Skip to main content
4 min read·694 words

Kubernetes Security Checklist

Required knowledge for the CKS certification.

This checklist is a practical, end-to-end set of controls for securing a production Kubernetes cluster. It is organized around the six domains of the Certified Kubernetes Security Specialist (CKS) exam, so it doubles as a revision aid and a real-world hardening baseline. Each item links to an in-depth article that explains the control, the attack it prevents, and the exact configuration.

Work through the checklist top to bottom for a new cluster, or use it as a periodic audit of an existing one. The controls are layered deliberately — defense in depth means no single item is sufficient on its own.

1. Cluster Setup (15%)​

  • Apply default-deny network policies — isolate namespaces and deny all ingress/egress by default, then allow only required flows. Network Policies
  • Restrict and encrypt egress — control which workloads can reach external endpoints. Egress Control
  • Secure ingress and terminate TLS correctly — avoid annotation/config injection and enforce HTTPS. Ingress Security
  • Benchmark the cluster against the CIS Kubernetes Benchmark — run kube-bench and remediate failed controls. CIS Benchmark with kube-bench
  • Protect etcd — enable encryption at rest, mutual TLS, and strict access control for the cluster datastore. etcd Security

2. Cluster Hardening (15%)​

  • Enforce least-privilege RBAC — eliminate wildcard verbs/resources and cluster-admin bindings; grant only what each subject needs. Securing RBAC Permissions
  • Lock down service account tokens — disable unnecessary automount and avoid long-lived tokens. Service Account Token Security
  • Restrict anonymous API server access — ensure --anonymous-auth=false where appropriate. Anonymous API Access
  • Configure admission control — use validating/mutating admission policies or a policy engine to reject insecure workloads. Admission Controller Hardening
  • Harden the kubelet — require authentication and authorization, and disable the read-only port. Kubelet Security

3. System Hardening (10%)​

  • Reduce the node attack surface — minimize installed packages, close unused ports, and restrict node access to authorized operators.
  • Apply seccomp profiles — constrain the syscalls containers can make, starting from RuntimeDefault. Seccomp in Pods
  • Use mandatory access control — apply AppArmor or SELinux profiles to confine container behavior at the host level.
  • Scope cloud IAM to the node — avoid broad instance roles that a compromised pod could abuse.

4. Minimize Microservice Vulnerabilities (20%)​

5. Supply Chain Security (20%)​

  • Scan images for vulnerabilities — fail builds and admission on critical CVEs. Trivy
  • Sign and verify images — require signatures so only trusted artifacts run. Cosign
  • Apply supply-chain best practices — use minimal base images, pin digests, generate an SBOM, and pull only from trusted registries. Supply Chain Best Practices
  • Enforce provenance at admission — reject unsigned or unscanned images with an admission policy. Admission Controller Hardening

6. Monitoring, Logging & Runtime Security (20%)​

  • Enable audit logging — capture API server activity with a tuned audit policy and ship logs to durable storage. Kubernetes Audit Logging
  • Detect threats at runtime — alert on anomalous syscalls and behavior with an eBPF-based sensor. Falco · Tetragon
  • Scan running workloads — continuously assess deployed images and configuration, not just the CI pipeline.
  • Prepare for incident response — define escalation, forensics, and rollback procedures before an incident occurs.

How to Use This Checklist​

Treat the checklist as a living control set rather than a one-time task:

Issue: Clusters drift as workloads, nodes, and RBAC bindings change over time.
Fix: Re-run the checklist on a schedule, automate the mechanical controls (kube-bench, image scanning, admission policies), and gate changes through CI so regressions are caught before they reach production.

For the full catalog of attacks these controls prevent, see the attack vectors index. For the deep-dive mitigations, see the best practices section, and for the tooling, the Kubernetes security tools guide.

References​

This article is based on information from the following official sources:

  1. Kubernetes Security Concepts - Kubernetes
  2. Pod Security Standards - Kubernetes
  3. Using RBAC Authorization - Kubernetes
  4. CIS Kubernetes Benchmark - Center for Internet Security