* [Topics](/en/topics "Topics")
* [Security](/en/topics/security "Security")
* What is Kubernetes security?
What is Kubernetes security?
============================
Published  May 10, 2024•*5*-minute read
Copy URL
Jump to section
---------------
OverviewWhy is Kubernetes security important?Security at every stageHow can Red Hat help?
Overview
--------
[Kubernetes](/en/topics/containers/what-is-kubernetes), also known as K8s or “Kube,” is an open source container [orchestration](/en/topics/automation/what-is-orchestration) platform that automates the deployment, management, and scaling of containerized applications. Kubernetes organizes Linux [containers](/en/topics/containers) into clusters and uses application programming interfaces (APIs) to connect containerized microservices. Since any layer or service involved in a Kubernetes deployment can present vulnerabilities, the process of securing Kubernetes clusters can be complex.
While some teams take a [container-centric](/en/topics/security/container-security) approach to Kubernetes security, which mainly focuses on securing container images and the container runtime, others opt for [Kubernetes-native security](/topics/containers/advantages-of-kubernetes-native-security), which takes a broader approach, pulling in context from Kubernetes and using built-in Kubernetes controls to implement risk-based security best practices across the full application development life cycle. Kubernetes-native security also addresses risks and vulnerabilities that are specific to Kubernetes, such as misconfigured Kubernetes RBAC policies, insecure Kubernetes control plane components, and misused Kubernetes secrets.
Why is Kubernetes security important?
-------------------------------------
Kubernetes, as a relatively new technology, has seen tremendous adoption in recent years, but security investment hasn’t always kept up. Combined with a lack of security awareness and the ever-present skills gap, security incidents can have devastating consequences. Security issues are responsible for delaying or [slowing down application](/en/resources/kubernetes-adoption-security-market-trends-overview) development and deployment. When culminating in an incident, Kubernetes and container security issues also contribute to revenue or customer loss, employee termination, and additional impacts on business operations.
Kubernetes and containerization facilitate quicker and more scalable [DevOps](/en/topics/devops), but they also come with additional security risks. As more containers are deployed, your attack surface expands and the ability to pinpoint which containers have vulnerabilities or misconfigurations becomes more challenging.
### Common risks & challenges
#### Kubernetes pod-to-pod networking
A major benefit of Kubernetes is its wide range of network configuration options, which control how pods within a cluster communicate. However, Kubernetes does not restrict network communication between pods within a cluster by default, so every pod can communicate with every other pod until a relevant network policy is assigned. This means a single pod that’s been breached by a bad actor can be used as the vector to attack every other pod in that cluster. Kubernetes network policies are written using YAML files. This is just one among many reasons why operationalizing Kubernetes network policies can be challenging, which can lead to simply foregoing network segmentation in favor of speed.
#### Configuration management
Misconfigurations, which are often caused by human error and an absence of automated security scans, present a serious risk to Kubernetes environments and can lead to breaches. Due to the dynamic nature of containers, identifying misconfigurations and maintaining a consistent security posture can be challenging. Kubernetes was developed to prioritize speed and operability, so default configurations are usually open/unrestricted. This leaves organizations susceptible to attacks.
#### Software supply chain issues
Security issues in the software supply chain, including vulnerable application components, insufficient [access controls](/en/topics/security/what-is-access-control), a lack of a Software Bill of Materials (SBOM), CI/CD pipeline weaknesses, and inconsistent policy enforcement, are also a major concern for organizations. The sprawling software supply chains emblematic of cloud-native, Kubernetes environments, require a unique set of controls. Software supply chain security must start at the Individual Developer Environment (IDE), and extend all the way to the runtime environment. It needs to account for all the content (source code, images, artifacts), tooling (developer and security), and people involved in the supply chain. Source code analysis, access control, attestation, SBOMs are just a few of the many security considerations for software supply chain security.
#### Shifting security left
Closely related to software supply chain security is the challenge of shifting security to the left. Shifting security to the left is a concept that states that Kubernetes security efforts should move to the earlier stages of the container life cycle. This is a challenge because shift-left security requires developers to become security users, empowered with the knowledge and tooling to make security decisions within their workflows. However, the business benefits of shifting security to the left is tremendous. This is the primary way that Kubernetes and container security should be implemented. The more security issues are addressed at the build stage, the fewer runtime issues are likely to arise, leading to fewer project delays.
#### Runtime detection and response
The volume of runtime threat vectors in containerized applications running in a Kubernetes environment poses a challenge for teams tasked with detecting and responding to such issues. There are many ways for a bad actor to gain initial access to a Kubernetes environment, execute malicious code, escalate privilege, achieve persistence, evade detection, and move laterally, resulting in data deletion or exfiltration, denial of service, or resource hijacking. You can read more about this topic in further detail in our blog on the [MITRE ATT&CK® framework for Kubernetes](https://cloud.redhat.com/blog/2021-kubernetes-threat-matrix-updates-things-you-should-know).
