OWASP Kubernetes Top 10
This skill encodes the OWASP Kubernetes Top 10 for secure cluster and workload design and review. References are loaded per risk. Based on OWASP Kubernetes Top 10 2022.
When to Read Which Reference
| Risk | Read |
|---|---|
| K01 Insecure Workload Configurations | references/k01-insecure-workload-configurations.md |
| K02 Supply Chain Vulnerabilities | references/k02-supply-chain-vulnerabilities.md |
| K03 Overly Permissive RBAC | references/k03-permissive-rbac.md |
| K04 Lack of Centralized Policy Enforcement | references/k04-policy-enforcement.md |
| K05 Inadequate Logging and Monitoring | references/k05-logging-monitoring.md |
| K06 Broken Authentication Mechanisms | references/k06-broken-authentication.md |
| K07 Missing Network Segmentation | references/k07-network-segmentation.md |
| K08 Secrets Management Failures | references/k08-secrets-management.md |
| K09 Misconfigured Cluster Components | references/k09-misconfigured-cluster-components.md |
| K10 Outdated and Vulnerable Components | references/k10-vulnerable-components.md |
Quick Patterns
- Run workloads as non-root with read-only filesystem where possible; use image signing and supply chain controls. Apply least-privilege RBAC and network policies; centralize policy (e.g. OPA); secure secrets and audit logging.
Quick Reference / Examples
| Task | Approach |
|---|---|
| Harden pod | Non-root, read-only rootfs, drop capabilities. See K01. |
| Secure images | Sign images, scan for CVEs, use trusted registries. See K02. |
| Limit RBAC | Least privilege, no cluster-admin for workloads. See K03. |
| Network policies | Default deny, explicit allow per namespace. See K07. |
| Manage secrets | Use external secrets manager or encrypted secrets. See K08. |
Safe - hardened SecurityContext:
securityContext:
runAsNonRoot: true
runAsUser: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
Unsafe - privileged container:
securityContext:
privileged: true # NEVER in production - full host access
Network policy - default deny ingress:
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-ingress
spec:
podSelector: {}
policyTypes: ["Ingress"]
Workflow
Load the reference for the risk you are addressing. See OWASP Kubernetes Top 10 for the official list.