Improving application security with Pods

In a Kubernetes cluster, we can categorize the applications’ workloads distributed cluster-wide as either privileged or unprivileged. Privileged workloads should always be avoided for normal applications unless they are strictly necessary. In this section, we will help you define the security of your applications by declaring your requirements in your workload manifests.

Security contexts

In a security context, we define the privileges and security configuration required for a Pod or the containers included in it. Security contexts allow us to configure the following security features:

• runAsUser/runAsGroup: These options manage the userID and groupID properties that run the main process with containers. We can add more groups by using the supplementalGroups key.
• runAsNonRoot: This key can control whether we allow the process to run as root.
• fsGroup/fsGroupChangePolicy: These options manage the permissions of the...