What are the core concepts covered in Cloud & Kubernetes Security: CSPM & Threat Modeling?

The MITRE ATT&CK Matrix for Kubernetes: Initial Access, Execution, Persistence, Privilege Escalation, and Egress; Validating Admission Controllers: intercepting Kubernetes API requests before persisting to etcd; Writing policy-as-code guardrails with Kyverno to disallow root containers and hostPath volume mounts; Cryptographic container image signing and Software Bill of Materials (SBOM) verification using Sigstore `cosign`

Advanced 28 min readModule: Module 15: Cloud Security Posture & Kubernetes Threat Modeling

Cloud & Kubernetes Security: CSPM & Threat Modeling

Harden multi-tenant cloud and container infrastructure: the MITRE ATT&CK Matrix for Kubernetes, detecting misconfigurations with Cloud Security Posture Management (CSPM), enforcing security guardrails with Validating Admission Controllers (Kyverno / OPA Gatekeeper), and container supply chain security (cosign / SBOMs).

What You Will Learn in This Lesson

The MITRE ATT&CK Matrix for Kubernetes: Initial Access, Execution, Persistence, Privilege Escalation, and Egress
Validating Admission Controllers: intercepting Kubernetes API requests before persisting to etcd
Writing policy-as-code guardrails with Kyverno to disallow root containers and hostPath volume mounts
Cryptographic container image signing and Software Bill of Materials (SBOM) verification using Sigstore `cosign`

Introduction & Core Concept

Modern cloud security breaches rarely stem from 0-day exploits; over 80% occur due to infrastructure misconfigurations (over-privileged IAM roles, public S3 buckets, privileged Kubernetes containers with host access). Cloud Security Posture Management (CSPM) continuously audits cloud resources against CIS Benchmarks, while Kubernetes Admission Controllers enforce immutable policy guardrails that prevent insecure workloads from ever running.

WHY DOES THIS MATTER IN THE REAL WORLD?

Attackers compromising a single pod can access the host root filesystem or the cloud provider instance metadata service if Admission Controllers and CSPM guardrails are not strictly enforced.

Syntax & Structure

yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-root-user
spec:
  validationFailureAction: Enforce

Kyverno Policy-as-Code Enforcing Non-Root Containers and Disallowing hostPath

yaml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# Kyverno Policy Guardrail: Prevent Privileged Containers & HostPath Volume Mounts
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-pod-security-standards
spec:
  validationFailureAction: Enforce # Rejects non-compliant pods immediately!
  background: true
  rules:
    # Rule 1: Disallow Root User Execution
    - name: require-run-as-non-root
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Running containers as root (UID 0) is strictly forbidden for security compliance."
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true
            containers:
              - securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                      - ALL
    # Rule 2: Disallow dangerous hostPath mounts (prevents host filesystem takeover)
    - name: disallow-host-path
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "hostPath volume mounts are prohibited. Use CSI PersistentVolumes."
        pattern:
          spec:
            =(volumes):
              - X(hostPath): null

Line-by-Line Technical Breakdown

1Software Supply Chain Security (Sigstore & Cosign): Developers sign container images using ephemeral OIDC tokens (`cosign sign`). The Kubernetes admission controller verifies the signature and SBOM (CycloneDX / SPDX) before pulling the image, ensuring untrusted third-party images cannot execute.

Try It Yourself (Interactive Editor)

Modify the code in real-time and click Run to test live browser output and console logs.

Intelligent Code Runner & Live Sandbox[YAML]

YAML SOURCE EDITOR

Interactive Live Code

# Kyverno Policy Guardrail: Prevent Privileged Containers & HostPath Volume Mounts
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: enforce-pod-security-standards
spec:
  validationFailureAction: Enforce # Rejects non-compliant pods immediately!
  background: true
  rules:
    # Rule 1: Disallow Root User Execution
    - name: require-run-as-non-root
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "Running containers as root (UID 0) is strictly forbidden for security compliance."
        pattern:
          spec:
            securityContext:
              runAsNonRoot: true
            containers:
              - securityContext:
                  allowPrivilegeEscalation: false
                  capabilities:
                    drop:
                      - ALL
    # Rule 2: Disallow dangerous hostPath mounts (prevents host filesystem takeover)
    - name: disallow-host-path
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        message: "hostPath volume mounts are prohibited. Use CSI PersistentVolumes."
        pattern:
          spec:
            =(volumes):
              - X(hostPath): null

>[YAML Runtime Initialized]

>Program compiled and executed with 0 errors.

>Output generated successfully.

Common Mistakes & How to Avoid Them

#1: Mounting the host Docker socket (`/var/run/docker.sock` or `containerd.sock`) inside application containers.

Mounting the container runtime socket gives container processes direct control over the host daemon, allowing instant root escape.

Incorrect / Antipattern

volumeMounts:
  - mountPath: /var/run/docker.sock
    name: docker-sock # Instant root host compromise!

Correct / Professional Solution

// Use isolated rootless builders like Kaniko or Buildah without host socket mounts

Industry Best Practices & Professional Standards

Enforce Kubernetes Pod Security Standards at the `restricted` profile level.
Deploy Kyverno or OPA Gatekeeper to automate policy-as-code enforcement.
Sign all production container images using Sigstore `cosign` and generate automated SBOMs.

Lesson Summary & Core Takeaways

CSPM continuously audits cloud infrastructure against misconfigurations.
Kubernetes Admission Controllers enforce zero-trust security guardrails before pod creation.
Disallowing root execution, dropping capabilities, and signing container images harden the cloud supply chain.