Common Kubernetes misconfigurations and how to avoid them

This report highlights common Kubernetes security pitfalls—publicly exposed APIs/ports, running privileged or root containers, unnecessary Linux capabilities, unscanned and unsigned images, and weak or unenforced Pod Security Admission—and explains how attackers leverage them for easy access and escalation. It recommends practical mitigations such as private networking and bastion access, least-privilege securityContext settings (non-root, read-only filesystems, dropped capabilities), image pinning and scanning with signing/verification, and enforcing PSA at the restricted level.