Zero-Trust Networking in Kubernetes
Implement network policies, service mesh mTLS, and RBAC best practices. From cluster hardening to workload identity.
Network Policies
By default, every pod in Kubernetes can communicate with every other pod. Network Policies are the firewall rules of Kubernetes — start with a default deny-all policy and explicitly allow required traffic.
Use Calico or Cilium for the CNI plugin. Define ingress policies per namespace and egress policies for external access. Label-based selectors are more maintainable than IP-based rules.
apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: default-deny-all spec: podSelector: {} # Matches all pods policyTypes: - Ingress - Egress
Service Mesh mTLS
Istio or Linkerd provides automatic mutual TLS between all services. This encrypts all in-cluster traffic and provides cryptographic identity for each workload without code changes.
Enable strict mTLS mode on all namespaces. Use PeerAuthentication resources to enforce the policy and DestinationRule resources to configure TLS settings per service.
RBAC Best Practices
Follow the principle of least privilege. Create Roles (namespaced) instead of ClusterRoles. Bind users to groups, and groups to roles — never bind roles directly to users.
Audit RBAC with kubectl auth can-i --list and tools like rakkess. Implement admission controllers to prevent privilege escalation and enforce security baselines.
| Aspect | Role | ClusterRole |
|---|---|---|
| Scope | Namespace | Cluster-wide |
| Risk | Low | High |
| Use Case | App team access | Platform team / CRDs |
| Binding | RoleBinding | ClusterRoleBinding |
| Recommended | ✅ Default choice | ⚠️ Use sparingly |