Infrastructure50 items

Kubernetes & Container Security Checklist

A pentest-oriented checklist for Kubernetes clusters and the containers running on them. Covers cluster-control-plane exposure, pod-spec hardening, network policy, runtime escape risks, and the privilege graph that ties it all together.

Aligned with the CIS Kubernetes Benchmark, NSA/CISA Kubernetes Hardening Guidance v1.2, OWASP K8s Top 10, and NIST SP 800-190.

CIS Kubernetes BenchmarkNSA/CISA Kubernetes Hardening GuidanceOWASP K8s Top 10NIST SP 800-190

Progress: 0 of 50 items

Inventory all clusters, contexts, and Kubernetes versions in scopeinfo

Production, staging, dev; managed (EKS/GKE/AKS) vs self-managed; control-plane vs node K8s version skew. Each cluster has its own attack surface.

Commands

kubectl config get-contexts

kubectl version --short

Evidence to capture

Cluster inventory with versions and managed/unmanaged flag

Define RBAC review scope and the in-scope namespacesinfo

Cluster-wide RBAC review is heavy. Agree which namespaces are in scope and whether cross-namespace privilege checks are explicitly included.

Inventory container image registries and base-image lineageinfo

A cluster is only as trustworthy as its registries. Note GHCR/ECR/GCR/Docker Hub usage and whether base images come from a hardened internal registry.

Commands

kubectl get pods -A -o jsonpath='{.items[*].spec.containers[*].image}' | tr " " "\n" | sort -u

Capture authentication providers (OIDC, IAM, certs) for the API serverhigh

Static-token auth is a red flag, OIDC + workload identity is normal. Note auth providers per-cluster.

Capture admission-controller stack (PSA, OPA Gatekeeper, Kyverno)high

Admission control is where most workload-hardening lives. Inventory enforced policies and which mode (enforce vs audit) they run in.

Commands

kubectl get validatingwebhookconfigurations

kubectl get mutatingwebhookconfigurations

References

Kubernetes - Pod Security Admission

Run kube-bench to baseline CIS Kubernetes Benchmark posturehigh

kube-bench gives a per-control pass/fail against the CIS Benchmark. Use the output as a backlog and a starting point for deeper testing.

Commands

kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml

kubectl logs -f job/kube-bench

References

kube-bench
CIS Kubernetes Benchmark

Run kube-hunter externally and inside the clusterhigh

kube-hunter is the dedicated K8s pentest scanner. Run from outside (network exposure) and as a pod (insider) to map the differential.

Commands

kube-hunter --remote <api-server>

kubectl run --rm -it --image=aquasec/kube-hunter kube-hunter --command -- /entrypoint.sh --pod

References

kube-hunter

Confirm test access (kubeconfig, namespaces, impersonation rights)info

Get explicit kubeconfigs per-role: cluster-admin (read-only audit), namespace-admin, normal-developer. Cross-role tests require all three.

Document cloud-provider integrations (IRSA, Workload Identity)high

Pod -> cloud IAM links are a major lateral path. Note the OIDC mappings in IRSA / GKE Workload Identity / Azure AD Workload Identity.

References

AWS IRSA documentation

Reference the NSA/CISA Kubernetes Hardening Guide for baselineinfo

NSA/CISA v1.2 (Aug 2022) is the de-facto baseline for kubernetes hardening. Use it as the structural lens for the engagement.

References

NSA/CISA Kubernetes Hardening Guidance v1.2

Test API server exposure to the internetcritical

Managed-control-plane endpoints often default to public. Confirm whether the API server is private-only, IP-allow-listed, or open. nmap from outside.

Commands

nmap -p 6443,443 -sV --script=ssl-cert <api-server>

Audit kubelet authentication and authorization modecritical

CIS 4.2.1 / 4.2.2. kubelet must be `--anonymous-auth=false` and `--authorization-mode=Webhook`. Anonymous kubelet was the Tesla 2018 cluster compromise.

Commands

kubectl get --raw "/api/v1/nodes/<node>/proxy/configz" | jq

Verify etcd encryption-at-rest is enabledcritical

Without encryption-at-rest, every secret in the cluster is a base64 line in etcd.db. Confirm `--encryption-provider-config` and rotate the KEK.

References

Kubernetes - Encrypting Confidential Data at Rest

Confirm audit logging is enabled with a meaningful policyhigh

CIS 1.2.20-23. Bare audit log without RequestResponse-level entries on Secrets / RoleBindings is too coarse to investigate incidents.

Verify Pod Security Admission baseline / restricted enforcementhigh

Each namespace should carry pod-security.kubernetes.io/enforce=baseline at minimum, restricted preferred for non-system workloads.

