DEV Community

Cover image for Day 24 - Kubernetes Fundamentals and Security
Rahul Joshi
Rahul Joshi

Posted on

Day 24 - Kubernetes Fundamentals and Security

#masterclassdevsecops #webdev #kubernetes #devops

In Current Time applications are no longer deployed as a single server.

Today organizations run:

  • Microservices
  • Containers
  • Kubernetes
  • Service Mesh
  • GitOps
  • Cloud Native Platforms

At the center of this transformation is Kubernetes.

Kubernetes has become the de-facto standard for container orchestration.

According to CNCF surveys, Kubernetes adoption continues to grow rapidly across enterprises, startups, cloud providers, and platform engineering teams.

But Kubernetes is much more than deploying containers.

A production Kubernetes engineer must understand:

  • Pods
  • Services
  • ConfigMaps
  • Secrets
  • Deployments
  • RBAC
  • Network Policies
  • Pod Security
  • Runtime Security
  • Policy Enforcement

🔗 Resources

What is Kubernetes?

Kubernetes (K8s) is an open-source container orchestration platform originally developed by Google and now maintained by the CNCF.

Its purpose is to automate:

Container Deployment
        ↓
Scaling
        ↓
Networking
        ↓
Self-Healing
        ↓
Availability
Enter fullscreen mode Exit fullscreen mode

Instead of manually managing containers:

Docker Container
Docker Container
Docker Container
Enter fullscreen mode Exit fullscreen mode

Kubernetes manages them automatically.

Why Kubernetes?

Before Kubernetes:

Application
      ↓
Virtual Machine
      ↓
Manual Scaling
      ↓
Manual Recovery
Enter fullscreen mode Exit fullscreen mode

Problems:

  • Downtime
  • Scaling issues
  • Operational complexity
  • Resource wastage

Kubernetes solves these problems.

Benefits:

  • Self-healing
  • Auto-scaling
  • Service discovery
  • Rolling updates
  • Multi-cloud portability
  • High availability

k8s architecture

Control Plane manages the cluster.

Worker Nodes run workloads.

Understanding Pods

Pods are the smallest deployable unit in Kubernetes.

Think of a Pod as:

Container Wrapper
Enter fullscreen mode Exit fullscreen mode

Example:

Pod
 └─ NGINX Container
Enter fullscreen mode Exit fullscreen mode

A Pod can also contain multiple containers.

Example:

Pod
 ├─ Application Container
 └─ Logging Sidecar
Enter fullscreen mode Exit fullscreen mode

NGINX Pod Example 

apiVersion: v1
kind: Pod

metadata:
  name: nginx-pod

spec:
  containers:
  - name: nginx
    image: nginx:latest
Enter fullscreen mode Exit fullscreen mode

Create Pod:

kubectl apply -f pod.yaml
Enter fullscreen mode Exit fullscreen mode

Why Pods Matter

Pods provide:

  • Shared network
  • Shared storage
  • Shared lifecycle

Containers inside a Pod communicate using:

localhost
Enter fullscreen mode Exit fullscreen mode

What is a Deployment?

Managing Pods directly is not recommended.

Instead use Deployments.

Deployment provides:

  • Scaling
  • Rollbacks
  • Rolling Updates
  • Self-healing

Deployment Example 

apiVersion: apps/v1
kind: Deployment

metadata:
  name: nginx

spec:
  replicas: 3

  selector:
    matchLabels:
      app: nginx

  template:
    metadata:
      labels:
        app: nginx

    spec:
      containers:
      - name: nginx
        image: nginx:latest
Enter fullscreen mode Exit fullscreen mode

Deployment Benefits 

Pod Crashes
      ↓
Deployment Detects Failure
      ↓
New Pod Created
Enter fullscreen mode Exit fullscreen mode

This is Kubernetes self-healing.

What is a Service?

Pods are ephemeral.

Their IP addresses change.

Service provides a stable endpoint.

Without Service:

Client
   ↓
Pod IP
Enter fullscreen mode Exit fullscreen mode

Pod restart breaks communication.

With Service:

Client
   ↓
Service
   ↓
Pods
Enter fullscreen mode Exit fullscreen mode

Applications always connect to Service.

