Advanced

# Step 1: Create ServiceAccount (Pod identity)
apiVersion: v1
kind: ServiceAccount # => Identity for Pods (not Users)
metadata:
 name: pod-reader-sa # => ServiceAccount name referenced by Pods
 namespace:
 default # => Namespace-scoped resource
 # => ServiceAccounts cannot be shared across namespaces
 # => Each namespace requires separate ServiceAccount
automountServiceAccountToken:
 true # => Auto-mount token in Pods (default)
 # => Token location: /var/run/secrets/kubernetes.io/serviceaccount/
 # => Contains: token, ca.crt, namespace files

---
# Step 2: Define Role (permissions within namespace)
apiVersion: rbac.authorization.k8s.io/v1
kind: Role # => Namespace-scoped permissions
metadata:
 name: pod-reader # => Role name referenced by RoleBinding
 namespace:
 default # => Permissions apply only within default namespace
 # => Cannot access Pods in other namespaces
rules: # => Array of permission rules (OR relationship)
 - apiGroups:
 [""] # => Core API group (v1 resources)
 # => Empty string = core API
 # => apps group = deployments, statefulsets
 # => batch group = jobs, cronjobs
 resources:
 ["pods"] # => Resource types (plural names)
 # => Subresources: pods/log, pods/exec, pods/portforward
 # => Each subresource requires explicit permission
 verbs:
 ["get", "list", "watch"] # => Allowed operations (CRUD subset)
 # => get: fetch single Pod by name
 # => list: retrieve all Pods in namespace
 # => watch: stream Pod changes (long-polling)
 # => MISSING: create, update, patch, delete
 # => Read-only access pattern

---
# Step 3: Bind Role to ServiceAccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding # => Grants Role permissions to subjects
metadata:
 name: read-pods-binding # => RoleBinding name (arbitrary)
 namespace:
 default # => Must match Role namespace
 # => RoleBinding only effective in this namespace
subjects: # => WHO gets permissions (users, groups, ServiceAccounts)
 - kind:
 ServiceAccount # => Subject type (ServiceAccount, User, Group)
 # => User: for kubectl/external access
 # => Group: for multiple users
 # => ServiceAccount: for Pods
 name:
 pod-reader-sa # => ServiceAccount name (must exist)
 # => This ServiceAccount gains Role permissions
 namespace:
 default # => ServiceAccount namespace
 # => Can bind to ServiceAccounts in other namespaces
roleRef: # => WHAT permissions to grant (immutable after creation)
 kind:
 Role # => References Role (namespace-scoped)
 # => Could reference ClusterRole for namespace-scoped use
 # => CANNOT change after RoleBinding creation
 name:
 pod-reader # => Role name (must exist in same namespace)
 # => Role defines actual permissions
 apiGroup:
 rbac.authorization.k8s.io # => RBAC API group
 # => Required for roleRef validation

---
# Step 4: Use ServiceAccount in Pod
apiVersion: v1
kind: Pod
metadata:
 name: rbac-pod # => Pod name
spec:
 serviceAccountName:
 pod-reader-sa # => Use custom ServiceAccount
 # => Default: "default" ServiceAccount (every namespace has one)
 # => Token auto-mounted at /var/run/secrets/kubernetes.io/serviceaccount/
 # => Pod inherits ALL permissions from ServiceAccount
 containers:
 - name: kubectl
 image:
 bitnami/kubectl:latest # => Container with kubectl CLI
 # => Uses mounted ServiceAccount token automatically
 # => Token read from standard location
 command: ["sh", "-c"] # => Shell command executor
 args: # => Commands to test RBAC permissions
 - |
 echo "=== Testing RBAC Permissions ==="
 # => Test 1: List pods (ALLOWED)
 echo "Test 1: kubectl get pods"
 kubectl get pods
 # => SUCCESS: Role permits "list" verb on "pods" resource
 # => Returns: list of Pods in default namespace

 # => Test 2: Get single pod (ALLOWED)
 echo "Test 2: kubectl get pod rbac-pod"
 kubectl get pod rbac-pod
 # => SUCCESS: Role permits "get" verb on "pods" resource
 # => Returns: Pod details

 # => Test 3: List services (DENIED)
 echo "Test 3: kubectl get services"
 kubectl get services || echo "DENIED: services not in Role"
 # => FAILED: 403 Forbidden
 # => Role only permits pods, not services

 # => Test 4: Delete pod (DENIED)
 echo "Test 4: kubectl delete pod rbac-pod --dry-run=client"
 kubectl delete pod rbac-pod --dry-run=client || echo "DENIED: delete not permitted"
 # => FAILED: 403 Forbidden
 # => Role missing "delete" verb

 # => Test 5: Create pod (DENIED)
 echo "Test 5: kubectl run test --image=nginx --dry-run=client"
 kubectl run test --image=nginx --dry-run=client || echo "DENIED: create not permitted"
 # => FAILED: 403 Forbidden
 # => Role missing "create" verb

 sleep 3600 # => Keep Pod running for manual testing

# Test permissions as ServiceAccount
kubectl auth can-i list pods --as=system:serviceaccount:default:pod-reader-sa
# => yes (Role permits list on pods)

kubectl auth can-i get pods --as=system:serviceaccount:default:pod-reader-sa
# => yes (Role permits get on pods)

kubectl auth can-i list services --as=system:serviceaccount:default:pod-reader-sa
# => no (services not in Role rules)

kubectl auth can-i delete pods --as=system:serviceaccount:default:pod-reader-sa
# => no (delete verb not in Role)

kubectl auth can-i create pods --as=system:serviceaccount:default:pod-reader-sa
# => no (create verb not in Role)

# View effective permissions
kubectl describe role pod-reader
# => Shows: get, list, watch on pods

kubectl describe rolebinding read-pods-binding
# => Shows: pod-reader-sa bound to pod-reader Role

# ServiceAccount (namespace-scoped, used by cluster-wide ClusterRoleBinding)
apiVersion: v1
kind: ServiceAccount
metadata:
 name: cluster-reader-sa # => ServiceAccount name
 namespace:
 kube-system # => Placed in kube-system (system namespace)
 # => ServiceAccount is namespace-scoped
 # => Can be granted cluster-wide permissions via ClusterRoleBinding

