Control plane & cluster

0/4

API server endpoint is private or IP-restrictedA public API server is the first thing scanners find.
Cluster runs a supported Kubernetes minor versionUnsupported versions stop receiving security patches.
Audit logging is enabled and shipped off-clusterWithout audit logs, you can't reconstruct who did what during an incident.
Secrets are encrypted at rest (KMS envelope encryption)etcd backups otherwise contain every secret in plain base64.

Identity & RBAC

0/5

No human or workload is bound to cluster-admin by defaultcluster-admin is full control; keep it for break-glass access only.
Roles are namespace-scoped and least-privilegeNamespace-scoped Roles limit the blast radius of a compromised identity.
Human access goes through SSO with short-lived credentialsStatic kubeconfigs with long-lived tokens get copied and leaked.
automountServiceAccountToken is disabled where pods don't call the APIA mounted token is a free credential for anyone who gets a shell in the pod.
Workloads use cloud workload identity (IRSA, Workload Identity) instead of node rolesNode-level cloud roles give every pod on the node the same permissions.

Workloads

0/4

Pod Security Admission enforces the restricted (or baseline) profileBlocks privileged pods, host namespaces, and other easy escape paths.
Containers run as non-root with a read-only root filesystemLimits what an attacker can do after exploiting the application.
Linux capabilities are dropped (drop: [ALL]) and privilege escalation is disabledMost applications need no capabilities at all.
CPU and memory requests and limits are setPrevents one compromised or runaway pod from starving the node.

Network

0/4

Default-deny NetworkPolicies exist in every namespaceBy default every pod can reach every other pod.
Egress is restricted to what workloads actually needUnrestricted egress makes data exfiltration and C2 callbacks trivial.
Pods can't reach the cloud metadata endpoint unless requiredMetadata endpoints hand out cloud credentials.
Ingress terminates TLS with automated certificate renewalExpired certificates cause outages; plaintext ingress leaks data.

Supply chain

0/4

Images are scanned in CI and builds fail on critical vulnerabilitiesCatch known vulnerabilities before they reach the cluster.
Images are referenced by digest, from trusted registries onlyMutable tags can be re-pushed with different content.
An admission policy (Kyverno, Gatekeeper) enforces image and pod rulesPolicies in CI can be bypassed; admission control can't.
Deployments happen through GitOps, not kubectl from laptopsEvery change gets a reviewer and an audit trail; drift is reverted.

Secrets

0/3

Secrets come from an external manager (Vault, cloud secret store)Keeps secrets out of Git and out of manifests.
Secrets are rotated, and rotation is testedA secret that can't be rotated quickly turns a leak into a long incident.
Sensitive values are mounted as files rather than environment variables where possibleEnvironment variables leak into logs, crash dumps, and child processes.

Detection & response

0/4

Runtime threat detection is deployed (e.g. Falco)Detects shells in containers, unexpected processes, and sensitive file access.
Alerts exist for RBAC changes, exec into pods, and failed auth spikesThese are early signals of an attacker moving through the cluster.
Cluster state and volumes are backed up, and restores are testedRansomware and accidental deletion both end at your last working restore.
An incident runbook exists for a compromised workloadDecide how to isolate and preserve evidence before you need to.

Control plane & cluster

0/4

API server endpoint is private or IP-restrictedA public API server is the first thing scanners find.
Cluster runs a supported Kubernetes minor versionUnsupported versions stop receiving security patches.
Audit logging is enabled and shipped off-clusterWithout audit logs, you can't reconstruct who did what during an incident.
Secrets are encrypted at rest (KMS envelope encryption)etcd backups otherwise contain every secret in plain base64.

Identity & RBAC

0/5

No human or workload is bound to cluster-admin by defaultcluster-admin is full control; keep it for break-glass access only.
Roles are namespace-scoped and least-privilegeNamespace-scoped Roles limit the blast radius of a compromised identity.
Human access goes through SSO with short-lived credentialsStatic kubeconfigs with long-lived tokens get copied and leaked.
automountServiceAccountToken is disabled where pods don't call the APIA mounted token is a free credential for anyone who gets a shell in the pod.
Workloads use cloud workload identity (IRSA, Workload Identity) instead of node rolesNode-level cloud roles give every pod on the node the same permissions.

Workloads

0/4

Pod Security Admission enforces the restricted (or baseline) profileBlocks privileged pods, host namespaces, and other easy escape paths.
Containers run as non-root with a read-only root filesystemLimits what an attacker can do after exploiting the application.
Linux capabilities are dropped (drop: [ALL]) and privilege escalation is disabledMost applications need no capabilities at all.
CPU and memory requests and limits are setPrevents one compromised or runaway pod from starving the node.

Network

0/4

Default-deny NetworkPolicies exist in every namespaceBy default every pod can reach every other pod.
Egress is restricted to what workloads actually needUnrestricted egress makes data exfiltration and C2 callbacks trivial.
Pods can't reach the cloud metadata endpoint unless requiredMetadata endpoints hand out cloud credentials.
Ingress terminates TLS with automated certificate renewalExpired certificates cause outages; plaintext ingress leaks data.

Supply chain

0/4

Images are scanned in CI and builds fail on critical vulnerabilitiesCatch known vulnerabilities before they reach the cluster.
Images are referenced by digest, from trusted registries onlyMutable tags can be re-pushed with different content.
An admission policy (Kyverno, Gatekeeper) enforces image and pod rulesPolicies in CI can be bypassed; admission control can't.
Deployments happen through GitOps, not kubectl from laptopsEvery change gets a reviewer and an audit trail; drift is reverted.

Secrets

0/3

Secrets come from an external manager (Vault, cloud secret store)Keeps secrets out of Git and out of manifests.
Secrets are rotated, and rotation is testedA secret that can't be rotated quickly turns a leak into a long incident.
Sensitive values are mounted as files rather than environment variables where possibleEnvironment variables leak into logs, crash dumps, and child processes.

Detection & response

0/4

Runtime threat detection is deployed (e.g. Falco)Detects shells in containers, unexpected processes, and sensitive file access.
Alerts exist for RBAC changes, exec into pods, and failed auth spikesThese are early signals of an attacker moving through the cluster.
Cluster state and volumes are backed up, and restores are testedRansomware and accidental deletion both end at your last working restore.
An incident runbook exists for a compromised workloadDecide how to isolate and preserve evidence before you need to.

Kubernetes security checklist

Control plane & cluster

Identity & RBAC

Workloads

Network

Supply chain

Secrets

Detection & response

Kubernetes security checklist

Control plane & cluster

Identity & RBAC

Workloads

Network

Supply chain

Secrets

Detection & response