* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* Kubernetes security best practices
Kubernetes security best practices
==================================
Published  June 17, 2022•*6*-minute read
Copy URL
Jump to section
---------------
OverviewKubernetes security risksBuild phase securityDeployment phase securityRuntime phase securityKubernetes infrastructure securityOperationalized Kubernetes securityHow Red Hat can help
Overview
--------
Implementing [Kubernetes security](/en/topics/containers/kubernetes-security) best practices involves remediating known security vulnerabilities during the build phase, reconfiguring misconfigurations during the build/deploy phase, responding to threats at runtime, and securing the entire Kubernetes infrastructure.   
These correspond to responses about top security concerns gathered as part of the latest State of Kubernetes Security report, which found that more than 50% of respondents are worried about misconfigurations and vulnerabilities due to the highly customizable nature of Kubernetes and the complexity of [container security](/en/topics/security/container-security). In order to overcome security challenges and avoid slowdowns in application deployment, organizations must make securing Kubernetes a priority throughout the full development life cycle.
[Read the latest State of Kubernetes Security Report](/en/engage/state-kubernetes-security-report-2024 "SOLP : State of Kubernetes Security Report 2023")
What are the security risks of Kubernetes?
------------------------------------------
### Containers are everywhere
[Kubernetes](/en/topics/containers/what-is-kubernetes) is an [open source](/en/topics/open-source/what-is-open-source-software) [container orchestration](/en/topics/containers/what-is-container-orchestration) platform used to manage hundreds (sometimes thousands) of [Linux®](/en/topics/linux) containers batched into Kubernetes [clusters](/en/topics/containers/what-is-a-kubernetes-cluster). It relies heavily on [application programming interfaces (APIs)](/en/topics/api/what-are-application-programming-interfaces) connecting containerized [microservices](/en/topics/microservices/what-are-microservices). This distributed nature makes it difficult to quickly investigate which [containers](/en/topics/containers/whats-a-linux-container) might have [vulnerabilities](/en/topics/security/what-is-cve), may be misconfigured, or pose the greatest [risks](/en/topics/management/what-is-risk-management) to your [organization](/en/topics/open-culture).
The solution is to develop a comprehensive view of container deployments that captures critical system-level events in each container.
### Images and registries can be misused
Container images (also known as base images) are immutable templates used to create new containers. Newly copied container images can then be modified to serve distinct purposes.
The solution is to set up policies determining how images are built, and how they’re stored in image registries. Base images need to be regularly tested, approved, and scanned. And only images from allowed image [registries](/en/topics/cloud-native-apps/what-is-a-container-registry) should be used to launch containers in a Kubernetes environment.
### Uninhibited container communication
Containers and pods need to talk to each other within [deployments](/en/topics/containers/what-is-kubernetes-deployment), as well as to other internal and external endpoints to properly function. If a container is breached, the ability for a hacker to move within the environment is directly related to how broadly that container can communicate with other containers and [pods](/en/topics/containers/what-is-kubernetes-pod). In a sprawling container environment, implementing network segmentation can be prohibitively difficult given the complexity of [configuring](/en/topics/automation/what-is-configuration-management) such policies manually.
The solution is to track traffic moving between namespaces, deployments, and pods; and determine how much of that traffic is actually allowed.
[Learn more about how Red Hat can help containers securely communicate](/en/technologies/cloud-computing/service-interconnect)
### Default container network policies
By default, Kubernetes deployments do not apply a network policy to a pod—the smallest unit of a Kubernetes application. These network policies behave like firewall rules. They control how pods communicate. Without network policies, any pod can talk to any other pod.
The solution is to define network policies that limit pod communication to only defined assets, and to mount secrets in read-only volumes within containers instead of passing them as environment variables.
### Container and Kubernetes compliance
[Cloud-native environments](/en/topics/cloud-native-apps) facilitated by Kubernetes should (like all other IT environments) comply with [security](/en/topics/security) best practices, industry standards, benchmarks, and internal organizational policies—and prove that [compliance](/en/topics/management/what-is-compliance-management). Sometimes this means adapting compliance strategies so Kubernetes environments meet controls originally written for traditional [application architectures](/en/topics/cloud-native-apps/what-is-an-application-architecture).
The solution is to monitor for compliance adherence and [automate](/en/topics/automation) audits.
### Runtime
Kubernetes is an immutable infrastructure. [Patching](/en/topics/management/what-patch-management-and-automation) isn't possible during container runtime—running containers must be destroyed and recreated. Compromised containers can run malicious processes, like crypto mining and port scanning.
The solution is to destroy any breached or running container, rebuild an uncompromised container image, and then relaunch it.
Red Hat resources
-----------------
[Keep reading](/en/resources "Keep reading")
Build phase security
--------------------
Kubernetes security begins in the build phase by creating strong base images and adopting vulnerability scanning processes.
