KCSA — Pod & Network Security
Chapter 5 — Pod & Network Security
Welcome to Chapter 5 of the KCSA tutorial series. This chapter covers pod-level and network-level security controls — the mechanisms that protect your workloads once they are running inside a Kubernetes cluster.
KCSA Domain: Kubernetes Cluster Security — 22% weight
Pods are the smallest deployable units in Kubernetes, and the network is what connects them. Securing both is essential to prevent privilege escalation, lateral movement, and denial-of-service attacks within your cluster.
What You’ll Learn
This chapter is organized into 5 sub-topics that cover the full spectrum of pod and network security:
| # | Topic | Description |
|---|---|---|
| 1 | Pod Security Standards (PSS) | Privileged, Baseline, Restricted — the three levels |
| 2 | Pod Security Admission (PSA) | enforce, audit, warn modes for PSS enforcement |
| 3 | Security Contexts | runAsNonRoot, readOnlyRootFilesystem, capabilities, seccomp |
| 4 | Network Policies | Ingress/egress rules, default deny, namespace isolation |
| 5 | Resource Limits & DoS Prevention | Resource quotas, limit ranges, preventing resource abuse |
After completing all five topics, test your understanding with the Practice Questions.
Why Pod & Network Security Matters
In Kubernetes, every pod runs with a set of permissions and capabilities. Without proper controls:
- A compromised container can escalate privileges to root on the host node.
- An attacker can move laterally across namespaces using the default flat network.
- A rogue workload can consume all cluster resources, causing a denial of service.
Pod and network security controls are your inner perimeter — they limit the blast radius of any breach.
Key Concepts at a Glance
| Concept | Purpose | Key Resource |
|---|---|---|
| Pod Security Standards | Define security levels for pods | Built-in Kubernetes policy |
| Pod Security Admission | Enforce PSS at the namespace level | Admission controller |
| Security Contexts | Configure pod/container-level security | Pod spec fields |
| Network Policies | Control pod-to-pod network traffic | NetworkPolicy resource |
| Resource Limits | Prevent resource exhaustion | LimitRange, ResourceQuota |
Prerequisites
Before starting this chapter, make sure you have completed:
- Chapter 1 — Kubernetes Security Fundamentals
- Chapter 2 — Kubernetes API Security
- Chapter 3 — Kubernetes RBAC & Service Accounts
- Chapter 4 — Securing the Kubernetes Control Plane
A solid understanding of pods, namespaces, and RBAC is essential for the topics covered here.
Exam Relevance
The KCSA exam is a multiple-choice (MCQ) exam focused on conceptual understanding. For this chapter, expect questions on:
- Identifying the correct PSS level for a given scenario
- Understanding PSA mode behaviors (enforce vs. audit vs. warn)
- Knowing which security context fields prevent privilege escalation
- Understanding network policy selectors and AND/OR logic
- Differentiating between resource requests and limits
You do not need to write YAML from scratch, but you must be able to read and interpret it.
Ready to Begin?
Start with the first topic in this chapter:
