Summary
- Defense-in-depth Kubernetes security through network policies, pod security standards, RBAC, and admission control.
- Covers three pod security levels (Privileged, Baseline, Restricted) enforced via namespace labels for graduated security posture Provides NetworkPolicy templates for default-deny, service-to-service communication, and DNS egress patterns Includes RBAC configuration examples for roles, cluster roles, and bindings to implement least-privilege access Demonstrates OPA Gatekeeper constraint templates and Istio mTLS/AuthorizationPolicy for policy enforcement and service mesh security References CIS Kubernetes Benchmark and NIST Cybersecurity Framework compliance patterns with troubleshooting commands for NetworkPolicy and RBAC validation