Service Types

Service Types

ClusterIP

Default internal service.

Inside Cluster Only
Enter fullscreen mode Exit fullscreen mode

NodePort

Exposes service through node port.

NodeIP:30080
Enter fullscreen mode Exit fullscreen mode

LoadBalancer

Creates cloud load balancer.

AWS ELB
Azure LB
GCP LB
Enter fullscreen mode Exit fullscreen mode

ExternalName

Maps service to external DNS.

Service Example 

apiVersion: v1
kind: Service

metadata:
  name: nginx-service

spec:
  selector:
    app: nginx

  ports:
  - port: 80
    targetPort: 80

  type: ClusterIP
Enter fullscreen mode Exit fullscreen mode

What is ConfigMap?

Applications need configuration.

Examples:

Database Host
API URL
Feature Flags
Enter fullscreen mode Exit fullscreen mode

Hardcoding these values is bad practice.

ConfigMaps store non-sensitive configuration.

ConfigMap Example 

apiVersion: v1
kind: ConfigMap

metadata:
  name: app-config

data:
  APP_ENV: production
  LOG_LEVEL: info
Enter fullscreen mode Exit fullscreen mode

Use inside Pod:

envFrom:
- configMapRef:
    name: app-config
Enter fullscreen mode Exit fullscreen mode

What are Kubernetes Secrets?

Secrets store sensitive information.

Examples:

Database Password
API Keys
Tokens
Certificates
Enter fullscreen mode Exit fullscreen mode

Unlike ConfigMaps, Secrets are intended for sensitive data.

Secret Example 

apiVersion: v1
kind: Secret

metadata:
  name: db-secret

type: Opaque

stringData:
  username: admin
  password: Password123
Enter fullscreen mode Exit fullscreen mode

First Image

Important Security Warning

Secrets are Base64 encoded.

They are NOT automatically encrypted.

Bad assumption:

Base64 = Encryption
Enter fullscreen mode Exit fullscreen mode

Wrong.

Production clusters should enable:

Encryption at Rest
Enter fullscreen mode Exit fullscreen mode

for Secrets.

Kubernetes Security Fundamentals

Many organizations secure:

Cloud
Network
Applications
Enter fullscreen mode Exit fullscreen mode

but forget Kubernetes security.

A compromised cluster can expose:

  • Customer data
  • Internal services
  • Cloud credentials
  • Secrets

Kubernetes security must be built in from the beginning.

What is RBAC?

RBAC stands for:

Role-Based Access Control
Enter fullscreen mode Exit fullscreen mode

RBAC controls:

Who
Can Do What
Inside Kubernetes
Enter fullscreen mode Exit fullscreen mode

RBAC Components

Role

Defines permissions.

Example:

Read Pods
Read Services
Enter fullscreen mode Exit fullscreen mode

RoleBinding

Assigns Role to User.

User
   ↓
RoleBinding
   ↓
Role
Enter fullscreen mode Exit fullscreen mode

RBAC Example 

apiVersion: rbac.authorization.k8s.io/v1
kind: Role

metadata:
  name: pod-reader

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get","list","watch"]
Enter fullscreen mode Exit fullscreen mode

RBAC Arctecture

Why RBAC Matters

Without RBAC:

Developer
     ↓
Cluster Admin
Enter fullscreen mode Exit fullscreen mode

Huge security risk.

Use least privilege.

What are Network Policies?

By default:

Pod A
      ↓
Pod B
Enter fullscreen mode Exit fullscreen mode

Communication is often allowed.

This violates Zero Trust principles.

Network Policy Purpose

Control:

Pod-to-Pod Traffic
Namespace Traffic
Ingress
Egress
Enter fullscreen mode Exit fullscreen mode

Example Policy

Allow traffic only from frontend Pods.

kind: NetworkPolicy
Enter fullscreen mode Exit fullscreen mode

Result:

Frontend
    ↓
Backend

Other Pods
    ✗ Blocked
Enter fullscreen mode Exit fullscreen mode

Pod Security

Pods themselves must be secured.

