Question 1

What is Kubernetes security?

Accepted Answer

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

Question 2

What is the CKS certification?

Accepted Answer

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

Question 3

What are Kubernetes network policies?

Accepted Answer

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

Question 4

What are Pod Security Standards?

Accepted Answer

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

Question 5

What is RBAC in Kubernetes?

Accepted Answer

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

Question 6

How do I secure etcd in Kubernetes?

Accepted Answer

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

Question 7

What is a container escape attack?

Accepted Answer

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

Question 8

What tools are used for Kubernetes security scanning?

Accepted Answer

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

CVE	Severity	Projects	Disclosed	Summary
CVE-2026-41520	HIGH7.9	cilium	Apr 22, 2026	Sensitive information included in cilium-bugtool debug archive
CVE-2026-41485	HIGH7.7	kyverno	Apr 22, 2026	Kyverno Controller Denial of Service via forEach Mutation Panic
CVE-2026-41323	HIGH8.1	kyverno	Apr 15, 2026	ServiceAccount token leaked to external servers via apiCall service URL
CVE-2026-41068	HIGH7.7	kyverno	Apr 15, 2026	Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix)
CVE-2026-40868	HIGH8.1	kyverno	Apr 13, 2026	kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token
CVE-2026-4789	HIGH8.5	kyverno	Apr 13, 2026	SSRF via CEL http.Get/http.Post in NamespacedValidatingPolicy allows cross-namespace data access
CVE-2026-22039	CRITICAL10.0	kyverno	Jan 27, 2026	Kyverno Cross-Namespace Privilege Escalation via Policy apiCall
CVE-2026-23881	HIGH7.7	kyverno	Jan 27, 2026	Kyverno Denial of Service via Context Variable Amplification in Policy Engine
CVE-2025-47281	HIGH7.7	kyverno	Jul 22, 2025	Kyverno Denial of Service via Improper JMESPath Variable Evaluation
CVE-2025-47290	CRITICAL	containerd	May 20, 2025	Host filesystem access during image unpack
CVE-2025-46342	HIGH8.6	kyverno	Apr 29, 2025	Bypass of policy rules that use namespace selectors in match statements
CVE-2024-37307	HIGH7.9	cilium	Jun 13, 2024	Sensitive information leak in cilium-bugtool
CVE-2024-28860	HIGH8.0	cilium	Mar 27, 2024	Insecure IPsec transport encryption in Cilium
CVE-2024-28248	HIGH7.2	cilium	Mar 18, 2024	Intermittent HTTP policy bypass
CVE-2023-47630	HIGH7.1	kyverno	Nov 13, 2023	Attacker can cause Kyverno user to unintentionally consume insecure image
CVE-2023-29002	HIGH7.2	cilium	Apr 18, 2023	Debug mode leaks confidential data in Cilium
CVE-2022-47633	HIGH	kyverno	Dec 21, 2022	Bypass of verifyImages rule possible with malicious proxy/registry
CVE-2022-29179	HIGH7.6	cilium	May 16, 2022	User with root privileges on node can leverage permissions of Cilium ClusterRole
CVE-2021-43816	HIGH	containerd	Jan 5, 2022	containerd CRI plugin: Unprivileged pod using `hostPath` can side-step SELinux

Kubernetes CVE Tracker

How the Tracker Works