How do I secure Kubernetes API access?

1. Enable Role-Based Access Control (RBAC)

RBAC lets you enforce granular access policies by defining roles and binding them to specific users or service accounts.

Create roles and cluster roles with the principle of least privilege.
Bind roles to users, groups, or service accounts using RoleBindings or ClusterRoleBindings.

bash kubectl create rolebinding <name> --role=<role-name> --user=<user-name> -n <namespace>

2. Use TLS for All API Communications

Encrypt all communication between the Kubernetes API server and clients with TLS certificates.

Use a proper Certificate Authority (CA) to sign the API server certificate.
Configure the --client-ca-file flag on the API server to enforce client certificate authentication.
Use certificates for both API server and etcd backend communication.

3. Enable Strong Authentication

Configure authentication mechanisms so only authorized users and systems can access the API.

Client Certificates: Authenticate users with X.509 certificates.
OIDC (OpenID Connect): Integrate an identity provider (e.g., Azure AD, Okta, Google) for user authentication.
Service Accounts: Use service accounts for workloads that need API access.
Disable anonymous access with --anonymous-auth=false on the API server, but verify that kubelet health checks (/healthz, /readyz) still work — they may require anonymous access or a dedicated service account.

4. Restrict Access with Network Policies

Use Kubernetes Network Policies to control which pods, namespaces, or external IPs can reach the API server.

Apply firewall rules or cloud-native tools (AWS Security Groups, Azure NSGs) to restrict access to the API server’s external endpoint.

5. Harden API Server Flags

Set --authorization-mode=RBAC,Node to enable RBAC and Node authorization.
Do not bind the API server to 127.0.0.1; nodes and controllers must reach it. Instead, restrict external exposure with a firewall or private load balancer.
The --insecure-port flag is deprecated and removed in v1.20+; ignore it on current clusters.

6. Audit API Access

Enable Kubernetes audit logging to record API requests.

Use --audit-log-path and --audit-policy-file to define log location and policy.
Ship logs to a centralized system (ELK, Loki, cloud monitoring) for analysis and alerting on suspicious activity.

7. Configure API Server Rate Limiting

Prevent abuse or DoS by limiting concurrent requests.

Set --max-requests-inflight and --max-mutating-requests-inflight to appropriate values for your cluster size.

8. Restrict External Access to the API Server

Expose the API server only over secure networks (VPN, VPC peering, private link).
If a public endpoint is required, terminate TLS at a reverse proxy (NGINX, HAProxy) or cloud load balancer with WAF rules.
In cloud environments, use private endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect).

9. Rotate Secrets, Certificates, and Tokens

Regularly rotate Kubernetes secrets, TLS certificates, and service account tokens.
Prefer short-lived credentials and automate rotation (cert-manager, CSI drivers, or external secret operators).

10. Enforce Pod Security Standards

Ensure workloads follow security best practices using Pod Security Admission (built-in since v1.23) or policy engines.

Apply baseline/restricted Pod Security Standards via namespace labels or admission configuration.
Use Kyverno, OPA/Gatekeeper, or ValidatingAdmissionPolicy (v1.26+) for custom policies.
Restrict privileged containers and prevent unnecessary API server access from pods.

11. Limit Node Access to the API Server

On each kubelet, set --anonymous-auth=false and enable RBAC for kubelet-to-API-server communication (Node authorizer handles this).
Ensure nodes only reach required API endpoints (/healthz, /metrics, etc.) via network policy or firewall.

12. Monitor and Patch Regularly

Track security advisories (CVE feeds, Kubernetes release notes) and upgrade control-plane and worker nodes promptly.
Run runtime security tools (Falco, Sysdig, Tetragon) and image scanners (Trivy, Grype) in CI/CD and admission.

13. Use External Secrets Management

Never hardcode credentials or tokens in YAML manifests.
Integrate HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager via CSI driver or operator (External Secrets Operator, Secrets Store CSI Driver).

14. Require Multi-Factor Authentication

If you use OIDC or an external identity provider, enforce MFA for all human access to the Kubernetes API.