* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* Advantages of Kubernetes-native security
Advantages of Kubernetes-native security
========================================
Published  October 8, 2021•*7*-minute read
Copy URL
Jump to section
---------------
What is Kubernetes-native security?Kubernetes-native definitionSecurity in the cloudAdvantagesReduced operational riskImprove operational efficiencyFaster analysis and remediationConfigure once, use everywhere
What is Kubernetes-native security?
-----------------------------------
There are 2 main approaches to [container security](/en/topics/security/container-security): container-centric and Kubernetes-native.
Container-centric platforms operate at the container level, focused on securing container images and the container runtime. These tools provide controls at the container level itself, using techniques such as inline proxies or shims to control [cross-container communications](/en/technologies/cloud-computing/service-interconnect), for example.
Kubernetes-native security operates at the [Kubernetes](/en/topics/containers/what-is-kubernetes) layer. It derives context from Kubernetes and pushes policies into Kubernetes for Kubernetes to enforce.
Kubernetes-native security relies on deep integrations with Kubernetes to pull in context and tap into the native controls of Kubernetes. This architecture improves security in 2 key ways by providing rich context and insights and detecting Kubernetes-specific threats.
What makes security “Kubernetes-native”
---------------------------------------
Kubernetes-native security is based on the principle that security is implemented most effectively when it is aligned with the system managing containerized applications.
A security platform must exhibit the following characteristics to be considered Kubernetes-native:
* Directly integrate with the [Kubernetes API](/en/topics/containers/what-is-the-kubernetes-api) server to gain firsthand visibility into Kubernetes workloads and infrastructure
* Assess vulnerabilities in Kubernetes software itself
* Base its security functionality, including policy management, on resources within the Kubernetes object model, including deployments, namespaces, services, pods, and others
* Analyze declarative data from Kubernetes-specific artifacts (e.g., workload manifests) and configurations
* Use built-in Kubernetes security features to handle enforcement whenever possible for greater automation, scalability, and reliability
* Deploy and run as a Kubernetes application, including integrations and support for common tools in cloud-native toolchains
Kubernetes-native security provides visibility into the configuration not just of your containers but also your Kubernetes deployment.
It’s also important to understand how, or if, your workloads are isolated. Kubernetes, by default, allows all deployments to talk to all other deployments, within and beyond their namespaces. Deep visibility into the network policy settings, preferably in a visual format vs. reading the text of a [YAML](/en/topics/automation/what-is-yaml) file, will highlight which workloads are not isolated.
To understand your overall security posture, you must ensure that Kubernetes configurations such as role permissions, access to secrets, allowed network traffic, and the settings on the control plane components are locked down, follow [best practices](/en/topics/containers/kubernetes-security-best-practices), and are scoped to the least-possible privileges needed for your applications to run.
[Find out how to secure containers from build to deploy to run](/en/engage/container-security-20170802 "SOLP : Container Security 20170802")
Red Hat resources
-----------------
[Keep reading](/en/resources "Keep reading")
Kubernetes security in the cloud
--------------------------------
Just as with other compute resources, many organizations choose to run Kubernetes in the cloud. You have multiple options for how to run Kubernetes in the cloud:
* Self-managed Kubernetes
* Commercial distribution of Kubernetes
* Managed Kubernetes service
Whichever model you choose, you and the cloud provider "share" responsibility for securing the deployment. While the typical shared responsibility model applies with Kubernetes—especially with managed Kubernetes services—where the line falls in terms of responsibility for security can sometimes feel confusing.
With managed Kubernetes services, the cloud provider manages the Kubernetes control plane, which includes the Kubernetes components that control the cluster, along with data about the cluster’s state and configuration.
Services typically include setting up the control plane, enabling redundancy of those nodes, often including running them in different regions to prevent an outage should part of the cloud provider’s infrastructure go down.
Typically, the cloud providers:
* Will keep Kubernetes up to date
* Will keep the control plane patched
* May provide patching of node OS—often depends on your choice of OS
* Will often offer container-optimized OS images for nodes
* Will sometimes include vulnerability scanners, but you must create the policy, such as using admission controller to allow/deny based on scanning results
The customer is always responsible for securing the Kubernetes workload, including these security aspects:
* **Container images:** their source, contents, and vulnerabilities
* **Deployments:** network services, storage, privileges
* **Configuration management:** roles, groups, role bindings, service accounts
* **Application:** secrets management, labels, annotations
* **Network segmentation:** network policies in the cluster
* **Runtime:** threat detection and incident response
[What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
The advantages of Kubernetes-native security
--------------------------------------------
Kubernetes-native security platforms provide several key advantages.
#### Increased protection
Kubernetes-native security provides richer insights by tying into Kubernetes’ declarative data to discover vulnerabilities in Kubernetes as well as containers.
#### Greater operational efficiency
Using the same framework for infrastructure management and security lowers the Kubernetes learning curve, and Kubernetes context enables faster threat detection and prioritized risk assessments.
#### Reduced operational risk
Tapping into the native controls of Kubernetes ensures security has the pace and scalability of Kubernetes. Having policies embedded in Kubernetes means there’s no conflict between external controls and the orchestrator.
