securing-kubernetes-on-cloud

# Securing Kubernetes on Cloud ## When to Use - When deploying new managed Kubernetes clusters in production with security requirements - When hardening existing EKS, AKS, or GKE clusters after a security audit or pentest finding - When implementing workload identity to eliminate static cloud credentials in pods - When enforcing pod security policies across namespaces to prevent container escapes - When integrating runtime security monitoring for detecting container-level threats **Do not use** for non-Kubernetes container deployments like ECS Fargate or Azure Container Instances, for application-level security within containers (see securing-serverless-functions), or for CI/CD pipeline security (see implementing-cloud-devsecops). ## Prerequisites - Managed Kubernetes cluster provisioned on EKS, AKS, or GKE with admin access - kubectl configured with cluster admin credentials - Familiarity with Kubernetes RBAC, namespaces, and security contexts - Container network interface plugin supporting network policies (Calico, Cilium) ## Workflow ### Step 1: Enforce Pod Security Standards Apply Pod Security Admission labels at the namespace level to enforce the Restricted profile in production namespaces. Pod Security Policies were removed in Kubernetes v1.25 and replaced with Pod Security Admission. ```yaml # Production namespace with restricted Pod Security Standard apiVersion: v1 kind: Namespace metadata: name: production labels: pod-security.kubernetes.io/enforce: ...