Cortex LogoCortex Charts
Version: 6.4.1

Kubernetes Security

This section provides general information on security settings for Kubernetes clusters.

Lock Down Kubernetes Namespaces

  1. Install the PodSecurity admission webhook into Kubernetes https://kubernetes.io/docs/concepts/security/pod-security-admission/#webhook (Available in Kubernetes v1.22+)

  2. Add the labels to enforce security policies for pods launched into a namespace (Policy values are: baseline, privileged, or restricted)

    Example

    NS=cortex
    kubectl label namespace ${NS} pod-security.kubernetes.io/enforce=baseline \
      pod-security.kubernetes.io/enforce-version=latest \
      pod-security.kubernetes.io/warn=baseline \
      pod-security.kubernetes.io/warn-version=latest