0Pricing
Cyber Security Academy · Lesson

Pod Security and Network Policies

Isolating workloads.

Pod Security and Network Policies is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Isolating Workloads

Two controls limit what a compromised pod can do: Pod Security restricts a pod's privileges, and Network Policies restrict which pods can talk to each other. Together they contain blast radius.

  • Pod Security stops escapes to the node.
  • Network Policies stop lateral movement across pods.

Dangerous Pod Settings

Several pod spec fields dramatically widen risk if allowed.

  • privileged: true grants near-host access.
  • hostPID, hostNetwork, hostIPC break namespace isolation.
  • hostPath volumes mount node directories.
  • Added capabilities like SYS_ADMIN enable escape.
  • Running as root (runAsUser: 0).

Pod Security Admission

Pod Security Admission (PSA) replaced PodSecurityPolicy. It enforces three built-in standards per namespace.

  • Privileged: unrestricted (avoid for workloads).
  • Baseline: blocks known privilege escalations.
  • Restricted: hardened best practice (non-root, no privilege, dropped caps).
# Enforce the restricted standard on a namespace
kubectl label namespace prod \
  pod-security.kubernetes.io/enforce=restricted

A Hardened securityContext

Define least-privilege at the pod and container level with a securityContext.

  • Run as a non-root user, read-only root filesystem.
  • Drop all Linux capabilities, then add only what is needed.
  • Disallow privilege escalation.
# securityContext fields (YAML)
# runAsNonRoot: true
# readOnlyRootFilesystem: true
# allowPrivilegeEscalation: false
# capabilities: drop: [ALL]
kubectl apply -f hardened-deploy.yaml

Beyond Standards: Policy Engines

For richer rules than PSA, admission controllers enforce custom policy.

  • OPA Gatekeeper evaluates Rego constraints.
  • Kyverno uses YAML policies and can mutate as well as validate.

These can ban hostPath, require signed images, or enforce labels cluster-wide.

# Apply a Kyverno policy that disallows privileged pods
kubectl apply -f disallow-privileged.yaml

Default-Open Networking

By default, all pods can reach all other pods across all namespaces. There is no segmentation until you add Network Policies. This flat network is why a single compromised pod can scan and attack the whole cluster.

# From a pod, the flat network lets you reach any service
curl http://internal-db.prod.svc.cluster.local:5432

Network Policy Basics

Network Policies are namespaced rules that select pods and allow specific ingress/egress. They are additive: applying any policy to a pod switches it to default-deny for the covered direction.

  • Selectors match pods by label.
  • Rules permit traffic from/to specific pods, namespaces, or CIDRs.
  • A CNI that supports policy (Calico, Cilium) is required.

Default-Deny Then Allow

The recommended pattern is a default-deny baseline per namespace, then explicit allow rules for required flows.

# Default-deny all ingress in a namespace (YAML)
# kind: NetworkPolicy spec: podSelector: {} policyTypes: [Ingress]
kubectl apply -f default-deny.yaml

# Then allow only frontend -> backend
kubectl apply -f allow-frontend.yaml

Egress and Metadata Blocking

Egress policies are just as important as ingress.

  • Restrict which external endpoints pods can reach (limits exfil and C2).
  • Block the cloud metadata IP 169.254.169.254 from pods to prevent node-credential theft.
  • Constrain DNS and internal east-west traffic.

Runtime Defense

Static policy is complemented by runtime detection.

  • Falco alerts on suspicious syscalls (shell in container, sensitive mounts).
  • seccomp profiles restrict the syscalls a container may make.
  • AppArmor/SELinux add mandatory access control on the node.
# Apply the runtime/default seccomp profile (securityContext)
# seccompProfile: type: RuntimeDefault
kubectl apply -f seccomp-deploy.yaml

Testing Isolation

When validating containment, attempt cross-pod connections and escape primitives from a test pod, confirming policies block them. Do this in a controlled namespace and remove test pods afterward.

Report any pod that runs privileged or any namespace lacking default-deny, with the exact manifest fix.

Quick Check

Confirm your isolation knowledge.

Recap

You learned to isolate workloads.

  • Pod Security Admission (restricted) and securityContext block escapes.
  • Gatekeeper/Kyverno enforce custom admission policy.
  • Networking is default-open; apply default-deny then explicit allows.
  • Egress rules, metadata blocking, and Falco add depth.

Next: securing the supply chain and secrets.

Frequently asked questions

Is the “Pod Security and Network Policies” lesson free?

Yes — the full text of “Pod Security and Network Policies” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Pod Security and Network Policies”?

Isolating workloads. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Pod Security and Network Policies” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Kubernetes Threat Model
  2. RBAC and Service Accounts
  3. Pod Security and Network Policies
  4. Securing the Supply Chain and Secrets
← Back to Cyber Security Academy