DevOps: What is Kubernetes Pod Security Context?

1apiVersion: v1
2kind: Pod
3metadata:
4  name: secure-pod
5spec:
6  securityContext:
7    runAsNonRoot: true
8    runAsUser: 1000
9    runAsGroup: 1000
10    fsGroup: 1000
11    fsGroupChangePolicy: OnRootMismatch
12    supplementalGroups: [2000]
13    seccompProfile:
14      type: RuntimeDefault
15  containers:
16  - name: app
17    image: nginx:latest
18    securityContext:
19      allowPrivilegeEscalation: false
20      readOnlyRootFilesystem: true
21      runAsNonRoot: true
22      runAsUser: 1000
23      capabilities:
24        drop:
25        - ALL
26        add:
27        - NET_BIND_SERVICE
28      seLinuxOptions:
29        level: "s0:c123,c456"
30        type: "my_app_t"
31        user: "system_u"
32        role: "system_r"
33      windowsOptions:
34        runAsUserName: "ContainerUser"
35        gmsaCredentialSpecName: "my-gmsa"
36        gmsaCredentialSpec: ""
37        supplementalGroupsGroupPolicy: Merge
38    volumeMounts:
39    - name: tmp
40      mountPath: /tmp
41    - name: nginx-cache
42      mountPath: /var/cache/nginx
43  volumes:
44  - name: tmp
45    emptyDir: {}
46  - name: nginx-cache
47    emptyDir: {}

1# Check security context
2kubectl get pod secure-pod -o jsonpath='{.spec.securityContext}' | jq
3kubectl get pod secure-pod -o jsonpath='{.spec.containers[0].securityContext}' | jq
4
5# Verify user
6kubectl exec secure-pod -- id
7kubectl exec secure-pod -- whoami
8
9# Check capabilities
10kubectl exec secure-pod -- cat /proc/1/status | grep Cap
11
12# Check seccomp profile
13kubectl get pod secure-pod -o jsonpath='{.spec.securityContext.seccompProfile}' | jq
14
15# Verify read-only filesystem
16kubectl exec secure-pod -- touch /test 2>&1