Kubernetes Security
Kubernetes Security in OpsMx Delivery Shield secures the clusters, workloads, and orchestration layer that manages containerized applications — addressing the unique and complex security challenges introduced by Kubernetes at scale.
A Kubernetes environment spans multiple components — API servers, etcd, nodes, pods, and networking layers — all of which must be secured. Misconfigurations such as overly permissive RBAC roles, exposed dashboards, insecure pod configurations, and lack of network segmentation create significant vulnerabilities that are often invisible without continuous scanning.
Why Kubernetes Security Is Used in OpsMx
OpsMx uses Kubernetes Security in Delivery Shield — powered by Kubescape — to:
Scan Kubernetes manifests, Helm charts, and live clusters for security misconfigurations and policy violations
Enforce CIS Benchmarks, NSA-CISA guidelines, and MITRE ATT&CK framework controls across all clusters
Block deployments to insecure clusters via Deployment Firewall integration — Kubescape results are a direct gate on deployment
Monitor continuously — detecting changes in cluster configuration in real time and evaluating each change against security policies
Enforce RBAC least privilege — ensuring no service account, role, or user has more access than required
Key Focus Areas
Cluster Configuration
Secure API access, etcd encryption, audit logging
RBAC & Identity
Least privilege enforcement, service account controls
Workload Security
Secure pod configurations, no privileged containers
Network Policies
East-west traffic controls between services
Admission Controls
Policy enforcement preventing insecure deployments
Helm Chart Security
Scanning both templates and packaged charts
Security Frameworks Supported
CIS Kubernetes Benchmarks · NSA-CISA Kubernetes Hardening · MITRE ATT&CK · ARMO Best Practices · SOC 2 · NIST 800-53
Benefits for the User
Every new deployment is automatically evaluated against cluster security policies before proceeding
Framework-aligned findings provide ready-made audit evidence for CIS and NSA compliance
Kubescape integrates natively — no separate cluster scanner installation required
Last updated