Lesson 4.15: Network policies and secrets
Inside a Kubernetes cluster, every pod can talk to every other pod by default, so one compromised pod can reach the database, the cache and every internal API. NetworkPolicies restrict that, like a firewall around each workload. And Kubernetes Secrets are only base64-encoded, not encrypted: anyone allowed to read them has the password. In the lab you find no network policies at all in the shop namespace, decode the database password from a Secret, discover that every developer can read it, narrow their role, and apply a default-deny policy with explicit allows.
17 min
You will learn to
- Explain Kubernetes' default network behaviour
- Write default-deny and allow policies
- Explain why Secrets are not encrypted by base64
- Find who can read Secrets
- Describe encryption at rest and external secret stores
Key terms
- NetworkPolicy
- Rules selecting pods by label and allowing specific ingress/egress traffic; anything not allowed is denied once a policy selects the pod.
- Default deny
- A policy with an empty podSelector and no rules, blocking all traffic of that type in the namespace.
- Kubernetes Secret
- An object for sensitive data, stored base64-encoded in the cluster database (etcd).
- External secrets
- Keeping secrets in a manager outside the cluster and syncing or mounting them at runtime.
- Lateral movement
- Moving from one compromised system to others.
← Zeek connection logs · All lessons · Public-key cryptography and SSH keys →