What practices do you know for enhancing application…

Using Network Policies to control traffic between pods.
Applying Resource Quotas and Limit Ranges to restrict resource consumption by pods.
Disabling privileged mode for containers.
Minimizing permissions granted to Service Accounts.
Using secrets to store sensitive data.
Regularly scanning container images for vulnerabilities.
Applying Security Context Constraints (SCC) in OpenShift or Pod Security Policies (PSP) (deprecated) / Pod Security Standards in plain Kubernetes.
Using tools for cluster auditing, such as Kubesec or OpenSCAP.
Implementing the principle of least privilege at the cluster and application levels.
Segmenting pods and namespaces.
Using Immutability for deployments.

Example of using Network Policy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend # Applies only to pods with this label
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend # Allows incoming traffic only from frontend pods
    ports:
    - protocol: TCP
      port: 8080 # Allows traffic only on this port

Example of using Security Context:

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000 # Run container as user with ID 1000
    runAsGroup: 3000 # Run container as group with ID 3000
    fsGroup: 2000 # Filesystem will belong to group 2000
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    securityContext:
      allowPrivilegeEscalation: false # Prohibit privilege escalation
      readOnlyRootFilesystem: true # Make root filesystem read-only

What practices do you know for enhancing application security in Kubernetes?