- 01Five controls catch real attacks: Pod Security Standards Restricted via admission, NetworkPolicy default-deny with explicit per-workload allow, signed + pinned images verified at admission, eBPF runtime sensors, audit-log pipeline to SIEM with compliance-proportional retention.
- 02What admission must reject: privileged containers, hostPath outside an explicit allowlist, host network/PID/IPC, missing readOnlyRootFilesystem, capabilities beyond a strict allowlist, missing security context. Use Kyverno or OPA Gatekeeper aligned to PSS Restricted.
- 03eBPF sensors (Falco, Tetragon, vendor equivalents) catch what admission cannot — drift, post-exploitation, container-escape attempts. Their value depends entirely on tuning. Plan a six-week tuning project per cluster type before relying on alerts.
- 04None of these controls are exotic; all of them are routinely missing in environments we audit. Most of the work is enforcement and tuning, not novel technology.
After several years of Kubernetes-native security tooling maturing, the controls that consistently move the needle in production environments have crystallized. None of them are exotic; all of them are routinely missing.
The five controls that catch real attacks
- 01Pod Security Standards (Restricted profile) enforced via admission
- 02NetworkPolicy default-deny with explicit allow per workload
- 03Signed and pinned container images, verified at admission
- 04Runtime sensors (eBPF-based) for behavioral detection
- 05Audit-log pipeline to your SIEM with retention proportional to compliance
What admission controllers should reject
Privileged containers, hostPath mounts outside an explicit allowlist, host network/PID/IPC, missing readOnlyRootFilesystem, capabilities beyond a strict allowlist, missing security context. Use Kyverno or OPA Gatekeeper with policy bundles aligned to Pod Security Standards Restricted.
The runtime sensor question
EBPF-based sensors (Falco, Tetragon, vendor equivalents) catch what admission cannot — drift, post-exploitation behavior, container escape attempts. Their value depends entirely on tuning. Plan for a six-week tuning project per cluster type before relying on alerts.