[CKA] 009. Security 2/2

Service Account, Image Security, Security Context, Network Policy, CRD, Custom Controller, Operator Framework

hpyYh
January 20, 2026
2 min read

Service Account

account for bots (pods)
default create : default

create

kubectl create serviceaccount sa1

apiVersion: v1
kind: ServiceAccount
metadata:
    name: sa1
    namespace: default

get
```
kubectl get serviceaccount 
```
connect to pod
```
spec:
  serviceAccountName: sa1
```

token disable

kind: ServiceAccount
automountServiceAccountToken: "false"

kind: Pod
spec:
  automountServiceAccountToken: "false"

create token
```
kubectl create token sa1
```

Image Security

image: nginx
real image : docker.io(registry)/library(user/Account)/nginx
docker login (registry)

kubectl create secret docker-registry <name> \
  --docker-server=<docker-registry-server> \
  --docker-username=<docker-user> \
  --docker-password=<docker-password> \
  --docker-email=<docker-email>

spec:
  imagePullSecrets:
    - name: myregistrykey

Security Context

docker’s namespace is not secure (all shared)

spec:
  securityContext:
    runAsUser: 1000

Network Policy

to pod : spec.selector
from pod : spec.ingress.from.podSelector
other : namespaceSelector, ipblock ( warn : - confirm and, or)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: test-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.17.0.0/16
        except:
        - 172.17.1.0/24
    - namespaceSelector:
        matchLabels:
          project: myproject
    - podSelector:
        matchLabels:
          role: frontend
    ports:
    - protocol: TCP
      port: 6379
  egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/24
    ports:
    - protocol: TCP
      port: 5978

engress : incoming traffic

CRD (custom resource)

Custom Resource Definition

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  # name must match the spec fields below, and be in the form: <plural>.<group>
  name: crontabs.stable.example.com
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: stable.example.com
  # list of versions supported by this CustomResourceDefinition
  versions:
    - name: v1
      # Each version can be enabled/disabled by Served flag.
      served: true
      # One and only one version must be marked as the storage version.
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              properties:
                cronSpec:
                  type: string
                image:
                  type: string
                replicas:
                  type: integer
  # either Namespaced or Cluster
  scope: Namespaced
  names:
    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
    plural: crontabs
    # singular name to be used as an alias on the CLI and for display
    singular: crontab
    # kind is normally the CamelCased singular type. Your resource manifests use this.
    kind: CronTab
    # shortNames allow shorter string to match your resource on the CLI
    shortNames:
      - ct

apiVersion: "stable.example.com/v1"
kind: CronTab
metadata:
  name: my-new-cron-object
spec:
  cronSpec: "* * * * */5"
  image: my-awesome-cron-image

Custom Controller

use github sample code

Operator Framework

customer controller + CRD

tags :
Cka