A guide to the security controls that matter most when moving a Kubernetes cluster from development to production, ordered by risk reduction per unit of implementation effort.
Pod security standards first
Enforce the “restricted” Pod Security Standard at the namespace level before adding any other control — this alone closes the majority of container escape and privilege escalation paths that default cluster configurations leave open.
Network policies second
Default-deny network policies, with explicit allow rules per service, prevent lateral movement if a single pod is compromised — most clusters we review have no network policies at all, relying entirely on perimeter controls.
Image supply chain third
Enforce image signing verification and vulnerability scanning at admission time (not just in CI) using a tool like Kyverno or OPA Gatekeeper, so an unscanned or unsigned image can never reach a running pod regardless of how it was deployed.
Leave a Reply