Kubernetes security & hardening

Correct — pods can no longer reach kube-dns on port 53, so every hostname lookup fails — always allow DNS egress alongside a default-deny.

Correct — it scores control-plane flags, file permissions, and kubelet settings against CIS and cites each item.

Correct — a compromised pod that reaches it can often assume the node’s cloud role and pivot into the account.

Correct — naming only Ingress leaves egress untouched (allow-all) until a policy covers it.

Correct — separate list items are ORed; combine them under one item for AND.

Correct — the controller presents it and forwards plaintext internally.

Correct — they 308-upgrade HTTP requests to HTTPS.

Correct — catches a corrupted download or a man-in-the-middle swap.

Correct — you permit the world and carve out the metadata address.

Correct — without DNS every hostname lookup times out.

Correct — Calico/Cilium/Weave enforce it; some default/bridge CNIs silently ignore every policy.

Correct — it disables authorization entirely — anyone who reaches the API can do anything. Use Node,RBAC.

Correct — these let a subject grant themselves more than their own role allows — treat them as near-admin.

Correct — no reason to hand every container an API credential it never uses — turn automount off and opt in per-pod.

Correct — require auth, let the API server vet each call, and close the unauthenticated port.

Correct — so "can-i create secrets --as ..." is a fact, not a guess.

Correct — prefer a namespaced Role over a ClusterRole wherever you can.

Correct — a leaked one expires and is scoped to the API server.

Correct — so one node cannot relabel others or read secrets it was not assigned.

Correct — the API server is the highest-value target — patch on a short clock.

Correct — name explicit verbs; the wildcard is how privilege quietly accumulates.

Correct — it turns the runtime’s curated syscall filter back on with near-zero risk of breaking the app.

Correct — seccomp cannot limit which files a process touches — AppArmor confines resource access.

Correct — exercise the app, read the denials, tighten, then enforce.

Correct — a one-line, high-value default that blocks the risky syscalls.

Correct — localhostProfile paths resolve relative to it.

Correct — let the log tell you, then flip the default action to errno.

Correct — privileged also restores all caps and exposes host devices.

Correct — container_t may only touch container_file_t content.

Correct — the node is inside the trust boundary; shrink what an intruder finds.

Correct — a user-space kernel or lightweight VM gives its own kernel boundary.

Correct — non-root, no escalation, and a minimal capability set are the high-value baseline.

Correct — that is exactly the restricted baseline PSA enforces via namespace labels.

Correct — a user-space kernel or lightweight VM contains a kernel-level escape.

Correct — three independent modes set per namespace.

Correct — enforcing outright rejects every non-compliant pod on next deploy.

Correct — the API server then encrypts secret data before writing etcd.

Correct — only future writes are encrypted, so you rewrite in place.

Correct — keep secrets:get scoped tight — encryption and least-privilege are different controls.

Correct — so a service knows it is really talking to who it expects.

Correct — a file is read only by code that opens it, and can be made read-only.

Correct — pass one reports for visibility; pass two gates on what you would actually page for.

Correct — Kubesec scores how you ask to run the workload; scanning reads the image.

Correct — you must also pin allowed registries and the expected signer identity.

Correct — no durable private key to steal.

Correct — unsigned/untrusted images are refused before a pod runs.

Correct — less surface for both patching and post-exploitation.

Correct — "is it signed" is not the question — "signed by us, from our registry" is.

Correct — static manifest analysis catches the privileged pod in review.

Correct — syft generates it; grype/trivy scan it.

Correct — minimal helps, but "few" is not "none".

Correct — a shell in a container or a write to /etc fires in real time against a rule.

Correct — the local file takes precedence over a shipped rule of the same name and survives upgrades.

Correct — Metadata records who, what, and when without the request/response bodies.

Correct — the two feeds answer different halves of an investigation.

Correct — so you drop noise first, then set levels for sensitive resources.

Correct — noise buries the one alert that matters.

Correct — log sensitive verbs in detail, everything else at Metadata or None.

Correct — off-box storage preserves the evidence.

Correct — that turns "something happened" into a concrete account of the intrusion.

Correct — hardening turns the workload into a tripwire.