authegg/kubernetes-pod-security

Kubernetes Pod Security

Enforce Kubernetes pod and workload security using Pod Security Standards (PSS), CIS Kubernetes Benchmark, and NSA/CISA Kubernetes Hardening Guide.

When to Use

• Creating or editing Kubernetes Deployments, StatefulSets, DaemonSets, Jobs, CronJobs
• Writing Helm charts or Kustomize overlays
• Configuring RBAC roles and bindings
• Setting up NetworkPolicies
• Reviewing manifests before production deployment

Pod Security Checklist — Apply to Every Workload

SecurityContext (Required on Every Pod/Container)

1. Run as non-root:

   securityContext:
     runAsNonRoot: true
     runAsUser: 1000
     runAsGroup: 1000
   

2. Read-only root filesystem:

   securityContext:
     readOnlyRootFilesystem: true
   

3. Drop all capabilities:

   securityContext:
     capabilities:
       drop: ["ALL"]
       add: ["NET_BIND_SERVICE"]  # Only if needed
   

4. Disallow privilege escalation:

   securityContext:
     allowPrivilegeEscalation: false
   

5. Use seccomp profile:

   securityContext:
     seccompProfile:
       type: RuntimeDefault
   

Resource Management (Required)

6. CPU and memory limits on every container:

   resources:
     requests:
       cpu: "100m"
       memory: "128Mi"
     limits:
       cpu: "500m"
       memory: "512Mi"
   

7. Never use resources: {} or omit resources entirely.

Image Security

8. Pin images by digest:

   image: nginx@sha256:abc123...
   

9. Always set imagePullPolicy:

   imagePullPolicy: Always  # For mutable tags
   

10. Use private registries with imagePullSecrets.

RBAC (Least Privilege)

11. Never bind ClusterAdmin to service accounts.
12. Use Role (namespaced) over ClusterRole where possible.
13. Avoid wildcards in RBAC rules: No verbs: ["*"] or resources: ["*"].
14. ServiceAccount per workload — don't use the default service account:

    automountServiceAccountToken: false  # Unless needed
    

Network

15. NetworkPolicy for every namespace — default deny ingress/egress, then allow explicitly:

    apiVersion: networking.k8s.io/v1
    kind: NetworkPolicy
    metadata:
      name: default-deny-all
    spec:
      podSelector: {}
      policyTypes: ["Ingress", "Egress"]
    

16. No hostNetwork, hostPID, or hostIPC:

    spec:
      hostNetwork: false
      hostPID: false
      hostIPC: false
    

Secrets

17. Never put secrets in env vars from ConfigMaps — use Kubernetes Secrets or external secret operators.
18. Never hardcode secrets in manifests — use SealedSecrets, ExternalSecrets, or Vault.
19. Enable encryption at rest for etcd.

Pod Security Standards (PSS)

20. Target "Restricted" profile for production namespaces:

    apiVersion: v1
    kind: Namespace
    metadata:
      labels:
        pod-security.kubernetes.io/enforce: restricted
        pod-security.kubernetes.io/warn: restricted
        pod-security.kubernetes.io/audit: restricted
    

Secure Deployment Template

apiVersion: apps/v1
kind: Deployment
metadata:
  name: secure-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: secure-app
  template:
    metadata:
      labels:
        app: secure-app
    spec:
      automountServiceAccountToken: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: myapp@sha256:abc123...
          imagePullPolicy: Always
          ports:
            - containerPort: 8080
              protocol: TCP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "500m"
              memory: "512Mi"
          livenessProbe:
            httpGet:
              path: /healthz
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: tmp
          emptyDir:
            sizeLimit: "100Mi"

Severity Classification

• CRITICAL: Running as root, privileged containers, hostPID/hostNetwork, wildcard RBAC
• HIGH: No SecurityContext, missing resource limits, no NetworkPolicy, default service account with token
• MEDIUM: Missing probes, no seccomp profile, mutable image tags
• LOW: Missing pod disruption budgets, no topology spread, missing labels