Skip to main content
Hello, and welcome to this section on Kubernetes security. In this lesson we introduce the core Kubernetes security primitives: how users and system components authenticate to a cluster, and how their actions are authorized and constrained. We’ll begin with authentication methods and the cluster’s default settings, then practice inspecting an existing cluster’s security configuration.
  • Topics covered in this section:
    • Authentication mechanisms (client certs, tokens, OIDC)
    • Authorization (RBAC and default behaviors)
    • TLS certificates for cluster components and certificate troubleshooting
    • Image security and admission controls
    • Running workloads with least privilege using Security Contexts
    • Network Policies to restrict pod-to-pod traffic
A presentation slide titled "Security" with a dark left column. It lists four numbered topics: Kubernetes Security Primitives; Secure Persistent Key Value Store; Authentication and Authorization; and Security Contexts.
TLS certificates and their role in securing cluster components are a major component of cluster hardening. If you’ve set up a cluster yourself or debug cluster issues, you’ll likely encounter certificate-related problems — so we cover TLS from basic concepts through cluster-level applications and troubleshooting techniques.
A slide titled "Security" with a dark left column and three numbered items on the right: 05 TLS Certificates for Cluster Components, 06 Image Security, and 07 Network Policies.
I spent extra time on certificate material to simplify core concepts and give a clear path from fundamentals to practical troubleshooting. During preparation we polled learners about their TLS experience; most identified as beginners, so the content includes additional introductory explanations and hands-on exercises to make the many certificates used across cluster components easier to understand.
If you already have experience with TLS and certificates, you can focus on authorization and other advanced topics.
After authentication and TLS, we focus on authorization with an emphasis on Role-Based Access Control (RBAC) and its common pitfalls. Then we cover image security practices, Security Contexts for controlling pod and container privileges, and Network Policies to enforce pod-to-pod communication rules. Goals for this section:
  • Understand how users and components authenticate to Kubernetes.
  • Inspect and interpret certificate-related configuration and logs.
  • Apply RBAC to grant least-privilege access.
  • Harden workloads using Security Contexts and image policies.
  • Implement Network Policies to limit attack surface and lateral movement.
Links and references There are many lectures and hands-on practice tests in this section — proceed at your own pace. By the end, you’ll be able to diagnose and resolve common security- and certificate-related issues in Kubernetes.

Watch Video