kubernetes

Kubernetes

Pod security

• Never run as root. runAsNonRoot: true, runAsUser (non-zero) in securityContext
• readOnlyRootFilesystem: true. Mount writable volumes explicitly
• allowPrivilegeEscalation: false
• Drop all capabilities, re-add only what's needed: capabilities: {drop: [ALL], add: [NET_BIND_SERVICE]}
• No hostPID, hostNetwork, hostIPC without explicit system-level justification
• Pod Security Admission: restricted profile for all application workloads. baseline minimum for system workloads
• automountServiceAccountToken: false on pods that don't call the API server

RBAC

• Least privilege. Separate ServiceAccount per workload. No default SA with cluster-level roles
• Role/RoleBinding over ClusterRole/ClusterRoleBinding unless cluster-scope is required
• Audit RBAC with kubectl auth can-i --list and rakkess or rbac-tool
• No verbs: ["*"] or resources: ["*"] in production roles

Secrets

• Secrets in external store (Vault, AWS Secrets Manager, GCP Secret Manager). Sync via External Secrets Operator or Secrets Store CSI driver
• Never commit secrets to git. Plain Kubernetes Secret objects are base64 only — require etcd encryption at rest
• etcd encryption at rest enabled. etcd backed up on schedule (Velero or equivalent)

Network policy

• Default-deny ingress and egress per namespace. Explicit allow rules per service
• NetworkPolicies enforced by CNI (Calico, Cilium, or equivalent). Verify CNI supports policy enforcement — not all do
• Cilium: use CiliumNetworkPolicy for L7 rules (HTTP, gRPC path/method filtering) where needed

Workloads

• Deployment for stateless. StatefulSet for stateful with stable identity. DaemonSet for node-level agents
• requests and limits on every container. No unbounded CPU or memory
• CPU limits cause throttling — set conservatively or omit and rely on namespace LimitRange. Memory limits cause OOMKill — set with headroom
• minReplicas ≥ 2 for production. Single-replica = not HA
• Liveness probe: deadlock detection. Readiness probe: traffic gating. Startup probe: slow-starting containers. All three on every long-running container
• terminationGracePeriodSeconds set to cover max request duration + drain time. Default 30s is often too short
• preStop: exec: sleep 5 (or equivalent) to allow load balancer to drain before SIGTERM
• PodDisruptionBudget on all production workloads. minAvailable > 0
• topologySpreadConstraints or podAntiAffinity to spread replicas across nodes and zones
• HorizontalPodAutoscaler on CPU/memory or custom metrics for stateless workloads
• KEDA for event-driven scaling (queue depth, Kafka lag, cron). Preferred over custom metrics pipelines
• VerticalPodAutoscaler in recommendation mode to right-size requests over time