Hands-On Microservices with Kubernetes

Implementing security contexts

Sometimes, pods and containers need escalated privileges or access to the node. This will be very rare for your application workloads. However, when necessary, Kubernetes has the concept of a security context that encapsulates and allows you to configure multiple Linux security concepts and mechanisms. This is critical from a security perspective because you open up a tunnel out of the container world into the host machine.

Here is a list of some mechanisms that are covered by security contexts:

• Allowing (or forbidding) privilege escalation
• Access control via user IDs and group IDs (runAsUser, runAsGroup)
• Capabilities as opposed to unrestricted root access
• Using AppArmor and seccomp profiles
• SELinux configuration ...