Kubernetes Security Fundamentals
The Kubernetes Security Fundamentals domain tests the request pipeline - who you are, what you may do, and what the cluster refuses to run - plus the workload fields that decide blast radius.
Authentication and authorization
Kubernetes has no User objects: identities come from X.509 client certificates (CN = user, O = group), OIDC, webhook token authentication, and ServiceAccount tokens. Authorization is RBAC: Role/ClusterRole grant verbs on resources within apiGroups, and RoleBinding/ClusterRoleBinding attach them. RBAC is purely additive - there are no deny rules, so access is removed only by removing the binding. kubectl auth can-i --as=... is the verification tool.
Admission and workload controls
After authorization, mutating then validating admission plugins run: NodeRestriction, ResourceQuota, LimitRanger, ServiceAccount, and Pod Security Admission. Pod Security Standards define three levels - privileged, baseline, restricted - applied per namespace with pod-security.kubernetes.io/enforce labels. Restricted requires runAsNonRoot, allowPrivilegeEscalation: false, seccompProfile: RuntimeDefault, capabilities.drop: ["ALL"], and forbids privileged mode, host namespaces and hostPath.
Data and traffic
Secrets are base64-encoded, not encrypted, unless EncryptionConfiguration is added; anyone with get secrets holds every credential in the namespace. Disable automountServiceAccountToken where the API is not needed. NetworkPolicy is default-allow until a policy selects a pod, and enforcement requires a CNI that implements it.
Worked example
A Deployment sets privileged: true and runAsUser: 0. Labelling the namespace with restricted enforcement makes the API server reject creation. The fix: drop privileged, set runAsNonRoot: true, drop ALL capabilities, add RuntimeDefault seccomp, and grant the single capability genuinely required (for example NET_BIND_SERVICE) rather than the full set.
Traps
Expecting RBAC deny rules; assuming Pod Security Admission applies retroactively to running pods; assuming NetworkPolicy works without CNI support; confusing Secret encoding with encryption.