Ashish Kumar Pandey

· 3 min read

Where Kubernetes security config actually lives

kubernetessecurity

Most of these tools fail because you edited the wrong file, or the right file on the wrong node. This is the map I keep next to the cluster.

The centre of gravity is /etc/kubernetes/, especially manifests/kube-apiserver.yaml. Almost every admission plugin, audit log, and webhook client starts there.

Supply chain

Thing Path Why you open it
Trivy /etc/trivy/trivy.yaml, ~/.trivy/trivy.yaml, .trivyignore Scanner defaults and CVE suppressions
ImagePolicyWebhook manifests/kube-apiserver.yaml --enable-admission-plugins, --admission-control-config-file
ImagePolicyWebhook /etc/kubernetes/admission-control.yaml defaultAllow, TTL, kubeconfig path
ImagePolicyWebhook /etc/kubernetes/imagepolicy-webhook.kubeconfig URL and client certs for the webhook

Cluster policy

Thing Path Why you open it
Admission manifests/kube-apiserver.yaml Plugin list
Admission /etc/kubernetes/admission-control.yaml or admission-config.yaml PodSecurity defaults, webhook config
Gatekeeper ConstraintTemplate / Constraint / Config CRDs Policy logic and scope
PSS Namespace labels pod-security.kubernetes.io/* enforce / warn / audit
RBAC Role, ClusterRole, RoleBinding, ClusterRoleBinding, ServiceAccount Who can do what 
kubectl get constrainttemplates
kubectl get constraints
kubectl get validatingadmissionwebhooks
kubectl get mutatingadmissionwebhooks
kubectl get namespace --show-labels

Node hardening

Thing Path Why you open it
AppArmor /etc/apparmor.d/ Profiles. Must exist on the worker.
AppArmor /sys/kernel/security/apparmor/ Runtime state
Seccomp /var/lib/kubelet/seccomp/profiles/ localhostProfile files
Runtimes /etc/containerd/config.toml runsc, kata, default runc
Kata /opt/kata/share/defaults/kata-containers/configuration.toml Guest CPU/memory
RuntimeClass kubectl get runtimeclass Handler names

Runtime monitoring

Thing Path Why you open it
Falco /etc/falco/falco.yaml Outputs and rule file list
Falco /etc/falco/falco_rules.yaml Defaults. Leave them.
Falco /etc/falco/falco_rules.local.yaml Your rules
Falco /etc/falco/k8s_audit_rules.yaml Audit-based rules
Audit manifests/kube-apiserver.yaml Audit flags
Audit /etc/kubernetes/audit-policy.yaml What gets logged
Audit /var/log/audit.log Output

Cluster setup checks

Thing Path Why you open it
kube-bench /etc/kube-bench/config.yaml, /opt/kube-bench/cfg/ Which CIS version to run
NetworkPolicy kubectl get networkpolicies, /etc/cni/net.d/ Policies vs CNI

If you cannot remember a path, find /etc/kubernetes /etc/falco /etc/apparmor.d -type f on the node is faster than guessing. Confirm the file exists on the node that actually runs the process — API server configs on the control plane, AppArmor and seccomp on the worker that will host the pod.