kubernetes

Training jobs need privileged-looking things: device access, big volumes, fast networking. Hardening is about granting exactly those and nothing else.

Everything in Kubernetes goes through the API server, so most attacks are about who can talk to it and with what rights. The rest is what a pod can do to its node and to its neighbours.

Most escapes are not clever kernel exploits. They are configuration that handed the container the host: a privileged flag, a mounted socket, a host path or a shared namespace.

Four open-source tools, four different questions: what happened, what is the state now, is this behaviour forbidden, and can the kernel stop it. Choosing well starts with knowing which question each answers.

RBAC decides who may create a pod; admission decides what kind of pod may exist. The scored answer layers the built-in options, handles webhook failure modes and remembers that the admission path is itself attack surface.

A workload migration coincides with a quiet alert dashboard. Trace inventory, sensor compatibility, event collection and policy mode before interpreting the drop as reduced risk.