Chapter 51: Kubernetes Security — From Pod to Cluster¶

# SYNTHETIC — kubelet configuration hardening
# File: /var/lib/kubelet/config.yaml on each node
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
  anonymous:
    enabled: false          # CRITICAL: disable anonymous access
  webhook:
    enabled: true           # Delegate auth to API server
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook             # Delegate authz to API server
readOnlyPort: 0             # Disable unauthenticated read-only port (10255)
protectKernelDefaults: true  # Prevent pods from changing kernel parameters
eventRecordQPS: 50          # Ensure events are captured for detection

# SYNTHETIC — Namespace-level PSS enforcement
apiVersion: v1
kind: Namespace
metadata:
  name: synth-production
  labels:
    # Enforce restricted profile — reject non-compliant pods
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    # Warn on baseline violations (for migration)
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
    # Audit log violations
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/audit-version: latest

# SYNTHETIC — Hardened service account configuration
apiVersion: v1
kind: ServiceAccount
metadata:
  name: synth-app-sa
  namespace: synth-production
automountServiceAccountToken: false   # CRITICAL: do not auto-mount

---
# If the application NEEDS API access, explicitly mount with audience binding
apiVersion: v1
kind: Pod
metadata:
  name: synth-app
  namespace: synth-production
spec:
  serviceAccountName: synth-app-sa
  automountServiceAccountToken: false
  containers:
  - name: app
    image: synth-registry.example.com/app@sha256:abc123...
    volumeMounts:
    - name: sa-token
      mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      readOnly: true
  volumes:
  - name: sa-token
    projected:
      sources:
      - serviceAccountToken:
          path: token
          expirationSeconds: 3600     # Short-lived (1 hour)
          audience: synth-api-server  # Audience-bound

# SYNTHETIC — Pod with hostPID escape vector
apiVersion: v1
kind: Pod
metadata:
  name: synth-escape-demo
  namespace: synth-dev
spec:
  hostPID: true              # Shares host PID namespace
  containers:
  - name: escape
    image: synth-registry.example.com/debug:1.0
    securityContext:
      privileged: false      # Even WITHOUT privileged flag
    command: ["sleep", "infinity"]

# ESCAPE CONCEPT:
# With hostPID=true, the container can see ALL host processes.
# If the container has nsenter binary:
#   nsenter -t 1 -m -u -i -n -- /bin/bash
#   → Enters PID 1's namespaces (init process = host)
#   → Full host shell access
#
# EVEN WITHOUT PRIVILEGED FLAG, hostPID enables:
#   - Process enumeration of host and all containers
#   - /proc/<pid>/environ reading (environment variable secrets)
#   - Signal injection to host processes
#   - With nsenter: full namespace escape

# SYNTHETIC — EncryptionConfiguration for Kubernetes Secrets
# File: /etc/kubernetes/encryption-config.yaml
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
  - secrets
  - configmaps
  providers:
  # Primary: AES-GCM (recommended — authenticated encryption)
  - aesgcm:
      keys:
      - name: key-2026-04
        secret: REDACTED  # 32-byte base64-encoded key
  # Fallback: allows reading old unencrypted secrets during migration
  - identity: {}

# API server flag: --encryption-provider-config=/etc/kubernetes/encryption-config.yaml
#
# CRITICAL STEPS after enabling:
# 1. Restart API server with the flag
# 2. Re-encrypt all existing secrets:
#    kubectl get secrets --all-namespaces -o json | kubectl replace -f -
# 3. Remove the identity{} provider after migration
# 4. Store encryption key OUTSIDE the cluster (HSM, Vault, KMS)

# SYNTHETIC — External Secrets Operator example
# Syncs a secret from AWS Secrets Manager into a Kubernetes Secret
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: synth-db-credentials
  namespace: synth-production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: synth-aws-secrets-manager
    kind: ClusterSecretStore
  target:
    name: synth-db-secret
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: synth/production/database
      property: username
  - secretKey: password
    remoteRef:
      key: synth/production/database
      property: password

# SYNTHETIC — Default deny all ingress and egress
# Apply to every namespace as the baseline
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: synth-production
spec:
  podSelector: {}          # Applies to ALL pods in namespace
  policyTypes:
  - Ingress
  - Egress
  # No ingress/egress rules = deny all traffic

# SYNTHETIC — Allow only intra-namespace communication + DNS
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: synth-production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector: {}      # Allow from same namespace only
  egress:
  - to:
    - podSelector: {}      # Allow to same namespace only
  - to:                    # Allow DNS resolution
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

# SYNTHETIC — Cilium L7 network policy
# Only allows GET requests to /api/v1/health and /api/v1/data
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: synth-api-l7-policy
  namespace: synth-production
spec:
  endpointSelector:
    matchLabels:
      app: synth-api
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: synth-frontend
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "GET"
          path: "/api/v1/health"
        - method: "GET"
          path: "/api/v1/data"
        # POST, PUT, DELETE are implicitly denied

