Kubernetes Least Privilege SecurityContexts for a Sensitive Application Pod

This tutorial demonstrates how to implement least privilege security contexts for a Kubernetes pod running a sensitive application. We’ll focus on minimizing the attack surface of the pod and controlling what the application process can do within the cluster.

Example 1: Baseline SecurityContext – Initial State

Let’s start with a simple pod definition that grants the application broad permissions. This will be our starting point for demonstrating the need for least privilege.

apiVersion: v1
kind: Pod
metadata:
  name: sensitive-app-pod
  labels:
    app: sensitive-app
spec:
  containers:
  - name: sensitive-app-container
    image: busybox
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo 'Hello, World!' >> /output.txt; sleep 1; done"]
    securityContext:
      privileged: false
    resources:
      limits:
        cpu: "100m"
        memory: "128Mi"
  restartPolicy: Always

kubectl apply -f sensitive-app-pod.yaml

After applying this manifest, you can describe the pod:

kubectl describe pod sensitive-app-pod

Notice that the container has `privileged: true`. This grants significant access, including the ability to access all devices and modify system configurations. This is highly discouraged for sensitive applications.

Example 2: Restricting Capabilities and User – Reducing Risk

Now, let’s reduce the risk by restricting the container’s capabilities and specifying a non-root user. This will limit the container’s ability to perform actions.

apiVersion: v1
kind: Pod
metadata:
  name: sensitive-app-pod-restricted
  labels:
    app: sensitive-app
spec:
  containers:
  - name: sensitive-app-container
    image: busybox
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo 'Hello, World!' >> /output.txt; sleep 1; done"]
    securityContext:
      runAsUser: 1000
      capabilities:
        drop:
          - ALL
    resources:
      limits:
        cpu: "100m"
        memory: "128Mi"
  restartPolicy: Always

kubectl apply -f sensitive-app-pod-restricted.yaml

Check the pod description again:

kubectl describe pod sensitive-app-pod-restricted

The `runAsUser` field now specifies user ID 1000, and `capabilities: drop: – ALL` removes all Linux capabilities from the container. This significantly reduces the potential damage if the container is compromised.

Example 3: Addressing a “Permission Denied” Error

Running the `sensitive-app-pod-restricted` pod, we might encounter a “Permission Denied” error when the container attempts to write to the `/output.txt` file. This is because the container is running as a non-root user without appropriate permissions on the host filesystem. We’ll correct this by specifying a volume mount that reflects the security context.

apiVersion: v1
kind: Pod
metadata:
  name: sensitive-app-pod-corrected
  labels:
    app: sensitive-app
spec:
  containers:
  - name: sensitive-app-container
    image: busybox
    command: ["/bin/sh"]
    args: ["-c", "while true; do echo 'Hello, World!' >> /output.txt; sleep 1; done"]
    securityContext:
      runAsUser: 1000
      capabilities:
        drop:
          - ALL
    volumeMounts:
    - name: output-volume
      mountPath: /output.txt
  restartPolicy: Always
  volumes:
  - name: output-volume
    emptyDir: {}

kubectl apply -f sensitive-app-pod-corrected.yaml

Now, the pod should run without the “Permission Denied” error. The `emptyDir` volume provides a dedicated space for the application’s output, ensuring the user has write access to it.

kubectl logs sensitive-app-pod-corrected

Verify that the application is writing to `/output.txt`. You should see the “Hello, World!” message repeated.