Question 1

What is the CIS Kubernetes Benchmark?

Accepted Answer

The CIS Kubernetes Benchmark is a collection of security best practices for Kubernetes clusters. It covers: API server configuration, etcd security, controller manager, scheduler, worker nodes, RBAC and pod security. Score: 0-100%. Target: 95%+. Kube-bench tool automatically checks clusters against CIS Benchmark.

Question 2

How do I configure RBAC in Kubernetes correctly?

Accepted Answer

Kubernetes RBAC Least-Privilege: no cluster-admin role for workloads. Namespace-specific Roles instead of ClusterRoles. Do not auto-mount ServiceAccount tokens (automountServiceAccountToken: false). Manage regular users via groups. Check RBAC with rbac-lookup tool. No wildcards in verbs or resources.

Question 3

What are Kubernetes Pod Security Standards?

Accepted Answer

Pod Security Standards (PSS) replace Pod Security Policies (deprecated since K8s 1.21): Privileged (no restrictions), Baseline (minimal restrictions, prevents known privilege escalations), Restricted (strict restrictions, security best practice). Enable per namespace label: pod-security.kubernetes.io/enforce=restricted.

Question 4

How do I protect Kubernetes Secrets securely?

Accepted Answer

Kubernetes Secrets are only base64-encoded, not encrypted. Recommendations: enable etcd Encryption at Rest (EncryptionConfiguration). Use External Secrets Operator with HashiCorp Vault or AWS Secrets Manager. Restrict secrets access via RBAC. Never store secrets in ConfigMaps or environment variables as plaintext. Sealed Secrets for GitOps.

Kubernetes Security Hardening

🎯 CIS Benchmark Bereiche

🔗 ClawGuru für K8s