Reduced operational risk
------------------------
Kubernetes-native security helps reduce operational issues that stem from inconsistent configurations, lack of coordination, and user errors.
Given the learning curve most users are on with Kubernetes, it’s easy to make mistakes, including granting elevated privileges using Kubernetes Role-based Access Controls (RBAC), such as giving a user or service account full cluster administrative permissions, or unnecessarily exposing Kubernetes secrets by enabling deployments to pull secrets even when they aren’t needed.
Kubernetes-native security platforms can identify these misconfigurations automatically and continuously.
Embedding security controls directly in Kubernetes also removes the risk of having separate control software that, in the event of a failure, would either fail open and allow all traffic with no security enabled, or fail closed and break all application traffic.
Having the Kubernetes orchestrator enforce policy controls means security immediately gains all the scalability of Kubernetes itself as well as the range of policy enforcement options it includes.
In contrast, using inline proxies or shims for enforcement introduces single points of failure, scalability challenges, and performance limitations.
With Kubernetes, you can, for example, apply network policies to segment your traffic, use admission controllers to apply policies to requests going to the Kubernetes API server, use secrets for storing sensitive credentials, and apply Role-based Access Control (RBAC) to authorize certain capabilities for certain users and service accounts.
You can also use additional standardized tools, such as network plugins that adhere to the Container Network Interface (CNI) in conjunction with the Kubernetes-native security platform and change those additional tools as needed.
Improve operational efficiency
------------------------------
By providing a single, unified platform for [provisioning](/en/topics/automation/what-is-provisioning) and operating infrastructure services, Kubernetes streamlines and unifies workflows across application development and operations teams.
That same consolidated approach, where everyone is working off a common source of truth and using the same infrastructure, can extend to security as well when you deploy a Kubernetes-native security platform.
This approach saves time and money by shortening the learning curve and enabling faster analysis and remediation.
When [DevOps](/en/topics/devops) and security teams are using different tools, it’s easy for conflicts to arise in how they’re configured.
DevOps may specify a Kubernetes network policy allowing traffic between 2 nodes, and security could introduce a control via separate control software that blocks that traffic.
Looking at the settings in Kubernetes would show DevOps that the application should be working with traffic flowing, and they could easily have no idea why the app is failing, because they cannot see the controls exerted by the separate control software.
When DevOps and security teams are using the same constructs to build and ship containerized apps as well as to secure them, they have fewer interfaces, tools, and models to learn.
DevOps uses Kubernetes manifest files to define the resources a given application needs. Using those same assets to glean security context and apply policies reduces complexity and improves the security outcome.
Kubernetes-native security treats Kubernetes as the source of truth for security policies, and everyone—security, operations teams, DevOps, and [site reliability engineering (SRE)](/en/topics/devops/what-is-sre) teams—will all be working off that same source of truth.
In addition, security issues map directly to the Kubernetes objects and resources these teams use daily, further simplifying operations.
Avoid the operational risk that comes with implementing separate security software by using Kubernetes-native enforcement for your security policies.
Faster analysis and remediation
-------------------------------
Containers complicate security on a number of fronts for [cloud-native applications](/en/topics/cloud-native-apps), including the fact that incidents can be very spread out, containers produce high volumes of data to process, and they’re ephemeral, which renders traditional incident response obsolete.
Kubernetes-native security enables you to detect threats to your containers more accurately and reduces the time and effort you need to effectively apply security in your environment.
With Kubernetes context, the expected behavior is clear. As a result, Kubernetes-native security can identify anomalies with higher fidelity, and you can apply enforcement options, such as killing a pod, with more confidence.
At the same time, using Kubernetes context also reduces the false positives and alert fatigue.
Kubernetes-native security also provides the ability to take a risk-based approach to security tasks.
Your deployments are likely to contain a number of policy violations, but where do you start? Again, tapping Kubernetes context helps.
Bringing together different aspects of the Kubernetes metadata, including whether a cluster is in development or production, whether it’s exposed to the Internet or not, how critical the application is, and whether any suspicious processes are currently running on it, will show you what needs your team’s attention right now.
Detecting Kubernetes-specific vulnerabilities, especially any that put the Kubernetes API server at risk, are especially crucial to prevent, identify, and remediate. Kubernetes-native security tooling can automatically identify these vulnerabilities.
Integrating with the Kubernetes API server provides security monitoring for both the containers running in Kubernetes clusters as well as Kubernetes resources such as deployments, daemon sets, services, pods, and other resources.
The wide-open nature of Kubernetes deployments presents another threat vector. Because Kubernetes is first and foremost a platform for infrastructure operations, all components are not necessarily secure by default for operational ease of use.
Applying Kubernetes network policies to limit communications is another critical element in securing your Kubernetes deployments. Kubernetes-native security platforms can automatically baseline your network activity, identify which communications paths are needed to service your application, and create the correct YAML file to reduce network access scope.
With the automatic security settings in a Kubernetes-native platform, you’ll be able to continuously identify and stop threats at the Kubernetes layer.
