Implement network policies, Pod Security Admission, and resource constraints to harden Kubernetes pods against common threats.

Diagnosis: Common Pod Security Failures

Most insecure pods stem from three gaps:

• Missing network isolation: Unrestricted ingress/egress exposes attack surfaces.
• Permissive admission controls: Default policies allow privileged containers.
• Unbounded resource usage: No limits lead to noisy neighbor issues or crashes.

Check for these with:

kubectl get pods --as=system:serviceaccount:<namespace>:default -o jsonpath='{.items[0].spec.securityContext}'  
kubectl get networkpolicies -A  
kubectl describe pod <pod-name> | grep -i 'resources'  

Repair Workflow: Immediate Hardening Steps

1. Apply Network Policies
   Restrict pod communication to least-privilege rules. Example:

   kubectl apply -f - <<EOF  
   apiVersion: networking.k8s.io/v1  
   kind: NetworkPolicy  
   metadata:  
     name: default-deny  
   spec:  
     podSelector: {}  
     policyTypes:  
     - Ingress  
     - Egress  
   EOF  
   

   Then allow specific traffic explicitly.

2. Enable Pod Security Admission (PSA)
   Set cluster-wide defaults to enforce security contexts:

   kubectl label namespaces <namespace> pod-security.kubernetes.io/enforce=restricted  
   kubectl label namespaces <namespace> pod-security.kubernetes.io/enforce=baseline  
   

3. Set Resource Limits
   Apply requests/limits to prevent resource exhaustion:

   resources:  
     requests:  
       cpu: "100m"  
       memory: "256Mi"  
     limits:  
       cpu: "500m"  
       memory: "512Mi"  
   

Prevention: Policy as Code and Monitoring

• Automate enforcement: Use Kyverno or OPA/Gatekeeper to validate pods on admission.
• Monitor violations:

  kubectl get events --field-selector reason=PodSecurityViolation  
  

• Audit regularly:

  kubectl auth can-i --list --as=system:serviceaccount:<namespace>:<service-account>  
  

Policy Example: Restrictive Pod Security

For OpenShift environments, leverage Security Context Constraints (SCCs):

oc get scc restricted -o yaml  
# Apply via role binding to service accounts  
oc adm policy add-scc-to-user restricted -z <service-account>  

Tooling

• kubectl: describe, get events, auth can-i for diagnostics.
• OpenShift CLI: oc adm policy for SCC management.
• Kyverno: Enforce image policies, security contexts.
• Falco: Runtime anomaly detection.

Tradeoffs and Caveats

• Strict policies break apps: Some workloads (e.g., init containers) need exceptions. Start with admit modes in PSA (restricted, baseline, exempt) to phase in enforcement.
• NetworkPolicy overhead: Misconfigured policies can silently drop traffic. Test with kubectl exec to simulate connectivity.

Troubleshooting Common Failures

• Pod in CrashLoopBackoff: Check resource limits or image pull errors:

  kubectl describe pod <pod-name> | grep -A 5 Events  
  

• Admission denied: Verify PSA labels and SCC bindings:

  kubectl get namespace <namespace> -o jsonpath='{.metadata.labels}'  
  kubectl get rolebindings -n <namespace>  
  

• NetworkPolicy not applying: Ensure CNI plugin supports policies (e.g., Calico, Cilium).

Final Note

Security is a process, not a checkbox. Prioritize observability, iterate on policies, and avoid over-reliance on default configurations. Test changes in staging before production.

Source thread: [Question] People don’t know how to secure pods?