🔒 Cloud & Kubernetes Track

Kubernetes Hardening

Secure a production Kubernetes cluster using industry-standard benchmarks, Pod Security Standards, and defense-in-depth strategies.

⏱️ 8-12 hours 🎯 Intermediate 💼 Portfolio Ready

📋 Project Overview

Security isn't a feature you add at the end—it's foundational. In this project, you'll harden a Kubernetes cluster from the ground up, implementing controls that real enterprises use to protect production workloads.

You'll apply the CIS Kubernetes Benchmark, configure RBAC with least privilege, enforce Pod Security Standards, and implement network segmentation using Network Policies.

✅ Prerequisites

Required Knowledge

  • • Kubernetes basics (Pods, Deployments, Services)
  • • YAML configuration
  • • Basic Linux security concepts
  • • kubectl command proficiency

Tools Needed

  • • Kubernetes cluster (kind/minikube)
  • • kubectl CLI
  • • kube-bench (security scanner)
  • • OPA Gatekeeper (optional)

🎯 What You'll Learn

🔐

RBAC Mastery

Design least-privilege access controls using Roles and RoleBindings

🛡️

Pod Security

Enforce security contexts and Pod Security Standards

🌐

Network Segmentation

Implement default-deny Network Policies

📊

Security Auditing

Use kube-bench to validate CIS compliance

🔨 Implementation Guide

Step 1: CIS Benchmark Baseline

Run kube-bench to identify security gaps

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml kubectl logs -f job/kube-bench

Step 2: Enable RBAC & Remove Default Permissions

Create a read-only ClusterRole for developers

apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: developer-read-only rules: - apiGroups: ["", "apps"] resources: ["pods", "services", "deployments"] verbs: ["get", "list", "watch"]

Step 3: Pod Security Standards

Enforce "restricted" profile on production namespaces

kubectl label namespace production \\ pod-security.kubernetes.io/enforce=restricted

Step 4: Network Policies (Default-Deny)

Block all ingress traffic by default, then allow explicitly

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-ingress namespace: production spec: podSelector: {} policyTypes: - Ingress

📦 Deliverables

  • ✓ kube-bench report showing >80% compliance with CIS benchmark
  • ✓ RBAC configuration with 3+ roles (admin, developer, viewer)
  • ✓ Network Policy manifests for production namespace
  • ✓ Documentation explaining security controls implemented

📚 Resources

Pod Security Standards

Official Kubernetes documentation

CIS Kubernetes Benchmark

Industry security standard