Cloud, Kubernetes and Infrastructure Security
Kubernetes Security Assessment
We review your Kubernetes cluster configuration and permissions. We show how far a compromised pod could reach within the cluster and your cloud account.
What it is
By default, pods in a cluster can access each other freely. Protection depends on RBAC permissions, pod security settings, and network policies working together. The assessment compares these layers with the CIS Kubernetes Benchmark and Kubernetes Pod Security Standards. In managed clusters such as EKS, AKS, and GKE, it also reviews connections to cloud identities.
Scope
- API server access, authentication, and audit log settings
- RBAC roles, service accounts, and token use
- Privileged containers and pods accessing host resources
- Network policies and access between namespaces
- Secret storage and encryption
- Permissions of node and workload identities in the cloud account
The need
When organizations need it
- Before deploying a customer-facing application on Kubernetes.
- When multiple teams or customers share the same cluster.
- When the team or provider that set up the cluster changes and no one knows the reasons for the current settings.
Method
How we work
-
Access
We review the cluster with a read-only account. A read-only role is also sufficient on the cloud side.
-
Configuration review
We compare control plane, node, and workload settings with the CIS Kubernetes Benchmark.
-
Attacker's view
Assuming a compromised pod, we map the paths to cluster admin privileges and into the cloud account.
-
Transition plan
We plan the transition to Pod Security Standards levels and network policies step by step, without disrupting workloads.
Outcome
What you have at the end
You know how far a compromised workload could reach in your cluster. You have a practical transition plan for network policies and pod security settings.
Frequently asked questions
We use a managed Kubernetes service. Is this assessment still necessary?
Yes. The provider operates the control plane. RBAC, workload settings, and network policies remain your responsibility.
Will the assessment affect running applications?
The review uses read-only access. Steps requiring testing inside the cluster are performed with your approval, in a separate namespace.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting