☸️ Secure Execution of Containers in Kubernetes Clusters

🌟 Objective

Ensure that the execution of containers in Kubernetes environments - applications, pipelines, sidecars or agents - takes place with explicit restrictions, technical enforcement and verifiable evidence, reducing risks such as:

• Execution with excessive privileges;
• Escalation of permissions at node level;
• Undue access to secrets, volumes or the network;
• Executions outside the organisational baseline.

Kubernetes provides mechanisms, not guarantees. Execution security depends on correct configuration, active enforcement and continuous verification.

---

🧬 What secure execution in Kubernetes means (in SbD-ToE)

In the SbD-ToE model, running containers securely in Kubernetes implies:

• Declaring execution restrictions (securityContext, PSA);
• Imposing those restrictions technically (admission control);
• Verifying that the real state of the pod matches what is expected;
• Maintaining traceability between decision, configuration and execution.

⚠️ A pod may be accepted by the cluster and still violate security expectations if the effective state is not verified.

---

⚠️ Configuration is not a guarantee of security

It is essential to avoid the implicit equivalence:

• ✔️ securityContext defined
• ❌ automatically secure execution

There are three distinct levels:

1. Platform capability What Kubernetes allows to be configured.
2. Declared configuration What is in the manifests.
3. Effective execution state What the pod actually applies at runtime.

This file explicitly addresses all three levels, not only the second.

---

📘 Applicable security mechanisms

Mechanism	Technical function	Inherent limitation
securityContext	Defines UID, capabilities, privileges	May be bypassed if poorly applied
Pod Security Standards	Pod acceptance baseline	Does not validate post-admission state
Kyverno / OPA (Gatekeeper)	Blocking of out-of-policy configurations	Does not assess contextual risk
NetworkPolicies	Traffic isolation	Requires complete coverage
RuntimeClass / Sandboxing	Reinforced isolation	Does not eliminate logical risk
Admission Webhooks	Pre-execution validation	Acts before runtime

---

🛠️ How to apply it correctly

1️⃣ Declare mandatory minimum restrictions

All pods must explicitly declare:

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

These declarations are necessary, but not sufficient.

---

2️⃣ Impose technical enforcement

• Enable Pod Security Admission (restricted or baseline);

• Apply policies via Kyverno or OPA to:

  • prohibit privileged: true;
  • block images from outside an authorised origin;
  • require traceability labels and metadata.

Enforcement reduces human error; it does not replace governance.

---

3️⃣ Verify the effective state at runtime

For critical workloads (L2/L3), it is necessary to:

• Confirm the effective UID of the process;
• Validate real mounts and permissions;
• Verify that the seccomp / AppArmor profile is active;
• Detect deviations (drift) after admission;
• Record evidence for audit.

Without this verification, security is merely assumed.

---

📂 Where to configure, version and observe

• Manifests in versioned Git repositories;
• Policies as code via GitOps;
• Admission and rejection logs preserved;
• Compliance and deviation metrics monitored;
• Execution evidence associated with the workload.

---

✅ Good practices

• Treat Kubernetes as an execution platform, not as an autonomous security barrier;

• Clearly separate:

  • configuration,
  • enforcement,
  • verification;

• Apply policies progressively (audit → enforce);

• Review permissions after cluster upgrades;

• Document exceptions as temporary and traceable decisions;

• Assume that configuration without observation is a hypothesis, not a fact.

---

📎 Cross-references

Document	Relation to execution in Kubernetes
02-runners-isolamento.md	Runners as ephemeral pods
04-hardening-containers.md	Restrictions applied to the runtime
05-policies-runtime-opa.md	Technical enforcement at admission
09-riscos-processo-imagens.md	Separation between intention and real state
15-aplicacao-lifecycle.md	Integration into the SSDLC

☁️ Kubernetes executes what it is asked to. Security exists only when what is executed matches what was consciously decided.