Kubernetes Security Assessment Methodology
READ-ONLY Kubernetes security assessment using kubectl CLI. No resources are created, modified, or deleted — all checks use get/list/describe/auth can-i verbs only. Based on CIS Kubernetes Benchmark v1.8+.
Prerequisites
- kubectl installed —
kubectl version --client
- kubeconfig with read access — cluster-viewer or equivalent ClusterRole
- Verify read-only — ALWAYS run
k8s_audit verify_readonly first
# Quick prerequisite check
kubectl version --client # verify kubectl
kubectl cluster-info # verify cluster access
kubectl auth can-i list pods --all-namespaces # verify read access
Assessment Phases
Phase 0 — Safety Check (MANDATORY FIRST STEP)
k8s_audit verify_readonly
Confirms current identity has no write/modify/delete permissions via kubectl auth can-i. If write permissions are detected, STOP and request a read-only kubeconfig.
Phase 1 — RBAC Analysis
| Check |
Command |
CIS Benchmark |
| cluster-admin bindings |
k8s_audit rbac_audit |
5.1.1 |
| Wildcard ClusterRoles |
k8s_audit rbac_audit |
5.1.3 |
| Default SA permissions |
k8s_audit rbac_audit --namespace NS |
5.1.5 |
Phase 2 — Pod Security
| Check |
Command |
CIS Benchmark |
| Privileged containers |
k8s_audit pod_security_audit |
5.2.1 |
| hostPID / hostNetwork |
k8s_audit pod_security_audit |
5.2.2, 5.2.3 |
| Dangerous capabilities |
k8s_audit pod_security_audit |
5.2.7-9 |
| Root execution |
k8s_audit pod_security_audit |
5.2.6 |
| hostPath mounts |
k8s_audit pod_security_audit |
5.2.13 |
Phase 3 — Network Security
| Check |
Command |
CIS Benchmark |
| Missing NetworkPolicies |
k8s_audit network_policy_audit |
5.3.2 |
| Default deny policies |
k8s_audit network_policy_audit |
5.3.2 |
| Ingress TLS |
k8s_audit ingress_audit |
— |
| Ingress snippet injection |
k8s_audit ingress_audit |
— |
Phase 4 — Secrets & Encryption
| Check |
Command |
CIS Benchmark |
| Secret types & counts |
k8s_audit secrets_audit |
5.4.1 |
| Secrets as env vars |
k8s_audit secrets_audit |
5.4.1 |
| etcd encryption |
k8s_audit secrets_audit |
1.2.29-30 |
Phase 5 — API Server & Infrastructure
| Check |
Command |
CIS Benchmark |
| Anonymous auth |
k8s_audit api_server_audit |
1.2.1 |
| Insecure port |
k8s_audit api_server_audit |
1.2.19 |
| Admission controllers |
k8s_audit api_server_audit |
1.2.11-16 |
| Audit logging |
k8s_audit api_server_audit |
1.2.17-18 |
Phase 6 — Workload Hardening
| Check |
Command |
CIS Benchmark |
| Resource limits |
k8s_audit resource_limits_audit |
5.4.1 |
| LimitRange/ResourceQuota |
k8s_audit resource_limits_audit |
— |
| Image tags |
k8s_audit image_audit |
— |
| Untrusted registries |
k8s_audit image_audit |
— |
| SA auto-mount tokens |
k8s_audit serviceaccount_audit |
5.1.5-6 |
Program Reference
| Program |
Checks |
CIS Section |
| verify_readonly |
Write permission detection |
— |
| rbac_audit |
cluster-admin, wildcards, default SA |
5.1.x |
| network_policy_audit |
Missing policies, default deny |
5.3.x |
| pod_security_audit |
Privileged, hostPID, capabilities, root |
5.2.x |
| secrets_audit |
Secret types, env exposure, etcd encryption |
1.2.29, 5.4.x |
| image_audit |
Latest tags, pull policy, untrusted registries |
— |
| api_server_audit |
Anonymous auth, insecure port, admission, audit |
1.2.x |
| resource_limits_audit |
CPU/memory limits, LimitRange, ResourceQuota |
5.4.x |
| ingress_audit |
TLS, wildcard hosts, snippet injection |
— |
| serviceaccount_audit |
Auto-mount tokens, cluster-admin SAs, unused SAs |
5.1.x |