Commands

kubectl get ns -o json | jq '.items[] | {ns:.metadata.name, psa:.metadata.labels}'

References

Kubernetes Pod Security Standards

Audit cluster-admin and wildcard ClusterRoleBindingscritical

Run `kubectl get clusterrolebindings -o yaml` and look for cluster-admin granted to ServiceAccounts, dev users, or the system:authenticated group.

Commands

kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name=="cluster-admin")'

Test default-namespace and default-serviceaccount usagemedium

Workloads in the `default` namespace using the `default` ServiceAccount inherit the most-permissive defaults. Audit and migrate.

Inspect for the dashboard / kubeapps / Lens UI exposurecritical

The Kubernetes Dashboard with cluster-admin token is a one-step compromise. Confirm it is not exposed externally and uses scoped tokens.

Verify NetworkPolicy default-deny posture per-namespacehigh

Without a default-deny NetworkPolicy, every pod can reach every other pod and the metadata IP. Confirm Calico/Cilium/Antrea enforces it.

Verify control-plane components run with --profiling=falsemedium

CIS 1.1.20. /debug/pprof on kube-apiserver / kube-scheduler / kube-controller-manager has historically been an info leak. Confirm disabled.

Audit pod securityContext for runAsNonRoot, readOnlyRootFilesystemhigh

CIS 5.2 / NSA. Pods running as root with writable rootfs make container escape one CVE away. Inspect every workload`s securityContext.

Commands

kubectl get pods -A -o json | jq '.items[] | {name:.metadata.name, ns:.metadata.namespace, runAsNonRoot:.spec.securityContext.runAsNonRoot}'

Identify pods running with privileged: true or hostPID/hostNetworkcritical

Privileged pods are root on the host. Any privileged pod outside system-namespaces is an escalation hand-grenade.

Commands

kubectl get pods -A -o json | jq '.items[] | select(.spec.containers[]?.securityContext.privileged==true) | {name:.metadata.name, ns:.metadata.namespace}'

References

OWASP K8s Top 10 - K01: Insecure Workload Configurations

Audit Linux capabilities granted to containershigh

CAP_SYS_ADMIN, CAP_NET_ADMIN, CAP_SYS_PTRACE in workloads outside the kube-system namespace are warning signs. Drop ALL by default.

Identify pods with sensitive hostPath mounts (/, /var/run, /etc)critical

A hostPath mount of `/` makes container escape trivial. Any docker.sock or kubelet.sock mount is a path to cluster takeover.

Commands

kubectl get pods -A -o json | jq '.items[] | select(.spec.volumes[]?.hostPath) | {name:.metadata.name, mounts:.spec.volumes}'

Run image vulnerability scans (Trivy / Grype) on every workload imagehigh

Confirm that running images do not have unpatched critical CVEs. Trivy gives the cleanest CI-friendly output.

Commands

trivy k8s --report summary cluster

trivy image <image>:<tag> --severity HIGH,CRITICAL

References

Trivy

Verify seccomp / AppArmor profiles are applied to workloadshigh

NSA hardening guide 4.3. RuntimeDefault seccomp closes a wide class of kernel-attack-surface. Confirm at least RuntimeDefault on all non-system pods.

Audit ServiceAccount token automount on each podhigh

automountServiceAccountToken: false on every pod that does not call the API server. Otherwise any RCE in the pod = cluster API access.

Commands

kubectl get pods -A -o json | jq '.items[] | select(.spec.automountServiceAccountToken!=false) | .metadata.name' | head

Identify ServiceAccounts with cluster-wide read on secretscritical

A SA with `secrets/get` cluster-wide is effectively cluster-admin (it can read any kubeconfig token in any namespace). Audit aggressively.

Commands

kubectl auth can-i list secrets --all-namespaces --as=system:serviceaccount:<ns>:<sa>

Test NetworkPolicy isolation between sensitive namespaceshigh

Deploy a debug pod and try to reach kube-system / db namespaces. Anywhere it succeeds without policy is a lateral-movement path.

Commands

kubectl run net-test --rm -it --image=nicolaka/netshoot --restart=Never -- bash

Verify resource limits and PriorityClass disciplinemedium

Workloads without resource limits enable DoS by noisy-neighbour. Pods with system-cluster-critical priority that should not have it can starve real system pods.

Test for known container-escape CVEs against the kernel versioncritical

Dirty Pipe (CVE-2022-0847), Dirty COW (CVE-2016-5195), CVE-2024-1086 (nf_tables UAF) - confirm node kernel is patched against the latest LPE class.

Commands

kubectl get nodes -o jsonpath='{.items[*].status.nodeInfo.kernelVersion}'

References

Kubernetes Container Escape primer

Test runc / containerd known-CVE escape pathscritical

CVE-2019-5736 (runc), CVE-2024-21626 (Leaky Vessels). Capture container-runtime version and confirm the patch.

