[] | .metadata.namespace'
# Create secret
kubectl create secret generic db-creds \
--from-literal=password=mypassword
# Use in pod
# secretKeyRef:
# name: db-creds
# key: password
# Audit policy
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
verbs: ["create", "update", "patch", "delete"]
omitStages:
- RequestReceived