Kubernetes Security: Pod Security and Runtime Hardening
Kubernetes security is a layered discipline spanning admission control, container-level isolation, supply chain integrity, and runtime threat detection. Pod Security Standards (PSS) replaced the deprecated PodSecurityPolicy in v1.25 with a built-in admission plugin requiring no webhook. The SecurityContext API enforces per-container and per-pod isolation constraints such as runAsNonRoot, capability dropping, and seccomp profiles. Supply chain security uses Sigstore and cosign for image signing, Trivy for CVE scanning, and distroless base images to minimize attack surface. Runtime monitoring via Falco uses eBPF to catch live container threats, while etcd encryption-at-rest with KMS envelope encryption protects secrets even if backup media is compromised. Together these controls address the full threat surface from build time to runtime.
Sign up free to read the full topic
More DevOps topics
- Kubernetes Operators & CRDs
- Kubernetes Pod Networking & CNI
- Kubernetes Pod Scheduling
- Kubernetes RBAC
- Kubernetes Runtime Classes
- Kubernetes Secrets Management
- Kubernetes Services
- Kubernetes Storage
- Kubernetes the Hard Way
- Kubescape and Kubernetes Runtime Security
- Kustomization and Reconciliation
- Lease and Reservation Control Planes
Start free on Cariara · Coding problems · System design studio