> For the complete documentation index, see [llms.txt](https://dinush-chathurya.gitbook.io/kustomize-e-book/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dinush-chathurya.gitbook.io/kustomize-e-book/production-ready-practices/12-security-best-practices.md).

# Security Best Practices

Securing your Kubernetes deployments is non-negotiable in production. Kustomize helps you enforce security policies declaratively. In this chapter, we’ll cover critical security controls and patterns to harden your manifests and clusters.

***

## Why Security Matters

* Prevent unauthorized access and breaches
* Ensure compliance with regulatory standards
* Reduce blast radius of misconfigurations
* Build trust with customers and stakeholders

***

## 1. Least-Privilege RBAC

Define minimal permissions for each role:

```yaml
# overlays/prod/patches/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
rules:
  - apiGroups: [""]
    resources: ["pods", "services"]
    verbs: ["get", "list", "watch"]
```

Reference in your overlay:

```yaml
# overlays/prod/kustomization.yaml
resources:
  - ../../base
  - patches/rbac.yaml
```

✅ Tip: Use `RoleBinding` scoped to \`\`namespaces`; use` ClusterRoleBinding\` only when necessary.

## 2. Secrets Management

Never commit plain-text secrets. Instead, use:

* **Sealed Secrets**
* **External Secrets Operator**
* **Vault CSI Driver**

Example with SealedSecrets:

```yaml
# base/kustomization.yaml
resources:
  - sealed-secret.yaml   # encrypted secret CR
```

In overlays, merge additional literals:

```yaml
# overlays/prod/kustomization.yaml
secretGenerator:
  - name: app-secret
    literals:
      - API_KEY=${API_KEY}
    behavior: merge
```

## 3. Pod Security Standards & Contexts

Enforce security contexts in your base:

```yaml
# base/deployment.yaml (snippet)
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
      containers:
        - name: my-app
          securityContext:
            allowPrivilegeEscalation: false
```

Use Pod Security Admission or Gatekeeper for cluster-wide enforcement.

## 4. Network Policies

Lock down traffic between pods:

```yaml
# base/networkpolicy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-app-traffic
spec:
  podSelector:
    matchLabels:
      app: my-app
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              role: frontend
```

Include in your base:

```yaml
# base/kustomization.yaml
resources:
  - networkpolicy.yaml
```

## 5. Image Security

* **Scan images** for vulnerabilities before deployment
* **Use signed images** (e.g., Docker Content Trust)
* **Pin image digests**:

```yaml
# overlays/prod/patches/image-digest.yaml
spec:
  template:
    spec:
      containers:
        - name: my-app
          image: my-app@sha256:abcdef123456...
```

## 6. Policy Enforcement (OPA/Gatekeeper)

Deploy policies to enforce compliance:

```yaml
# base/constraint.yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPAllowPrivilegeEscalationContainer
metadata:
  name: disallow-priv-escalation
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
```

Install CRDs and constraints via your base `kustomization.yaml`

## 7. Audit & Logging

Enable Kubernetes audit logging\
Centralize logs (e.g., ELK, Datadog)\
Use `kubectl diff` and `--dry-run` in CI to catch unsafe changes:

```bash
kustomize build overlays/prod | kubectl apply --dry-run=server -f -
```

## Summary

Implementing security best practices—least-privilege RBAC, robust secrets management, Pod Security Standards, network policies, image signing, and policy enforcement—ensures your Kustomize-driven GitOps workflows remain secure, compliant, and production-ready.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://dinush-chathurya.gitbook.io/kustomize-e-book/production-ready-practices/12-security-best-practices.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.