Kubernetes defaults are convenient, not safe

Kubernetes was designed to make deployment easy, and it succeeds. The consequence is that a cluster which works is not a cluster which is defended. Out of the box, any pod can reach any other pod, service accounts are mounted whether or not they are needed, and nothing stops a container from running as root.

1. Default-deny the network

Without a NetworkPolicy, Kubernetes networking is flat. A compromised web pod can reach the database, the metrics stack and the internal API that never expected to be addressed from outside its namespace. The fix is unglamorous: apply a default-deny ingress policy per namespace, then add explicit allow rules for the traffic that must exist. Doing this after the fact is a week of careful work. Doing it at namespace creation is ten minutes.

2. Make Pod Security Admission mean something

PodSecurityPolicies are gone; Pod Security Admission replaced them with three profiles applied per namespace. Baseline blocks the obviously dangerous. Restricted enforces non-root, dropped capabilities, no privilege escalation and a seccomp profile. Start by labelling namespaces in warn mode so you can see what would break, then move to enforce. Teams that skip the warn phase either break production or give up.

3. RBAC that constrains rather than describes

• Audit for wildcard verbs and resources — they appear far more often than anyone expects.
• Watch for the escalation paths: create pods, exec into pods, read secrets, or bind roles. Any one of these can be a route to cluster-admin.
• Turn off automatic service-account token mounting where workloads do not call the API.
• Review who holds cluster-admin. In most clusters the honest answer is more people than the security team believes.

4. Trust the images you run

The container supply chain is where an attacker gets to skip every other control. Pull from registries you control, pin by digest rather than tag, sign images and verify signatures at admission, and scan continuously rather than once at build. An admission controller that rejects unsigned images is worth more than a dashboard that reports vulnerable ones.

Then watch what actually happens

Preventive controls fail quietly. Runtime detection with Falco fills the gap — a shell spawned in a container, an unexpected outbound connection, a write to a path that should be immutable. Route those events to the same place your SOC already looks, or they will be discovered during the post-incident review.

Run these four changes against a staging cluster first, in warn mode, and read what breaks. The list is the real inventory of your workloads assumptions.