Link to this headingHardening

Hardening Guide:

1. Close unused ports
2. Use NodeRestriction to prevent specific nodes from modifying parts of the API
3. Don’t allow anonymous requests
4. Avoid ApiServer exposure to the internet.
5. Set up PodSecurityContext:
   • Set runAsNonRoot to True
   • Configure runAsUser
   • Limit permissions by specifying seLinuxOptions and seccompProfile
   • Do NOT grant privileged group access via runAsGroup and supplementaryGroups
6. SecurityContext
   • allowPrivilegeEscalation = False
   • Remove capabilities you don’t need
   • privileged = False
   • readOnlyRootFilesystem = True (if possible)
   • Set runAsNonRoot to True and set a runAsUser