VOOZH about

URL: https://dev.to/17j/day-24-kubernetes-fundamentals-and-security-348l

⇱ Day 24 - Kubernetes Fundamentals and Security - DEV Community

In Current Time applications are no longer deployed as a single server.

Today organizations run:

  • Microservices
  • Containers
  • Kubernetes
  • Service Mesh
  • GitOps
  • Cloud Native Platforms

At the center of this transformation is Kubernetes.

Kubernetes has become the de-facto standard for container orchestration.

According to CNCF surveys, Kubernetes adoption continues to grow rapidly across enterprises, startups, cloud providers, and platform engineering teams.

But Kubernetes is much more than deploying containers.

A production Kubernetes engineer must understand:

  • Pods
  • Services
  • ConfigMaps
  • Secrets
  • Deployments
  • RBAC
  • Network Policies
  • Pod Security
  • Runtime Security
  • Policy Enforcement

🔗 Resources

What is Kubernetes?

Kubernetes (K8s) is an open-source container orchestration platform originally developed by Google and now maintained by the CNCF.

Its purpose is to automate:

Container Deployment
 ↓
Scaling
 ↓
Networking
 ↓
Self-Healing
 ↓
Availability

Instead of manually managing containers:

Docker Container
Docker Container
Docker Container

Kubernetes manages them automatically.

Why Kubernetes?

Before Kubernetes:

Application
 ↓
Virtual Machine
 ↓
Manual Scaling
 ↓
Manual Recovery

Problems:

  • Downtime
  • Scaling issues
  • Operational complexity
  • Resource wastage

Kubernetes solves these problems.

Benefits:

  • Self-healing
  • Auto-scaling
  • Service discovery
  • Rolling updates
  • Multi-cloud portability
  • High availability

👁 k8s architecture

Control Plane manages the cluster.

Worker Nodes run workloads.

Understanding Pods

Pods are the smallest deployable unit in Kubernetes.

Think of a Pod as:

Container Wrapper

Example:

Pod
 └─ NGINX Container

A Pod can also contain multiple containers.

Example:

Pod
 ├─ Application Container
 └─ Logging Sidecar

NGINX Pod Example 

apiVersion: v1
kind: Pod

metadata:
 name: nginx-pod

spec:
 containers:
 - name: nginx
 image: nginx:latest

Create Pod:

kubectl apply -f pod.yaml

Why Pods Matter

Pods provide:

  • Shared network
  • Shared storage
  • Shared lifecycle

Containers inside a Pod communicate using:

localhost

What is a Deployment?

Managing Pods directly is not recommended.

Instead use Deployments.

Deployment provides:

  • Scaling
  • Rollbacks
  • Rolling Updates
  • Self-healing

Deployment Example 

apiVersion: apps/v1
kind: Deployment

metadata:
 name: nginx

spec:
 replicas: 3

 selector:
 matchLabels:
 app: nginx

 template:
 metadata:
 labels:
 app: nginx

 spec:
 containers:
 - name: nginx
 image: nginx:latest

Deployment Benefits 

Pod Crashes
 ↓
Deployment Detects Failure
 ↓
New Pod Created

This is Kubernetes self-healing.

What is a Service?

Pods are ephemeral.

Their IP addresses change.

Service provides a stable endpoint.

Without Service:

Client
 ↓
Pod IP

Pod restart breaks communication.

With Service:

Client
 ↓
Service
 ↓
Pods

Applications always connect to Service.

Service Types

👁 Service Types

ClusterIP

Default internal service.

Inside Cluster Only

NodePort

Exposes service through node port.

NodeIP:30080

LoadBalancer

Creates cloud load balancer.

AWS ELB
Azure LB
GCP LB

ExternalName

Maps service to external DNS.

Service Example 

apiVersion: v1
kind: Service

metadata:
 name: nginx-service

spec:
 selector:
 app: nginx

 ports:
 - port: 80
 targetPort: 80

 type: ClusterIP

What is ConfigMap?

Applications need configuration.

Examples:

Database Host
API URL
Feature Flags

Hardcoding these values is bad practice.

ConfigMaps store non-sensitive configuration.

ConfigMap Example 

apiVersion: v1
kind: ConfigMap

metadata:
 name: app-config

data:
 APP_ENV: production
 LOG_LEVEL: info

Use inside Pod:

envFrom:
- configMapRef:
 name: app-config

What are Kubernetes Secrets?

Secrets store sensitive information.

Examples:

Database Password
API Keys
Tokens
Certificates

Unlike ConfigMaps, Secrets are intended for sensitive data.

Secret Example 

apiVersion: v1
kind: Secret

metadata:
 name: db-secret

type: Opaque

stringData:
 username: admin
 password: Password123

👁 First Image

Important Security Warning

Secrets are Base64 encoded.

They are NOT automatically encrypted.

Bad assumption:

Base64 = Encryption

Wrong.

Production clusters should enable:

Encryption at Rest

for Secrets.

