Securing a Cluster
Protect the token and API, restrict traffic with NetworkPolicies, and run the CIS hardening options.
A small cluster still needs sensible security, especially at the edge where machines may be physically exposed.
Practical steps
- Guard the node token and the kubeconfig — they grant full access.
- Limit which IPs can reach the API server on port
6443. - Use NetworkPolicies to control Pod-to-Pod traffic (k3s supports them out of the box).
- Use RBAC to give users and apps only the permissions they need.
- For regulated environments, run k3s in its CIS hardened mode with the
--secrets-encryptionand admission-control options.
Example
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes:
- Ingress
# Denies all incoming Pod traffic until you allow specific flowsWhen to use it
- A security team restricts the k3s API server to internal IPs using a firewall rule so the Kubernetes API is never reachable from the public internet.
- An operator applies a NetworkPolicy that denies all cross-namespace traffic by default, allowing only explicitly declared pod-to-pod communication.
- A compliance team enables the CIS hardening profile in k3s to pass an automated benchmark scan before a SOC 2 audit.
More examples
Restrict API access with firewall
Uses ufw to whitelist the internal management subnet for port 6443 and block all other access to the k3s API server.
# Allow only internal subnet to reach API server port 6443:
ufw allow from 192.168.1.0/24 to any port 6443
ufw deny 6443
ufw enableDefault-deny NetworkPolicy
Applies a default-deny policy to the production namespace so no pod can send or receive traffic unless explicitly allowed.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: production
spec:
podSelector: {}
policyTypes:
- Ingress
- EgressEnable CIS hardening profile
Installs k3s with kernel protection and secret encryption enabled as part of a CIS-aligned hardening configuration.
curl -sfL https://get.k3s.io | \
INSTALL_K3S_EXEC='--protect-kernel-defaults=true \
--secrets-encryption=true' sh -
kubectl get apiserver -o yaml | grep -i audit
Discussion