Probe ServiceAccount token theft from a compromised podcritical

From inside a pod: read /var/run/secrets/kubernetes.io/serviceaccount/token, then run kubectl --token=$T to enumerate. Log the maximum reachable verb-resource pair.

Commands

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)

kubectl --token=$TOKEN auth can-i --list

Test access to the cloud metadata IP from a podcritical

On AWS/GCP/Azure, hitting 169.254.169.254 from a pod and pulling node creds is a classic privilege escalation. Confirm IMDSv2 / hop-limit / Workload Identity.

Commands

kubectl run meta-probe --rm -it --image=curlimages/curl --restart=Never -- curl -fsS http://169.254.169.254/latest/meta-data/iam/security-credentials/

Cheat sheet · /cheat-sheets/ssrf

Audit init / sidecar containers for privilege drifthigh

A workload`s securityContext often passes review while its sidecar (Istio, log-forwarder) runs privileged. Audit each container in each pod, not just the primary.

Test for sensitive bind-mounts (docker.sock, containerd.sock, kubelet)critical

Any pod with /var/run/docker.sock or kubelet.sock mounted = node compromise on RCE. Worst-case-first triage.

Test runtime detection coverage (Falco / Tetragon / Sysdig)high

Trigger a known-bad operation (e.g. read /etc/shadow inside a pod) and confirm a runtime-detection alert fires within SLA.

Commands

kubectl exec -it <pod> -- cat /etc/shadow

References

Falco - runtime threat detection

Verify image-signature admission policy (cosign + policy-controller)high

Confirm that an unsigned image is rejected at admission. Run kubectl create -f unsigned-pod.yaml and verify denial - if it admits, the chain is broken.

Probe for privilege graph: from pod -> SA -> RoleBinding -> ClusterRoleBindinghigh

Use rakkess / rbac-tool / krane to render the actual privilege graph for each ServiceAccount. Most clusters surprise their owners on first render.

Commands

rakkess --as=system:serviceaccount:<ns>:<sa>

rbac-tool policy-rules -e '^system:serviceaccount:<ns>:<sa>$'

References

rakkess - kubectl-access-matrix
rbac-tool

Test CrashLoopBackOff / log-output info leakagemedium

Crashing pods sometimes log secrets to stdout (env-var dumps). Confirm log-aggregation does not retain plaintext secrets, and that liveness errors are scrubbed.

Produce a privilege graph + trust-boundary map of the clusterinfo

Diagram nodes -> namespaces -> ServiceAccounts -> roles -> reachable cloud IAM. This is the headline deliverable for K8s engagements.

Map findings to OWASP K8s Top 10 and CIS Benchmark IDsinfo

Both taxonomies are familiar to platform teams. Cross-tag every finding so risk-owners can dedupe across audit and pentest reports.

References

OWASP Kubernetes Top 10

Score posture against NSA/CISA Hardening Guide controlsinfo

NSA guidance is the most recognisable benchmark in regulated environments. Score per-control and surface the gaps.

Recommend admission-policy-as-code (Kyverno / OPA Gatekeeper)high

Hand back a starter policy bundle: deny privileged pods, require runAsNonRoot, deny hostPath, require signed images.

References

Kyverno
OPA Gatekeeper

Recommend default-deny NetworkPolicy and per-namespace egress controlshigh

A 5-line default-deny + a namespace-egress allow-list is the highest-leverage K8s control for limiting lateral movement.

Recommend image-signing + admission verification (cosign)high

Closes the supply-chain loop opened by the build pipeline. Tie this finding back to the CI/CD report if both engagements are in scope.

Recommend runtime-detection deployment (Falco / Tetragon)medium

Pre-prod controls cannot catch zero-days. Recommend runtime-detection as the compensating control with a baseline ruleset.

Document upgrade cadence for the kubelet/runc/containerd stackmedium

Kernel and runtime CVEs ship multiple times per year. Recommend a quarterly node-AMI / OS-image refresh cadence.

Provide evidence pack: kube-bench output, kube-hunter output, RBAC graphinfo

Attach raw artefacts so the platform team can re-run and verify after fixes. Reproducibility is a key trust signal in K8s reports.

Schedule a re-test post-remediation aligned to release cadenceinfo

Cluster configs drift on every Helm chart bump. Recommend a 90-day re-test or a continuous Kubernetes Posture Management (KPM) tool.

Kubernetes & Container Security Checklist

Pre-Engagement

Cluster Configuration

Workload Security

Runtime & Escape Risks

Reporting

Report Vulnerabilities Faster with Vulnsy