Further reading
You may have noticed that some of the security control mechanisms we talked about in this chapter have been around for a long time: SELinux Multi-Category Security/Multi-Level Security (MCS/MLS), AppArmor, seccomp, Linux capabilities, and so on. There are already many books or articles introducing these technologies. I would encourage you to take a look at the following materials for a better understanding of how to use them to achieve the least privilege goal in Kubernetes:
- SELinux MCS: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/sec-mcs-getstarted
- AppArmor: https://ubuntu.com/server/docs/security-apparmor
- Linux capabilities: http://man7.org/linux/man-pages/man7/capabilities.7.html
- Help defining RBAC privilege grants: https://github.com/liggitt/audit2rbac