Pod Security and Observability

6 pages · ~4 min✓ Reviewed

Builds on NetworkPolicies. Next up: Helm and Kustomize.

KubernetesPage 1

securityContext: Hardening a Pod

1. What securityContext Is

securityContext sets privilege and access controls
Pod-level spec.securityContext applies to all containers
Container-level setting overrides the pod-level one

2. Users and Filesystem

Field	Effect	Level
`runAsNonRoot`	kubelet refuses a UID 0 image	either
`runAsUser` / `runAsGroup`	set the UID / GID	either
`fsGroup`	group owner of mounted volumes	pod only
`readOnlyRootFilesystem`	blocks writes to container FS	container

runAsNonRoot: true only checks, it never changes the user
Root image fails: CreateContainerConfigError
To pass: set runAsUser to a non-zero UID or use a non-root USER in the image
Read-only root: mount an emptyDir at /tmp for write paths

3. Lock Down the Container

yaml

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
    add: ["NET_BIND_SERVICE"]

drop ALL first, add back only what is needed

KubernetesPage 2

Pod Security Standards and Admission

KubernetesPage 3

metrics-server and kubectl top

KubernetesPage 4

Logs and Events

KubernetesPage 5

Prometheus Basics and Cheat Sheet

KubernetesPage 6

Level	Meaning
`privileged`	Unrestricted
`baseline`	Blocks known escalations: `hostNetwork`, `privileged`, `hostPath`
`restricted`	Hardened: non-root, drop `ALL`, seccomp `RuntimeDefault`

Mode	Effect
`enforce`	Rejects the Pod
`audit`	Logs to the audit log
`warn`	Shows the user a warning

Value	Unit	Reads as
CPU	millicores	`250m` = 0.25 core
Memory	`Mi`	mebibytes in use
Both	recent average	brief spikes are missed

	Logs	Events
Answer	What the app said	What Kubernetes did
Command	`kubectl logs`	`describe` / `get events`

Type	Behaviour	Use
Counter	only increases	`rate()`
Gauge	up and down	read directly
Histogram	buckets	`histogram_quantile`

Pod Security and Observability

securityContext: Hardening a Pod

1. What securityContext Is

2. Users and Filesystem

3. Lock Down the Container

Pod Security Standards and Admission

metrics-server and kubectl top

Logs and Events

Prometheus Basics and Cheat Sheet

Check yourself

1. The Three PSS Levels

2. Pod Security Admission

3. Rollout and Limits

1. What metrics-server Is

2. Reading kubectl top

3. When It Fails

1. kubectl logs

2. Events

1. Scraping and Metric Types

2. Discovery and PromQL

3. Cheat Sheet

Topic	Remember
securityContext	`runAsNonRoot` + `readOnlyRootFilesystem` + drop ALL
runAsNonRoot	needs non-zero `runAsUser` or image `USER`
PSA	namespace label enforce / audit / warn
`kubectl top`	now
`logs --previous`	crash
events	k8s actions
Prometheus	history