tomevault-io Kubernetes Security
Authorization Boundary
- Require cluster context, namespace scope, and read-only kubeconfig before live queries.
- Avoid disruptive runtime probes on production; prefer staging or ephemeral clusters.
Hardening Workflow
- Inventory: API server flags, node OS, CNI, CSI, ingress, service mesh, admission plugins, controllers.
- Scan:
kube-bench,kubescape,trivy k8s,polaris,kubeaudit,popeye. - RBAC: enumerate
ClusterRole/RoleBinding; flag wildcard verbs,system:masters,escalate,bind,impersonate, secret reads from broad subjects. - Workloads: enforce Pod Security
restricted, drop capabilities, read-only rootfs, non-root UID, seccompRuntimeDefault, nohostPath/hostNetwork/hostPID. - Network: default-deny
NetworkPolicy; explicit egress to known services; mTLS via mesh where applicable. - Supply chain: signed images (
cosign verify), provenance attestations (SLSA), admission policy that blocks unsigned. - Runtime: Falco/Tetragon rules for exec-in-container, reverse shells, crypto miners, sensitive mounts.
Multi-Tenant Patterns
- Namespace-per-tenant with quotas, limit ranges, and
NetworkPolicyisolation. - Separate node pools for untrusted workloads; gVisor or Kata for sandboxing.
- Per-tenant audit log filters; secrets via external KMS, never inline.
Output Contract
inventory.yaml,findings.csv,policies/(Gatekeeper/Kyverno),netpol/,runtime/falco-rules.yaml.runbook.md: incident response for compromised pod, leaked token, miner detection.gap.md: missing telemetry and proposed fixes.
Source: Masriyan/gemini-security-skills — distributed by TomeVault.