How to Harden a Kubernetes Cluster: RBAC, Pod Security, and Network Policies

Audit current RBAC bindings for excessive permissions:

# Find all ClusterRoleBindings that grant cluster-admin:
kubectl get clusterrolebindings -o json | jq '
  .items[] | select(.roleRef.name == "cluster-admin") |
  {name: .metadata.name, subjects: .subjects}'

# Find all service accounts with wildcard permissions:
kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]?.verbs[]? == "*" or
    .rules[]?.resources[]? == "*"
  ) | .metadata.name'

# Check what permissions a specific service account has:
kubectl auth can-i --list --as=system:serviceaccount:default:my-service-account

# Find pods using the default service account (often has excessive permissions):
kubectl get pods --all-namespaces -o json | jq '
  .items[] | select(.spec.serviceAccountName == "default" or
    .spec.serviceAccountName == null) |
  {namespace: .metadata.namespace, name: .metadata.name}'

Remove automount of service account tokens:

# For workloads that do not need to call the Kubernetes API:
apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: production
automountServiceAccountToken: false  # No token mounted in pods
---
# Or disable at pod level:
apiVersion: v1
kind: Pod
spec:
  automountServiceAccountToken: false
  serviceAccountName: my-app-sa

Create minimal RBAC roles (least privilege example):

# Role: read-only access to ConfigMaps in one namespace only
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: configmap-reader
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]  # Minimal verbs: never use "*"
  resourceNames: ["app-config"]  # Specific resource names if possible
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-configmaps
  namespace: production
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: production
roleRef:
  kind: Role
  name: configmap-reader
  apiGroup: rbac.authorization.k8s.io

Pod Security Standards (PSS) replaced PodSecurityPolicy in Kubernetes 1.25. Apply them per namespace using labels.

# Enable Restricted profile for a namespace:
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/enforce-version=latest \
  pod-security.kubernetes.io/warn=restricted \
  pod-security.kubernetes.io/audit=restricted

# Verify a pod would pass the Restricted profile (dry run):
kubectl apply --dry-run=server -n production -f my-pod.yaml
# If it fails Restricted, the error message shows which fields violate policy

# Check which namespaces have PSS labels:
kubectl get namespaces -L pod-security.kubernetes.io/enforce

Compliant pod spec (passes Restricted profile):

apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true          # Must not run as root
    runAsUser: 1000             # Specific non-root UID
    runAsGroup: 3000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault      # Required in Restricted profile
  containers:
  - name: app
    image: myapp:v1.2.3
    securityContext:
      allowPrivilegeEscalation: false  # Required
      readOnlyRootFilesystem: true     # Required in Restricted
      capabilities:
        drop:
          - ALL                         # Drop all Linux capabilities
    resources:
      limits:
        cpu: "200m"
        memory: "256Mi"
      requests:
        cpu: "100m"
        memory: "128Mi"
    volumeMounts:
    - name: tmp-volume
      mountPath: /tmp            # Writable tmp via emptyDir (not root filesystem)
  volumes:
  - name: tmp-volume
    emptyDir: {}
  hostNetwork: false             # Default; explicitly set for clarity
  hostPID: false
  hostIPC: false

By default, all pods can communicate with all other pods in a Kubernetes cluster. Network policies implement microsegmentation at the pod level.

Default deny all ingress and egress (baseline for each namespace):

# Apply this to every namespace as a starting point:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}  # Applies to ALL pods in the namespace
  policyTypes:
  - Ingress
  - Egress
  # No ingress or egress rules = deny all by default

Allow only specific pod-to-pod communication:

# Allow: frontend pods can reach backend pods on port 8080 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: backend-allow-from-frontend
  namespace: production
spec:
  podSelector:
    matchLabels:
      role: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 8080
---
# Allow: backend pods can reach the database on port 5432 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: database-allow-from-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      role: database
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: backend
    ports:
    - protocol: TCP
      port: 5432
---
# Allow DNS egress (required for all pods):
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns-egress
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

Enable Kubernetes API server audit logging:

# /etc/kubernetes/audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# Log all calls to sensitive resources at RequestResponse level:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets", "serviceaccounts/token"]
  - group: "rbac.authorization.k8s.io"
    resources: ["clusterrolebindings", "rolebindings", "clusterroles"]

# Log all exec and port-forward requests (potential container escape):
- level: Request
  resources:
  - group: ""
    resources: ["pods/exec", "pods/portforward", "pods/attach"]

# Log authentication failures:
- level: Request
  userGroups: ["system:unauthenticated"]

# Minimal logging for everything else:
- level: Metadata

# Enable in kube-apiserver (kubeadm cluster):
# In /etc/kubernetes/manifests/kube-apiserver.yaml:
# - --audit-log-path=/var/log/kubernetes/audit/audit.log
# - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
# - --audit-log-maxage=30
# - --audit-log-maxbackup=10
# - --audit-log-maxsize=100

Detection queries for Kubernetes audit logs:

// In Sentinel with Kubernetes audit logs forwarded:
// Detect: exec into a pod (potential container escape or lateral movement)
KubeAuditEvent
| where TimeGenerated > ago(24h)
| where ObjectRef.Resource == "pods" and ObjectRef.Subresource == "exec"
| where Stage == "ResponseComplete"
| project TimeGenerated, User.username, ObjectRef.Namespace,
    ObjectRef.Name, ResponseStatus.code

// Detect: secret access by service accounts (potential credential theft)
KubeAuditEvent
| where TimeGenerated > ago(24h)
| where ObjectRef.Resource == "secrets"
| where Verb in ("get", "list", "watch")
// Exclude expected system accounts:
| where User.username !startswith "system:serviceaccount:kube-system"
| project TimeGenerated, User.username, ObjectRef.Namespace,
    ObjectRef.Name, Verb

// Detect: RBAC privilege escalation attempts:
KubeAuditEvent
| where TimeGenerated > ago(24h)
| where ObjectRef.Resource in ("clusterrolebindings", "rolebindings")
| where Verb in ("create", "update", "patch")
| project TimeGenerated, User.username, ObjectRef.Name,
    RequestObject, ResponseStatus.code