Summary
Further Reading
Curated references, specs, and tools to go deeper on Kubernetes security.
A short, curated list. Everything here earned its place; there is no attempt to be complete.
Primary Documentation
Start with the project’s own material. It is unusually good for security topics:
- Kubernetes Security Checklist: the upstream counterpart to this foundation’s checklist.
- Pod Security Standards: the exact field-by-field definition of
privileged,baseline, andrestricted. - RBAC documentation: the reference for verbs, resources, and binding semantics.
- Admission Controllers reference: what is compiled into the API server and what each controller does.
- Auditing: audit policy stages and levels.
Standards And Benchmarks
- CIS Kubernetes Benchmark: the de facto hardening standard; run it via kube-bench rather than reading it cover to cover.
- NSA/CISA Kubernetes Hardening Guide: opinionated, readable, and good for justifying hardening work to management.
- OWASP Kubernetes Top 10: the most common Kubernetes risk categories, useful for prioritising.
- SLSA: the supply chain security levels referenced in the provenance page.
Threat Intelligence And Attack Technique
Reading attack write-ups is the fastest way to make defensive settings feel concrete:
- MITRE ATT&CK Containers Matrix: attacker techniques mapped to the container lifecycle.
- Microsoft Kubernetes Threat Matrix: the original Kubernetes-specific threat matrix.
- Hacking Kubernetes (Martin, Hausenblas): the best single book on attacking and defending clusters.
- Bad Pods: eight pod configurations and exactly how each escalates to the node. Excellent companion to the workload security section.
Tools Worth Knowing
| Tool | What it does |
|---|---|
| kube-bench | Runs the CIS benchmark against your cluster |
| kube-hunter | Actively probes a cluster for known weaknesses |
| Trivy | Image, filesystem, and manifest scanning |
| Kyverno / Gatekeeper | Policy engines covered in the admission control section |
| Falco | Runtime syscall-level detection |
| Cosign | Image signing and verification |
| rbac-lookup / rakkess | Answer “who can do what” quickly |
| Security Profiles Operator | Manages seccomp and AppArmor profiles as cluster resources |
Staying Current
Kubernetes security moves fast; a small recurring habit beats a big annual catch-up:
- Kubernetes security announcements list: CVE announcements; low volume, subscribe.
- Kubernetes blog, security posts: feature deep dives when new security machinery ships.
- Release notes for each minor version: scan the auth, admission, and node sections; deprecations here become your migration work.
How To Read This List
Pick by role. Running clusters: CIS benchmark via kube-bench, the NSA/CISA guide, and the announcements list. Building platform policy: the Pod Security Standards and the policy engine docs. Doing security review or red teaming: Bad Pods, the threat matrices, and Hacking Kubernetes.