# Security

> Concepts for keeping your cloud-native workload secure.

---

LLMS index: [llms.txt](/llms.txt)

---

This section of the Kubernetes documentation aims to help you learn to run
workloads more securely, and about the essential aspects of keeping a
Kubernetes cluster secure.

Kubernetes is based on a cloud-native architecture, and draws on advice from the
<a class='glossary-tooltip' title='Cloud Native Computing Foundation' data-bs-toggle='tooltip' data-bs-placement='top' href='https://cncf.io/' target='_blank' aria-label='CNCF'>CNCF</a> about good practice for
cloud native information security.

Read [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)
for the broader context about how to secure your cluster and the applications that
you're running on it.

## Kubernetes security mechanisms {#security-mechanisms}

Kubernetes includes several APIs and security controls, as well as ways to
define [policies](#policies) that can form part of how you manage information security.

### Control plane protection

A key security mechanism for any Kubernetes cluster is to
[control access to the Kubernetes API](/docs/concepts/security/controlling-access).

Kubernetes expects you to configure and use TLS to provide
[data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/)
within the control plane, and between the control plane and its clients.
You can also enable [encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
for the data stored within Kubernetes control plane; this is separate from using
encryption at rest for your own workloads' data, which might also be a good idea.

### Secrets

The [Secret](/docs/concepts/configuration/secret/) API provides basic protection for
configuration values that require confidentiality.

### Workload protection

Enforce [Pod security standards](/docs/concepts/security/pod-security-standards/) to
ensure that Pods and their containers are isolated appropriately. You can also use
[RuntimeClasses](/docs/concepts/containers/runtime-class) to define custom isolation
if you need it.

[Network policies](/docs/concepts/services-networking/network-policies/) let you control
network traffic between Pods, or between Pods and the network outside your cluster.

You can deploy security controls from the wider ecosystem to implement preventative
or detective controls around Pods, their containers, and the images that run in them.

### Admission control {#admission-control}

[Admission controllers](/docs/reference/access-authn-authz/admission-controllers/)
are plugins that intercept Kubernetes API requests and can validate or mutate
the requests based on specific fields in the request. Thoughtfully designing
these controllers helps to avoid unintended disruptions as Kubernetes APIs
change across version updates. For design considerations, see
[Admission Webhook Good Practices](/docs/concepts/cluster-administration/admission-webhooks-good-practices/).

### Auditing

Kubernetes [audit logging](/docs/tasks/debug/debug-cluster/audit/) provides a
security-relevant, chronological set of records documenting the sequence of actions
in a cluster. The cluster audits the activities generated by users, by applications
that use the Kubernetes API, and by the control plane itself.

## Cloud provider security

<div class="alert alert-secondary callout third-party-content" role="note"><strong>Note:</strong>&puncsp;Items on this page refer to vendors external to Kubernetes. The Kubernetes project authors aren't responsible for those third-party products or projects. To add a vendor, product or project to this list, read the <a href="/docs/contribute/style/content-guide/#third-party-content">content guide</a> before submitting a change. <a href="#third-party-content-disclaimer">More information.</a></div>


If you are running a Kubernetes cluster on your own hardware or a different cloud provider,
consult your documentation for security best practices.
Here are links to some of the popular cloud providers' security documentation:



 





<table><caption style="display: none;">Cloud provider security</caption>
	<thead>
			<tr>
					<th>IaaS Provider</th>
					<th>Link</th>
			</tr>
	</thead>
	<tbody>
			<tr>
					<td>Alibaba Cloud</td>
					<td><a href="https://www.alibabacloud.com/trust-center">https://www.alibabacloud.com/trust-center</a></td>
			</tr>
			<tr>
					<td>Amazon Web Services</td>
					<td><a href="https://aws.amazon.com/security">https://aws.amazon.com/security</a></td>
			</tr>
			<tr>
					<td>Google Cloud Platform</td>
					<td><a href="https://cloud.google.com/security">https://cloud.google.com/security</a></td>
			</tr>
			<tr>
					<td>Huawei Cloud</td>
					<td><a href="https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety">https://www.huaweicloud.com/intl/en-us/securecenter/overallsafety</a></td>
			</tr>
			<tr>
					<td>IBM Cloud</td>
					<td><a href="https://www.ibm.com/cloud/security">https://www.ibm.com/cloud/security</a></td>
			</tr>
			<tr>
					<td>Microsoft Azure</td>
					<td><a href="https://docs.microsoft.com/en-us/azure/security/azure-security">https://docs.microsoft.com/en-us/azure/security/azure-security</a></td>
			</tr>
			<tr>
					<td>Oracle Cloud Infrastructure</td>
					<td><a href="https://www.oracle.com/security">https://www.oracle.com/security</a></td>
			</tr>
			<tr>
					<td>Tencent Cloud</td>
					<td><a href="https://www.tencentcloud.com/solutions/data-security-and-information-protection">https://www.tencentcloud.com/solutions/data-security-and-information-protection</a></td>
			</tr>
			<tr>
					<td>VMware vSphere</td>
					<td><a href="https://www.vmware.com/solutions/security/hardening-guides">https://www.vmware.com/solutions/security/hardening-guides</a></td>
			</tr>
	</tbody>
</table>


