---
# === IDENTITY ===
id: software/security/kubernetes-security/2026
canonical_question: "What is the Kubernetes security checklist?"
aliases:
  - "Kubernetes security best practices"
  - "K8s cluster hardening checklist"
  - "how to secure a Kubernetes cluster"
  - "Kubernetes RBAC network policy pod security"
  - "CIS Kubernetes Benchmark controls"
  - "NSA CISA Kubernetes hardening guide"
  - "Kubernetes security audit checklist"
  - "K8s production security configuration"
entity_type: software_reference
domain: software > security > Kubernetes Security
region: global
jurisdiction: global
temporal_scope: 2024-2026

# === VERIFICATION ===
last_verified: 2026-02-27
confidence: 0.94
version: 1.0
first_published: 2026-02-27

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: stable
  last_breaking_change: "Pod Security Standards replace PodSecurityPolicy (removed in K8s 1.25, Oct 2022); Validating Admission Policy GA in K8s 1.30 (Apr 2024); User namespaces stable in K8s 1.34 (2025)"
  next_review: 2026-08-26
  change_sensitivity: medium

# === CONSTRAINTS ===
constraints:
  - "NEVER run workloads as root unless absolutely required -- enforce runAsNonRoot: true and drop ALL capabilities"
  - "NEVER leave etcd unencrypted or accessible without mTLS -- write access to etcd equals root on the entire cluster"
  - "NEVER use the system:masters group for regular authentication -- reserve for break-glass emergency access only"
  - "ALWAYS apply default-deny NetworkPolicies in every namespace before deploying workloads"
  - "NEVER store secrets in plaintext in manifests or environment variables -- use encryption at rest and external secret managers"
  - "ALWAYS run the latest supported Kubernetes minor version -- only the 3 most recent minors receive security patches"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "Need Docker/container image security only, not cluster-level Kubernetes security"
    use_instead: "software/security/container-image-security/2026"
  - condition: "Need cloud provider-specific security (AWS EKS, GKE, AKS) rather than generic Kubernetes"
    use_instead: "software/security/cloud-kubernetes-security/2026"
  - condition: "Need application-level web security (XSS, CSRF, SQL injection)"
    use_instead: "software/security/xss-prevention/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: "environment"
    question: "What is your Kubernetes deployment environment?"
    type: choice
    options: ["Self-managed (kubeadm/bare metal)", "AWS EKS", "Google GKE", "Azure AKS", "Other managed"]
  - key: "security_focus"
    question: "Which security area is your primary concern?"
    type: choice
    options: ["RBAC & access control", "Network policies", "Pod security", "Secrets management", "Image scanning", "Runtime monitoring", "Audit logging", "Full checklist"]

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/software/security/kubernetes-security/2026"
suggested_citation: "Source: knowledgelib.io -- AI Knowledge Library (verified 2026-02-27)"

# === RELATED UNITS ===
related_kos:
  depends_on: []
  related_to:
    - id: "software/security/xss-prevention/2026"
      label: "XSS Prevention Guide"
    - id: "software/security/container-image-security/2026"
      label: "Container Image Security"
  solves: []
  alternative_to: []
  often_confused_with:
    - id: "software/security/cloud-kubernetes-security/2026"
      label: "Cloud-Managed Kubernetes Security (EKS/GKE/AKS)"

# === SOURCES (8 authoritative sources) ===
# Types: official_docs, technical_blog, rfc_spec, academic_paper, community_resource, industry_report
# Reliability: high, moderate_high, moderate, moderate_low, low, authoritative
sources:
  - id: src1
    title: "Security Checklist"
    author: Kubernetes Project
    url: https://kubernetes.io/docs/concepts/security/security-checklist/
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
  - id: src2
    title: "Kubernetes Security Cheat Sheet"
    author: OWASP Foundation
    url: https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html
    type: community_resource
    published: 2025-03-01
    reliability: authoritative
  - id: src3
    title: "Kubernetes Hardening Guide v1.2"
    author: NSA/CISA
    url: https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF
    type: industry_report
    published: 2022-08-29
    reliability: authoritative
  - id: src4
    title: "CIS Kubernetes Benchmarks"
    author: Center for Internet Security
    url: https://www.cisecurity.org/benchmark/kubernetes
    type: industry_report
    published: 2025-06-01
    reliability: authoritative
  - id: src5
    title: "Pod Security Standards"
    author: Kubernetes Project
    url: https://kubernetes.io/docs/concepts/security/pod-security-standards/
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
  - id: src6
    title: "Kubernetes Security: 2025 Stable Features and 2026 Preview"
    author: CNCF
    url: https://www.cncf.io/blog/2025/12/15/kubernetes-security-2025-stable-features-and-2026-preview/
    type: technical_blog
    published: 2025-12-15
    reliability: high
  - id: src7
    title: "OWASP Kubernetes Top Ten"
    author: OWASP Foundation
    url: https://owasp.org/www-project-kubernetes-top-ten/
    type: community_resource
    published: 2024-06-01
    reliability: high
  - id: src8
    title: "Falco - Cloud Native Runtime Security"
    author: Falco Project / CNCF
    url: https://falco.org/docs/
    type: official_docs
    published: 2025-09-01
    reliability: high
---