Configure once, use everywhere
------------------------------
Kubernetes-native security also enables high portability and re-use. Following a single, standardized approach that runs everywhere Kubernetes runs ensures that policies are applied consistently, across all environments.
Kubernetes-native security lets users specify a single configuration, such as a network policy, that should apply to all pods in a deployment, rather than having to configure system-level controls on every host in a cluster.
By tying policies into [CI/CD](/en/topics/devops/what-is-ci-cd) systems and the Kubernetes admission controller framework, organizations can more easily apply control policies early in the [software development life cycle](/en/topics/security/software-development-lifecycle-security), preventing exposures at runtime.
And tapping Kubernetes constructs such as the admission controller keeps security tied deeply into Kubernetes toolchains.
[Try enterprise Kubernetes](/en/technologies/cloud-computing/openshift/try-it "product | red hat openshift | try it")
Recommended for you
E-book
The state of Kubernetes security report: 2024 edition
-----------------------------------------------------
Read about new, emerging trends in container, Kubernetes, and cloud-native security in this latest edition of the State of Kubernetes security report.
[Read the e-book](https://www.redhat.com/en/engage/state-kubernetes-security-report-2024?percmp=RHCTG0250000455234)
Recommended for you
Transitional approach to implementing pragmatic Site Reliability Engineering (SRE) Technical Overview
-----------------------------------------------------------------------------------------------------
Site Reliability engineering (SRE) is a shared responsibility model, and if executed well can improve efficiency, resiliency, and security. But implementing SRE in an organization requires cultural shift, team shaping and training.
[View course](https://www.redhat.com/en/services/training/transitional-approach-implementing-pragmatic-site-reliability-engineering-sre-technical-overview?percmp=RHCTG0250000455236)
Keep reading
------------
### What are SPIFFE and SPIRE?
SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems.
[Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?")
### Red Hat Enterprise Linux security
Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy.
[Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security")
### What is zero trust?
Find out more about zero trust, an approach to designing security architectures based on the premise that every interaction begins in an untrusted state.
[Read the article](/en/topics/security/what-is-zero-trust "article | what is zero trust?")
Security resources
------------------
### Related content
* Detail
  [Advance your security maturity with Red Hat OpenShift](/en/resources/advance-security-maturity-openshift-detail)
* Blog post
  [Your Red Hat OpenShift AI models are waiting at the door. Who’s knocking?](/en/blog/your-red-hat-openshift-ai-models-are-waiting-door-whos-knocking)
* Datasheet
  [Red Hat Technical Account Management services for product security](/en/resources/tam-services-product-security-datasheet)
* Blog post
  [Mitigating AI's new risk frontier: Unifying enterprise cybersecurity with AI safety](/en/blog/mitigating-ais-new-risk-frontier-unifying-enterprise-cybersecurity-ai-safety)
### Related articles
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is a Linux container?](/en/topics/containers/whats-a-linux-container)
* [What is container orchestration?](/en/topics/containers/what-is-container-orchestration)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What is Kubernetes?](/en/topics/containers/what-is-kubernetes)
* [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware)
* [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt)
* [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop)
* [What is Podman?](/en/topics/containers/what-is-podman)
* [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers)
* [Red Hat Insights data and application security](/en/technologies/management/insights/data-application-security)
* [Containers vs VMs](/en/topics/containers/containers-vs-vms)
* [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What are microservices?](/en/topics/microservices/what-are-microservices)
* [What is container security?](/en/topics/security/container-security)
* [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack)
* [What is Buildah?](/en/topics/containers/what-is-buildah)
* [What are sandboxed containers](/en/topics/containers/sandboxed-containers)
* [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws)
* [What is an image builder?](/en/topics/linux/what-is-an-image-builder)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd)
* [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes)
* [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers)
* [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring)
* [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [What is a golden image?](/en/topics/linux/what-is-a-golden-image)
* [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services)
* [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference)
* [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry)
* [What is Skopeo?](/en/topics/containers/what-is-skopeo)
* [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators)
* [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security)
* [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift)
* [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing)
* [What is KubeLinter?](/en/topics/containers/what-is-kubelinter)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare)
* [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management)
* [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure)
* [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders)
* [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift)
* [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management)
* [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations)
* [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes)
* [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap)
* [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus)
* [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes)
* [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac)
* [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization)
* [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos)
* [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial)
* [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture)
* [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api)
* [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management)
* [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment)
* [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus)
* [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture)
* [What is CaaS?](/en/topics/cloud-computing/what-is-caas)
* [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns)
* [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster)
* [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus)
* [What is Jaeger?](/en/topics/microservices/what-is-jaeger)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is etcd?](/en/topics/containers/what-is-etcd)
* [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization)
* [What is Clair?](/en/topics/containers/what-is-clair)
* [What is Knative?](/en/topics/microservices/what-is-knative)
* [What is API security?](/en/topics/security/api-security)
* [What is malware?](/en/topics/security/what-is-malware)
* [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices)
* [What is cloud security](/en/topics/security/cloud-security)
* [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers)
* [What is Docker?](/en/topics/containers/what-is-docker)
* [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod)
[More about this topic](/en/topics/security "More about this topic")