Kubernetes Security Quick Check

About this program

A short audit of your k8s cluster against the high-impact controls — RBAC, secrets, network policies, image trust.

Risks addressed

Critical Overly-permissive cluster-admin bindings
High Container running as root with hostPath mounts
High Secrets stored in plain envs

Controls (7)

No wildcard cluster-admin bindings beyond ops team
Critical

This control restricts the assignment of Kubernetes cluster-admin ClusterRoleBindings with wildcard subjects (e.g., system:authenticated, system:unauthenticated, or wildcard group memberships) to only designated operations teams. Cluster-admin provides unrestricted access to all Kubernetes resources across all namespaces, and wildcard bindings grant this…

How to test + evidence

Testing procedure: kubectl get clusterrolebindings — review subjects.

Evidence to collect: CRB export.
RBAC: least-privilege per namespace
High

Role-Based Access Control (RBAC) with least privilege per namespace enforces segregation of duties and access boundaries within containerized environments by granting users and service accounts only the minimum permissions required to perform their tasks within specific namespaces. This control prevents…

How to test + evidence

Testing procedure: Sample 3 namespaces; verify roles align with workload need.

Evidence to collect: Role / RoleBinding export.
Pod Security Standards: restricted
High

Pod Security Standards (PSS) 'restricted' policy is the most stringent profile defined by Kubernetes for hardening pod specifications. It enforces a comprehensive set of security restrictions including prohibiting privileged containers, host namespace sharing, privileged escalation, non-root user enforcement, restricted volume…

How to test + evidence

Testing procedure: Restricted PSS applied to user workload namespaces.

Evidence to collect: Namespace labels export.
NetworkPolicies in place
High

NetworkPolicies are Kubernetes-native resources that define rules controlling ingress and egress traffic between pods, namespaces, and external endpoints at the network layer. They function as a distributed firewall within the cluster, enforcing least-privilege network segmentation by default-denying traffic unless explicitly…

How to test + evidence

Testing procedure: Default-deny NetworkPolicies + explicit allow rules per namespace.

Evidence to collect: NetworkPolicy export.
Secrets via external secret manager
High

This control requires that sensitive credentials, API keys, certificates, and other secrets are retrieved at runtime from a dedicated external secret management platform (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk) rather than hardcoded in application code, configuration…

How to test + evidence

Testing procedure: External-Secrets / Vault / cloud-provider secret manager — not raw K8s Secrets in git.

Evidence to collect: Operator config.
Image provenance / signed images only
Medium

Image provenance and signed images controls require that all container images deployed in production environments be cryptographically signed by trusted publishers and verified before execution. This control enforces that only images with valid digital signatures from authorized registries or build…

How to test + evidence

Testing procedure: Admission controller (Kyverno / cosign) blocks unsigned images.

Evidence to collect: Policy + sample violation log.
Audit logs enabled at apiserver
High

This control ensures that the Kubernetes API server is configured to generate and retain comprehensive audit logs capturing all API requests, including metadata about authentication, authorization decisions, request parameters, and responses. Audit logging at the API server provides a complete…

How to test + evidence

Testing procedure: --audit-policy-file configured; logs shipped externally.

Evidence to collect: apiserver flags + log destination.