# Kubernetes Security Checklist: Cluster Hardening Guide

## TL;DR

- **Bottom line**: Kubernetes security requires defense-in-depth across 8 domains: RBAC, network policies, pod security standards, secrets encryption, image scanning, API server hardening, etcd protection, and audit logging -- no single control is sufficient.
- **Key tool/command**: `kubectl auth can-i --list --as=system:serviceaccount:ns:sa` to audit RBAC permissions; `kube-bench run` to check CIS Benchmark compliance.
- **Watch out for**: Default Kubernetes allows all pod-to-pod communication and runs containers as root -- you must explicitly apply NetworkPolicies and Pod Security Standards to every namespace.
- **Works with**: Kubernetes 1.28+ (Pod Security Admission GA). CIS Benchmark covers 1.29-1.31. NSA/CISA guide applies to all versions. Falco 0.37+.

## Constraints
<!-- Agents: read this section before recommending any action from this unit.
     These are hard constraints that must not be violated. -->

- NEVER run workloads as root unless absolutely required -- enforce runAsNonRoot: true and drop ALL capabilities
- NEVER leave etcd unencrypted or accessible without mTLS -- write access to etcd equals root on the entire cluster
- NEVER use the system:masters group for regular authentication -- reserve for break-glass emergency access only
- ALWAYS apply default-deny NetworkPolicies in every namespace before deploying workloads
- NEVER store secrets in plaintext in manifests or environment variables -- use encryption at rest and external secret managers
- ALWAYS run the latest supported Kubernetes minor version -- only the 3 most recent minors receive security patches

## Quick Reference

| # | Security Domain | Risk Level | Key Control | Verification Command |
|---|---|---|---|---|
| 1 | RBAC | Critical | Least-privilege Roles; no system:masters for users | `kubectl auth can-i --list --as=<user>` |
| 2 | Network Policies | Critical | Default-deny ingress/egress in every namespace | `kubectl get networkpolicy -A` |
| 3 | Pod Security Standards | Critical | Enforce `restricted` or `baseline` per namespace | `kubectl label ns <ns> pod-security.kubernetes.io/enforce=restricted` |
| 4 | Secrets Management | Critical | Encryption at rest; external secret manager (Vault, AWS SM) | `kubectl get secrets -o yaml` (check no plaintext) |
| 5 | Image Security | High | Scan images in CI; allow only signed/trusted images | `trivy image <image:tag>` |
| 6 | API Server | Critical | Disable anonymous auth; enable audit logging; use OIDC | `curl -k https://<api>:6443/healthz` (should require auth) |
| 7 | etcd | Critical | mTLS; isolate behind firewall; encrypt at rest | `etcdctl endpoint health --cluster` |
| 8 | Audit Logging | High | Enable audit policy; protect log storage | `--audit-policy-file` flag on kube-apiserver |
| 9 | Runtime Security | High | Deploy Falco or equivalent; detect anomalous syscalls | `kubectl logs -n falco -l app=falco` |
| 10 | Resource Limits | Medium | Set CPU/memory requests and limits on all pods | `kubectl describe resourcequota -A` |
| 11 | Node Security | High | Seccomp + AppArmor/SELinux; isolate sensitive workloads | `kubectl get pod -o jsonpath='{.spec.securityContext}'` |
| 12 | Service Mesh / mTLS | Medium | Encrypt all in-cluster traffic with mutual TLS | `istioctl analyze` or mesh-specific check |