## Policies

You can define security policies using Kubernetes-native mechanisms,
such as [NetworkPolicy](/docs/concepts/services-networking/network-policies/)
(declarative control over network packet filtering) or
[ValidatingAdmissionPolicy](/docs/reference/access-authn-authz/validating-admission-policy/) (declarative restrictions on what changes
someone can make using the Kubernetes API).

However, you can also rely on policy implementations from the wider
ecosystem around Kubernetes. Kubernetes provides extension mechanisms
to let those ecosystem projects implement their own policy controls
on source code review, container image approval, API access controls,
networking, and more.

For more information about policy mechanisms and Kubernetes,
read [Policies](/docs/concepts/policy/).

## What's next

Learn about related Kubernetes security topics:

* [Securing your cluster](/docs/tasks/administer-cluster/securing-a-cluster/)
* [Known vulnerabilities](/docs/reference/issues-security/official-cve-feed/)
  in Kubernetes (and links to further information)
* [Data encryption in transit](/docs/tasks/tls/managing-tls-in-a-cluster/) for the control plane
* [Data encryption at rest](/docs/tasks/administer-cluster/encrypt-data/)
* [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access)
* [Network policies](/docs/concepts/services-networking/network-policies/) for Pods
* [Secrets in Kubernetes](/docs/concepts/configuration/secret/)
* [Pod security standards](/docs/concepts/security/pod-security-standards/)
* [RuntimeClasses](/docs/concepts/containers/runtime-class)

Learn the context:

<!-- if changing this, also edit the front matter of content/en/docs/concepts/security/cloud-native-security.md to match; check the no_list setting -->
* [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/)

Get certified:

* [Certified Kubernetes Security Specialist](https://training.linuxfoundation.org/certification/certified-kubernetes-security-specialist/)
  certification and official training course.

Read more in this section:

---

Section pages:

- [Cloud Native Security and Kubernetes](/docs/concepts/security/cloud-native-security/): Concepts for keeping your cloud native workload secure.
- [Pod Security Standards](/docs/concepts/security/pod-security-standards/): A detailed look at the different policy levels defined in the Pod Security Standards.
- [Pod Security Admission](/docs/concepts/security/pod-security-admission/): An overview of the Pod Security Admission Controller, which can enforce the Pod Security Standards.
- [Service Accounts](/docs/concepts/security/service-accounts/): Learn about ServiceAccount objects in Kubernetes.
- [Pod Security Policies](/docs/concepts/security/pod-security-policy/)
- [Security For Linux Nodes](/docs/concepts/security/linux-security/)
- [Security For Windows Nodes](/docs/concepts/security/windows-security/)
- [Controlling Access to the Kubernetes API](/docs/concepts/security/controlling-access/)
- [Role Based Access Control Good Practices](/docs/concepts/security/rbac-good-practices/): Principles and practices for good RBAC design for cluster operators.
- [Good practices for Kubernetes Secrets](/docs/concepts/security/secrets-good-practices/): Principles and practices for good Secret management for cluster administrators and application developers.
- [Multi-tenancy](/docs/concepts/security/multi-tenancy/)
- [Hardening Guide - Authentication Mechanisms](/docs/concepts/security/hardening-guide/authentication-mechanisms/): Information on authentication options in Kubernetes and their security properties.
- [Hardening Guide - Dynamic Resource Allocation](/docs/concepts/security/hardening-guide/dynamic-resource-allocation/): Information about hardening Dynamic Resource Allocation (DRA) authorization and access patterns.
- [Hardening Guide - Scheduler Configuration](/docs/concepts/security/hardening-guide/scheduler/): Information about how to make the Kubernetes scheduler more secure.
- [Kubernetes API Server Bypass Risks](/docs/concepts/security/api-server-bypass-risks/): Security architecture information relating to the API server and other components
- [Linux kernel security constraints for Pods and containers](/docs/concepts/security/linux-kernel-security-constraints/): Overview of Linux kernel security modules and constraints that you can use to harden your Pods and containers.
- [Security Checklist](/docs/concepts/security/security-checklist/): Baseline checklist for ensuring security in Kubernetes clusters.
- [Application Security Checklist](/docs/concepts/security/application-security-checklist/): Baseline guidelines around ensuring application security on Kubernetes, aimed at application developers