Kubernetes Security Highlights of 2025: Enhancing Cloud-Native Environments
The year 2025 marked significant progress in Kubernetes security, fortifying production cloud-native environments with essential advancements in authentication, authorization, workload isolation, and overall hardening. As Kubernetes v1.35 is scheduled for release on December 17, it's an opportune moment to review the past year's developments and prepare for the features expected to graduate to stable in early 2026.
Stable Graduates of 2025
The following features graduated to stable status between versions 1.32 and 1.35, improving the security posture of Kubernetes deployments:
Bound ServiceAccount Token Improvements
ServiceAccount tokens gained unique token IDs and node binding in v1.33, enhancing validation, auditability, and limiting token reuse or node impersonation.
Sidecar Containers
Native sidecar containers became a stable Pod lifecycle primitive in v1.33, making it safer and more reliable to run security agents, proxies, and observability sidecars alongside workloads.
Recursive Read-Only (RRO) Mounts
RRO mounts graduated to stable in v1.33, allowing volumes to be mounted fully read-only (including subpaths), closing write paths that attackers could previously abuse on supposedly read-only mounts.
Finer-Grained Authorization Using Selectors
In v1.34, authorizers (built-in and webhook) can now make decisions based on field/label selectors, enabling policies to restrict list/watch/delete collection requests to specific pods.
Restrict Anonymous Requests to Specific Endpoints
Anonymous access can be limited to an explicit allowlist of endpoints such as /healthz, /readyz, /livez, reducing the blast radius of RBAC misconfigurations that accidentally expose resources to unauthenticated users.
Ordered Namespace Deletion
Namespace deletion now follows a structured order in v1.34, so that pods are removed before dependent resources like NetworkPolicies, mitigating gaps where workloads could continue running without the intended network controls (e.g., CVE-2024-7598).
Looking Ahead: What to Expect in 2026
The alpha and beta features in Kubernetes 1.35 provide a clear indication of what's likely to graduate to stable in 2026. These advancements will further solidify Kubernetes as a secure platform:
Harden kubelet Serving Certificate Validation
Alpha new in v1.35 adds an API-server check that the kubelet's serving certificate CN matches system:node:
Constrained Impersonation
Alpha new in v1.35 tightens impersonation so that an impersonating user cannot perform actions they themselves are not allowed to do, reducing the risk of over-privileged debug or proxy workflows.
User Namespaces for HostNetwork Pods
Alpha new in v1.35 allows hostNetwork: true pods to keep hostUsers: false, so workloads can access the host network stack without also gaining host user privileges, improving containment if the pod is compromised.
CSI ServiceAccount Tokens via Secrets
Alpha new in v1.35 moves CSI driver ServiceAccount tokens out of volumeContext into a dedicated secrets field, separating sensitive credentials from non-sensitive metadata and reducing accidental leakage.
Robust Image Pull Authorization
Beta new in v1.35 introduces imagePullCredentialsVerificationPolicy so kubelet can re-verify registry credentials even when images are already cached, closing scenarios where pods could reuse pre-pulled images without proper auth.
Pod Certificates for mTLS
The PodCertificateRequest API and PodCertificate volume source moved to beta in v1.35, making it easier to issue workload X.509 certificates for first-class mTLS between pods and the API server or other services.
User Namespaces for Pods
Beta on-by-default in v1.35, pod-level user namespaces, previously alpha/beta and opt-in, become a more mature hardening option for running root in the pod, unprivileged on the host, improving multitenant isolation.
Image Volumes (OCI ArtifactImageVolume)
Using OCI images as read-only volumes is now beta, enabling separation of binaries and content. From a security POV, it demands tighter policies around which registries and images may be mounted into pods.
Relevance to North East India and Broader Indian Context
As the adoption of cloud-native technologies continues to grow in India, including the North East region, understanding and implementing best practices for Kubernetes security becomes increasingly crucial. The advancements discussed in this article will help organizations across India build more secure, resilient, and scalable cloud-native applications.
Reflections and Future Outlook
The continuous evolution of Kubernetes security features underscores the importance of staying informed about emerging trends and adopting best practices. By evaluating alpha-to-stable lifecycle features in pre-production environments, organizations can make informed decisions, stay ahead of evolving security needs, and maintain the security posture of their cloud-native applications.