Why Kubernetes widens the attack surface
A cluster adds components that did not exist before: the API server, etcd holding all configuration and secrets, the kubelet on every node, and pod networking. Each is a target, and a single exposure or misassigned permission in any of them can compromise entire workloads.
Most common attack vectors
Overly permissive RBAC allowing escalation from a pod to the whole cluster, privileged containers or containers with the Docker socket mounted, images with known vulnerabilities or from untrusted registries, secrets stored as environment variables, and missing network policies that leave every pod able to talk to every other.
How to harden a cluster
Apply least privilege to RBAC and service accounts, enforce restricted Pod Security Standards, scan images before deployment and sign them, define default-deny NetworkPolicies, manage secrets with an external store, and keep the control plane off the public internet. Then validate with active testing against CIS Benchmarks.
Learn more