---
# ClusterRole (cluster-scoped permissions definition)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole # => Cluster-wide permission template
metadata:
 name:
 node-reader # => ClusterRole name (cluster-scoped)
 # => NO namespace field (cluster-wide resource)
 # => Can be bound cluster-wide OR per-namespace
 # => Reusable across multiple bindings
rules: # => Permission rules (OR relationship between rules)
 # Rule 1: Node access (cluster-scoped resources)
 - apiGroups:
 [""] # => Core API group (v1)
 # => Empty string = core Kubernetes API
 # => Nodes in core API group
 resources:
 ["nodes"] # => Nodes are cluster-scoped
 # => No namespace concept for nodes
 # => One node serves multiple namespaces
 # => Subresources: nodes/status, nodes/proxy
 verbs:
 ["get", "list", "watch"] # => Read-only operations
 # => get: fetch single node by name
 # => list: list all cluster nodes
 # => watch: stream node changes
 # => MISSING: create, delete, update, patch
 # => Prevents node manipulation

 # Rule 2: PersistentVolume access (cluster-scoped resources)
 - apiGroups:
 [""] # => Core API group
 # => PersistentVolumes in core API
 resources:
 ["persistentvolumes"] # => PVs are cluster-scoped
 # => Different from PVCs (namespace-scoped)
 # => PVs can be claimed from any namespace
 verbs:
 ["get", "list"] # => Read-only (no watch)
 # => Sufficient for inventory/monitoring
 # => watch not needed for PVs (change less frequently)

 # Rule 3: Cross-namespace Pod access (demonstrating namespace resources)
 - apiGroups: [""] # => Core API group
 resources:
 ["pods"] # => Pods are namespace-scoped
 # => ClusterRole + ClusterRoleBinding = access ALL namespaces
 # => ClusterRole + RoleBinding = access SINGLE namespace
 verbs:
 ["get", "list", "watch"] # => Read Pods across all namespaces
 # => Enables cluster-wide monitoring

---
# ClusterRoleBinding (grants cluster-wide permissions)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding # => Grants ClusterRole globally
metadata:
 name:
 read-nodes-global # => ClusterRoleBinding name (cluster-scoped)
 # => NO namespace field
 # => Effective across entire cluster
subjects: # => WHO gets permissions (can be multiple)
 - kind:
 ServiceAccount # => Subject type
 # => ServiceAccount is namespace-scoped
 # => Must specify namespace
 name:
 cluster-reader-sa # => ServiceAccount name
 # => This ServiceAccount gains cluster-wide permissions
 namespace:
 kube-system # => ServiceAccount location
 # => ServiceAccount defined in kube-system namespace
 # => Can reference ServiceAccounts from any namespace
roleRef: # => WHAT permissions to grant (immutable)
 kind:
 ClusterRole # => References ClusterRole (cluster-scoped)
 # => CANNOT reference Role (incompatible scopes)
 # => Role is namespace-scoped, won't work here
 name:
 node-reader # => ClusterRole name
 # => ClusterRole must exist
 # => Grants ALL rules from node-reader ClusterRole
 apiGroup:
 rbac.authorization.k8s.io # => RBAC API group
 # => Required for validation

# Pattern 1: ClusterRole + ClusterRoleBinding = cluster-wide access
# => ServiceAccount can access resources in ALL namespaces

# Pattern 2: ClusterRole + RoleBinding = namespace-specific access
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding # => RoleBinding (namespace-scoped)
metadata:
 name: read-nodes-in-namespace # => Binding name
 namespace: production # => Effective only in production namespace
subjects:
 - kind: ServiceAccount
 name: limited-reader-sa # => ServiceAccount in production namespace
 namespace: production
roleRef:
 kind:
 ClusterRole # => References ClusterRole
 # => But binding is namespace-scoped
 name:
 node-reader # => Reuses ClusterRole definition
 # => Permissions limited to production namespace
 apiGroup: rbac.authorization.k8s.io
# => Result: limited-reader-sa can ONLY access Pods in production namespace

# Test cluster-wide permissions
kubectl auth can-i list nodes --as=system:serviceaccount:kube-system:cluster-reader-sa
# => yes (ClusterRole permits list on nodes cluster-wide)

kubectl auth can-i list persistentvolumes --as=system:serviceaccount:kube-system:cluster-reader-sa
# => yes (ClusterRole permits list on PVs)

kubectl auth can-i list pods --all-namespaces --as=system:serviceaccount:kube-system:cluster-reader-sa
# => yes (ClusterRole + ClusterRoleBinding grants cross-namespace access)

kubectl auth can-i delete nodes --as=system:serviceaccount:kube-system:cluster-reader-sa
# => no (delete verb not in ClusterRole)

# View ClusterRole details
kubectl describe clusterrole node-reader
# => Shows: nodes (get, list, watch), persistentvolumes (get, list), pods (get, list, watch)

kubectl describe clusterrolebinding read-nodes-global
# => Shows: cluster-reader-sa bound to node-reader ClusterRole globally

# Use Case 1: Monitoring (read-only across all namespaces)
# => Prometheus, Datadog, New Relic

# Use Case 2: Node management
# => Node auto-scalers (Cluster Autoscaler)

# Use Case 3: PersistentVolume administration
# => Storage operators (Rook, OpenEBS)

# Use Case 4: Cross-namespace operators
# => cert-manager, ingress-nginx, ArgoCD

# Parent ClusterRole (aggregates permissions from multiple child ClusterRoles)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name:
 monitoring-aggregated # => Parent ClusterRole (container)
 # => Rules auto-populated by aggregation controller
 # => DO NOT manually edit rules field
 labels:
 rbac.example.com/aggregate-to-monitoring:
 "true" # => Self-include label
 # => Optional but conventional
 # => Matches own aggregationRule selector
aggregationRule: # => Defines aggregation behavior
 clusterRoleSelectors: # => Label selectors (OR relationship)
 - matchLabels: # => Matches ClusterRoles with these labels
 rbac.example.com/aggregate-to-monitoring:
 "true" # => Custom label key
 # => Matches child ClusterRoles below
 # => Controller watches for ClusterRoles with this label
 # => Auto-updates when matching ClusterRoles change
rules: [] # => Auto-populated by RBAC aggregation controller
 # => DO NOT manually add rules here

