Question 1

What is Kubernetes security?

Accepted Answer

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

Question 2

What is the CKS certification?

Accepted Answer

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

Question 3

What are Kubernetes network policies?

Accepted Answer

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

Question 4

What are Pod Security Standards?

Accepted Answer

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

Question 5

What is RBAC in Kubernetes?

Accepted Answer

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

Question 6

How do I secure etcd in Kubernetes?

Accepted Answer

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

Question 7

What is a container escape attack?

Accepted Answer

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

Question 8

What tools are used for Kubernetes security scanning?

Accepted Answer

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

#	CVE	Severity	Projects	Disclosed	Published	Summary
1	GHSA-vjfx-fp68-rh4v	CRITICAL	kyverno	Oct 23, 2026	Oct 23, 2026	Generate authorization skipped entirely when target kind/namespace is a variable - Critical
2	GHSA-39w8-hv5g-f73w	CRITICAL9.9	kyverno	Oct 23, 2026	Oct 23, 2026	Cluster-admin escalation via a malformed percent-escape bypass of the v1.19.1 apiCall namespace clamp
3	GHSA-fr24-3hvf-393q	HIGH7.5	kyverno	Oct 21, 2026	Oct 22, 2026	Unbounded decompression in notary signature fetch enables memory exhaustion
4	GHSA-3f2c-hfj8-542w	HIGH7.5	kyverno	Oct 21, 2026	Oct 22, 2026	Unbounded decompression in notary attestation statement extraction enables memory exhaustion
5	GHSA-2r43-6962-xcw5	CRITICAL9.1	kyverno	Oct 21, 2026	Oct 22, 2026	Kyverno verifyImages caches verification results without binding to verified digest, enabling tag-move bypass
6	GHSA-493q-9xvg-9xf3	HIGH	kyverno	Oct 21, 2026	Oct 22, 2026	generate.clone/cloneList.namespace has no namespace restriction, allowing cross-tenant resource read (sibling of CVE-2026-22039/GHSA-cvq5)
7	GHSA-r2p2-3892-5jjf	HIGH	kyverno	Oct 21, 2026	Oct 22, 2026	Denial-of-Service via panic in In/NotIn operator when evaluating non-string JMESPath array values
8	GHSA-24cc-9745-hxfc	HIGH	kyverno	Oct 21, 2026	Oct 22, 2026	Remote panic in image-attestation parsing leads to image-verification bypass and reports-controller crash-loop
9	GHSA-fcfr-fr8g-qjqv	HIGH7.7	kyverno	Oct 21, 2026	Oct 22, 2026	cosign identity check (subject / subjectRegExp) is skipped when the signing cert has no SAN
10	GHSA-rcxg-3f92-3mgr	CRITICAL9.9	kyverno	Oct 21, 2026	Oct 22, 2026	Improper scope enforcement in CleanupPolicy API calls enables privilege escalation