Cheat SheetsKubernetesSecurity

Security — Cheat Sheet

Kubernetes · 1 topics. Download the PDF or the Instagram carousel and share it.

Cheat Sheet · AiCanCode.org
Security
Kubernetes1 topicsQuick revision reference
1

Namespaces & RBAC

Namespaces provide logical isolation within a cluster. RBAC (Role-Based Access Control) controls who can do what to which resources — the foundation of multi-team Kubernetes security.

  • ✓Namespaces provide logical isolation, per-namespace quotas, and scoped RBAC.
  • ✓Cross-namespace service access uses full DNS: service.namespace.svc.cluster.local.
  • ✓Role is namespace-scoped; ClusterRole applies cluster-wide (useful for non-namespaced resources).
  • ✓RoleBinding grants a Role to a user or ServiceAccount within a namespace.
  • ✓Every pod runs under a ServiceAccount — use dedicated SAs with minimal permissions, not the default SA.
  • ✓kubectl auth can-i is the fastest way to check if a user or SA has a specific permission.
Namespaces and ResourceQuota
# Built-in namespaces:

# default        → where resources go without explicit namespace

# kube-system    → Kubernetes system components (CoreDNS, kube-proxy)

# kube-public    → publicly readable cluster info

# kube-node-lease → node heartbeat leases



kubectl get namespaces



# Create namespace

kubectl create namespace production

kubectl create namespace staging



# Set default namespace for current context (avoid typing -n every time)

kubectl config set-context --current --namespace=production



# Namespace in resource manifests

metadata:

  name: my-app

  namespace: production



# Cross-namespace service DNS:

# Service in production: my-api.production.svc.cluster.local

# Service in staging:    my-api.staging.svc.cluster.local



# Resource Quotas — limit resources per namespace

apiVersion: v1

kind: ResourceQuota

metadata:

  name: production-quota

  namespace: production

spec:

  hard:

    requests.cpu: "10"

    requests.memory: 20Gi

    limits.cpu: "20"

    limits.memory: 40Gi

    pods: "50"

    services: "10"

    secrets: "20"
Learn this free with Aria, your AI tutor → AiCanCode.org/learn/kubernetes