Before deploymentkubernetes-security-readiness

Kubernetes Security Checklist

14 items ·9 critical ·5 warn ·0 info

How to use this checklist

This is the baseline a cluster should meet before it holds anything that matters. It is deliberately shorter than a compliance framework and deliberately harder to pass on a default install.

Mark an item N/A when it genuinely does not apply, and write down why. An unexplained N/A is the most common way a checklist stops working.

Sign-off

Every critical item must pass. A failing critical item blocks the deployment or the maintenance window; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical9 items

Pod Security Standards are enforced at the namespace level, with `restricted` or `baseline` in enforce mode rather than warn only.

kubectl get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.pod-security\.kubernetes\.io/enforce}{"\n"}{end}'

No workload runs privileged, hostNetwork, hostPID, or hostIPC outside a documented and reviewed exception list.

kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.hostNetwork}{"\n"}{end}' | grep true

cluster-admin is bound to as few subjects as possible, and every binding has a named owner.

kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name=="cluster-admin") | .metadata.name'

No Role or ClusterRole in use grants `*` on resources and verbs except the built-in admin roles.
Secrets are encrypted at rest, and access to `secrets: get` and `list` is treated as equivalent to access to their contents.
No plain Secret manifest is committed to Git. Sealed Secrets, SOPS, or an external secrets operator is in use.
Default-deny NetworkPolicy is in place for sensitive namespaces — see the networking checklist.
The API server is not reachable from the public internet, or access is restricted to known source ranges.
The kubelet read-only port is disabled and kubelet authentication and authorization are enabled.

Warning5 items

automountServiceAccountToken is disabled for workloads that do not call the API server.
The default ServiceAccount in each namespace has no RoleBinding granting it permissions.
Images come from a controlled registry, are scanned for known vulnerabilities, and the scan result gates the deploy.
An admission controller (Kyverno, Gatekeeper, or validating webhooks) enforces the policies above, rather than relying on review.
```
kubectl get validatingwebhookconfigurations
```
Audit logs are shipped off-cluster and someone has looked at them at least once since the cluster was built.