CKAD — Security Contexts

Application Security in Kubernetes

Security is the largest CKAD domain at 25%. You need to understand how to run containers securely — controlling user IDs, capabilities, filesystem access, and API authentication with ServiceAccounts.

This chapter covers SecurityContexts, Linux capabilities, and ServiceAccounts from the Application Environment, Configuration & Security domain.

Security Contexts

A SecurityContext defines privilege and access control settings for a Pod or container. You can control:

• Which user/group runs the process
• Whether the filesystem is read-only
• Whether the container runs as root
• Which Linux capabilities are added or dropped
• Whether privilege escalation is allowed

Pod-Level vs Container-Level

Level	Applies To	Example
Pod-level	All containers in the Pod	runAsUser, runAsGroup, fsGroup
Container-level	Specific container	capabilities, readOnlyRootFilesystem, allowPrivilegeEscalation

Container-level settings override Pod-level settings.

Pod-Level Security Context

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  containers:
  - name: app
    image: busybox:1.36
    command: ["/bin/sh", "-c", "id && ls -la /data && sleep 3600"]
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    emptyDir: {}

kubectl apply -f secure-pod.yaml
kubectl logs secure-pod
# Expected:
# uid=1000 gid=3000 groups=2000
# drwxrwsrwx 2 root 2000 4096 ... /data

Field	Description
runAsUser	UID to run the container process as
runAsGroup	Primary GID for the process
fsGroup	GID applied to all mounted volumes

Container-Level Security Context

apiVersion: v1
kind: Pod
metadata:
  name: restricted-pod
spec:
  securityContext:
    runAsUser: 1000
    runAsNonRoot: true
  containers:
  - name: app
    image: nginx:1.27
    securityContext:
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: cache
      mountPath: /var/cache/nginx
    - name: run
      mountPath: /var/run
  volumes:
  - name: tmp
    emptyDir: {}
  - name: cache
    emptyDir: {}
  - name: run
    emptyDir: {}

Key Security Settings

Setting	Description	Recommended
runAsNonRoot: true	Container must run as non-root user	Yes
readOnlyRootFilesystem: true	Root filesystem is read-only	Yes
allowPrivilegeEscalation: false	Process cannot gain more privileges	Yes
capabilities.drop: [ALL]	Remove all Linux capabilities	Yes
privileged: false	Do not run in privileged mode	Yes (default)

Exam tip: The secure pattern is: drop ALL capabilities, add only what you need, run as non-root, read-only filesystem. Learn this pattern — it appears frequently in CKAD questions.

---

Next: Linux Capabilities →