Bad Pod:

privileged: true
runAsUser: 0
Enter fullscreen mode Exit fullscreen mode

This means:

Root Access
Enter fullscreen mode Exit fullscreen mode

inside container.

Huge risk.

Secure Pod Example 

securityContext:

  runAsNonRoot: true

  allowPrivilegeEscalation: false

  readOnlyRootFilesystem: true
Enter fullscreen mode Exit fullscreen mode

Benefits:

  • Reduced attack surface
  • Better compliance
  • Least privilege

Secrets Management Best Practices

Never:

Store Passwords in Git
Hardcode API Keys
Commit Secrets to Repository
Enter fullscreen mode Exit fullscreen mode

Use:

  • Kubernetes Secrets
  • External Secrets Operator
  • HashiCorp Vault
  • AWS Secrets Manager
  • Azure Key Vault

Runtime Security with Falco

Kubernetes security doesn't stop at deployment.

You must monitor runtime behavior.

This is where Falco comes in.

What is Falco?

Falco is a CNCF runtime security tool.

It detects suspicious behavior inside Kubernetes.

Falco Detection

Example:

Container Starts Shell
Enter fullscreen mode Exit fullscreen mode

Falco Alert:

Unexpected Shell Execution
Enter fullscreen mode Exit fullscreen mode

Falco Architecture 

Container Activity
        ↓
Falco Rules Engine
        ↓
Alert Generated
Enter fullscreen mode Exit fullscreen mode

Falco Detection Examples

Detect:

  • Reverse shell
  • Privilege escalation
  • Crypto miners
  • Suspicious processes
  • Unexpected file access
  • Sensitive mounts

Example Falco Alert 

Terminal shell in container
Enter fullscreen mode Exit fullscreen mode

This could indicate compromise.

Policy Enforcement with Kyverno

Security should be automated.

Developers make mistakes.

Kyverno prevents insecure workloads from being deployed.

What is Kyverno?

Kyverno is a Kubernetes-native policy engine.

It validates Kubernetes resources before deployment.

Example Use Case

Block privileged containers.

Bad Deployment:

privileged: true
Enter fullscreen mode Exit fullscreen mode

Kyverno:

Deployment Rejected
Enter fullscreen mode Exit fullscreen mode

Kyverno Benefits

Enforce:

  • Non-root containers
  • Resource limits
  • Approved registries
  • Label requirements
  • Security standards

Automatically.

Example Security Policy

Require:

runAsNonRoot=true
Enter fullscreen mode Exit fullscreen mode

Any Pod violating policy:

Rejected
Enter fullscreen mode Exit fullscreen mode

before reaching production.

Production Kubernetes Security Checklist

Identity Security

  • RBAC
  • Least Privilege
  • Service Accounts

Network Security

  • Network Policies
  • Service Mesh
  • mTLS

Secrets Security

  • Vault
  • Secrets Manager
  • Encryption at Rest

Pod Security

  • Non-root containers
  • Read-only filesystems
  • Drop Linux capabilities

Runtime Security

  • Falco
  • Monitoring
  • Audit Logs

Policy Security

  • Kyverno
  • OPA Gatekeeper

Modern Secure Kubernetes Architecture 

Developer
      ↓
Git Repository
      ↓
CI Pipeline
      ↓
Container Scan
      ↓
Kyverno Validation
      ↓
Kubernetes Cluster
      ↓
Network Policies
      ↓
RBAC
      ↓
Falco Runtime Monitoring
      ↓
Alerts
Enter fullscreen mode Exit fullscreen mode

Final Thoughts

Learning Kubernetes means more than learning Pods and Deployments.

A production Kubernetes engineer must understand both:

Workload Management
        +
Security
Enter fullscreen mode Exit fullscreen mode

Core Fundamentals:

  • Pods
  • Deployments
  • Services
  • ConfigMaps
  • Secrets

Core Security:

  • RBAC
  • Network Policies
  • Pod Security
  • Secrets Management
  • Falco
  • Kyverno

Organizations that treat Kubernetes security as an afterthought often face misconfigurations, exposed workloads, and compliance failures.

The most successful Kubernetes platforms combine:

Automation
Security
Observability
Governance
Enter fullscreen mode Exit fullscreen mode

Top comments (0)