| Category | Risk | Findings | Worst Severity |
|---|---|---|---|
| K01 | Insecure Workload Configurations | 55 issue(s) / 4 finding(s) | MEDIUM |
| K02 | Overly Permissive RBAC | 1 issue(s) / 1 finding(s) | HIGH |
| K03 | Secrets Management Failures | 12 issue(s) / 3 finding(s) | MEDIUM |
| K04 | Lack of Centralized Policy Enforcement | 12 issue(s) / 2 finding(s) | CRITICAL |
| K05 | Missing Network Segmentation | 0 issue(s) / 1 finding(s) | PASS |
| K06 | Overly Exposed Cluster Components | 3 issue(s) / 2 finding(s) | MEDIUM |
| K07 | Misconfigured Cluster Components | 28 issue(s) / 1 finding(s) | HIGH |
| K08 | Cluster-to-Cloud Lateral Movement | 6 issue(s) / 1 finding(s) | MEDIUM |
| K09 | Broken Authentication Mechanisms | 17 issue(s) / 2 finding(s) | MEDIUM |
| K10 | Inadequate Logging and Monitoring | 0 issue(s) / 1 finding(s) | PASS |
| Rank | CWE ID | Weakness | K8s Relevance |
|---|---|---|---|
| 1 | CWE-79 | XSS: Cross-site Scripting | High — WAF/ModSecurity at ingress layer |
| 2 | CWE-89 | SQL Injection | High — Database service exposure, parameterized queries |
| 3 | CWE-352 | Cross-Site Request Forgery (CSRF) | Medium — Ingress-level CSRF protection headers |
| 4 | CWE-862 | Missing Authorization | Critical — RBAC — missing authorization on SA/roles |
| 5 | CWE-787 | Out-of-bounds Write | Medium — Image vulnerability scanning (Trivy) |
| 6 | CWE-22 | Path Traversal | Critical — hostPath mounts enable path traversal |
| 7 | CWE-416 | Use After Free | Medium — Image vulnerability scanning (Trivy) |
| 8 | CWE-125 | Out-of-bounds Read | Medium — Image vulnerability scanning (Trivy) |
| 9 | CWE-78 | OS Command Injection | Critical — Command injection — readOnlyRootFS, runAsNonRoot |
| 10 | CWE-94 | Code Injection | Critical — pods/exec RBAC = code injection vector |
| 11 | CWE-120 | Classic Buffer Overflow | Low — Image vulnerability scanning (Trivy) |
| 12 | CWE-434 | Unrestricted Upload of Dangerous File Type | Medium — readOnlyRootFilesystem, ephemeral storage |
| 13 | CWE-476 | NULL Pointer Dereference | Low — Image vulnerability scanning (Trivy) |
| 14 | CWE-121 | Stack-based Buffer Overflow | Low — Application-level |
| 15 | CWE-502 | Deserialization of Untrusted Data | High — Deserialization — readOnlyRootFS, network policies |
| 16 | CWE-122 | Heap-based Buffer Overflow | Low — Application-level |
| 17 | CWE-863 | Incorrect Authorization | Critical — Broken access control — RBAC misconfig |
| 18 | CWE-20 | Improper Input Validation | Low — Application-level |
| 19 | CWE-284 | Improper Access Control | Critical — Improper access control — RBAC |
| 20 | CWE-200 | Exposure of Sensitive Information | High — Env var exposure, secret protection |
| 21 | CWE-306 | Missing Authentication for Critical Function | High — Missing authentication — Ingress auth annotations |
| 22 | CWE-918 | Server-Side Request Forgery (SSRF) | High — SSRF — NetworkPolicy egress restrictions |
| 23 | CWE-77 | Command Injection | Critical — Command injection — same as CWE-78 |
| 24 | CWE-639 | Authorization Bypass Through User-Controlled Key | Medium — SA token automount = authorization bypass vector |
| 25 | CWE-770 | Allocation of Resources Without Limits | Critical — Resource limits prevent DoS |
| Function | ID | Focus Area | K8s Controls |
|---|---|---|---|
| GOVERN | GV | Organizational context, risk strategy, supply chain | Kyverno policies, namespace labels, image registries |
| IDENTIFY | ID | Asset management, risk assessment | Resource inventory, vulnerability scanning |
| PROTECT | PR | Access control, data security, platform security | RBAC, PSA, Secrets, resource limits |
| DETECT | DE | Continuous monitoring, adverse events | Falco, Vector/Splunk logging |
| RESPOND | RS | Incident management, analysis | NetworkPolicies for containment |
| RECOVER | RC | Recovery planning | Backup CronJobs, Velero |
15/16 application namespaces lack PSA enforce labels
13 policies exist but none enforce
8 containers lack limits
No backup/snapshot CronJobs found
11 registries: docker.io, ecr-public.aws.com, ghcr.io, global.artifactory.sms.dev.sci.scs.sap, natsio, nginxinc, public.ecr.aws, quay.io, reg.kyverno.io, registry.k8s.io
90 Opaque secrets. Verify encryption at rest.
17 nodes, 195 pods, 87 services, 32 namespaces
No non-system SAs bound to admin roles
Falco on 2 nodes
9 log collector pods
| Family | ID | Controls | K8s Implementation |
|---|---|---|---|
| Access Control | AC | AC-3, AC-6 | RBAC, SA tokens, privileged containers |
| Audit & Accountability | AU | AU-2, AU-3, AU-6 | Logging, runtime audit (Falco) |
| Security Assessment | CA | CA-2 | PolicyReports, compliance scanning |
| Config Management | CM | CM-2, CM-7 | ResourceQuotas, hostNetwork |
| Identification & Auth | IA | IA-5 | Default SA automount |
| System & Comms Protection | SC | SC-7, SC-8, SC-28 | NetworkPolicies, TLS, Secrets |
| System & Info Integrity | SI | SI-2, SI-4 | Vuln scanning, monitoring |
15/32 namespaces lack policies
27 app pods auto-mount SA tokens
16 namespaces with default SA automount
105 CRBs, 1 admin/cluster-admin
90 Opaque secrets. Verify etcd encryption.
20 log/SIEM pods
Falco on 2 nodes
1 ClusterPolicyReports
19 defined
All 12 ingresses use TLS
4 monitoring pods
| Check | ID | Description | Severity |
|---|---|---|---|
| Crashlooping | RT01 | Containers with 5+ restarts | HIGH |
| OOMKilled | RT02 | Containers terminated by OOM | HIGH |
| Pod State | RT03 | Pods in Failed/Unknown phase | MEDIUM |
| Image Tags | RT04 | Running :latest or untagged images | MEDIUM |
| Health Probes | RT05 | Missing liveness/readiness probes | MEDIUM |
| Ephemeral | RT06 | Active debug containers | MEDIUM |
| Stale Pods | RT07 | Running 90+ days without restart | LOW |
| K8s Events | RT08 | Warning events in last hour | INFO |
| Pull Policy | RT09 | IfNotPresent with mutable tags | MEDIUM |
| Security Agent | RT10 | Falco/Tetragon status | HIGH |
| Unready Pods | RT11 | Not ready for 5+ minutes | MEDIUM |
| Replica Drift | RT12 | Available < desired replicas | MEDIUM |
1 container(s) were recently OOMKilled - possible memory exhaustion
11 running container(s) lack both liveness and readiness probes
2 pod(s) have been in not-ready state for 5+ minutes
2 deployment(s) have fewer available replicas than desired
3 pod(s) running 90+ days without restart
9 warning event(s) in the last hour
No running containers use :latest or untagged images
No pods have ephemeral debug containers attached
2 Falco pod(s) running