Kubernetes Security Fundamentals

Many organizations secure:

Cloud
Network
Applications

but forget Kubernetes security.

A compromised cluster can expose:

  • Customer data
  • Internal services
  • Cloud credentials
  • Secrets

Kubernetes security must be built in from the beginning.

What is RBAC?

RBAC stands for:

Role-Based Access Control

RBAC controls:

Who
Can Do What
Inside Kubernetes

RBAC Components

Role

Defines permissions.

Example:

Read Pods
Read Services

RoleBinding

Assigns Role to User.

User
 ↓
RoleBinding
 ↓
Role

RBAC Example 

apiVersion: rbac.authorization.k8s.io/v1
kind: Role

metadata:
 name: pod-reader

rules:
- apiGroups: [""]
 resources: ["pods"]
 verbs: ["get","list","watch"]

👁 RBAC Arctecture

Why RBAC Matters

Without RBAC:

Developer
 ↓
Cluster Admin

Huge security risk.

Use least privilege.

What are Network Policies?

By default:

Pod A
 ↓
Pod B

Communication is often allowed.

This violates Zero Trust principles.

Network Policy Purpose

Control:

Pod-to-Pod Traffic
Namespace Traffic
Ingress
Egress

Example Policy

Allow traffic only from frontend Pods.

kind: NetworkPolicy

Result:

Frontend
 ↓
Backend

Other Pods
 ✗ Blocked

Pod Security

Pods themselves must be secured.

Bad Pod:

privileged: true
runAsUser: 0

This means:

Root Access

inside container.

Huge risk.

Secure Pod Example 

securityContext:

 runAsNonRoot: true

 allowPrivilegeEscalation: false

 readOnlyRootFilesystem: true

Benefits:

  • Reduced attack surface
  • Better compliance
  • Least privilege

Secrets Management Best Practices

Never:

Store Passwords in Git
Hardcode API Keys
Commit Secrets to Repository

Use:

  • Kubernetes Secrets
  • External Secrets Operator
  • HashiCorp Vault
  • AWS Secrets Manager
  • Azure Key Vault

Runtime Security with Falco

Kubernetes security doesn't stop at deployment.

You must monitor runtime behavior.

This is where Falco comes in.

What is Falco?

Falco is a CNCF runtime security tool.

It detects suspicious behavior inside Kubernetes.

👁 Falco Detection

Example:

Container Starts Shell

Falco Alert:

Unexpected Shell Execution

Falco Architecture 

Container Activity
 ↓
Falco Rules Engine
 ↓
Alert Generated

Falco Detection Examples

Detect:

  • Reverse shell
  • Privilege escalation
  • Crypto miners
  • Suspicious processes
  • Unexpected file access
  • Sensitive mounts

Example Falco Alert 

Terminal shell in container

This could indicate compromise.

Policy Enforcement with Kyverno

Security should be automated.

Developers make mistakes.

Kyverno prevents insecure workloads from being deployed.

What is Kyverno?

Kyverno is a Kubernetes-native policy engine.

It validates Kubernetes resources before deployment.

Example Use Case

Block privileged containers.

Bad Deployment:

privileged: true

Kyverno:

Deployment Rejected

Kyverno Benefits

Enforce:

  • Non-root containers
  • Resource limits
  • Approved registries
  • Label requirements
  • Security standards

Automatically.

Example Security Policy

Require:

runAsNonRoot=true

Any Pod violating policy:

Rejected

before reaching production.

Production Kubernetes Security Checklist

Identity Security

  • RBAC
  • Least Privilege
  • Service Accounts

Network Security

  • Network Policies
  • Service Mesh
  • mTLS

Secrets Security

  • Vault
  • Secrets Manager
  • Encryption at Rest

Pod Security

  • Non-root containers
  • Read-only filesystems
  • Drop Linux capabilities

Runtime Security

  • Falco
  • Monitoring
  • Audit Logs

Policy Security

  • Kyverno
  • OPA Gatekeeper

Modern Secure Kubernetes Architecture 

Developer
 ↓
Git Repository
 ↓
CI Pipeline
 ↓
Container Scan
 ↓
Kyverno Validation
 ↓
Kubernetes Cluster
 ↓
Network Policies
 ↓
RBAC
 ↓
Falco Runtime Monitoring
 ↓
Alerts

Final Thoughts

Learning Kubernetes means more than learning Pods and Deployments.

A production Kubernetes engineer must understand both:

Workload Management
 +
Security

Core Fundamentals:

  • Pods
  • Deployments
  • Services
  • ConfigMaps
  • Secrets

Core Security:

  • RBAC
  • Network Policies
  • Pod Security
  • Secrets Management
  • Falco
  • Kyverno

Organizations that treat Kubernetes security as an afterthought often face misconfigurations, exposed workloads, and compliance failures.

The most successful Kubernetes platforms combine:

Automation
Security
Observability
Governance