How do you secure a Kubernetes cluster? Cover RBAC, workload hardening, and network controls.
What they are really testing: Senior signal: layered security across identity, workload, and network, with least privilege throughout, not just "use RBAC". They want concrete controls.
A real interview question
How do you secure a Kubernetes cluster? Cover RBAC, workload hardening, and network controls.
What most people say
drag me
“I would set up RBAC so only the right people have access to the cluster.”
RBAC is one layer and only addresses identity. A secure cluster also needs workload hardening (non-root, no privileged), network policies (default is allow-all), image/supply-chain controls, and secrets encryption, all missing here.
The follow-ups they ask next
A container is compromised. What limits the blast radius?
Non-root + dropped capabilities + read-only FS contain it; least-privilege RBAC and no automounted SA token limit API access; default-deny NetworkPolicies stop lateral movement; mTLS means it cannot freely impersonate services.
Why is default-deny important for NetworkPolicies?
Because the Kubernetes default is allow-all: every pod can reach every other pod. Without a default-deny baseline, a compromised pod can move laterally across the whole cluster.
What the interviewer is listening for
- Layers identity/workload/network/supply-chain
- Least privilege RBAC + per-workload SAs
- Default-deny network + non-root/restricted PSS + admission control
What sinks the answer
- Only "set up RBAC"
- Runs privileged/root containers
- Unaware default network is allow-all
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Layer it: [RBAC least privilege, per-workload ServiceAccounts, no cluster-admin]; [harden workloads: non-root, read-only FS, drop caps, no privileged, restricted Pod Security]; [default-deny NetworkPolicies then allow required flows, mTLS via a mesh]; [scan/sign images, enforce via admission control, etcd encryption at rest, external secrets]. Theme: [assume breach, least privilege, limit blast radius].”
Keep going with kubernetes
Foundation
What problem does Kubernetes solve, and what does it actually do for you?
Foundation
What are the main components of a Kubernetes cluster (control plane and nodes)?
Foundation
What is a Pod, and why do you use a Deployment instead of creating Pods directly?
Foundation
What is a Service in Kubernetes, and what are the main types?
Junior
When would you use a Deployment versus a StatefulSet versus a DaemonSet?
Junior
How do you inject configuration and secrets into a pod, and what is the catch with Kubernetes Secrets?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free