Deploy · Orchestration
Kubernetes
Kubernetes schedules and runs containerised workloads declaratively. Its security model — RBAC, Pod Security admission, network policy, admission webhooks — is where most of the Deploy and Protect controls are enforced.
On this page
What it does
Runs pods across nodes according to declarative manifests, with services, ingress, storage and a rich extension model.
Where it fits
Deploy — the destination for images and Helm charts — and the enforcement point for Protect controls via admission and RBAC.
Quick start
kubectl apply -k overlays/prod
kubectl auth can-i --list --as=system:serviceaccount:payments:api
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.hostNetwork==true) | .metadata.name'Common pitfalls
- Namespaces without Pod Security labels silently accept privileged pods.
- A CNI that does not enforce
NetworkPolicygives a false sense of segmentation. - Cluster-admin bindings to groups are the most common audit finding.
On this site
- Kubernetes Operations path: workloads and controllers, probes and limits, debugging real failures, Services and DNS, scaling with an HPA.
- Cloud Security Foundations: bound service account tokens versus legacy ones, Secrets in etcd before and after encryption at rest, and API audit logging enabled, tuned and read on a kind cluster.
Hands-on labs using Kubernetes
Least-Privilege Kubernetes RBAC for a Deployer Service Account
Create a service account that can roll out Deployments in one namespace and nothing else, prove the boundary with impersonation and a real short-lived token, and audit the cluster for wildcard roles and anonymous access.
Enforce Pod Security with Pod Security Admission and Kyverno
On a kind cluster, turn on the restricted Pod Security profile for a namespace, watch it reject a default pod, then add a Kyverno ValidatingPolicy in Audit mode, read the PolicyReport, and switch it to Deny.
Articles about Kubernetes
Argo CD ApplicationSets for Multi-Environment Delivery
Replace hand-copied Argo CD Applications with an ApplicationSet driven by per-environment config files: the Git file generator, templatePatch for automated versus manual sync, AppProject boundaries and deletion policy.
Cloud Identity and Least Privilege: Humans, Workloads and CI
Human and workload identities and the credentials that carry them: why static keys are dangerous, how a bound short-lived token differs from a legacy one, how CI assumes a role without a key, and how to scope each one.
Debugging Kubernetes Workloads: A Repeatable Process on Real Failures
A troubleshooting sequence (get, describe, logs, events, exec, port-forward) applied to four broken workloads: a crashing container, a missing image, a missing ConfigMap and an empty Service. Real events, real fixes.
Kubernetes Health, Resources and Reliability
What readiness, liveness and startup probes do (with a failing one of each), how requests decide scheduling and limits decide OOMKilled and throttling, what the cgroup counters show, and how termination grace works.
Kubernetes Observability with Prometheus, Grafana and Loki
kube-prometheus-stack, Loki in single-binary mode and Alloy on a kind cluster; the PromQL and LogQL that answer operational questions; low-cardinality log labels; a real OOM restart loop diagnosed end to end.
Kubernetes Scaling, Rollouts and Recovery
Manual scaling, rolling updates and rollback as an operator sees them, and a HorizontalPodAutoscaler on kind with metrics-server: real utilisation figures, a 2-to-6 scale-up under load, and the scale-down window.