# SYNTHETIC — Kyverno policy requiring image signatures
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce  # Block non-compliant pods
  background: false
  rules:
  - name: check-image-signature
    match:
      any:
      - resources:
          kinds:
          - Pod
    verifyImages:
    - imageReferences:
      - "synth-registry.example.com/*"
      attestors:
      - count: 1
        entries:
        - keys:
            publicKeys: |-
              -----BEGIN PUBLIC KEY-----
              REDACTED
              -----END PUBLIC KEY-----

---
# SYNTHETIC — Kyverno policy: block images from untrusted registries
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-image-registries
spec:
  validationFailureAction: Enforce
  rules:
  - name: validate-registries
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Images must come from approved registries."
      pattern:
        spec:
          containers:
          - image: "synth-registry.example.com/*"

# SYNTHETIC — Custom Falco rules for Kubernetes security
# File: /etc/falco/rules.d/k8s-custom-rules.yaml

# Detect shell execution in a container
- rule: Shell in Container
  desc: Detect interactive shell opened in a container
  condition: >
    spawned_process and
    container and
    proc.name in (bash, sh, zsh, dash, ksh) and
    proc.tty != 0
  output: >
    Shell opened in container
    (user=%user.name command=%proc.cmdline
     container=%container.name pod=%k8s.pod.name
     namespace=%k8s.ns.name image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, mitre_execution]

# Detect reading of sensitive files
- rule: Read Sensitive File in Container
  desc: Detect reads of sensitive files that may indicate credential theft
  condition: >
    open_read and
    container and
    fd.name in (/etc/shadow, /etc/passwd,
                /var/run/secrets/kubernetes.io/serviceaccount/token,
                /var/run/secrets/kubernetes.io/serviceaccount/ca.crt)
  output: >
    Sensitive file read in container
    (file=%fd.name user=%user.name command=%proc.cmdline
     container=%container.name pod=%k8s.pod.name
     namespace=%k8s.ns.name)
  priority: CRITICAL
  tags: [container, credential_access, mitre_credential_access]

# Detect crypto-mining indicators
- rule: Detect Crypto Mining Process
  desc: Detect processes commonly associated with cryptocurrency mining
  condition: >
    spawned_process and
    container and
    (proc.name in (xmrig, minerd, minergate, cpuminer) or
     proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "pool.mining" or
     proc.cmdline contains "--donate-level")
  output: >
    Crypto mining process detected
    (process=%proc.name command=%proc.cmdline
     container=%container.name pod=%k8s.pod.name
     namespace=%k8s.ns.name)
  priority: CRITICAL
  tags: [container, cryptomining, mitre_resource_hijacking]

# Detect nsenter (container escape tool)
- rule: Detect nsenter Usage
  desc: nsenter allows entering host namespaces — container escape indicator
  condition: >
    spawned_process and
    container and
    proc.name = nsenter
  output: >
    nsenter executed in container (POSSIBLE ESCAPE ATTEMPT)
    (command=%proc.cmdline container=%container.name
     pod=%k8s.pod.name namespace=%k8s.ns.name
     user=%user.name)
  priority: CRITICAL
  tags: [container, escape, mitre_privilege_escalation]

# SYNTHETIC — Tetragon TracingPolicy
# Block sensitive file access in containers
apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: block-sensitive-access
spec:
  kprobes:
  - call: "security_file_open"
    syscall: false
    args:
    - index: 0
      type: "file"
    selectors:
    - matchArgs:
      - index: 0
        operator: "Prefix"
        values:
        - "/etc/shadow"
        - "/etc/kubernetes/pki"
        - "/var/lib/etcd"
      matchActions:
      - action: Sigkill      # Kill the process immediately
    - matchArgs:
      - index: 0
        operator: "Prefix"
        values:
        - "/var/run/secrets/kubernetes.io/serviceaccount/token"
      matchActions:
      - action: Post          # Log but allow (for expected access)

# SYNTHETIC — Kubernetes audit policy
# File: /etc/kubernetes/audit-policy.yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# CRITICAL: Log ALL authentication failures at RequestResponse
- level: RequestResponse
  verbs: ["create"]
  resources:
  - group: "authentication.k8s.io"
    resources: ["tokenreviews"]

# HIGH: Log secret access at Metadata only (never log secret values!)
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]

# HIGH: Log RBAC changes at Request level
- level: Request
  verbs: ["create", "update", "patch", "delete"]
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]

# HIGH: Log pod exec and port-forward
- level: Request
  verbs: ["create"]
  resources:
  - group: ""
    resources: ["pods/exec", "pods/portforward", "pods/attach"]

# MEDIUM: Log workload changes at Metadata
- level: Metadata
  verbs: ["create", "update", "patch", "delete"]
  resources:
  - group: "apps"
    resources: ["deployments", "daemonsets", "statefulsets"]
  - group: ""
    resources: ["pods", "services", "configmaps"]
  - group: "batch"
    resources: ["jobs", "cronjobs"]

# LOW: Log read-only access at None (reduce volume)
- level: None
  verbs: ["get", "list", "watch"]
  resources:
  - group: ""
    resources: ["events", "endpoints"]

# CATCH-ALL: Metadata for everything else
- level: Metadata