#### Kubernetes infrastructure security
The many layers of Kubernetes–from control plane components, such as the API server, kube-scheduler, kube-controller-manager, etcd, to the worker node components that run the containerized workloads–pose their own security challenges. Each of these services must be securely configured in order to provide a hardened cluster environment for applications to run on. On top of that, whether you’re running Kubernetes as a self-managed service or using a fully managed cloud service will change how you must secure the various components of Kubernetes. In self-managed environments, for example, the entirety of the control plane components are often your responsibility, in addition to the node components. When using a managed Kubernetes service, the security responsibility is shared between the service provider and you, the customer. This adds yet another challenge.
[Read the latest State of Kubernetes Security Report](/en/engage/state-kubernetes-security-report-2024)
Red Hat resources
-----------------
[Keep reading](/en/resources "Keep reading")
Security at every stage
-----------------------
Containerization and Kubernetes have several built-in security advantages that can help teams address the risks associated with container security issues. For example:
* Containers containing security issues discovered at runtime are fixed at the build stage and redeployed, rather than updated or patched while running. Known as immutability, this feature allows for better predictability in container behavior and anomalous behavior detection. .
* Network policies can segment pods or groups of pods while admission controllers can apply policies for better governance.
* [Role-based Access Control](/en/topics/security/what-is-role-based-access-control) (RBAC) can assign specific permissions to users and service accounts.
* Kubernetes secrets can better safeguard sensitive data like encryption keys.
However, Kubernetes is not a security platform, so teams must operationalize risk assessment and target vulnerabilities at each layer of the Kubernetes environment and at every stage throughout the container and application life cycles. To handle Kubernetes security effectively, you must take advantage of Kubernetes-native security controls where available, while implementing best practices during the build, deploy, and runtime phases.
[Learn more about Kubernetes best practices](/en/topics/containers/kubernetes-security-best-practices)
How can Red Hat help?
---------------------
As a leader in open source container technology, Red Hat can help you [grow your knowledge of Kubernetes security](/en/topics/containers/intro-kubernetes-security) best practices and make your implementation of containers more secure. To help teams identify and address K8s security concerns more efficiently, Red Hat offers Kubernetes-native solutions that embed security into the container lifecycle and enable DevOps teams to build and deploy production-ready applications.
[Kubelinter](/en/topics/containers/what-is-kubelinter), created by StackRox and [acquired by Red Hat in 2021](/en/blog/red-hat-closes-acquisition-stackrox), is an open source static analysis tool that identifies misconfigurations and programming errors in Kubernetes deployments. KubeLinter runs a series of tests to analyze Kubernetes configurations, identify errors, and generate warnings for anything that doesn’t align with security best practices.
[Red Hat Service Interconnect](/en/technologies/cloud-computing/service-interconnect) is equipped with built-in security that scales across clusters and clouds by default while providing trusted communication links between services. Service Interconnect also allows for flexibility of development across legacy, container or Kubernetes platforms—giving your developers more options for building, modernizing and deploying your next-generation business applications.
[Red Hat® Advanced Cluster Security for Kubernetes](/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes) (ACS) enables organizations to securely build, deploy, and run cloud-native applications. Offered as either a self-managed or fully managed SaaS solution, ACS protects containerized workloads in all major cloud and hybrid environments and enables DevOps and InfoSec teams to operationalize security, lower operational costs, and increase [developer productivity](/en/products/developer-productivity).
[Read the Red Hat Advanced Cluster Security for Kubernetes Datasheet](/en/resources/advanced-cluster-security-for-kubernetes-datasheet)
The official Red Hat blog
-------------------------
Get the latest information about our ecosystem of customers, partners, and communities.
[Keep reading](/en/blog "The official Red Hat blog")
Recommended for you
Red Hat Advanced Cluster Management for Kubernetes Technical Overview
---------------------------------------------------------------------
Unlock the full potential of your Kubernetes infrastructure.
[Learn more](https://www.redhat.com/en/services/training/do032-red-hat-advanced-cluster-management-kubernetes-technical-overview?percmp=RHCTG0250000455236)
Keep reading
------------
### What is secrets management?
Secrets management is a method for ensuring that the sensitive information needed to run your day-to-day operations is kept confidential.
[Read the article](/en/topics/devops/what-is-secrets-management "article | what is secrets management")
### What is post-quantum cryptography?
Learn about Red Hat’s approach to post-quantum cryptography, which refers to encryption algorithms that can resist attacks from quantum computers.
[Read the article](/en/topics/security/post-quantum-cryptography "What is post-quantum cryptography?")
### What is confidential computing?
Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it.
[Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?")