---
# Child ClusterRole 1 (defines Pod permissions)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name:
 monitoring-pods # => Component ClusterRole
 # => Provides Pod-related permissions
 labels:
 rbac.example.com/aggregate-to-monitoring:
 "true" # => Aggregation label
 # => Triggers inclusion in monitoring-aggregated
 # => Adding this label = instant aggregation
 # => Removing this label = instant removal
rules: # => These rules copied to monitoring-aggregated
 - apiGroups:
 [""] # => Core API group (v1)
 # => Pods in core API
 resources:
 - pods # => Pod resource
 # => Enables listing/getting Pods
 - pods/log # => Pod logs subresource
 # => Required for kubectl logs
 # => Separate permission from pods
 - pods/status # => Pod status subresource
 # => Read Pod status without full Pod access
 verbs:
 ["get", "list", "watch"] # => Read-only operations
 # => get: fetch single Pod
 # => list: list all Pods
 # => watch: stream Pod changes
 # => Typical monitoring permissions

---
# Child ClusterRole 2 (defines Metrics permissions)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name:
 monitoring-metrics # => Component ClusterRole
 # => Provides metrics-related permissions
 labels:
 rbac.example.com/aggregate-to-monitoring:
 "true" # => Aggregation label
 # => Same label = included in same parent
 # => Can have multiple parents with different labels
rules: # => These rules also copied to monitoring-aggregated
 - apiGroups:
 ["metrics.k8s.io"] # => Metrics API group
 # => Requires metrics-server installed in cluster
 # => Not available by default in some clusters
 resources:
 - pods # => Pod metrics (CPU, memory usage)
 # => Different from core API pods
 # => Used by kubectl top pods
 - nodes # => Node metrics (CPU, memory, disk)
 # => Used by kubectl top nodes
 # => Aggregated metrics from kubelet
 verbs:
 ["get", "list"] # => Read metrics
 # => get: fetch metrics for specific Pod/Node
 # => list: fetch metrics for all Pods/Nodes
 # => NO watch (metrics are point-in-time snapshots)

---
# Child ClusterRole 3 (defines Service permissions - optional extension)
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name:
 monitoring-services # => Additional component ClusterRole
 # => Demonstrates extensibility
 labels:
 rbac.example.com/aggregate-to-monitoring:
 "true" # => Same label = aggregated
 # => Add anytime to extend parent
rules:
 - apiGroups: [""] # => Core API group
 resources:
 - services # => Service resource
 # => Monitor service availability
 - endpoints # => Endpoints resource
 # => Monitor service endpoints
 verbs:
 ["get", "list", "watch"] # => Read-only monitoring
 # => Typical for service discovery

# Effective rules in monitoring-aggregated (auto-populated):
# rules:
# - apiGroups: [""]
# resources: ["pods", "pods/log", "pods/status", "services", "endpoints"]
# verbs: ["get", "list", "watch"]
# - apiGroups: ["metrics.k8s.io"]
# resources: ["pods", "nodes"]
# verbs: ["get", "list"]
# => Combined from monitoring-pods + monitoring-metrics + monitoring-services

# Step 1: Create new child ClusterRole with matching label
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: monitoring-configmaps # => New extension
 labels:
 rbac.example.com/aggregate-to-monitoring: "true" # => Use same label
rules:
 - apiGroups: [""]
 resources: ["configmaps"]
 verbs: ["get", "list"]

# Step 2: Apply child ClusterRole
# => kubectl apply -f monitoring-configmaps.yaml

# admin role (namespace admin permissions)
# => Aggregation label: rbac.authorization.k8s.io/aggregate-to-admin: "true"

# edit role (namespace edit permissions)
# => Aggregation label: rbac.authorization.k8s.io/aggregate-to-edit: "true"

# view role (namespace read-only permissions)
# => Aggregation label: rbac.authorization.k8s.io/aggregate-to-view: "true"

# Example: Extend built-in view role with custom CRD
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: view-databases-crd # => Extend view role
 labels:
 rbac.authorization.k8s.io/aggregate-to-view: "true" # => Built-in label
rules:
 - apiGroups: ["example.com"]
 resources: ["databases"] # => Custom resource
 verbs: ["get", "list", "watch"] # => Read-only
# => All users with view role now see databases CRD

# View aggregated ClusterRole (before children created)
kubectl get clusterrole monitoring-aggregated -o yaml
# => rules: [] (empty)

# Create child ClusterRoles
kubectl apply -f monitoring-pods.yaml
kubectl apply -f monitoring-metrics.yaml

# View aggregated ClusterRole (after children created)
kubectl get clusterrole monitoring-aggregated -o yaml
# => rules: [pods, pods/log, pods/status (get/list/watch), metrics.k8s.io/pods, nodes (get/list)]

# Test aggregation by adding new child
kubectl label clusterrole some-existing-role rbac.example.com/aggregate-to-monitoring=true
# => some-existing-role rules immediately merged into monitoring-aggregated

