A platform team wants to ensure a compromised application Pod cannot read Secrets from other namespaces via the Kubernetes API server. Which two controls together best limit this exposure?

Question

Accepted Answer

B. Bind the Pod ServiceAccount to a minimal RBAC role and apply NetworkPolicy restricting Pod egress to the API server. Combining minimal RBAC permissions on the ServiceAccount with NetworkPolicy that limits which Pods can reach the API server reduces both the blast radius of a compromise and the overall attack surface. Option c would break many Kubernetes features that rely on ServiceAccounts for legitimate cluster operations. Option d manages availability, not access control.

A platform team wants to ensure a compromised application Pod cannot read Secrets from other namespaces via the Kubernetes API server. Which two controls together best limit this exposure?

Related Questions

Discussion