Roadmap › Kubernetes (K8s) & AKS › Module: Running Workloads Well
Lessons in this course (15)
10. Namespaces, RBAC and security
Intermediate★ Must knowLesson 10 of 15
- Namespaces — logical partitions (dev/test/team-a) for names, quotas, RBAC and network policies.
- RBAC —
Role/ClusterRole(verbs on resources) bound to users/groups/ServiceAccounts withRoleBinding/ClusterRoleBinding. AKS integrates with Microsoft Entra ID and Azure RBAC. - ServiceAccounts — identities for pods; with AKS Workload Identity they map to Entra managed identities to access Key Vault, Storage, SQL without secrets.
- NetworkPolicies — firewall rules between pods (default: all pods can talk to each other).
- Pod Security Standards (Privileged/Baseline/Restricted) via Pod Security Admission; run as non-root, read-only root FS, drop capabilities.
- Image hygiene: private registry (ACR attached to AKS), scanning, admission policies (Azure Policy/Gatekeeper/Kyverno).