## Decision Tree

```
START: What is your primary Kubernetes security concern?
├── Setting up a new cluster from scratch?
│   ├── YES → Follow full checklist: Steps 1-8 below
│   └── NO ↓
├── Hardening an existing production cluster?
│   ├── YES → Run kube-bench first (Step 1), then fix gaps by priority
│   └── NO ↓
├── Investigating a specific security domain?
│   ├── RBAC → Step 2 (RBAC) + Anti-Pattern #1
│   ├── Network → Step 3 (NetworkPolicies)
│   ├── Pod Security → Step 4 (Pod Security Standards)
│   ├── Secrets → Step 5 (Secrets Management)
│   ├── Images → Step 6 (Image Security)
│   ├── Runtime → Step 7 (Runtime Monitoring)
│   └── Audit → Step 8 (Audit Logging)
├── Preparing for compliance audit (CIS/SOC2/PCI)?
│   ├── YES → Run kube-bench + review CIS Benchmark sections
│   └── NO ↓
└── DEFAULT → Start with kube-bench scan, address Critical findings first
```

## Step-by-Step Guide

### 1. Run CIS Benchmark assessment with kube-bench

Establish a security baseline by running kube-bench against the CIS Kubernetes Benchmark. This identifies misconfigurations across all control plane and worker node components. [src4]

```bash
# Run kube-bench as a Kubernetes Job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench
```

**Verify**: Review output for `[FAIL]` items -- these are CIS Benchmark violations that need remediation. Expected: zero FAIL items for a hardened cluster.

### 2. Configure least-privilege RBAC

Implement Role-Based Access Control with the principle of least privilege. Use namespace-scoped Roles (not ClusterRoles) wherever possible. Never bind to cluster-admin for regular operations. [src1]

```yaml
# Role: Allow read-only access to pods in a specific namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
---
# RoleBinding: Bind the role to a specific group
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: production
  name: read-pods-binding
subjects:
- kind: Group
  name: "developers"
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
```

**Verify**: `kubectl auth can-i create pods --as=developer1 -n production` --> expected output: `no`

### 3. Apply default-deny NetworkPolicies

By default, Kubernetes allows all pod-to-pod communication. Apply default-deny policies in every namespace, then explicitly allow required traffic flows. [src2]

```yaml
# Default deny all ingress and egress in namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}     # Selects ALL pods in namespace
  policyTypes:
  - Ingress
  - Egress
---
# Allow frontend to reach backend on port 8080 only
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080
```

**Verify**: `kubectl exec -n production frontend-pod -- curl backend:8080` --> should succeed. `kubectl exec -n production other-pod -- curl backend:8080` --> should timeout (blocked by policy).

### 4. Enforce Pod Security Standards

Apply Pod Security Standards (PSS) at the namespace level using Pod Security Admission. Use `restricted` for security-critical workloads, `baseline` for general workloads. [src5]

```yaml
# Label namespace to enforce restricted Pod Security Standard
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
# Pod that meets the restricted standard
apiVersion: v1
kind: Pod
metadata:
  name: secure-app
  namespace: production
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      capabilities:
        drop:
        - ALL
    resources:
      requests:
        memory: "128Mi"
        cpu: "100m"
      limits:
        memory: "128Mi"
        cpu: "200m"
```

**Verify**: Try deploying a privileged pod --> `kubectl run test --image=nginx --privileged -n production` --> expected: rejected by Pod Security Admission.

### 5. Secure secrets with encryption at rest

Enable Kubernetes secret encryption at rest and use external secret managers for production. Never commit secrets in manifests or use environment variables for sensitive data. [src3]

```yaml
# EncryptionConfiguration for kube-apiserver
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
  - resources:
    - secrets
    providers:
    - aescbc:
        keys:
        - name: key1
          secret: <base64-encoded-32-byte-key>
    - identity: {}  # Fallback for reading unencrypted secrets
```

Pass to API server: `--encryption-provider-config=/etc/kubernetes/encryption-config.yaml`

```bash
# Verify secrets are encrypted in etcd
ETCDCTL_API=3 etcdctl get /registry/secrets/default/my-secret \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key | hexdump -C
# Should show encrypted data, not plaintext
```

**Verify**: The hexdump output should show the encryption prefix (`k8s:enc:aescbc:v1:key1:`), not readable secret values.

