Kubernetes entities as security boundaries
In a Kubernetes cluster, the Kubernetes entities (objects and components) you interact with have their own built-in security boundaries. The security boundaries are derived from the design or implementation of the entities. It is important to understand the security boundaries built within or around these Kubernetes entities:
- Containers: Containers are a basic component within a Kubernetes cluster. A container provides minimal isolation to the application using cgroups, Linux namespaces, AppArmor profiles, and a seccomp profile to the application running within the container.
- Pods: A Pod is a collection of one or more containers. Pods isolate more resources compared to containers, such as a network and IPC. Features such as SecurityContext and NetworkPolicies work at the Pod level to ensure a higher level of isolation.
- Nodes: Nodes in Kubernetes are also a security boundary. Pods can be specified to run on specific...