* **Use minimal base images.** Avoid using images with operating system (OS) package managers or shells—which could contain unknown vulnerabilities—or remove the package manager later.
* **Use trusted sources.** Only choose base images that come from a trusted source and are hosted in a reputable registry.
* **Don’t add unnecessary components.** As a rule of thumb, common tools can become security risks when included in images.
* **Use up-to-date images only.** Update component versions.
* **Use an image scanner.** Identify vulnerabilities within images—broken down by layer.
* **Integrate security into CI/CD pipelines.** Automate a repeatable facet of security that will fail [continuous integration](/en/topics/devops/what-is-ci-cd) builds and generate alerts for severe, fixable vulnerabilities.
* **Label permanent vulnerabilities.** Add known vulnerabilities that can’t be fixed, aren’t critical, or don’t need to be fixed right away to an allow list.
* **Implement defense-in-depth.** Standardize policy checks and remediation workflows to detect and update vulnerable images.
Deployment phase security
-------------------------
Configure Kubernetes infrastructure security before workloads are deployed. That begins by knowing as much as possible about the deployment process, such as what’s being deployed (image, components, pods), where it’s deployed (clusters, namespaces, and nodes), how it’s deployed (privileges, communication policies, applied securities), what it can access (secrets, volumes), and the compliance standards.
* **Use namespaces.** Separating workloads into namespaces can help contain attacks, and limit the impact of mistakes or destructive actions by authorized users.
* **Use network policies.** Kubernetes allows every pod to contact every other pod by default, but network segmentation policies and plugins that control ingress and egress traffic from the application can override that default.
* **Restrict permissions to secrets.** Only mount secrets that deployments require.
* **Assess container privileges.** Provide only the capabilities, roles, and privileges that allow the container to perform its function.
* **Assess image provenance.** Use images from known registries.
* **Scan deployments.** Enforce policies based on the scans’ results.
* **Use labels and annotations.** Label or annotate deployments with the contact information of the team responsible for a containerized application to streamline triage.
* **Enable role-based access control (RBAC).** RBAC controls user and service account authorization to access a cluster’s [Kubernetes API](/en/topics/containers/what-is-the-kubernetes-api) server.
Runtime phase security
----------------------
Security incidents are less common when best practices for securing Kubernetes are applied during the build and deploy phases, but identifying and responding to runtime threats requires continually monitoring process activity and network communications.
* **Use contextual information.** Use the build and deploy time information in Kubernetes to evaluate observed vs. expected activity during runtime in order to detect suspicious activity.
* **Scan running deployments.** Monitor running deployments for the same recently discovered vulnerabilities discovered in container images.
* **Use built-in controls.** Configure the security context for pods to limit their capabilities.
* **Monitor network traffic.** Observe and compare live network traffic to what Kubernetes network policies allow to identify unexpected communication.
* **Use allow lists.** Identify processes executed during the normal course of the app’s runtime to create an allow list.
* **Compare runtime activity in similarly deployed pods.** Replicas with significant deviations require investigation.
* **Scale suspicious pods to zero.** Use Kubernetes native controls to contain breaches by automatically instructing Kubernetes to scale suspicious pods to zero, or destroy and restart instances.
Kubernetes infrastructure security
----------------------------------
Kubernetes security extends beyond images and workloads. Security includes the entire Kubernetes infrastructure: clusters, nodes, the container engine, and even [clouds](/en/topics/cloud-computing).
* **Apply Kubernetes updates.** Updating your Kubernetes distributions will apply security patches and install new security tools.
* **Secure the Kubernetes API server.** The Kubernetes API server is the gateway to the Kubernetes control plane. Disable unauthenticated/anonymous access and use TLS encryption for connections between kubelets and the API server. Audit logging should also be enabled for visibility into atypical API calls.
* **Secure etcd.** [etcd](/en/topics/containers/what-is-etcd) is a key-value store used by Kubernetes for [data](/en/topics/data-services) access. Secure the kubelet to minimize the attack surface. Disable anonymous access to the kubelet by starting the kubelet with the --anonymous-auth=false flag, and use the NodeRestriction admission controller to limit what the kubelet can access.
### Cloud security
Regardless of what type of cloud ([public cloud](/en/topics/cloud-computing/what-is-public-cloud), [private cloud](/en/topics/cloud-computing/what-is-private-cloud), [hybrid cloud](/en/topics/cloud-computing/what-is-hybrid-cloud), or [multicloud](/en/topics/cloud-computing/what-is-multicloud)) hosts the containers or runs Kubernetes, the cloud user—not the [cloud provider](/en/topics/cloud-computing/what-are-cloud-providers)—is always responsible for securing the Kubernetes workload, including:
* **Container images:** Sources, contents, and vulnerabilities
* **Deployments:** Network services, [storage](/en/topics/data-storage), and privileges
* **Configuration management:** Roles, groups, role bindings, and service accounts
* **Application:** Kubernetes secrets management, labels, and annotations
* **Network segmentation:** Network policies in the Kubernetes cluster
* **Runtime:** Threat detection and incident response
Operationalized Kubernetes security
-----------------------------------
Using containers and Kubernetes doesn’t change your security goals: to minimize vulnerabilities and security risks.