# Test aggregation by removing label
kubectl label clusterrole monitoring-services rbac.example.com/aggregate-to-monitoring-
# => monitoring-services rules immediately removed from monitoring-aggregated

apiVersion: v1
kind: Pod
metadata:
 name: security-context-pod
spec:
 securityContext: # => Pod-level security settings
 runAsUser:
 1000 # => Run as user ID 1000 (non-root)
 # => Default: container image user (often root)
 runAsGroup:
 3000 # => Run as group ID 3000
 # => Primary group for process
 fsGroup:
 2000 # => Filesystem group for volumes
 # => Files owned by group 2000
 # => Enables volume sharing between containers
 fsGroupChangePolicy:
 OnRootMismatch
 # => Change ownership only if needed
 # => Alternative: Always (slower but thorough)
 containers:
 - name: secure-app
 image:
 nginx:1.24 # => Container image
 # => Image may define default user
 securityContext: # => Container-level (overrides Pod-level)
 allowPrivilegeEscalation:
 false
 # => Prevents gaining more privileges
 # => Blocks setuid binaries
 runAsNonRoot:
 true # => Ensures non-root user
 # => Container fails if user is root
 # => Validates runAsUser setting
 readOnlyRootFilesystem:
 true # => Filesystem is read-only
 # => Use volumes for writable paths
 # => Prevents malware persistence
 capabilities:
 drop:
 - ALL # => Drop all Linux capabilities
 # => Start with zero privileges
 add:
 - NET_BIND_SERVICE # => Add only required capabilities
 # => Bind to ports < 1024
 # => Minimal privilege for nginx

 volumeMounts:
 - name:
 cache # => Volume mount name
 # => Writable because readOnlyRootFilesystem=true
 mountPath:
 /var/cache/nginx # => Writable volume for cache
 # => nginx needs writable cache directory

 volumes:
 - name: cache
 emptyDir:
 {} # => Ephemeral writable storage
 # => Deleted when Pod deleted
 # => Safe for cache/temp files


# Security best practices:
# => runAsNonRoot: true (prevent root exploits)

**Key Takeaway**: Always run containers as non-root with read-only root filesystem; drop all capabilities and add only required ones; use SecurityContext to enforce defense-in-depth security practices.

**Why It Matters**: SecurityContext prevents container escape vulnerabilities that have affected Docker, containerd, and runc (CVE-2019-5736). Running as non-root with read-only filesystem blocked 80% of container attacks in Aqua Security's 2023 threat report. Companies like This defense-in-depth approach is mandatory for PCI-DSS and SOC 2 compliance.

