InsideKubernetes from Zero: What It Is and Why It Matters
A beginner-friendly introduction to Kubernetes (K8s): what it is, why it's used, and the start of my Kubernetes security journey.
Learning Kubernetes security in public, from the very first "what even is a pod" to RBAC, kubelet hardening and real cloud-native attack paths. 42 parts, best read in order, newest first here. Switch the sort to "Topic 1 first" to read it as a course.
Complete series · all 42 topics publishedA beginner-friendly introduction to Kubernetes (K8s): what it is, why it's used, and the start of my Kubernetes security journey.
A clear mental model of Kubernetes: the control plane, worker nodes, pods, deployments, services and why each matters for security testing.
A practical look at Kubernetes nodes, pods, namespaces, resource quotas, monitoring, requests/limits and probes - and why each shapes security testing.
Topic 4 of my Kubernetes journey: the 4Cs of cloud native security explained, then a real attack chain from an open Docker port to a rigged poll database.
Topic 5 of my Kubernetes journey: what CIS Benchmarks actually are, why they matter for hardening a cluster, and how to score yours with Kube-Bench.
Topic 6 of my Kubernetes journey: the core security primitives, how the API server authenticates you, and why service account tokens changed in 1.22 and 1.24.
Topic 7 of my Kubernetes journey: how TLS and PKI actually work, which certificate every cluster component carries, and how to create, sign and audit them.
Topic 8 of my Kubernetes journey: what a kubeconfig file really is, how clusters, users and contexts fit together, and how the Kubernetes API is grouped.
Topic 9 of my Kubernetes journey: the authorization modes (Node, ABAC, RBAC, Webhook), how the API server chains them, and a hands-on RBAC walkthrough.
Topic 10 of my Kubernetes journey: cluster-scoped vs namespaced resources, ClusterRoles and ClusterRoleBindings, and how loose bindings get abused.
Topic 11 of my Kubernetes journey: why an exposed kubelet is instant RCE, ports 10250 and 10255, and how to harden it with auth, Webhook and no read-only port.
Topic 12 of my Kubernetes journey: reach the API server and internal ClusterIP services from your laptop with kubectl proxy and port-forward, in a kind lab.
Topic 13 of my Kubernetes journey: verify platform binaries with SHA-512 before you trust them, understand version skew, and upgrade a cluster with kubeadm.
Topic 14 of my Kubernetes journey: pods talk to everything by default. Learn network policies, ingress and egress, labels and selectors, and the AND/OR gotcha.
Topic 15 of my Kubernetes journey: how Ingress gives you one clean URL, path and host routing and SSL for many services, instead of a load balancer per app.
Topic 16 of my Kubernetes journey: why an exposed Docker daemon means root on the host, the 2375 vs 2376 ports, and locking it down with TLS and client certs.
Topic 17 of my Kubernetes journey: what node objects leak (kubelet and kernel versions, internal IPs, taints), why attackers love it, and how to lock it down.
Topic 18 of my Kubernetes journey: how audit logging records who did what in your cluster, the four policy levels, a hands-on kind lab, and what to alert on.
Topic 19 of my Kubernetes journey: least privilege as system hardening, applied to the node and to RBAC, with a hands-on lab to trim ports, modules and access.
Topic 20 of my Kubernetes journey: harden SSH on your nodes with key-based login, no root and no passwords, a hands-on lab you can run safely.
Topic 21 of my Kubernetes journey: how sudo really works, how to read /etc/sudoers, and why a sloppy sudo rule hands an attacker root on your node.
Topic 22 of my Kubernetes journey: audit and remove unused services, blacklist risky kernel modules, and close open ports to shrink a node's attack surface.
Topic 23 of my Kubernetes journey: apply least privilege two ways, cloud IAM roles for who can do what, and a UFW host firewall for who can reach what.
Topic 24 of my Kubernetes journey: what a Linux syscall is, why containers share one kernel, and how to watch them live with strace and Aqua Tracee (eBPF).
Topic 25 of my Kubernetes journey: use seccomp to block the syscalls a container never needs, why Kubernetes ships it off, and how to turn it on.
Topic 26 of my Kubernetes journey: AppArmor confines which files a container can touch, and Linux capabilities slice root into least-privilege pieces.
Topic 27 of my Kubernetes journey: RBAC decides if you can create a pod, admission controllers decide what that pod's allowed to contain. Hands-on lab.
Topic 28 of my Kubernetes journey: built-in admission controllers only go so far, so I built my own validating and mutating webhooks. Real YAML and Python.
Topic 29 of my Kubernetes journey: Pod Security Policies, the admission control that got removed in 1.25, why it broke clusters, and what replaced it.
Topic 30 of my Kubernetes journey: Open Policy Agent and Gatekeeper, writing Rego, unit-testing policy, and blocking non-compliant resources at admission.
Topic 31 of my Kubernetes journey: what a Secret actually protects, why base64 isn't security, encryption at rest, and the RBAC gap nobody closes.
Topic 32 of my Kubernetes journey: why containers share one kernel, what gVisor and Kata Containers actually change, and picking a runtime with RuntimeClass.
Topic 33 of my Kubernetes journey: how one-way TLS proves the server, how mutual TLS proves both sides, and a hands-on mTLS lab with openssl and curl.
Topic 34 of my Kubernetes journey: sharing one cluster between teams or customers safely with namespaces, RBAC, quotas and network policies, and where soft isolation stops.
Topic 35 of my Kubernetes journey: the layers of tenant isolation, control plane vs data plane, and the two most people skip: node isolation and storage isolation.
Topic 36 of my Kubernetes journey: a quota is a ceiling, not a referee. API Priority and Fairness, Pod Priority and Preemption, and QoS eviction order.
Swapping one base image took my Trivy count from 124 findings to zero. Scanners and SBOMs tell you what is inside a container image, they never remove it.
KubeLinter found five problems in a Deployment that applied without a complaint. Then I 'fixed' them and the pod wouldn't start. Static analysis for Kubernetes YAML.
By default your cluster will pull an image from any registry on the internet, and the built-in fix fails open. How to allowlist trusted registries and not undo it.
A Falco reference for Kubernetes: the two drivers, the file paths, the five required rule keys, the output channels, and three steps old install guides get wrong.
A read-only root filesystem in Kubernetes is worth setting, but it is not an immutable container. What readOnlyRootFilesystem actually stops, and what it doesn't.
The complete Kubernetes security journey mapped end to end: 42 topics from RBAC to runtime, organised by the attacker's path and by defence, with the pentest notes.