Security Context

Security Context An architecture diagram generated by Archify. Pod · Pod spec · Pod and container-level settings Pod Pod spec Pod Security Context · runAsUser · runAsGroup · fsGroup · supplementalGroups · Pod and container-level settings Pod Security Context runAsUser · runAsGroup · fsGroup · supplementalGroups Container · e.g. nginx:1.19 · Pod and container-level settings Container e.g. nginx:1.19 Container Security Context · privileged · allowPrivilegeEscalation · capabilities … · Pod and container-level settings Container Security Context privileged · allowPrivilegeEscalation · capabilities … Pod Security Standards · Three policy levels · Pod Security Standards Pod Security Standards Three policy levels Privileged · No restrictions · Pod Security Standards Privileged No restrictions Baseline · Basic security · Pod Security Standards Baseline Basic security Restricted · Enhanced security · Pod Security Standards Restricted Enhanced security contains contains contains complies with Pod and container-level settings Pod Security Standards

Pod Security Context

  • • runAsUser — user ID the container process runs as
  • • runAsGroup — group ID the container process runs as
  • • fsGroup — group ID used when accessing volumes
  • • supplementalGroups — additional groups granted to the process

Container Security Context

  • • privileged — privileged mode
  • • allowPrivilegeEscalation — whether a process can gain more privileges than its parent
  • • readOnlyRootFilesystem — mount the root filesystem read-only
  • • capabilities — add or drop Linux kernel capabilities
  • • seLinuxOptions — SELinux options

Pod Security Standards

  • • Privileged — no restrictions, all privileges allowed
  • • Baseline — blocks known privilege escalation paths
  • • Restricted — strongly hardened security policy
  • • Applied via namespace labels pod-security.kubernetes.io/enforce, audit and warn