Skip to main content
In this lesson we cover practical principles and steps to reduce the attack surface on hosts in your cluster. Keeping each system minimal, consistent, and up to date limits potential entry points an attacker can use. Even one poorly configured or unpatched node can compromise the broader cluster through lateral movement or privilege escalation.
A slide titled "Reducing the Attack Surface" showing a boxed cluster of nodes labeled controlplane and worker, with an attacker icon and arrow pointing at one worker node to illustrate an attack vector.
If an attacker gains control of a single node, they may move east–west across the cluster or escalate privileges to affect other workloads. The most common contributors to an expanded attack surface include:
  • Unnecessary services and open ports
  • Outdated or unpatched software
  • Excessive user or process privileges
  • Unrestricted kernel modules or drivers
Apply the principle of least privilege and strive for simplicity and consistency to limit exposure.
Minimizing installed software, disabling unused services, and enforcing least privilege are fundamental controls that reduce the number of potential vulnerabilities an attacker can exploit.
A presentation slide titled "Reducing the Attack Surface" listing security measures. It lists: use the least privilege principle, limit access, restrict obsolete kernel modules, remove obsolete software, and remove obsolete services.
Below are the key measures shown on the slide, with actionable guidance and examples. Use the following practical recommendations and examples for each area.
  • Use the principle of least privilege
    • Grant users, services, and processes only the permissions they require.
    • Prefer narrowly-scoped RBAC roles and role bindings. Reserve cluster-admin for tightly controlled admin tasks.
  • Limit access
    • Restrict traffic using Kubernetes NetworkPolicies, perimeter firewalls, and host-based firewalls (iptables/nftables).
    • Use bastion hosts or VPNs for management plane access instead of exposing ports to broad networks.
  • Restrict obsolete kernel modules
    • Blacklist modules you do not need to prevent them from loading and increasing the kernel attack surface.
  • Remove obsolete software
    • Regularly audit installed packages and remove anything unnecessary to reduce the number of vulnerable components.
  • Remove or disable obsolete services
    • Identify enabled services and disable those not required, which prevents them from running or listening on ports.
Additional practical controls to keep the attack surface small: References and further reading: Next, we will examine each of these measures in more detail.

Watch Video