Kubernetes security: hard to get in, harder to get out

Admission control, pod security, network policy, workload identity, secrets and the escape paths attackers actually use.

🔒 PROLesson·28 min read·Intermediate → Advanced

Kubernetesadmissionnetwork policyruntime

01Four layers of a cluster

✓What you will learn

Harden cluster, workload, network and runtime layers in order
Write an admission policy that blocks the dangerous defaults
Map the common container escape paths and close them

Layer	Threat	Control
Control plane	Exposed API server, overly broad RBAC	Private endpoint behind ZT gateway, RBAC audit, audit logs on
Workload	Privileged pods, hostPath mounts, root	Pod Security Standards (restricted), admission policies, read-only root FS
Network	Flat pod network, egress to anywhere	Default-deny NetworkPolicy, egress allow-list, mesh mTLS
Runtime	Crypto-miner, reverse shell, exec into pod	Falco/eBPF detection, no shell in images, alert on `kubectl exec`

Block the dangerous defaults at admissionyaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: restricted-defaults }
spec:
  validationFailureAction: Enforce
  rules:
  - name: no-privileged
    match: { any: [{ resources: { kinds: [Pod] } }] }
    validate:
      message: "privileged, hostPID, hostNetwork and hostPath are not allowed"
      pattern:
        spec:
          =(hostPID): false
          =(hostNetwork): false
          =(volumes): [ { X(hostPath): "null" } ]
          containers:
          - securityContext:
              =(privileged): false
              runAsNonRoot: true
              allowPrivilegeEscalation: false
              capabilities: { drop: [ALL] }

This is an advanced module

Cloud & Platform Security is part of the Pro pass. 1 more section — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access code See Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.