### 6. Implement image scanning in CI/CD

Scan container images for vulnerabilities before deployment. Block images with critical/high CVEs. Use admission controllers to enforce image policies. [src2]

```bash
# Scan image with Trivy in CI pipeline
trivy image --severity CRITICAL,HIGH --exit-code 1 myregistry/myapp:latest
# Exit code 1 = vulnerabilities found, fails CI build

# Scan running cluster images
trivy k8s --report summary cluster
```

**Verify**: `trivy image myapp:latest --severity CRITICAL` --> expected: 0 critical vulnerabilities for approved images.

### 7. Deploy runtime security monitoring (Falco)

Install Falco to detect anomalous runtime behavior: shell execution in containers, unexpected file access, privilege escalation attempts. [src8]

```bash
# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/..."
```

**Verify**: `kubectl logs -n falco -l app.kubernetes.io/name=falco` --> should show Falco running and processing events.

### 8. Enable Kubernetes audit logging

Configure API server audit logging to track all authentication, authorization, and resource operations. Retain logs for compliance and incident response. [src1]

```yaml
# Audit policy: log auth failures and sensitive operations
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  # Log authentication failures at RequestResponse level
  - level: RequestResponse
    resources:
    - group: ""
      resources: ["secrets", "configmaps"]
  # Log all changes to RBAC
  - level: RequestResponse
    resources:
    - group: "rbac.authorization.k8s.io"
      resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
  # Log pod creation/deletion
  - level: Request
    resources:
    - group: ""
      resources: ["pods"]
    verbs: ["create", "delete"]
  # Metadata for everything else
  - level: Metadata
    omitStages:
    - RequestReceived
```

Pass to API server: `--audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-log-path=/var/log/kubernetes/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10`

**Verify**: `cat /var/log/kubernetes/audit.log | jq '.verb + " " + .objectRef.resource' | head` --> should show recent API operations.

## Code Examples

### YAML: Complete RBAC Configuration for a Microservice

> Full script: [yaml-complete-rbac-configuration-for-a-microservic.yml](scripts/yaml-complete-rbac-configuration-for-a-microservic.yml) (39 lines)

```yaml
# Input:  A microservice "order-service" that needs to read ConfigMaps and Secrets in its namespace
# Output: Least-privilege RBAC with separate service account
apiVersion: v1
kind: ServiceAccount
metadata:
# ... (see full script)
```

### YAML: Comprehensive NetworkPolicy for Multi-Tier App

> Full script: [yaml-comprehensive-networkpolicy-for-multi-tier-ap.yml](scripts/yaml-comprehensive-networkpolicy-for-multi-tier-ap.yml) (39 lines)

```yaml
# Input:  Three-tier app (frontend, backend, database) in "production" namespace
# Output: NetworkPolicies allowing only required communication paths
# Backend: accept traffic from frontend on 8080, connect to database on 5432
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
# ... (see full script)
```

### Falco: Custom Runtime Security Rules

> Full script: [falco-custom-runtime-security-rules.yml](scripts/falco-custom-runtime-security-rules.yml) (46 lines)

```yaml
# Input:  Kubernetes cluster with security monitoring requirements
# Output: Falco rules detecting common attack patterns
# Detect shell execution inside containers (potential RCE)
- rule: Shell Spawned in Container
  desc: Detect shell (bash, sh, zsh) execution inside a container
# ... (see full script)
```

### Bash: Automated Security Audit Script

> Full script: [bash-automated-security-audit-script.sh](scripts/bash-automated-security-audit-script.sh) (31 lines)

```bash
#!/usr/bin/env bash
# Input:  Access to a Kubernetes cluster via kubectl
# Output: Security posture report highlighting misconfigurations
set -euo pipefail
echo "=== Kubernetes Security Audit ==="
# ... (see full script)
```

## Anti-Patterns

### Wrong: Granting cluster-admin to application service accounts

```yaml
# BAD -- cluster-admin gives full control over the entire cluster
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: app-admin
subjects:
- kind: ServiceAccount
  name: my-app
  namespace: default
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
```

