Skip to main content

Pro audit program · v1.0

Kubernetes Security Quick Check

A short audit of your k8s cluster against the high-impact controls — RBAC, secrets, network policies, image trust.

  • General target area
  • CIS Kubernetes framework
  • 7 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

A short audit of your k8s cluster against the high-impact controls — RBAC, secrets, network policies, image trust.

Risks addressed

  • Critical Overly-permissive cluster-admin bindings
  • High Container running as root with hostPath mounts
  • High Secrets stored in plain envs

Controls (7)

  1. No wildcard cluster-admin bindings beyond ops team

    Critical

    No wildcard cluster-admin bindings beyond ops team

    How to test + evidence

    Testing procedure: kubectl get clusterrolebindings — review subjects.

    Evidence to collect: CRB export.

  2. RBAC: least-privilege per namespace

    High

    RBAC: least-privilege per namespace

    How to test + evidence

    Testing procedure: Sample 3 namespaces; verify roles align with workload need.

    Evidence to collect: Role / RoleBinding export.

  3. Pod Security Standards: restricted

    High

    Pod Security Standards: restricted

    How to test + evidence

    Testing procedure: Restricted PSS applied to user workload namespaces.

    Evidence to collect: Namespace labels export.

  4. NetworkPolicies in place

    High

    NetworkPolicies in place

    How to test + evidence

    Testing procedure: Default-deny NetworkPolicies + explicit allow rules per namespace.

    Evidence to collect: NetworkPolicy export.

  5. Secrets via external secret manager

    High

    Secrets via external secret manager

    How to test + evidence

    Testing procedure: External-Secrets / Vault / cloud-provider secret manager — not raw K8s Secrets in git.

    Evidence to collect: Operator config.

  6. Image provenance / signed images only

    Medium

    Image provenance / signed images only

    How to test + evidence

    Testing procedure: Admission controller (Kyverno / cosign) blocks unsigned images.

    Evidence to collect: Policy + sample violation log.

  7. Audit logs enabled at apiserver

    High

    Audit logs enabled at apiserver

    How to test + evidence

    Testing procedure: --audit-policy-file configured; logs shipped externally.

    Evidence to collect: apiserver flags + log destination.