Kubernetes. On the Roadmap. For Good Reason.
RBAC sprawl. Everyone got cluster-admin because it was easier. This is not a cluster. This is unplanned infrastructure with a deployment pipeline.
Kubernetes clusters grow organically. etcd is not encrypted. Kubelet configuration is the same as on installation day. API server flags have never been hardened. The Kubernetes module of the SPAS suite addresses exactly that, as a planned extension when concrete requirements arise.
Why Kubernetes Clusters Are Rarely Truly Secure
RBAC Sprawl
RBAC starts with cluster-admin for everyone and is never cleaned up. Overly broad roles, orphaned bindings, and unchecked service accounts accumulate silently over months.
etcd Not Encrypted
Kubernetes Secrets are stored in plaintext in etcd. Anyone who can read etcd can read all secrets in the cluster, without admission controllers, without an audit log, without any warning.
Kubelet as on Installation Day
Anonymous auth enabled, no certificate-based authentication, read-only port open. The Kubelet configuration has not been adjusted since the initial installation.
API Server Flags Never Hardened
TLS configuration incomplete, authorization modes on default, audit logging disabled. The API server remains exactly as it was after the kubeadm bootstrap.
What the Kubernetes Module Will Address
These capabilities are defined on the SPAS roadmap. No delivery commitment, but a clear direction.
- Planned API Server Hardening
TLS configuration, authentication modes, authorization modes, and RBAC audit configuration against a defined baseline.
- Planned etcd Encryption
Secrets at rest via --encryption-provider-config. A cryptographically secured data layer instead of plaintext etcd.
- Planned Kubelet Hardening
Anonymous auth disabled, certificate-based authentication, restrictive port configuration, and node authorization.
- Planned GitOps-Based RBAC Management
Least-privilege enforcement as code. Regular cleanup of orphaned bindings and service accounts through versioned policies.
- Planned Admission Controllers
OPA/Gatekeeper, Pod Security Standards, and namespace policies as enforced guardrails for all deployments in the cluster.
Three Stages. Clear Direction.
Container Module
Rootless containers, Seccomp profiles, OCI policies, and image scanning. The security foundation that every Kubernetes environment builds on.
Start NowKubernetes Module
RBAC management, etcd encryption, Kubelet hardening, and Admission Controllers as a planned platform extension.
Full Platform Hardening
Container baseline and Kubernetes hardening as a consistent security logic. From hardened image to cluster configuration.
Start Now: Container Hardening
Those who build the container baseline today are the first candidates for the Kubernetes module. Rootless containers, Seccomp profiles, and hardened OCI images are the prerequisite and the logical first step toward secure Kubernetes clusters.
Secure Container Platform AutomationInterested in Kubernetes on the SPAS roadmap? Get in touch.
No commitment · No sales pitch · Confidential