### Correct: Scoped Role with minimum required permissions

```yaml
# GOOD -- namespace-scoped Role with only the permissions the app needs
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: my-app-ns
  name: my-app-role
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["my-app-config"]
  verbs: ["get", "watch"]
```

### Wrong: No NetworkPolicy (default allow-all)

```yaml
# BAD -- no NetworkPolicy means any pod can reach any other pod
# This is the default Kubernetes behavior
# (No manifest needed -- this is what you get by doing nothing)
```

### Correct: Default-deny with explicit allow rules

```yaml
# GOOD -- default deny everything, then allow specific traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
```

### Wrong: Running containers as root with all capabilities

```yaml
# BAD -- running as root with privilege escalation enabled
apiVersion: v1
kind: Pod
metadata:
  name: insecure-pod
spec:
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      privileged: true
      runAsUser: 0
```

### Correct: Non-root with dropped capabilities and read-only filesystem

```yaml
# GOOD -- restricted security context following Pod Security Standards
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  containers:
  - name: app
    image: myapp:1.0.0
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop: ["ALL"]
```

### Wrong: Storing secrets as environment variables from plaintext manifests

```yaml
# BAD -- secrets in plaintext in the manifest, exposed via env vars
apiVersion: v1
kind: Pod
metadata:
  name: app
spec:
  containers:
  - name: app
    image: myapp:latest
    env:
    - name: DB_PASSWORD
      value: "super-secret-password"  # Plaintext in manifest!
```

### Correct: External secret manager with volume mount

> Full script: [correct-external-secret-manager-with-volume-mount.yml](scripts/correct-external-secret-manager-with-volume-mount.yml) (34 lines)

```yaml
# GOOD -- secrets managed by External Secrets Operator, mounted as files
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: db-credentials
# ... (see full script)
```

## Common Pitfalls

- **Auto-mounted service account tokens**: Every pod gets a service account token by default, expanding the blast radius if compromised. Fix: Set `automountServiceAccountToken: false` on ServiceAccounts and Pods, then explicitly mount only where needed. [src1]
- **Wildcard RBAC rules**: Using `resources: ["*"]` or `verbs: ["*"]` grants far more access than intended. Fix: Enumerate specific resources and verbs; use `resourceNames` to restrict to specific objects. [src2]
- **Missing egress NetworkPolicies**: Teams apply ingress rules but forget egress, allowing compromised pods to exfiltrate data. Fix: Apply both ingress AND egress default-deny, then explicitly allow required outbound traffic including DNS (UDP 53). [src3]
- **Pod Security Standards only in warn mode**: Setting `pod-security.kubernetes.io/warn` without `enforce` logs violations but does not block non-compliant pods. Fix: Use `enforce` mode with `audit` and `warn` for full protection. [src5]
- **etcd accessible without mTLS**: Exposing etcd without mutual TLS allows anyone with network access to read all cluster data including secrets. Fix: Configure `--peer-cert-file`, `--peer-key-file`, `--peer-client-cert-auth=true` on etcd. [src2]
- **Stale RBAC bindings for departed team members**: Users who leave the organization retain cluster access if RBAC bindings are not cleaned up. Fix: Implement periodic access reviews (at least every 24 months per official checklist); use OIDC with IdP integration for automatic deprovisioning. [src1]
- **Cloud metadata API exposure**: Pods can access cloud metadata at 169.254.169.254 to steal instance credentials. Fix: Block metadata API access via NetworkPolicy egress rules or use cloud-specific controls (AWS IMDSv2, GKE Workload Identity). [src3]
- **Running kube-bench but not acting on results**: Teams run CIS Benchmark scans but fail to remediate findings. Fix: Integrate kube-bench into CI/CD with threshold-based gating (zero FAIL items for Critical/High). [src4]

