Kubernetes Security Audit

Audit a cluster across four layers: workload, identity, network, supply chain.

Workload Security

• Pod Security Standards: check namespace labels (pod-security.kubernetes.io/enforce)
• Privileged pods, hostPID/hostNetwork/hostPath usage — each needs justification
• Containers running as root; allowPrivilegeEscalation: true; missing readOnlyRootFilesystem
• securityContext set at pod and container level; capabilities dropped to minimum set

RBAC

• Enumerate bindings; find cluster-admin subjects — minimize to a named list
• Escalation paths: bind/escalate/impersonate verbs; create pods + node privileged, create pods/exec
• Service accounts: default SA used by workloads? token automount disabled where unneeded?
• Check for wildcard (*) verbs/resources in custom roles

Network