<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-secure-container-orchestration
description: >-
  Design secure container orchestration architectures with hardened Kubernetes clusters,
  pod security standards, network policies, image supply chain controls, and runtime
  security monitoring.
domain: cybersecurity
subdomain: security-architecture
tags:
  - kubernetes
  - container-security
  - pod-security
  - network-policy
  - image-scanning
  - runtime-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Designing Secure Container Orchestration

## Overview

Secure container orchestration hardens Kubernetes and container platforms across the
build, deploy, and runtime lifecycle. This skill covers cluster hardening, pod security
standards, network policies, image provenance, and runtime threat detection.

Mode: `[MODE: ARCHITECT]` — Container security architecture and policy design.

## Prerequisites

| Requirement | Details |
|---|---|
| Kubernetes cluster (1.25+) with kubectl access | Required |
| Container registry with scanning capability | Required |
| Python 3.10+ | Required |
| Optional | OPA/Gatekeeper, Falco, Trivy |

## Key Concepts

### Kubernetes Security Layers

```
┌────────────────────────────────────────────────┐
│              Supply Chain Security              │
│  (Image scanning, SBOM, signing, provenance)   │
├────────────────────────────────────────────────┤
│              Admission Control                  │
│  (OPA/Gatekeeper, Pod Security Standards)      │
├────────────────────────────────────────────────┤
│              Network Policies                   │
│  (Ingress/egress rules, service mesh mTLS)     │
├────────────────────────────────────────────────┤
│              Runtime Security                   │
│  (Falco, seccomp, AppArmor, audit logging)     │
├────────────────────────────────────────────────┤
│              Infrastructure Hardening           │
│  (CIS Benchmarks, RBAC, etcd encryption)       │
└────────────────────────────────────────────────┘
```

### Pod Security Standards

```yaml
# Pod Security Standard — Restricted
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: registry.example.com/app:v1.2@sha256:abc123
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop: ["ALL"]
        runAsUser: 65534
      resources:
        limits:
          cpu: "500m"
          memory: "256Mi"
        requests:
          cpu: "100m"
          memory: "128Mi"
```

### Network Policy — Default Deny with Explicit Allow

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-api-to-db
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: database
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: api-server
      ports:
        - protocol: TCP
          port: 5432
```

### OPA Gatekeeper Constraint — Block Privileged Containers

```yaml
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
  name: deny-privileged
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
    excludedNamespaces: ["kube-system"]
```

## Workflow

### Step 1: Audit Cluster Security

```bash
node scripts/agent.js --action audit --kubeconfig ~/.kube/config
```

### Step 2: Generate Security Policies

```bash
node scripts/agent.js --action policies --namespace production --output k8s-policies.json
```

### Step 3: Scan Container Images

```bash
node scripts/agent.js --action scan --images images.json --output scan-results.json
```

### Step 4: Validate Compliance

```bash
node scripts/agent.js --action validate --policies k8s-policies.json --benchmark cis
```

## Detection

```yaml
title: Designing Secure Container Orchestration Detection
id: 657ecfd3-20c3-47ff-9f86-9b9ba0886a1f
status: experimental
description: Detects suspicious activity related to designing secure container orchestration techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Designing Secure Container Orchestration Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Pod Security Standards enforced at `restricted` level for production
- [ ] Default-deny network policies applied to all namespaces
- [ ] Container images pinned by digest, not mutable tags
- [ ] No privileged containers outside kube-system
- [ ] RBAC follows least privilege — no cluster-admin for workloads
- [ ] etcd encrypted at rest with external KMS
- [ ] Runtime monitoring (Falco) deployed with alerting

## References

- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes)
- [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/)
- [NIST SP 800-190 Container Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