## Diagnostic Commands

```bash
# Run CIS Benchmark check
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs job/kube-bench

# Audit RBAC permissions for a service account
kubectl auth can-i --list --as=system:serviceaccount:production:my-app -n production

# Check which namespaces have Pod Security Standards enforced
kubectl get ns -o json | jq -r '.items[] | "\(.metadata.name): \(.metadata.labels["pod-security.kubernetes.io/enforce"] // "NONE")"'

# List NetworkPolicies across all namespaces
kubectl get networkpolicy -A

# Check for pods running as root
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.containers[].securityContext.runAsUser == 0 or .spec.securityContext.runAsNonRoot != true) | "\(.metadata.namespace)/\(.metadata.name)"'

# Verify etcd encryption is enabled
kubectl get apiserver -o=jsonpath='{.items[0].spec.encryption.resources}'

# Check API server audit log status
kubectl logs -n kube-system kube-apiserver-<node> | grep "audit" | tail -5

# Scan cluster images for vulnerabilities
trivy k8s --report summary cluster

# Check Falco runtime alerts
kubectl logs -n falco -l app.kubernetes.io/name=falco --tail=50

# List all ClusterRoleBindings to cluster-admin (should be minimal)
kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name == "cluster-admin") | "\(.metadata.name): \(.subjects[].name)"'

# Check for pods with hostNetwork, hostPID, or hostIPC enabled
kubectl get pods -A -o json | jq -r '.items[] | select(.spec.hostNetwork == true or .spec.hostPID == true or .spec.hostIPC == true) | "\(.metadata.namespace)/\(.metadata.name)"'
```

## Version History & Compatibility

| Kubernetes Version | Status | Key Security Features |
|---|---|---|
| 1.34-1.35 (2025) | Current | User namespaces GA; finer-grained authorization via selectors; restricted anonymous requests; pod certificates for mTLS (beta) |
| 1.30-1.33 (2024-2025) | Supported | Validating Admission Policy GA; bound SA token improvements; recursive read-only mounts; sidecar containers stable |
| 1.28-1.29 (2023-2024) | LTS | Pod Security Admission GA; seccomp RuntimeDefault GA |
| 1.25 (2022) | EOL | PodSecurityPolicy removed -- must migrate to Pod Security Standards |
| Pre-1.25 | EOL | Used PodSecurityPolicy (PSP) -- no longer supported |

| Tool | Version | Purpose |
|---|---|---|
| kube-bench | 0.8.x | CIS Benchmark compliance scanning (supports K8s 1.29-1.31) |
| Falco | 0.37+ | Runtime threat detection (syscall + k8s_audit) |
| Trivy | 0.50+ | Image + cluster vulnerability scanning |
| OPA/Gatekeeper | 3.16+ | Policy enforcement via admission controller |
| Kyverno | 1.12+ | Kubernetes-native policy management |

## When to Use / When Not to Use

| Use When | Don't Use When | Use Instead |
|---|---|---|
| Deploying any production Kubernetes cluster | Running local dev cluster (minikube, kind) with no sensitive data | Basic kubectl access controls only |
| Preparing for SOC 2, PCI DSS, or HIPAA compliance | Using serverless containers (Fargate, Cloud Run) without K8s | Cloud provider's native security controls |
| Multi-tenant clusters sharing infrastructure | Single-tenant cluster with full trust between all workloads | Simplified RBAC + network policies may suffice |
| Clusters exposed to the internet (ingress controllers) | Air-gapped clusters with no external access | Focus on internal controls; network policies less critical |
| Running untrusted workloads or third-party containers | Running only internally-built, fully-trusted images | Standard Pod Security Standards + image scanning |

## Important Caveats

- CIS Benchmark recommendations vary significantly between self-managed clusters (kubeadm) and managed services (EKS, GKE, AKS) -- many control plane settings are not configurable on managed platforms
- NetworkPolicies require a CNI plugin that supports them (Calico, Cilium, Weave Net) -- the default kubenet CNI does NOT enforce NetworkPolicies
- Pod Security Standards enforcement only prevents creation of non-compliant pods -- it does not retroactively terminate existing non-compliant pods already running
- Kubernetes secrets are only base64-encoded by default, NOT encrypted -- encryption at rest must be explicitly configured via EncryptionConfiguration
- Falco and similar runtime tools add CPU overhead (~1-5%) on each node -- plan capacity accordingly
- RBAC authorization cannot be granular at the individual Pod level -- authorization applies to all Pods of a resource type within the namespace scope

## Related Units
<!-- Generated from related_kos frontmatter -->

- [XSS Prevention Guide](/software/security/xss-prevention/2026)
- [Container Image Security](/software/security/container-image-security/2026)
- [Cloud-Managed Kubernetes Security (EKS/GKE/AKS)](/software/security/cloud-kubernetes-security/2026)