Implementing Security Best Practices

1. Implementing Network Segmentation

2. Enabling RBAC Authorization

kube-apiserver --authorization-mode=Node,RBAC

3. Using Pod Security Standards

Apply restricted profile on all workload namespaces; reserve privileged for system namespaces only.

4. Scanning Container Images

5. Enabling Secrets Encryption

apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources: [secrets]
  providers:
  - aescbc: { keys: [{ name: key1, secret: BASE64_32_BYTE_KEY }] }
  - identity: {}

6. Using Admission Controllers

Enable NodeRestriction, PodSecurity, ResourceQuota, and policy engines (Kyverno, Gatekeeper) for org rules.

7. Enabling Audit Logging

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  resources: [{ group: "", resources: [secrets, configmaps] }]
- level: RequestResponse
  verbs: [delete, deletecollection]
- level: None
  users: [system:kube-proxy]

8. Implementing mTLS

Cluster-wide mTLS via service mesh (Istio STRICT, Linkerd default). Identity from SPIFFE/SPIRE.

9. Rotating Certificates

See §42 — automate kubeadm cert renewal + kubelet auto-rotation; alert on expiry < 30 days.

10. Running CIS Benchmarks

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

11. Using Runtime Security

12. Implementing Supply Chain Security