CIS Benchmark for Kubernetes 1.6

This report reviews the CIS Kubernetes 1.6 benchmark and highlights key security recommendations for production Kubernetes deployments: enforce strong authentication and granular authorization, rotate certificates and keys, encrypt and authenticate all cluster communications, protect sensitive data at rest (and avoid relying on current Kubernetes secrets implementations), apply least-privilege via namespaces and network policies, prevent or restrict privileged containers, assign pod identities/service accounts, enable pod security policies and platform security controls (seccomp/SELinux), and ensure robust event logging for compliance and forensics. The author notes the benchmark’s breadth and complexity and offers these prioritized best-practice highlights to help organizations implement the standard.