Isolate workloads with sandboxes and mTLS

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Sandboxed runtimes and pod-to-pod encryption

Use a sandboxed runtime with RuntimeClass

A RuntimeClass names a runtime handler configured in containerd (for example runsc for gVisor). Pods choose it with runtimeClassName.

runtimeclass.yaml

apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata: { name: gvisor }
handler: runsc
---
apiVersion: v1
kind: Pod
metadata: { name: untrusted, namespace: shop }
spec:
  runtimeClassName: gvisor
  containers:
    - name: app
      image: nginx:1.27

$kubectl apply -f runtimeclass.yaml
$kubectl exec untrusted -n shop -- dmesg | head -2
[    0.000000] Starting gVisor...
$kubectl get runtimeclass

Sandbox	How it isolates
gVisor (`runsc`)	A user-space kernel catches system calls
Kata Containers	Every pod in a small virtual machine

Remember

The handler (runsc) must be installed and configured in containerd on the node — the RuntimeClass object alone does nothing.

7.2

Know where sandboxes help

Sandboxes cost some speed and compatibility. Use them where the risk is high.

Code from customers or the internet (CI runners, online code playgrounds).
Multi-tenant clusters with teams that do not trust each other.
Workloads that parse untrusted files (image or document converters).

7.3

Encrypt pod-to-pod traffic with mTLS

With mutual TLS, both sides show a certificate — traffic is encrypted and both identities are proven. A service mesh or the CNI does it without changing the app.

Option	How
Istio (sidecar or ambient)	`PeerAuthentication` with `mode: STRICT`
Linkerd	mTLS on by default for meshed pods
Cilium	Transparent encryption (WireGuard/IPsec) and mutual authentication

istio-strict.yaml

apiVersion: security.istio.io/v1
kind: PeerAuthentication
metadata: { name: default, namespace: shop }
spec:
  mtls:
    mode: STRICT

7.4

Encrypt node-to-node traffic

The CNI can encrypt all pod traffic between nodes, for example Cilium with WireGuard.

$cilium install --set encryption.enabled=true --set encryption.type=wireguard
$cilium status | grep Encryption

All commands in this chapter