Default Deny All Traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Allow Only From a Specific App

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

• No policy: all traffic is allowed (default open)
• Empty podSelector {}: selects every pod in the namespace
• Policies are additive: allowed traffic is the union of all matching rules

Run kube-bench

# Control plane checks (apiserver, etcd, scheduler, controller-manager)
kube-bench run --targets master

# Worker node / kubelet checks
kube-bench run --targets node

# Inspect kubelet config that kube-bench evaluates
cat /var/lib/kubelet/config.yaml

High-Value Hardening Settings

Create the TLS Secret

kubectl create secret tls app-tls --cert=tls.crt --key=tls.key

Ingress Resource

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-app
spec:
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app
            port:
              number: 443

• Store certificates in a TLS Secret referenced by spec.tls
• Use a controller that terminates TLS (ingress-nginx, Traefik)
• Redirect plaintext HTTP to HTTPS where the controller supports it

• Restrict access to the cloud metadata endpoint (169.254.169.254) with egress NetworkPolicy.
• Avoid hostNetwork, hostPID, and hostPath unless a task truly requires them.
• Minimize GUI access: remove dashboards and admin UIs; require authenticated API access.
• Verify platform binaries by comparing sha512sum to the published checksum before installing.

Verify a Downloaded Binary

# Compare against the official SHA512 on the release page
sha512sum kubernetes-server-linux-amd64.tar.gz

# Block a pod from reaching the cloud metadata service
# (add an egress rule that does NOT allow 169.254.169.254/32)