Skip to main content

K8s cluster checks

K8s cluster checks are the analysis that measures the security misconfigurations of the resources actually running in a live Kubernetes cluster. Even when your definition files (YAML) are written safely, a deployed cluster drifts over time. Emergency patches, hand-edited quick fixes, Helm overrides, and dynamic changes from autoscaling and operators all pull the running state further away from what you first wrote. So no matter how clean the definition files are, they are no guarantee that the cluster is safe right now.

Here is how it works. It connects to the registered cluster and enumerates the actual resources, such as pods, deployments, service accounts, RBAC, and network settings, then checks each resource's security context and permission settings against security baselines. Where IaC analysis looks at code (definition files) statically, this check looks at the state actually deployed and running. Used from a Server / host service.

  • Analysis : Security misconfigurations of running cluster resources
  • What you need : A registered host + kubeconfig (or a service account token)
  • Results : Findings by severity + compliance mapping

What it finds​

  • Privileged containers, running as root, excessive permissions (RBAC)
  • Missing resource limits and security contexts
  • Insecure network / pod settings
  • Security misconfigurations of cluster resources

Prerequisites​

  • The target server must be registered as a Server / host.
  • A kubeconfig (or service account token) is required.
  • Private clusters connect through an SSH tunnel or a VPN profile.

Handling results​

  • Settings that are intended per organization policy can be marked as accepted risk to reduce noise.
  • Use the KEV and group badges to surface the important items first.
Namespace scoping

Large clusters can take long to enumerate fully, so checks are scoped by namespace.