Certified Kubernetes Application Developer (CKAD) Study Guide, 2nd Edition

Chapter 20. Security Contexts

Running a Pod in Kubernetes without implementing more restrictive security measures can pose a security risk. Without these measures, an attacker can potentially gain access to the host system or perform malicious activities, such as accessing files containing sensitive data. A security context defines privilege and access control settings for containers as part of a Pod specification. The following list provides some examples for security-related parameters:

• The user ID that should be used to run the Pod and/or container

• The group ID that should be used for filesystem access

• Granting a running process inside the container some privileges of the root user but not all of them

This chapter will give you an overview of defining security contexts and seeing their runtime effects in practice. Given the wide range of security settings, we won’t be able to discuss all of them. You will find additional use cases and configuration options in the Kubernetes documentation.

Coverage of Curriculum Objectives

This chapter addresses the following curriculum objective:

• Understand SecurityContext

Working with Security Contexts

The security context is not a Kubernetes primitive. It is modeled as a set of attributes under the directive securityContext within the Pod specification. Security settings defined on the Pod level apply to all containers running in the Pod. When applied to a single container, it will have no effects on other containers running ...