> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Security Concepts

> This guide covers Kubernetes security concepts, vulnerabilities, and policy enforcement using tools to harden clusters and CI/CD pipelines.

In this guide, we’ll cover critical Kubernetes security concepts, highlight common vulnerabilities in deployments and container images, and show you how to enforce policies using industry-standard tools like [OPA Conftest][conftest], [Kubesec][kubesec], and [Trivy][trivy]. By the end, you’ll have actionable steps to harden your clusters and CI/CD pipelines.

***

## Table of Contents

1. [Common Kubernetes Vulnerabilities](#common-kubernetes-vulnerabilities)
2. [Scanning and Policy Enforcement](#scanning-and-policy-enforcement)
3. [Defining and Applying securityContext](#defining-and-applying-securitycontext)
4. [Additional Kubernetes Security Features](#additional-kubernetes-security-features)
5. [Demo: Validating Deployments with OPA Conftest](#demo-validating-deployments-with-opa-conftest)
6. [Links & References](#links--references)

***

## Common Kubernetes Vulnerabilities

Attackers often exploit misconfigurations or unpatched components. Typical risks include:

* **Privileged Containers**
* **Images with Known CVEs**
* **Excessive RBAC Permissions**
* **Unrestricted Network Access**
* **Improper Secret Management**

Addressing these early in your development lifecycle prevents costly incidents later on.

***

## Scanning and Policy Enforcement

Leverage automated scanners and policy-as-code to detect risks before deployment. Below is a comparison:

| Tool         | Use Case                          | Example Command                                    |
| ------------ | --------------------------------- | -------------------------------------------------- |
| Trivy        | Image & filesystem CVE scanning   | `trivy image my-app:latest`                        |
| Kubesec      | Static manifest analysis          | `kubesec scan deployment.yaml`                     |
| OPA Conftest | Custom policy checks against YAML | `conftest test deployment.yaml --policy policies/` |

<Callout icon="lightbulb" color="#1CB2FE">
  Integrate these tools into your CI pipelines for continuous assessment. For example, add a GitHub Action step to run `trivy` on every push.
</Callout>

***

## Defining and Applying securityContext

A `securityContext` sets Linux privileges and filesystem controls for Pods and containers. Enforcing non-root users and read-only filesystems significantly reduces attack surface.

| Field                      | Description                                                  |
| -------------------------- | ------------------------------------------------------------ |
| `runAsUser`                | Numeric UID the container must run as                        |
| `runAsNonRoot`             | Ensures the container UID is non-zero                        |
| `readOnlyRootFilesystem`   | Mounts the root filesystem read-only                         |
| `allowPrivilegeEscalation` | Defaults to `false` to block setuid binaries and escalations |

<Callout icon="triangle-alert" color="#FF6B6B">
  Running containers as root (UID 0) may allow privilege escalation and lateral movement within your cluster. Always set `runAsNonRoot: true` unless absolutely necessary.
</Callout>

### Example securityContext

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsNonRoot: true
    readOnlyRootFilesystem: true
  containers:
    - name: app
      image: your-registry/secure-app:latest
      securityContext:
        allowPrivilegeEscalation: false
      volumeMounts:
        - name: tmp-volume
          mountPath: /tmp
  volumes:
    - name: tmp-volume
      emptyDir: {}
```

***

## Additional Kubernetes Security Features

Beyond `securityContext`, Kubernetes offers:

* **AppArmor & SELinux** policies for Mandatory Access Control
* **Pod Security Admission** & legacy PodSecurityPolicy
* **NetworkPolicies** to isolate traffic at the pod level
* **Audit Logging** for forensic analysis
* **Air-gapped Cluster Deployments** for sensitive environments
* **TLS Encryption** for API and etcd communication

***

## Demo: Validating Deployments with OPA Conftest

1. **Write a Rego Policy**\
   Create `policies/run_as_non_root.rego`:

   ```rego theme={null}
   package k8s.security

   deny[msg] {
     input.kind == "Pod"
     not input.spec.securityContext.runAsNonRoot
     msg = "Pods must set securityContext.runAsNonRoot = true"
   }
   ```

2. **Create a Sample Deployment**\
   Save as `deployment.yaml`:

   ```yaml theme={null}
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: insecure-deployment
   spec:
     replicas: 1
     template:
       metadata:
         labels:
           app: insecure
       spec:
         containers:
           - name: app
             image: busybox
   ```

3. **Run Conftest**

   ```bash theme={null}
   conftest test deployment.yaml --policy policies/
   ```

   You should see an error indicating the missing `runAsNonRoot` setting.

***

## Links & References

* [OPA Conftest][conftest]
* [Kubesec.io][kubesec]
* [Trivy by Aqua Security][trivy]
* [Kubernetes Security Best Practices](https://kubernetes.io/docs/concepts/security/overview/)
* [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/)

[conftest]: https://www.conftest.dev

[kubesec]: https://kubesec.io

[trivy]: https://aquasecurity.github.io/trivy/

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/devsecops-kubernetes-devops-security/module/877bd662-968c-40a5-bda6-a42b600ea957/lesson/9cddc9b9-2fb6-4b17-9318-8a1203addbb8" />
</CardGroup>