--- title: "Five Tips for Successful Kubernetes Network Security and Compliance" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/five-tips-for-kubernetes-network-security-and-compliance/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Five Tips for Successful Kubernetes Network Security and Compliance By [Vince Lau](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/vincetigera-io/) on Oct 08, 2018 • 4 min read Kubernetes is dynamic and hard to secure or monitor using existing tools. This has a significant impact on your security and compliance controls. - Traditional solutions like perimeter security, zone-based security, and static firewalls are not sufficiently scalable or flexible enough to meet security controls for Kubernetes. - Monitoring tools do not provide context into microservices traffic. - Compliance tools designed to provide audit trails were also designed for static applications and environments and won’t work properly for Kubernetes. - Since microservices use the network, several teams – development, platform, networking, security – now need access to security tools that let them work together in an agile manner. Kubernetes changes the way that we implement security controls. Here are some best practices for securing those environments. ## **1. Deploy what you know** Not knowing what is inside containers could be problematic, especially if it has vulnerable code. Downloaded container images could contain vulnerable code, making run-time containers exploitable by attackers. Therefore, it is crucial to practice good security hygiene and understand what exactly is being deployed. Container scanning can help you to an extent, screening out containers with known major CVEs. Assuming that your code does what you want it to do, you want to make sure that no one can change it in a way that you don’t know about. Use source code control systems like Git. ## **2. Ensure deployments are in compliance** Since IP addresses are ephemeral in a Kubernetes environment, we need to use other attributes to identify and audit workloads. This might include metadata and labels that identify infrastructure that must align to your compliance controls. When you use labels or fingerprints as an identity, you can begin attaching the security controls you need for compliance. The next step is to write policies that interact with your labels. If an element in your architecture is labeled for PCI, then it doesn’t matter what specific kind of element it is. Your PCI-related policies should apply automatically, no matter what. Lastly, you need to enforce the concrete nature of your policies. Developers and other personnel should not be able to change your policies – only the security and/or compliance team can. If someone tries to change those policies, the security and/or compliance team should receive an alert. ## **3. Make sure logs are meaningful and durable** You may have thousands or even tens of thousands of servers, each with hundreds of workloads. You need a solution that can correlate all of these workloads, so you can detect what’s really happening in your platform. As one example, your containers need to have a consistent sense of time. Without a sense of time, your logs won’t be in a sequential order, so you can’t determine cause or effect. ## **4. Embrace Zero Trust network security** As we’ve mentioned, you need to assume that you have one or more compromises in your network. Acting accordingly means implementing multiple enforcement points in and outside of your pod and hosts. If a single enforcement point gets compromised, the infection won’t be able to compromise your security posture. By implementing multiple, interlocking, and partially redundant security controls at every level of your stack, you eliminate the possibility that a single compromise can own your entire system. ## **5. Orchestrate security just like you orchestrate code** Your orchestrator is in charge of the rest of your environment, so it should be in charge of security. Doing anything else will create an impedance between your policies and your security. Where the workload goes, the policy should follow. Creating new microservices security models means adding more complexity to what are already very complex environments. Do it right, however, and you’ll be able to create a security model that’s even more secure than the model it’s replacing. ————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Tutorials [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Solve Common Kubernetes Roadblocks and Advance Your Enterprise Adoption [Best Practices](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/best-practices/)[Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![Calico Load Balancer: Simplifying Network Traffic Management with eBPF](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Calico-Load-Balancer-Simplifying-Network-Traffic-Management-with-eBPF.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-load-balancer-simplifying-network-traffic-management-with-ebpf/) #### [Calico Load Balancer: Simplifying Network Traffic Management with eBPF](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-load-balancer-simplifying-network-traffic-management-with-ebpf/) By [Aadhil Abdul Majeed](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/aadhil-abdul-majeed/) on Mar 21, 2026 Authors: Alex O’Regan, Aadhil Abdul Majeed Ever had a load balancer become the bottleneck in an on-prem Kubernetes cluster? You are not alone. Traditional hardware load balancers add cost, create coordination overhead, and can make... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-load-balancer-simplifying-network-traffic-management-with-ebpf/) [![Lift-and-Shift VMs to Kubernetes with Calico L2 Bridge Networks](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Mar-20-Lift-and-Shift-VMs-to-Kubernetes-with-Calico-L2-Bridge-Networks.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/lift-and-shift-vms-to-kubernetes-with-calico-l2-bridge-networks/) #### [Lift-and-Shift VMs to Kubernetes with Calico L2 Bridge Networks](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/lift-and-shift-vms-to-kubernetes-with-calico-l2-bridge-networks/) By [Aadhil Abdul Majeed](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/aadhil-abdul-majeed/) on Mar 20, 2026 On paper, lift-and-shift VM migration to Kubernetes sounds simple. Compute can be moved. Storage can be remapped. But many migration projects stall at the network boundary. VM workloads are often tied to IP addresses, network... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/lift-and-shift-vms-to-kubernetes-with-calico-l2-bridge-networks/) [![AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/Blog-Mar-20-AI-Assistant-for-Calico.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) #### [AI Assistant for Calico: Troubleshooting at the Speed of Thought](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 19, 2026 Despite the wealth of data available, distilling a coherent narrative from a Kubernetes cluster remains a challenge for modern infrastructure teams. Even with powerful visualization tools like the Policy Board, Service Graph, and specialized dashboards,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/ai-assistant-for-calico-troubleshooting-at-the-speed-of-thought/)