Security

Mutation must finish before validation so that validators judge the final object — otherwise a webhook could inject a sidecar that a validator already approved the spec without. Mutating webhook authors must therefore assume other webhooks also mutate, run in unspecified order, may be re-invoked, and must produce a schema-valid object with idempotent patches and no side effects on dry-run.

Direct etcd access bypasses Kubernetes authentication, RBAC and admission, so a caller can read or rewrite every object, including Secrets. Require client and peer certificates signed by a dedicated etcd CA, and firewall 2379 and 2380 to control-plane hosts only.

Turn on warn and audit at restricted first, collect violations across a full deploy cycle including CronJobs, fix manifests (non-root UID, drop ALL, no escalation, seccomp, emptyDir for writable paths), verify with server-side dry-run, then set enforce per namespace with a pinned version. Diagnose rejections from ReplicaSet/Job events, which name the violated fields.

When you create or update a Role or ClusterRole, the API server checks that you already hold every permission in it; otherwise it rejects the write. Creating a binding likewise requires holding the role's permissions, or the bind verb on that role. The escalate verb waives the first check. This stops namespace admins from minting themselves cluster power.

Never start at deny. Ship the rule in audit/warn mode first, measure violations per namespace from the reports, give owners a deadline and help, then enforce namespace by namespace starting with low-risk ones. Handle exceptions as explicit, labelled, time-boxed, individually-reviewed exclusions — not by weakening the global rule.

Budget volume through the policy: drop or thin high-rate system traffic, omit RequestReceived, keep bodies only for rare writes. Then choose backend modes by what must win when the sink fails: blocking protects completeness, batch protects latency and may drop events.

Rank kube-bench failures by what an attacker gains, find who depends on each open setting before closing it, roll changes one control-plane node and small kubelet waves at a time, and bake the result into provisioning.

Decide on what native Secrets cannot do: fine-grained non-Kubernetes access policy, automatic rotation and dynamic short-lived credentials, cross-cluster single source of truth, and secret-level audit. If you need those, use an external manager; External Secrets Operator syncs into Secret objects for compatibility, the CSI driver mounts files and skips the object entirely.

Use an OIDC identity provider for daily access, with prefixed groups bound by RBAC and short-lived tokens, because leavers and movers are handled centrally. Keep an independent, short-lived or sealed client certificate as an alerted break-glass path.

kube-apiserver can emit one audit event per stage - RequestReceived, ResponseStarted for long-running calls, ResponseComplete, and Panic - all sharing one auditID. ResponseComplete already carries the outcome, so omitting RequestReceived roughly halves volume for ordinary requests.

NodeRestriction checks the content of a kubelet's writes. A kubelet may change only its own Node and pods bound to it, may not change its taints, and may not set node-restriction.kubernetes.io/ labels, so a stolen node cannot pull sensitive workloads onto itself.