Security: RBAC, NetworkPolicy, Pod Security | Kubernetes

Picture it this way

RBAC is the list of who may give orders. A NetworkPolicy is a rule about which boats may talk. If the harbour has no one enforcing the rule, the paper does nothing. Pod security is the rule about what a boat is allowed to carry.

RBAC

A Role or ClusterRole lists verbs on resources. A RoleBinding or ClusterRoleBinding grants that list to a user, group, or ServiceAccount. A Pod uses a ServiceAccount. The default ServiceAccount in a namespace can get more power than you meant if you bind a wide role to it.

kubectl auth can-i answers as the current user. kubectl auth can-i get secrets --as=system:serviceaccount:default:builder checks someone else. Reading Secrets and creating Pods are the verbs attackers want.

NetworkPolicy needs a CNI that implements it

A NetworkPolicy selects Pods and lists allowed ingress and egress. Pods that are not selected are unaffected. Once a Pod is selected, traffic that is not allowed is denied, if a controller enforces the API.

kind's default CNI does not enforce NetworkPolicy. Applying a policy there is a silent no-op. To practice enforcement, use a cluster whose CNI documents NetworkPolicy support, such as a minikube cluster started with Calico, or a cloud cluster that says it enforces the API. Cilium and Calico are examples, not the only ones.

You applied a policy	What you know
On default kind	The object exists. Traffic is not filtered by it.
On a CNI that implements the API	Selected Pods lose traffic you did not allow.
No policy selects the Pod	That Pod is not restricted by NetworkPolicy.

Pod Security Admission

Pod Security Admission is built in. Namespace labels choose a standard and a mode: privileged, baseline, or restricted, in enforce, audit, or warn. Privileged is the wide-open standard. Restricted is the tight one.

PodSecurityPolicy was removed in Kubernetes 1.25. Do not follow a guide that tells you to install that admission controller.

Three different gates

RBAC
NetworkPolicy
Pod security

Step 1 of 3RBAC is about API verbs. It does not filter packet paths.

Lab: ask what you are allowed to do

This does not pretend to enforce a NetworkPolicy on kind. It checks RBAC, which the API server does enforce.

kubectl auth can-i create deployments
kubectl auth can-i get secrets
kubectl label namespace default pod-security.kubernetes.io/warn=restricted --overwrite
# a privileged Pod manifest would now warn in this namespace
# remove the label if you want the namespace back:
# kubectl label namespace default pod-security.kubernetes.io/warn-

Concept summary

RBAC, NetworkPolicy, and Pod Security Admission answer three different questions.
A NetworkPolicy object is not enforcement.
PodSecurityPolicy is gone. Use Pod Security Admission labels.

Knowledge check

You applied a NetworkPolicy on default kind and traffic still flows. Why?

Which object grants a ServiceAccount permission to list Pods?

What replaced PodSecurityPolicy?

Official sources

Checked against the linked documentation in October 2026. A later release can move a flag, a price, or a supported pair. Use the page for the version you installed.