Minimize Microservice Vulnerabilities
Microservice security is largely about Pod Security Standards (PSS) and secure Pod specifications. PSS defines three levels: privileged (unrestricted), baseline (blocks known privilege escalations), and restricted (heavily hardened). Enforce them with namespace labels: pod-security.kubernetes.io/enforce, plus the audit and warn variants, each set to the level name.
Know what restricted requires: runAsNonRoot: true, allowPrivilegeEscalation: false, capabilities dropped to ALL with only NET_BIND_SERVICE optionally added, seccompProfile.type RuntimeDefault or Localhost, and a restricted set of volume types. Baseline blocks privileged containers, hostNetwork, hostPID, hostIPC, and hostPath volumes.
Also understand secrets handling and isolation: mount Secrets as volumes rather than environment variables where practical, enable encryption at rest for Secrets, and use mTLS through a service mesh. Sandboxed runtimes such as gVisor or Kata Containers, selected through RuntimeClass, reduce kernel attack surface for untrusted workloads.
Traps: forgetting that a Pod violating an enforced level is rejected at admission, not at runtime; assuming restricted still allows hostPath; and setting runAsUser: 0 while runAsNonRoot: true, which admission rejects.
Worked example: for a restricted namespace, every container needs allowPrivilegeEscalation: false and capabilities.drop: [ALL], and the Pod needs securityContext.runAsNonRoot: true with seccompProfile.type: RuntimeDefault.