Kubernetes Security Best Practices for 2026

Implementation Checklist

• Audit all ClusterRoleBindings and RoleBindings quarterly — wildcards (* verbs or resources) are a critical misconfiguration
• Use dedicated service accounts per workload, never the default service account
• Disable automounting of service account tokens unless explicitly required via automountServiceAccountToken: false
• Prefer namespace-scoped Roles over cluster-wide ClusterRoles for application workloads
• Use tools like rbac-audit or kubectl-who-can to visualize effective permissions

Common Misconfiguration

Implementation Checklist

• Apply a default-deny NetworkPolicy to every namespace immediately after creation
• Use Cilium or Calico for L7-aware policies that can filter by HTTP method and path
• Isolate the kube-system namespace from application namespaces with explicit deny policies
• Restrict egress to known CIDR ranges and DNS only — prevent pod-to-internet exfiltration
• Monitor network policy violations with Hubble (Cilium) or similar observability tooling

Common Misconfiguration

Implementation Checklist

• Label namespaces with pod-security.kubernetes.io/enforce: restricted for production workloads
• The Restricted profile prohibits: privilege escalation, running as root, hostPath volumes, and all Linux capabilities by default
• Use the Baseline profile for workloads that require some flexibility — it still blocks privileged containers and hostNetwork
• Enforce at cluster level with a default policy and grant namespace overrides only for specific system workloads
• Validate compliance with kube-bench or Polaris before workloads reach production

Common Misconfiguration

Implementation Checklist

• Integrate Trivy or Grype into your CI pipeline and fail builds on CVSS >= 7.0 findings
• Use an Admission Webhook (e.g., Kyverno or Gatekeeper) to reject unscanned images at deploy time
• Enforce image signing with Cosign and verify signatures in the admission controller
• Use distroless or minimal base images to reduce attack surface — Alpine, Chainguard, or Google Distroless
• Scan images weekly even for unchanged deployments — new CVEs are disclosed against existing packages daily

Common Misconfiguration

Implementation Checklist

• Enable Kubernetes Secrets encryption at rest via EncryptionConfiguration with AES-GCM or KMS provider
• Use External Secrets Operator to sync secrets from AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault
• Mount secrets as volumes, not environment variables — environment variables are exposed in /proc/$PID/environ
• Rotate secrets automatically — use Vault dynamic secrets or cloud-native rotation with zero downtime
• Audit secret access with Kubernetes audit logs filtered on secrets resource operations

Common Misconfiguration

Implementation Checklist

• Deploy an eBPF agent (Falco, Tetragon, or TigerGate) as a DaemonSet — runs on every node with <3% CPU overhead
• Monitor for container escape indicators: unexpected host filesystem access, namespace transitions, /proc manipulation
• Detect privilege escalation: setuid/setgid execution, capability changes, securityContext overrides at runtime
• Alert on unexpected outbound connections — a Node.js container connecting to a cryptocurrency mining pool is a clear indicator of compromise
• Use Linux 5.7+ with LSM BPF to actively block policy violations — not just detect them

Common Misconfiguration

Implementation Checklist

• Deploy Kyverno or Gatekeeper as a ValidatingAdmissionWebhook to enforce organizational policies
• Write policies to: require resource limits/requests, prohibit latest tag, require security context, validate image registries
• Use OPA policies to enforce cross-cutting concerns like mandatory labels, namespace naming conventions, and PodDisruptionBudgets
• Enable the built-in admission controllers: PodSecurity, NodeRestriction, LimitRanger, ResourceQuota
• Test policies in audit mode before switching to enforce — use kyverno test to validate policy logic

Common Misconfiguration

Implementation Checklist

• Configure kube-apiserver with an audit policy that captures at minimum: secrets reads, RBAC changes, exec/portforward operations
• Ship audit logs to an immutable external store (S3, CloudWatch Logs, GCS) — never rely on node-local log storage
• Set log retention to 90 days minimum for SOC 2 / ISO 27001 compliance
• Alert on: kubectl exec to production pods, secret enumeration, cluster-admin binding changes, new CronJobs or DaemonSets
• Use Falco or TigerGate to correlate audit log events with runtime eBPF events for enriched incident context

Common Misconfiguration

Implementation Checklist

• Run kube-bench as a Job in your cluster to test API server, etcd, controller manager, scheduler, and worker node configuration
• Prioritize Level 1 (Scored) findings — these have direct security impact and are required for most compliance frameworks
• Common failures: anonymous-auth not disabled, insecure-port enabled, profiling endpoints exposed, etcd without client cert auth
• Use TigerGate Cloud Scanner's Kubernetes checks (83+ controls) for continuous automated compliance assessment
• Map findings to CIS controls in compliance reports for SOC 2 Type II and ISO 27001 auditor evidence

Common Misconfiguration

Implementation Checklist

• Sign container images with Sigstore/Cosign and verify signatures at admission with policy enforcement
• Generate and attest SBOMs (CycloneDX or SPDX) for all production images — required for NIST SSDF compliance
• Use a private container registry with vulnerability scanning enabled (ECR, GAR, ACR) — block public registry pulls in production
• Pin Helm chart versions and use Artifact Hub to verify chart provenance
• Enable Binary Authorization (GKE) or AWS ECR Image Signing to prevent unsigned images from running

Common Misconfiguration