---

### Example 62: PodSecurityPolicy (Deprecated)

PodSecurityPolicy (PSP) enforces cluster-wide security standards for Pods. PSP is deprecated in Kubernetes 1.21+ and removed in 1.25+, replaced by Pod Security Admission.


```yaml
# NOTE: PSP deprecated, use Pod Security Standards instead
# Shown for historical context and migration understanding

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
 name: restricted # => PSP name
spec:
 privileged: false # => Disallow privileged containers
 allowPrivilegeEscalation: false # => Prevent privilege escalation
 requiredDropCapabilities:
 - ALL # => Require dropping all capabilities
 volumes:
 - configMap
 - emptyDir
 - projected
 - secret
 - downwardAPI
 - persistentVolumeClaim # => Allowed volume types
 runAsUser:
 rule: MustRunAsNonRoot # => Enforce non-root user
 seLinux:
 rule: RunAsAny
 fsGroup:
 rule: RunAsAny
 readOnlyRootFilesystem: true # => Require read-only root filesystem

---
# Migration to Pod Security Standards (PSS)
# 1. Label namespaces with Pod Security levels
# => kubectl label namespace default pod-security.kubernetes.io/enforce=restricted
# => Levels: privileged, baseline, restricted

# 2. Pod Security Admission enforces policies
# => No PSP or RBAC setup needed
# => Built-in controller validates Pods

# 3. Restricted level enforces:
# => runAsNonRoot: true
# => allowPrivilegeEscalation: false
# => Drop ALL capabilities
# => Read-only root filesystem

# File: /etc/kubernetes/encryption-config.yaml
# Location: Control plane node (where kube-apiserver runs)
# Purpose: Encrypt Secrets and ConfigMaps in etcd at rest

apiVersion: apiserver.config.k8s.io/v1 # => EncryptionConfiguration API
kind: EncryptionConfiguration # => Encryption settings for kube-apiserver
resources: # => Resource types to encrypt
 - resources: # => First resource group
 - secrets # => Encrypt Secret objects
 # => Contains passwords, tokens, certificates
 # => Base64-encoded by default (NOT encrypted)
 - configmaps # => Optionally encrypt ConfigMaps
 # => Usually not sensitive, but can contain credentials
 # => Encrypting increases etcd overhead
 providers: # => Encryption providers (tried in order)
 # => First provider encrypts new data

 # Primary encryption provider (AES-CBC)
 - aescbc: # => AES-CBC with PKCS#7 padding
 # => Industry-standard symmetric encryption
 keys: # => Encryption keys (can have multiple for rotation)
 - name:
 key1 # => Key identifier (arbitrary name)
 # => Used for key rotation tracking
 # => Appears in etcd metadata
 secret:
 <base64-encoded-32-byte-key> # => 256-bit encryption key
 # => MUST be exactly 32 bytes before base64 encoding
 # => Generate: head -c 32 /dev/urandom | base64
 # => Example: ySPsowMmLdOJJHvQ7g5G2YQffQhBdVxfRPEADqpYZ9s=

 # Additional key for rotation (optional)
 - name:
 key2 # => Older key kept for decryption
 # => Data encrypted with key1, but key2 still decrypts old data
 # => Remove after all data re-encrypted with key1
 secret:
 <base64-encoded-old-key> # => Previous encryption key
 # => Enables zero-downtime key rotation

 # Fallback provider (no encryption)
 - identity: {} # => No-op encryption provider
 # => Stores data in plaintext

# Step 1: Generate encryption key (256-bit = 32 bytes)
head -c 32 /dev/urandom | base64
# => Output: ySPsowMmLdOJJHvQ7g5G2YQffQhBdVxfRPEADqpYZ9s=

# Step 2: Create encryption config file on control plane node
sudo cat > /etc/kubernetes/encryption-config.yaml <<EOF
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
 - resources:
 - secrets
 providers:
 - aescbc:
 keys:
 - name: key1
 secret: ySPsowMmLdOJJHvQ7g5G2YQffQhBdVxfRPEADqpYZ9s=
 - identity: {}
EOF
# => File created at /etc/kubernetes/encryption-config.yaml

# Step 3: Update kube-apiserver configuration
sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
# => Add flag: --encryption-provider-config=/etc/kubernetes/encryption-config.yaml

# Step 4: Verify kube-apiserver restarted
kubectl get pods -n kube-system | grep kube-apiserver
# => kube-apiserver-controlplane 1/1 Running (recent restart time)

# Step 5: Encrypt ALL existing Secrets (re-write to trigger encryption)
kubectl get secrets --all-namespaces -o json | kubectl replace -f -
# => Reads all Secrets from etcd (decrypted if encrypted with old key)

# Step 6: Verify encryption (check etcd directly)
ETCDCTL_API=3 etcdctl get /registry/secrets/default/my-secret --print-value-only
# => Before encryption: plaintext "password123" visible

# Option 1: AES-GCM (faster than AES-CBC, requires unique nonce)
providers:
 - aesgcm: # => AES-GCM authenticated encryption
 # => Faster than AES-CBC (hardware acceleration)
 keys:
 - name: key1
 secret: <base64-encoded-32-byte-key> # => 256-bit key
 - identity: {}

# Option 2: KMS provider (AWS KMS - enterprise grade)
providers:
 - kms: # => External Key Management Service
 # => Keys stored outside cluster (AWS KMS, GCP KMS, Azure Key Vault)
 name: aws-encryption-provider # => KMS provider name
 endpoint: unix:///var/run/kmsplugin/socket.sock # => KMS plugin socket
 # => Requires aws-encryption-provider daemonset
 cachesize: 1000 # => Cache decrypted keys (performance)
 # => Reduces KMS API calls
 timeout: 3s # => KMS request timeout
 # => Prevents kube-apiserver hang if KMS unavailable
 - identity: {} # => Fallback if KMS unavailable (disaster recovery)

# Option 3: Secretbox (NaCl library)
providers:
 - secretbox: # => XSalsa20-Poly1305 encryption
 # => Modern authenticated encryption
 keys:
 - name: key1
 secret: <base64-encoded-32-byte-key>
 - identity: {}

# Step 1: Add new key to encryption config (keep old key)
providers:
 - aescbc:
 keys:
 - name: key2 # => New key (encrypts new data)
 secret: <base64-encoded-new-key>
 - name: key1 # => Old key (decrypts existing data)
 secret: <base64-encoded-old-key>
 - identity: {}
# => New Secrets encrypted with key2

# Step 2: Apply config and restart kube-apiserver
# => kubectl apply and wait for restart

# Step 3: Re-encrypt all Secrets with new key
kubectl get secrets --all-namespaces -o json | kubectl replace -f -
# => All Secrets now encrypted with key2

# Step 4: Remove old key from config
providers:
 - aescbc:
 keys:
 - name: key2 # => Only new key remains
 secret: <base64-encoded-new-key>
 - identity: {}
# => Old key removed safely (all data re-encrypted)

# Check encryption config loaded
kubectl get --raw /api/v1 | jq '.encryption.providers'
# => Shows: aescbc, identity

# Test encryption (create Secret, check etcd)
kubectl create secret generic test-encryption --from-literal=key=value

# Read from etcd directly (encrypted)
ETCDCTL_API=3 etcdctl get /registry/secrets/default/test-encryption --print-value-only | hexdump -C