Security resources
------------------
### Related content
* Blog post
  [From if to how: A year of post-quantum reality](/en/blog/if-how-year-post-quantum-reality)
* Blog post
  [End-to-end security for AI: Integrating AltaStata Storage with Red Hat OpenShift confidential containers](/en/blog/end-end-security-ai-integrating-altastata-storage-red-hat-openshift-confidential-containers)
* Blog post
  [Understanding security embargoes at Red Hat](/en/blog/Understanding-security-embargoes-at-Red-Hat)
* Analyst material
  [The Opportunity for Open Source in Defence and National Security](/en/engage/idc-open-source-national-security-analyst-material)
### Related articles
* [What is secrets management?](/en/topics/devops/what-is-secrets-management)
* [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop)
* [What is Podman?](/en/topics/containers/what-is-podman)
* [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography)
* [Containers vs. VMs: Similarities, differences, and combined approaches](/en/topics/containers/containers-vs-vms)
* [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing)
* [What is confidential computing?](/en/topics/security/what-is-confidential-computing)
* [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire)
* [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security)
* [What is zero trust?](/en/topics/security/what-is-zero-trust)
* [What is AI security?](/en/topics/ai/what-is-ai-security)
* [What is a Linux container?](/en/topics/containers/whats-a-linux-container)
* [What is container orchestration?](/en/topics/containers/what-is-container-orchestration)
* [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux)
* [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless)
* [What is access control?](/en/topics/security/what-is-access-control)
* [What is Kubernetes?](/en/topics/containers/what-is-kubernetes)
* [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware)
* [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt)
* [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift)
* [What is a CVE?](/en/topics/security/what-is-cve)
* [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control)
* [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client)
* [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes)
* [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right)
* [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers)
* [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security)
* [What is CI/CD security?](/en/topics/security/what-is-cicd-security)
* [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS)
* [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM)
* [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking)
* [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform)
* [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai)
* [What is edge security?](/en/topics/security/what-is-edge-security)
* [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow)
* [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience)
* [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management)
* [What is backup and recovery?](/en/topics/security/backup-and-recovery)
* [What are microservices?](/en/topics/microservices/what-are-microservices)
* [What is container security?](/en/topics/security/container-security)
* [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack)
* [What is Buildah?](/en/topics/containers/what-is-buildah)
* [What are sandboxed containers](/en/topics/containers/sandboxed-containers)
* [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack)
* [What is DevSecOps?](/en/topics/devops/what-is-devsecops)
* [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns)
* [What is compliance management?](/en/topics/management/what-is-compliance-management)
* [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops)
* [What is security automation?](/en/topics/automation/what-is-security-automation)
* [What is cloud governance?](/en/topics/automation/what-is-cloud-governance)
* [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws)
* [What is an image builder?](/en/topics/linux/what-is-an-image-builder)
* [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security)
* [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd)
* [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes)
* [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers)
* [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring)
* [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes)
* [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security)
* [What is a golden image?](/en/topics/linux/what-is-a-golden-image)
* [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services)
* [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference)
* [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry)
* [What is Skopeo?](/en/topics/containers/what-is-skopeo)
* [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators)
* [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm)
* [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices)
* [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication)
* [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift)
* [What is SOAR?](/en/topics/security/what-is-soar)
* [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator)
* [What's an insider threat?](/en/topics/security/what-are-insider-threats)
* [Security for IoT devices](/en/topics/security/security-for-iot-devices)
* [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam)
* [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing)
* [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security)
* [What is KubeLinter?](/en/topics/containers/what-is-kubelinter)
* [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security)
* [Container and Kubernetes compliance considerations](/en/topics/containers/compliance)
* [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare)
* [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management)
* [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure)
* [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders)
* [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift)
* [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management)
* [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes)
* [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap)
* [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus)
* [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes)
* [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations)
* [What is Kubernetes role-based access control (RBAC)](/en/topics/containers/what-kubernetes-role-based-access-control-rbac)
* [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization)
* [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos)
* [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial)
* [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture)
* [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api)
* [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management)
* [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment)
* [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus)
* [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture)
* [What is CaaS?](/en/topics/cloud-computing/what-is-caas)
* [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns)
* [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster)
* [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus)
* [What is Jaeger?](/en/topics/microservices/what-is-jaeger)
* [What is risk management?](/en/topics/management/what-is-risk-management)
* [What is SELinux?](/en/topics/linux/what-is-selinux)
* [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security)
* [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services)
* [What is etcd?](/en/topics/containers/what-is-etcd)
* [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization)
* [What is Clair?](/en/topics/containers/what-is-clair)
* [What is Knative?](/en/topics/microservices/what-is-knative)
* [What is API security?](/en/topics/security/api-security)
* [What is malware?](/en/topics/security/what-is-malware)
* [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices)
* [What is cloud security](/en/topics/security/cloud-security)
* [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers)
* [What is Docker?](/en/topics/containers/what-is-docker)
* [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod)
[More about this topic](/en/topics/security "More about this topic")