HomeRoadmapsTerraform Day 13
Kubernetes & GitOps Track · Day 13 · 20 min

Cluster Security & Policy Audit
DevOps IaC Part 2 — Day 13

Audit K8s manifests for non-root security context (runAsNonRoot), Trivy container scanning, and Checkov static analysis rules

🛠️ Tooling: Terraform 1.5+, Checkov, Trivy & Kubernetes PSS🎭 Role: Kubernetes & Cloud Infrastructure Quality Architect
KubernetesSecurity AuditCheckovTrivyPod Security StandardsHardening
About Today's 20-Minute Lab

Default Kubernetes workloads are notoriously permissive: containers run as the root user (UID 0), possess Linux capabilities that allow container breakouts, and read/write to the host root filesystem. On Day 13, you will enforce enterprise Pod Security Standards (Restricted Profile) directly in Terraform HCL, scan your infrastructure code with Checkov static analysis, and inspect container images with Trivy to ensure zero critical CVEs before deployment.

🎬
Day 13 Video Walkthrough: Kubernetes Manifest Hardening & Static Policy AuditingComing Soon

An interactive 20 min video walkthrough for Day 13 is currently in production. Follow the step-by-step interactive playbook below!

📦Sample Codebase & Working Solution (Day 13)Available Now
View on GitHub

The official reference codebase for Day 13 is hosted in the repository. Clone the repository and navigate to day-13-cluster-security to run the working solution.

Git Clone — Working Solution
git clone https://github.com/777abhi/devops-terraform-roadmap.git
cd devops-terraform-roadmap/day-13-cluster-security
1

Security Standards: Baseline vs Restricted PSS

Understand Kubernetes Pod Security Standards (Privileged, Baseline, Restricted) and the CIS Benchmark.

Audit Threat Vectors in Kubernetes Workloads

Identify common container misconfigurations that expose host nodes to privilege escalation.

threat-vector-audit.txt
Kubernetes Threat Vectors:
1. Root Execution (UID 0): An attacker exploiting an app vulnerability gets host root privileges.
2. Writable Root Filesystem: Allows attackers to install rootkits and download malicious binaries.
3. Excessive Capabilities: Defaults grant CAP_CHOWN, CAP_KILL, CAP_NET_BIND_SERVICE, etc.
4. Host IPC/PID/Network Sharing: Exposes socket communication between processes on the node.

Restricted Profile Enforcement:
• runAsNonRoot: true (UID >= 1000)
• readOnlyRootFilesystem: true
• allowPrivilegeEscalation: false
• capabilities.drop: ["ALL"]
2

HCL Manifest Hardening: Security Contexts

Express the Restricted Pod Security profile directly in Terraform HCL.

Author Hardened Deployment in main.tf

Configure pod and container security contexts to satisfy enterprise compliance.

HCL — main.tf (Hardened Pod Security)
# main.tf
resource "kubernetes_namespace" "secure_ns" {
  metadata {
    name = "secure-production"
    labels = {
      "pod-security.kubernetes.io/enforce" = "restricted"
      "pod-security.kubernetes.io/audit"   = "restricted"
    }
  }
}

resource "kubernetes_deployment" "hardened_app" {
  metadata {
    name      = "secure-microservice"
    namespace = kubernetes_namespace.secure_ns.metadata[0].name
  }

  spec {
    replicas = 2

    selector {
      match_labels = {
        app = "secure-microservice"
      }
    }

    template {
      metadata {
        labels = {
          app = "secure-microservice"
        }
      }

      spec {
        # Pod-level security context
        security_context {
          run_as_non_root = true
          run_as_user     = 10001
          run_as_group    = 10001
          fs_group        = 10001
        }

        container {
          name  = "web"
          image = "nginxinc/nginx-unprivileged:alpine"

          security_context {
            allow_privilege_escalation = false
            read_only_root_filesystem  = true
            privileged                 = false

            capabilities {
              drop = ["ALL"]
            }
          }

          port {
            container_port = 8080
          }
        }
      }
    }
  }
}
3

Automated Security Scanning: Checkov & Trivy

Run static policy checks against Terraform code and container image vulnerability scans.

Scan Terraform Code with Checkov

Execute Checkov to verify all CIS benchmark and Kubernetes rules pass.

Terminal — Run Checkov Static Analysis
cd /Users/abhinavsharma/Downloads/devops-terraform-roadmap/day-13-cluster-security
checkov -d . --framework terraform,kubernetes
Scan Container Image with Trivy

Audit container image for known CVEs before deployment.

Terminal — Run Trivy Image Scan
trivy image --severity HIGH,CRITICAL nginxinc/nginx-unprivileged:alpine
4

Production Quality Gates & Compliance

Integrate security scans into PR quality gates with automated build rejection.

🏭CI/CD Security Gate Assertion

In production pipelines, configure the security scanner step to fail the build whenever a policy violation or Critical CVE is detected:

Passed checks: 14, Failed checks: 0, Skipped checks: 0
Status: PASSED - Manifest conforms to Restricted Pod Security Standard.
Day 13 Quality Gate & Outcomes Checklist
  • Understood Pod Security Standards (Baseline vs Restricted) and common container threat vectors.
  • Hardened Kubernetes Deployment in HCL with runAsNonRoot, readOnlyRootFilesystem, and drop ALL.
  • Used unprivileged container images (nginxinc/nginx-unprivileged) capable of running non-root.
  • Audited Terraform HCL with Checkov static policy engine achieving zero failures.
  • Executed Trivy vulnerability scanning to block HIGH/CRITICAL CVEs at the pipeline boundary.
Continue to Day 14: GitOps & CI/CD Quality Gates (Capstone) →