## Kubernetes Security (K8s)

Kubernetes manages thousands of containers. It is complex ("K8s is hard").

### 1. The API Server
The brain of K8s. Port 6443.
*   **Attack**: If this is open to the internet with no auth, anyone can delete your cluster.
*   **Fix**: Private access only.

### 2. RBAC (Role-Based Access Control)
*   **Service Accounts**: Every pod has an identity.
*   **Risk**: Default Service Account often has too many permissions.
*   **Fix**: Create specific ServiceAccounts. "This Web Pod can ONLY talk to the Database Pod."

### 3. Pod Security Standards (PSS)
*   **Privileged Pods**: A pod with `privileged: true` is basically a root shell on the host.
*   **Policy**: Use OPA Gatekeeper or Kyverno to **Block** any deployment that asks for `privileged: true`.

### 4. Network Policies
*   By default, in K8s, **all pods can talk to all pods**. (Flat network).
*   **Attack**: Hacker compromises Web Pod. Moves laterally to Database Pod easily.
*   **Fix**: Implement Network Policies (Firewall rules) to deny traffic by default.