# => Binary encrypted data (k8s:enc:aescbc:v1:key1: prefix)

# Read via kubectl (automatically decrypted)
kubectl get secret test-encryption -o jsonpath='{.data.key}' | base64 -d
# => Output: value (decrypted)

# NetworkPolicy: Pod-level firewall rules
apiVersion: networking.k8s.io/v1 # => NetworkPolicy API
kind: NetworkPolicy # => Firewall rules for Pods
metadata:
 name: backend-network-policy # => Policy name
 namespace:
 default # => Namespace-scoped (applies within this namespace only)
 # => NetworkPolicies don't cross namespace boundaries
 # => Need separate policies per namespace
spec:
 podSelector: # => Which Pods this policy applies to
 matchLabels:
 app:
 backend # => Selects Pods with label app=backend
 # => Policy applies to ALL Pods matching this selector
 # => Empty selector {} = all Pods in namespace
 # => Multiple labels = AND relationship

 policyTypes: # => Which traffic directions to control
 - Ingress # => Controls INCOMING traffic to selected Pods
 # => Default: allow all if not specified
 # => With Ingress: deny all, then explicit allow
 - Egress # => Controls OUTGOING traffic from selected Pods
 # => Default: allow all if not specified
 # => With Egress: deny all, then explicit allow

 ingress: # => Ingress rules (who can connect TO backend Pods)
 - from: # => Traffic sources (OR relationship between selectors)
 # Source 1: Frontend Pods
 - podSelector: # => Select Pods by labels (same namespace)
 matchLabels:
 app:
 frontend # => Allow traffic FROM Pods with app=frontend
 # => Pods in same namespace
 # => No namespaceSelector = same namespace only

 # Source 2: Database Pods
 - podSelector:
 matchLabels:
 app:
 database # => Allow traffic FROM Pods with app=database
 # => OR relationship with frontend selector above
 # => Either frontend OR database can connect

 ports: # => Allowed destination ports (applies to ALL from sources)
 - protocol:
 TCP # => Protocol (TCP, UDP, SCTP)
 # => Required field
 port:
 8080 # => Destination port on backend Pods
 # => Backend must listen on this port
 # => Source port unrestricted
 # => Result: frontend OR database → backend:8080/TCP allowed
 # => All other ingress traffic denied (default deny)

 egress: # => Egress rules (where backend Pods can connect TO)
 - to: # => Traffic destinations
 - podSelector:
 matchLabels:
 app:
 database # => Allow traffic TO Pods with app=database
 # => Backend can connect to database
 # => Same namespace only

 ports: # => Allowed destination ports
 - protocol: TCP
 port:
 5432 # => PostgreSQL default port
 # => Backend can connect to database:5432
 # => Result: backend → database:5432/TCP allowed
 # => All other egress traffic denied (including DNS!)

 # IMPORTANT: DNS egress required for service discovery
 - to: # => Additional egress rule for DNS
 - namespaceSelector: # => Select namespaces by labels
 matchLabels:
 name:
 kube-system # => kube-system namespace
 # => Where kube-dns/CoreDNS runs
 - podSelector:
 matchLabels:
 k8s-app: kube-dns # => Select DNS Pods
 ports:
 - protocol: UDP
 port:
 53 # => DNS port
 # => Required for service name resolution
 # => Without this, backend can't resolve service names

# Allowed ingress (TO backend Pods):
# => frontend Pods → backend:8080/TCP ✓

# Allowed egress (FROM backend Pods):
# => backend → database:5432/TCP ✓

# Create test Pods with labels
kubectl run frontend --image=busybox --labels="app=frontend" -- sleep 3600
kubectl run backend --image=nginx --labels="app=backend" --port=8080
kubectl run database --image=postgres:15 --labels="app=database" --port=5432
kubectl run external --image=busybox --labels="app=external" -- sleep 3600

# Apply NetworkPolicy
kubectl apply -f backend-network-policy.yaml
# => NetworkPolicy created

# Test 1: frontend → backend:8080 (ALLOWED)
kubectl exec frontend -- wget -O- --timeout=2 backend:8080
# => SUCCESS: HTML response from nginx

# Test 2: external → backend:8080 (DENIED)
kubectl exec external -- wget -O- --timeout=2 backend:8080
# => TIMEOUT: no response

# Test 3: backend → database:5432 (ALLOWED)
kubectl exec backend -- nc -zv database 5432
# => SUCCESS: connection established

# Test 4: backend → external (DENIED if no rule)
kubectl exec backend -- wget -O- --timeout=2 external:8080
# => TIMEOUT: no response

# Verify NetworkPolicy applied
kubectl describe networkpolicy backend-network-policy
# => Shows: podSelector, ingress rules, egress rules

kubectl get pods -l app=backend -o wide
# => Shows backend Pods subject to NetworkPolicy

# Requirement 1: CNI plugin with NetworkPolicy support
# => Supported: Calico, Cilium, Weave Net, Antrea, Romana

# Requirement 2: Pods must have labels
# => NetworkPolicy selects Pods by labels

# Requirement 3: Namespace-scoped
# => NetworkPolicies don't cross namespaces

# Behavior notes:
# => Without NetworkPolicy: ALL traffic allowed (permissive)

# Pattern 1: Deny all ingress traffic (allow egress)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all-ingress # => Policy name
 namespace: default # => Applies to default namespace only
spec:
 podSelector: {} # => Empty selector = ALL Pods in namespace
 # => Every Pod in default namespace affected
 policyTypes:
 - Ingress # => Declares Ingress policy (default deny)
 # => NO ingress rules = deny all ingress
 # => Egress NOT declared = allow all egress (default)
 # ingress: [] field omitted = no ingress allowed
 # => Result: No Pod can receive traffic
 # => Exception: Pods can still connect OUT (egress allowed)

---
# Pattern 2: Deny all egress traffic (allow ingress)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all-egress # => Policy name
 namespace: default
spec:
 podSelector: {} # => All Pods in namespace
 policyTypes:
 - Egress # => Declares Egress policy (default deny)
 # => NO egress rules = deny all egress
 # => Ingress NOT declared = allow all ingress (default)
 # egress: [] field omitted = no egress allowed
 # => Result: No Pod can send traffic
 # => Exception: Pods can still receive traffic (ingress allowed)
 # => WARNING: Breaks DNS (Pods can't resolve service names)

---
# Pattern 3: Deny all ingress AND egress (complete isolation)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all # => Policy name
 namespace: default
spec:
 podSelector: {} # => All Pods in namespace
 policyTypes:
 - Ingress # => Default deny ingress
 - Egress # => Default deny egress
 # NO ingress or egress rules = total isolation
 # => Result: Pods cannot send OR receive traffic
 # => Use case: emergency lockdown, compliance isolation
 # => WARNING: Breaks everything including DNS, health checks

---
# Pattern 4: Default deny with DNS exception (recommended)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: deny-all-with-dns # => Recommended default deny
 namespace: default