1---2name: k8s-assessment3description: READ-ONLY Kubernetes security assessment based on CIS Kubernetes Benchmark using kubectl4---56# Kubernetes Security Assessment Methodology78READ-ONLY Kubernetes security assessment using kubectl CLI. No resources are created, modified, or deleted — all checks use get/list/describe/auth can-i verbs only. Based on CIS Kubernetes Benchmark v1.8+.910## Prerequisites11121. **kubectl installed** — `kubectl version --client`132. **kubeconfig with read access** — cluster-viewer or equivalent ClusterRole143. **Verify read-only** — ALWAYS run `k8s_audit verify_readonly` first1516```bash17# Quick prerequisite check18kubectl version --client # verify kubectl19kubectl cluster-info # verify cluster access20kubectl auth can-i list pods --all-namespaces # verify read access21```2223## Assessment Phases2425### Phase 0 — Safety Check (MANDATORY FIRST STEP)2627```28k8s_audit verify_readonly29```3031Confirms current identity has no write/modify/delete permissions via kubectl auth can-i. If write permissions are detected, STOP and request a read-only kubeconfig.3233### Phase 1 — RBAC Analysis3435| Check | Command | CIS Benchmark |36|-------|---------|---------------|37| cluster-admin bindings | `k8s_audit rbac_audit` | 5.1.1 |38| Wildcard ClusterRoles | `k8s_audit rbac_audit` | 5.1.3 |39| Default SA permissions | `k8s_audit rbac_audit --namespace NS` | 5.1.5 |4041### Phase 2 — Pod Security4243| Check | Command | CIS Benchmark |44|-------|---------|---------------|45| Privileged containers | `k8s_audit pod_security_audit` | 5.2.1 |46| hostPID / hostNetwork | `k8s_audit pod_security_audit` | 5.2.2, 5.2.3 |47| Dangerous capabilities | `k8s_audit pod_security_audit` | 5.2.7-9 |48| Root execution | `k8s_audit pod_security_audit` | 5.2.6 |49| hostPath mounts | `k8s_audit pod_security_audit` | 5.2.13 |5051### Phase 3 — Network Security5253| Check | Command | CIS Benchmark |54|-------|---------|---------------|55| Missing NetworkPolicies | `k8s_audit network_policy_audit` | 5.3.2 |56| Default deny policies | `k8s_audit network_policy_audit` | 5.3.2 |57| Ingress TLS | `k8s_audit ingress_audit` | — |58| Ingress snippet injection | `k8s_audit ingress_audit` | — |5960### Phase 4 — Secrets & Encryption6162| Check | Command | CIS Benchmark |63|-------|---------|---------------|64| Secret types & counts | `k8s_audit secrets_audit` | 5.4.1 |65| Secrets as env vars | `k8s_audit secrets_audit` | 5.4.1 |66| etcd encryption | `k8s_audit secrets_audit` | 1.2.29-30 |6768### Phase 5 — API Server & Infrastructure6970| Check | Command | CIS Benchmark |71|-------|---------|---------------|72| Anonymous auth | `k8s_audit api_server_audit` | 1.2.1 |73| Insecure port | `k8s_audit api_server_audit` | 1.2.19 |74| Admission controllers | `k8s_audit api_server_audit` | 1.2.11-16 |75| Audit logging | `k8s_audit api_server_audit` | 1.2.17-18 |7677### Phase 6 — Workload Hardening7879| Check | Command | CIS Benchmark |80|-------|---------|---------------|81| Resource limits | `k8s_audit resource_limits_audit` | 5.4.1 |82| LimitRange/ResourceQuota | `k8s_audit resource_limits_audit` | — |83| Image tags | `k8s_audit image_audit` | — |84| Untrusted registries | `k8s_audit image_audit` | — |85| SA auto-mount tokens | `k8s_audit serviceaccount_audit` | 5.1.5-6 |8687## Program Reference8889| Program | Checks | CIS Section |90|---------|--------|-------------|91| verify_readonly | Write permission detection | — |92| rbac_audit | cluster-admin, wildcards, default SA | 5.1.x |93| network_policy_audit | Missing policies, default deny | 5.3.x |94| pod_security_audit | Privileged, hostPID, capabilities, root | 5.2.x |95| secrets_audit | Secret types, env exposure, etcd encryption | 1.2.29, 5.4.x |96| image_audit | Latest tags, pull policy, untrusted registries | — |97| api_server_audit | Anonymous auth, insecure port, admission, audit | 1.2.x |98| resource_limits_audit | CPU/memory limits, LimitRange, ResourceQuota | 5.4.x |99| ingress_audit | TLS, wildcard hosts, snippet injection | — |100| serviceaccount_audit | Auto-mount tokens, cluster-admin SAs, unused SAs | 5.1.x |
cyberstrikeus