* **Embed security best practices early into the container lifecycle.** Kubernetes security should allow developers and [DevOps](/en/topics/devops) teams to confidently build and deploy applications that are production-ready.
* **Use Kubernetes-native security controls.** Native controls keep security controls from colliding with the [orchestrator](/en/topics/automation/what-is-orchestration).
* **Let Kubernetes prioritize remediation.**
How Red Hat can help
--------------------
Securing cloud-native applications and the underlying infrastructure requires significant changes to an organization’s security approach—organizations must apply controls earlier in the application development life cycle, use built-in controls to enforce policies that prevent operational and scalability issues, and keep up with increasingly rapid release schedules.
[Red Hat® Advanced Cluster Security for Kubernetes](/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes) is a Kubernetes-native security platform that equips organizations to more securely build, deploy, and run cloud-native applications anywhere. The solution helps improve the security of the application build process, protect the application platform and configurations, and detect and respond to runtime issues.
[Start your free trial of Red Hat Advanced Cluster Security](/node/737841 "Start your free trial of Advanced Cluster Security")
The official Red Hat blog
-------------------------
Get the latest information about our ecosystem of customers, partners, and communities.
[Keep reading](/en/blog "The official Red Hat blog")
Recommended for you
Red Hat Certified OpenShift Application Developer exam
------------------------------------------------------
deploy existing applications in a Red Hat® OpenShift® Container Platform environment
[View exam](https://www.redhat.com/en/services/training/ex288-red-hat-certified-openshift-application-developer-exam?percmp=RHCTG0250000455236)
Keep reading
------------
### What is confidential computing?
Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it.
[Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?")
### What are SPIFFE and SPIRE?
SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems.
[Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?")
### Red Hat Enterprise Linux security
Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy.
[Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security")
Security resources
------------------
### Related content
* Case study
  [RTLZWEI hones competitive edge with Red Hat OpenShift AI](/en/resources/rtlzwei-case-study)
* E-book
  [The state of cloud-native security](/en/resources/state-of-cloud-native-security-ebook)
* Detail
  [CVE management on Red Hat Advanced Cluster Security](/en/resources/cve-management-advanced-cluster-security-detail)
* Blog post
  [Ford's keyless strategy for managing 200+ Red Hat OpenShift clusters](/en/blog/fords-keyless-strategy-managing-200-red-hat-openshift-clusters)
### Related articles
* [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms)
* [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing)
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is a Linux container?](/en/topics/containers/whats-a-linux-container)
* [What is container orchestration?](/en/topics/containers/what-is-container-orchestration)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What is Kubernetes?](/en/topics/containers/what-is-kubernetes)
* [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware)
* [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt)
* [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop)
* [What is Podman?](/en/topics/containers/what-is-podman)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client)
* [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes)
* [What is kubernetes security?](/en/topics/containers/kubernetes-security)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What are microservices?](/en/topics/microservices/what-are-microservices)
* [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack)
* [What is container security?](/en/topics/security/container-security)
* [What are sandboxed containers](/en/topics/containers/sandboxed-containers)
* [What is Buildah?](/en/topics/containers/what-is-buildah)
* [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws)
* [What is an image builder?](/en/topics/linux/what-is-an-image-builder)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd)
* [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes)
* [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring)
* [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes)
* [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [What is a golden image?](/en/topics/linux/what-is-a-golden-image)
* [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services)
* [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference)
* [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry)
* [What is Skopeo?](/en/topics/containers/what-is-skopeo)
* [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators)
* [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security)
* [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [What is KubeLinter?](/en/topics/containers/what-is-kubelinter)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare)
* [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management)
* [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure)
* [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders)
* [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift)
* [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management)
* [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus)
* [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes)
* [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations)
* [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes)
* [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap)
* [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac)
* [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization)
* [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos)
* [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial)
* [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture)
* [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api)
* [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management)
* [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment)
* [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus)
* [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture)
* [What is CaaS?](/en/topics/cloud-computing/what-is-caas)
* [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns)
* [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster)
* [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus)
* [What is Jaeger?](/en/topics/microservices/what-is-jaeger)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is Clair?](/en/topics/containers/what-is-clair)
* [What is Knative?](/en/topics/microservices/what-is-knative)
* [What is API security?](/en/topics/security/api-security)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is etcd?](/en/topics/containers/what-is-etcd)
* [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization)
* [What is malware?](/en/topics/security/what-is-malware)
* [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices)
* [What is cloud security](/en/topics/security/cloud-security)
* [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers)
* [What is Docker?](/en/topics/containers/what-is-docker)
* [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod)
[More about this topic](/en/topics/security "More about this topic")