Securing a Cluster

Protect the token and API, restrict traffic with NetworkPolicies, and run the CIS hardening options.

A small cluster still needs sensible security, especially at the edge where machines may be physically exposed.

Practical steps

  • Guard the node token and the kubeconfig — they grant full access.
  • Limit which IPs can reach the API server on port 6443.
  • Use NetworkPolicies to control Pod-to-Pod traffic (k3s supports them out of the box).
  • Use RBAC to give users and apps only the permissions they need.
  • For regulated environments, run k3s in its CIS hardened mode with the --secrets-encryption and admission-control options.

Example

Example · yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
spec:
  podSelector: {}
  policyTypes:
    - Ingress
# Denies all incoming Pod traffic until you allow specific flows

When to use it

  • A security team restricts the k3s API server to internal IPs using a firewall rule so the Kubernetes API is never reachable from the public internet.
  • An operator applies a NetworkPolicy that denies all cross-namespace traffic by default, allowing only explicitly declared pod-to-pod communication.
  • A compliance team enables the CIS hardening profile in k3s to pass an automated benchmark scan before a SOC 2 audit.

More examples

Restrict API access with firewall

Uses ufw to whitelist the internal management subnet for port 6443 and block all other access to the k3s API server.

Example · bash
# Allow only internal subnet to reach API server port 6443:
ufw allow from 192.168.1.0/24 to any port 6443
ufw deny 6443
ufw enable

Default-deny NetworkPolicy

Applies a default-deny policy to the production namespace so no pod can send or receive traffic unless explicitly allowed.

Example · yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

Enable CIS hardening profile

Installs k3s with kernel protection and secret encryption enabled as part of a CIS-aligned hardening configuration.

Example · bash
curl -sfL https://get.k3s.io | \
  INSTALL_K3S_EXEC='--protect-kernel-defaults=true \
  --secrets-encryption=true' sh -
kubectl get apiserver -o yaml | grep -i audit

Related

k3s node tokenk3s resource tuning

Discussion

  • Be the first to comment on this lesson.