Kubernetes Security Best Practices Cheat Sheet

This cheat sheet covers the essential security configurations you need for production Kubernetes clusters.

RBAC (Role-Based Access Control)

• Always use RBAC instead of ABAC
• Follow least privilege principle
• Avoid cluster-admin role for regular users
• Use namespaced roles when possible

Pod Security

• Set securityContext for all pods
• Run containers as non-root users
• Use read-only root filesystem
• Drop all capabilities and add only what is needed
• Implement Pod Security Standards (Restricted policy)

Network Policies

• Implement default deny ingress/egress policies
• Allow only required traffic between namespaces
• Use Calico or Cilium for advanced policies

Secrets Management

• Never store secrets in container images
• Use external secrets managers (Vault, AWS Secrets Manager)
• Enable encryption at rest for etcd
• Rotate secrets regularly

Image Security

• Use trusted base images only
• Scan images for vulnerabilities (Trivy, Snyk)
• Implement image signing with Cosign
• Use private registries with authentication

Audit and Monitoring

• Enable Kubernetes audit logging
• Monitor for suspicious activities
• Use Falco for runtime security
• Implement centralized logging (ELK, Splunk)

Remember to regularly review and update your security posture as new vulnerabilities and best practices emerge.