What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

2 min read·243 words

Notation

Notation is a command-line interface (CLI) tool developed as part of the Notary Project, which defines a standard for signing and verifying artifacts in OCI-compliant registries. It enables cryptographic signing of container images and ensures only trusted content is deployed within a Kubernetes environment.

By using Notation, organizations can enforce artifact integrity, trace the source of images, and integrate signature verification into CI/CD pipelines and policy engines.

Usage

1. Install Notation

# On macOS
brew install notaryproject/tap/notation

# Or download from GitHub
curl -Lo notation.tar.gz https://github.com/notaryproject/notation/releases/latest/download/notation-linux-amd64.tar.gz
tar -xvzf notation.tar.gz
chmod +x notation
sudo mv notation /usr/local/bin/

2. Generate a Signing Key and Certificate

notation cert generate-test --default my-cert

This command generates a test certificate and sets it as the default signer.

3. Sign an Image

notation sign ghcr.io/myorg/myimage:1.0

This creates and stores a signature in the OCI registry.

4. Verify a Signed Image

notation verify ghcr.io/myorg/myimage:1.0

The verification process ensures the signature matches the configured trusted certificate.

5. Use with Kubernetes

Notation can integrate with Kubernetes admission controllers or supply chain security frameworks to ensure that only signed and verified images are allowed into your cluster.

Best Practices

Rotate keys regularly and use short-lived certificates for signing.
Use trusted certificate authorities or your internal PKI to sign images.
Restrict deployment of unsigned images via admission policies (e.g., OPA Gatekeeper or Kyverno).
Incorporate image signature verification into CI/CD pipelines.
Audit signature verification logs for security monitoring and compliance.

Resources

Official Documentation: https://notaryproject.dev
GitHub Repository: https://github.com/notaryproject/notation

References

This article is based on information from the following official sources:

Notation CLI Overview - Notary Project Documentation
Sign and Verify Container Images - Notary Project Documentation
Notation GitHub Repository - Notary Project

Usage​

1. Install Notation​

2. Generate a Signing Key and Certificate​

3. Sign an Image​

4. Verify a Signed Image​

5. Use with Kubernetes​

Best Practices​

Resources​

References​