Why Kubernetes Security Matters
Kubernetes has become the de facto container orchestration platform, but its flexibility comes with a large attack surface. Misconfigurations are the #1 cause of Kubernetes security incidents, with studies showing over 90% of clusters have at least one serious misconfiguration.
25 Critical Security Checks
Pod Security
1. Enforce Pod Security Standards
Replace the deprecated PodSecurityPolicy with Pod Security Admission:
apiVersion: v1
kind: Namespace
metadata:
name: production
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/warn: restricted
2. Run as Non-Root
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
3. Drop All Capabilities
securityContext:
capabilities:
drop: ["ALL"]
add: ["NET_BIND_SERVICE"] # Only what's needed
4. Read-Only Root Filesystem
securityContext:
readOnlyRootFilesystem: true
5. Disable Privilege Escalation
securityContext:
allowPrivilegeEscalation: false
Network Security
6. Default Deny Network Policies
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes: ["Ingress", "Egress"]
7. Encrypt Pod-to-Pod Traffic with service mesh mTLS (Istio, Linkerd).
8. Restrict External Egress to only required destinations.
9. Use Network Policies Per Namespace with explicit allow rules.
10. Secure the API Server. Bind to internal IPs, require TLS, enable audit logging.
RBAC
11. Principle of Least Privilege. Grant minimal permissions per service account.
12. No Cluster-Admin for Workloads. Use namespace-scoped roles.
13. Audit RBAC Bindings regularly for over-permissioned accounts.
14. Disable Auto-Mounting Service Account Tokens
automountServiceAccountToken: false
Secrets Management
15. Use External Secrets Operators. Sync from HashiCorp Vault, AWS Secrets Manager.
16. Enable Encryption at Rest for etcd secrets.
17. Rotate Secrets Regularly with automated rotation policies.
Image Security
18. Scan Images in CI/CD before pushing to registry.
19. Use Signed Images with Cosign/Notary for supply chain integrity.
20. Pin Image Digests instead of mutable tags:
image: myapp@sha256:abc123... # Not myapp:latest
Runtime Security
21. Enable Audit Logging for API server access.
22. Use Runtime Security Tools (Falco, Tetragon) for anomaly detection.
23. Set Resource Limits to prevent DoS:
resources:
limits:
cpu: "500m"
memory: "256Mi"
24. Restrict Host Path Mounts. Never mount /, /etc, or Docker socket.
25. Enable Seccomp Profiles
securityContext:
seccompProfile:
type: RuntimeDefault
Testing with SuperClue
SuperClue does not audit cluster configuration against these 25 checks or the CIS Kubernetes Benchmarks. You can run the SuperClue SOC agent on every node as a Kubernetes DaemonSet to monitor processes, network connections, file integrity and logs, and use the DAST scanner to test the applications your cluster exposes.