spec:
 podSelector: {} # => All Pods
 policyTypes:
 - Ingress # => Deny all ingress
 - Egress # => Deny all egress (except DNS below)
 egress:
 # Allow DNS lookups (required for service discovery)
 - to:
 - namespaceSelector: # => Select kube-system namespace
 matchLabels:
 kubernetes.io/metadata.name: kube-system # => Standard namespace label
 ports:
 - protocol: UDP
 port:
 53 # => DNS port
 # => kube-dns/CoreDNS in kube-system
 # Allow HTTPS to Kubernetes API (kubelet health checks)
 - to:
 - namespaceSelector: {} # => Any namespace
 ports:
 - protocol: TCP
 port: 443 # => HTTPS for kubelet → API server
 # => Result: Deny all EXCEPT DNS and API access

# Step 1: Apply to test namespace
kubectl create namespace test-isolation
kubectl label namespace test-isolation kubernetes.io/metadata.name=test-isolation
kubectl apply -f deny-all-with-dns.yaml -n test-isolation
# => Test namespace isolated

# Step 2: Deploy test Pod
kubectl run test-app -n test-isolation --image=nginx
# => Pod created but network isolated

# Step 3: Verify DNS works
kubectl exec -n test-isolation test-app -- nslookup kubernetes.default
# => SUCCESS (DNS allowed)

# Step 4: Verify other traffic blocked
kubectl run test-client -n test-isolation --image=busybox --rm -it -- wget -O- --timeout=2 test-app
# => TIMEOUT (blocked, as expected)

# Step 5: Add allow rule
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-to-nginx
 namespace: test-isolation
spec:
 podSelector:
 matchLabels:
 run: test-app
 ingress:
 - from:
 - podSelector: {}
EOF
# => Allow rule added

# Step 6: Retry connection
kubectl run test-client -n test-isolation --image=busybox --rm -it -- wget -O- test-app
# => SUCCESS (now allowed)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
 name: allow-from-frontend-namespace
 namespace: backend-ns # => Applies in backend-ns namespace
spec:
 podSelector:
 matchLabels:
 app: api # => Applies to api Pods in backend-ns
 policyTypes:
 - Ingress
 ingress:
 - from:
 - namespaceSelector:
 matchLabels:
 environment:
 frontend # => Allow from namespaces with environment=frontend label
 # => kubectl label namespace frontend-ns environment=frontend
 - podSelector:
 matchLabels:
 app: web # => AND Pods with app=web
 ports:
 - protocol: TCP
 port: 8080

# Namespace isolation patterns:
# => Production namespace: allow only from prod namespaces

# Label namespaces for NetworkPolicy:
# => kubectl label namespace frontend-ns environment=frontend

apiVersion:
 networking.k8s.io/v1 # => NetworkPolicy API
 # => Stable networking API
kind:
 NetworkPolicy # => NetworkPolicy resource
 # => Egress traffic control
metadata:
 # => Policy metadata
 name:
 allow-egress-external # => Policy name
 # => Descriptive identifier
 namespace:
 default # => Namespace scope
 # => Applies within this namespace
spec:
 # => NetworkPolicy specification
 podSelector:
 # => Selects target Pods
 matchLabels:
 # => Label selector
 app:
 api # => Applies to app=api Pods
 # => Restricts these Pods' egress
 policyTypes:
 # => Policy directions
 - Egress # => Controls outgoing traffic only
 # => Allows all ingress by default
 # => Egress default deny when specified
 egress:
 # => Egress rule list
 # Allow DNS resolution
 - to:
 # => Destination selector
 - namespaceSelector:
 # => Namespace label selector
 matchLabels:
 # => Namespace labels
 kubernetes.io/metadata.name:
 kube-system # => kube-system namespace
 # => DNS service location
 podSelector:
 # => Pod label selector
 matchLabels:
 # => Pod labels
 k8s-app:
 kube-dns # => Allow CoreDNS
 # => DNS service Pods
 # => Required for name resolution
 ports:
 # => Allowed ports
 - protocol:
 UDP # => UDP protocol
 # => DNS uses UDP
 port:
 53 # => DNS port
 # => Standard DNS port
 # => Essential for service discovery

 # Allow specific external IP
 - to:
 # => Destination IP range
 - ipBlock:
 # => IP block selector
 cidr:
 203.0.113.0/24 # => Allow to IP range
 # => /24 = 256 addresses
 # => Specific external service range
 except:
 # => Exclusion list
 - 203.0.113.10/32 # => Except this IP
 # => /32 = single IP
 # => Blocked within allowed range
 ports:
 # => Allowed ports
 - protocol:
 TCP # => TCP protocol
 # => HTTPS uses TCP
 port:
 443 # => HTTPS only
 # => Secure connection required
 # => Blocks unencrypted HTTP

 # Allow to external service
 - to:
 # => Destination IP range
 - ipBlock:
 # => IP block selector
 cidr:
 0.0.0.0/0 # => Allow to any IP (internet)
 # => All external IPs
 # => Broad internet access
 ports:
 # => Allowed ports
 - protocol:
 TCP # => TCP protocol
 # => HTTPS uses TCP
 port:
 443 # => HTTPS to internet
 # => Secure connections only
 # => No HTTP (port 80)

# Egress control use cases:
# => Restrict outbound to approved APIs

apiVersion:
 networking.k8s.io/v1 # => Networking API group
 # => Stable v1 NetworkPolicy API
 # => NetworkPolicies since Kubernetes 1.7
kind:
 NetworkPolicy # => NetworkPolicy resource
 # => Defines traffic rules for Pods
 # => Firewall rules at Pod level
metadata:
 name:
 complex-policy # => Policy name
 # => Unique within namespace
 namespace:
 production # => Namespace scope
 # => Policy applies only to production namespace
spec:
 # => Policy specification
 podSelector:
 # => Selects Pods this policy applies to
 matchLabels:
 # => Label-based selection (AND logic)
 tier:
 backend # => Matches backend tier Pods
 # => First label requirement
 environment:
 prod # => Applies to Pods with both labels
 # => Second label requirement
 # => Both tier=backend AND environment=prod
 policyTypes:
 # => Traffic directions controlled
 - Ingress # => Controls incoming traffic
 # => Defines what can connect TO these Pods
 - Egress # => Controls outgoing traffic
 # => Defines where these Pods can connect
 ingress:
 # => Ingress rules (OR logic between rules)
 # Rule 1: Allow from frontend in same namespace
 - from:
 # => Traffic sources (OR logic between items)
 - podSelector:
 # => Pods in same namespace
 matchLabels:
 tier:
 frontend # => Allow from frontend Pods
 # => Same namespace as policy
 ports:
 # => Allowed ports (AND logic with from)
 - protocol:
 TCP # => TCP protocol
 # => Alternative: UDP, SCTP
 port:
 8080 # => Application port
 # => Backend API endpoint

 # Rule 2: Allow from monitoring namespace
 - from:
 # => Different source selector
 - namespaceSelector:
 # => Pods from specific namespace
 matchLabels:
 name:
 monitoring # => Monitoring namespace
 # => Cross-namespace access
 ports:
 # => Monitoring port
 - protocol:
 TCP # => TCP protocol
 # => HTTP/gRPC common
 port:
 9090 # => Metrics endpoint
 # => Prometheus scrape port
 # => Separate rule for monitoring

 # Rule 3: Allow from specific IP range
 - from:
