Container, Kubernetes & IaC Security

Cloud-native workloads must be strictly isolated across container runtimes and Kubernetes clusters.

Security Baseline

• Multi-Stage Builds: Compile in builder stages and copy only runtime binaries to minimal base images.
• Non-Root Execution: Workloads execute explicitly as non-root users (USER 65532).
• Read-Only Root Filesystem: Immutability enforced with readOnlyRootFilesystem: true.
• NetworkPolicy Enforcement: Default-deny ingress/egress policies restricting east-west traffic.
• PodDisruptionBudgets: PDBs configured to guarantee availability during maintenance.

Canonical Source

• Container, Kubernetes & IaC Security