0PricingLogin▼
Cyber Security Academy · Lesson

Pod Security and Network Policies

Isolating workloads.

Isolating Workloads

Two controls limit what a compromised pod can do: Pod Security restricts a pod's privileges, and Network Policies restrict which pods can talk to each other. Together they contain blast radius.

  • Pod Security stops escapes to the node.
  • Network Policies stop lateral movement across pods.

Dangerous Pod Settings

Several pod spec fields dramatically widen risk if allowed.

  • privileged: true grants near-host access.
  • hostPID, hostNetwork, hostIPC break namespace isolation.
  • hostPath volumes mount node directories.
  • Added capabilities like SYS_ADMIN enable escape.
  • Running as root (runAsUser: 0).

All lessons in this course

  1. Kubernetes Threat Model
  2. RBAC and Service Accounts
  3. Pod Security and Network Policies
  4. Securing the Supply Chain and Secrets
← Back to Cyber Security Academy