 # => IP-based source
 - ipBlock:
 # => CIDR-based access control
 cidr:
 10.0.0.0/8 # => Internal network
 # => RFC 1918 private network
 # => Corporate network range
 ports:
 # => Application port
 - protocol:
 TCP # => TCP protocol
 # => Standard application traffic
 port:
 8080 # => Backend API port
 # => Same port as Rule 1

 egress:
 # => Egress rules (OR logic)
 # Allow to database
 - to:
 # => Egress destinations
 - podSelector:
 # => Database Pods in same namespace
 matchLabels:
 tier:
 database # => Database tier Pods
 # => Backend can connect to database
 ports:
 # => Database port
 - protocol:
 TCP # => TCP protocol
 # => PostgreSQL wire protocol
 port:
 5432 # => PostgreSQL port
 # => Standard PostgreSQL port

 # Allow to external API
 - to:
 # => External destination
 - ipBlock:
 # => Specific external IP
 cidr:
 203.0.113.50/32 # => Specific external API
 # => /32 = single IP
 # => Whitelisted external service
 ports:
 # => HTTPS port
 - protocol:
 TCP # => TCP protocol
 # => HTTPS over TCP
 port:
 443 # => HTTPS port
 # => Encrypted external API

# Multiple selector behavior:
# => Multiple items in from/to are OR'd (any match allows)

# CustomResourceDefinition: Extend Kubernetes API with custom types
apiVersion: apiextensions.k8s.io/v1 # => CRD API version
kind: CustomResourceDefinition # => Defines new custom resource type
metadata:
 name:
 databases.example.com # => CRD name format: <plural>.<group>
 # => Must match spec.names.plural + spec.group
 # => Cluster-scoped (no namespace)
spec:
 group:
 example.com # => API group for custom resources
 # => Appears in apiVersion: example.com/v1
 # => Use reverse domain (com.example, io.mydomain)
 # => Avoid k8s.io, kubernetes.io (reserved)

 names: # => Resource naming (used in kubectl and API)
 kind:
 Database # => Resource kind (singular, PascalCase)
 # => Used in YAML: kind: Database
 # => Convention: singular, capitalized
 plural:
 databases # => Plural form (lowercase)
 # => Used in API path: /apis/example.com/v1/databases
 # => Used in kubectl: kubectl get databases
 singular:
 database # => Singular form (lowercase)
 # => Used in kubectl: kubectl get database
 shortNames: # => Short aliases for kubectl
 - db # => kubectl get db (shorthand)
 # => Easier to type than kubectl get databases
 listKind:
 DatabaseList # => List kind (optional, auto-generated)
 # => Used for list operations
 categories: # => Custom categories for grouping
 - all # => Included in kubectl get all

 scope:
 Namespaced # => Resource scope
 # => Namespaced: resources belong to namespaces
 # => Cluster: cluster-wide resources (like nodes)
 # => Most CRDs are Namespaced

 versions: # => API versions (can have multiple for compatibility)
 - name:
 v1 # => Version identifier
 # => Appears in apiVersion: example.com/v1
 # => Convention: v1, v1alpha1, v1beta1, v2
 served:
 true # => Enable this version in API
 # => false = version exists but disabled
 # => Can serve multiple versions simultaneously
 storage:
 true # => Storage version (etcd persistence)
 # => MUST have exactly ONE storage version
 # => Other versions converted to storage version
 # => Migration changes storage version

 schema: # => OpenAPI v3 validation schema
 openAPIV3Schema: # => JSON Schema for validation
 type: object # => Root must be object
 required: ["spec"] # => Top-level required fields
 properties:
 spec: # => Desired state (user-defined)
 type: object # => Spec is always object
 required:
 ["engine", "version"] # => Required spec fields
 # => API rejects resources missing these
 properties:
 engine: # => Database engine field
 type: string # => Field type
 enum:
 ["postgres", "mysql", "mongodb"] # => Allowed values
 # => Validation rejects invalid values
 description: "Database engine type" # => Field documentation
 version: # => Database version field
 type:
 string # => Version as string (not int)
 # => Supports semver: "15", "15.2", "15.2.1"
 pattern:
 '^[0-9]+(\.[0-9]+)*$' # => Regex validation
 # => Ensures version format
 replicas: # => Replica count field
 type: integer # => Integer type
 minimum: 1 # => Validation: must be >= 1
 maximum: 10 # => Validation: must be <= 10
 default: 3 # => Default value if not specified
 storage: # => Storage configuration (optional)
 type: object
 properties:
 size:
 type: string
 pattern: "^[0-9]+(Gi|Mi)$" # => Examples: 10Gi, 500Mi
 storageClass:
 type: string

 status: # => Actual state (controller-managed)
 type: object # => Status is always object
 properties:
 phase: # => Current phase
 type: string
 enum: ["Pending", "Running", "Failed"] # => Valid phases
 readyReplicas: # => Number of ready replicas
 type: integer
 conditions: # => Status conditions array
 type: array
 items:
 type: object
 properties:
 type:
 type: string # => Condition type (e.g., "Ready")
 status:
 type: string
 enum: ["True", "False", "Unknown"]
 lastTransitionTime:
 type: string
 format: date-time # => RFC3339 timestamp
 reason:
 type: string # => Machine-readable reason
 message:
 type: string # => Human-readable message

 # Subresources (optional but recommended)
 subresources:
 status: {} # => Enable status subresource
 # => Separate /status endpoint
 scale: # => Enable scale subresource
 specReplicasPath: .spec.replicas # => Path to replica count in spec
 statusReplicasPath: .status.readyReplicas # => Path in status
 labelSelectorPath: .status.labelSelector # => Label selector path
 # => Enables: kubectl scale database/production-db --replicas=5

 # Additional printer columns (kubectl get output)
 additionalPrinterColumns:
 - name: Engine # => Column name
 type: string # => Data type
 jsonPath: .spec.engine # => JSONPath to field
 description: "Database engine type" # => Column description
 - name: Version
 type: string
 jsonPath: .spec.version
 - name: Replicas
 type: integer
 jsonPath: .spec.replicas
 - name: Ready
 type: integer
 jsonPath: .status.readyReplicas
 - name: Phase
 type: string
 jsonPath: .status.phase
 - name: Age
 type: date
 jsonPath: .metadata.creationTimestamp # => Auto-formatted age
 # => Result: kubectl get databases shows these columns

---
# Custom Resource instance (using CRD above)
apiVersion: example.com/v1 # => Uses CRD API group and version
kind: Database # => Uses CRD kind
metadata:
 name: production-db # => Resource name
 namespace: default # => Namespace (if scope: Namespaced)
spec:
 engine: postgres # => Validated against enum
 version: "15" # => String version
 replicas: 3 # => Within min/max range (1-10)
 storage:
 size: 50Gi # => Matches pattern
 storageClass: fast-ssd

# Initially, status is empty (controller populates)
# status:
# phase: Pending
# readyReplicas: 0
# conditions: []