Runbook 01 — Kubernetes Workload Security Assessment

Runbook Information

Item	Details
Runbook ID	K8S-WORKLOAD-RUNBOOK-01
Category	Kubernetes Workload Security Assessment
Assessment Type	Preventive Security Review
Environment	Development / QA / Production
Target Audience	Kubernetes Security Engineer, DevSecOps Engineer, Platform Engineer, Cloud Security Architect, SOC Analyst
Estimated Duration	3–5 Hours
Frequency	Before Production Deployment and Quarterly Thereafter
Last Reviewed	July 2026
Framework Alignment	CIS Kubernetes Benchmark, Kubernetes Pod Security Standards, NIST CSF, NIST 800-190, OWASP Kubernetes Top 10

Executive Summary

This runbook provides a structured methodology for assessing the security posture of Kubernetes workloads before they are deployed into production or during periodic security reviews.

The assessment focuses on validating whether workloads follow enterprise security best practices including:

Pod Security Standards
Least Privilege
Immutable Infrastructure
Zero Trust
Defence in Depth
Runtime Hardening
Production Readiness

The goal is to identify misconfigurations that could increase the likelihood of container compromise, privilege escalation, lateral movement, or service disruption.

Enterprise Scenario

CloudNova Technologies has over 800 Kubernetes workloads deployed across multiple production clusters supporting customer-facing applications, internal services, and critical business systems.

A recent internal audit identified inconsistent workload security configurations:

Containers running as root
Privileged Pods
Missing security contexts
Writable root filesystems
Excessive Linux capabilities
Missing Network Policies
Unrestricted Service Account access
Inconsistent health probes
Missing resource limits
Use of mutable image tags
Production workloads bypassing Pod Security Standards

Before approving future releases, the Cloud Security team must perform a standardised workload security assessment.

Assessment Objectives

The assessment should answer the following questions:

Are workloads following the Restricted Pod Security Standard?
Are containers running with least privilege?
Can workloads escalate privileges?
Are Service Account credentials protected?
Is filesystem access restricted?
Are Linux capabilities minimised?
Is runtime behaviour appropriately constrained?
Are workloads resilient and production ready?
Is network communication restricted?
Is workload governance complete?

Assessment Architecture

                Kubernetes Cluster

                        │

            Production Namespaces

                        │

        ┌───────────────┼───────────────┐
        │               │               │

   Deployment       StatefulSet      DaemonSet

        │               │               │

        └───────────────┼───────────────┘

                        │

            Workload Security Review

                        │

 ┌────────────────────────────────────────────┐

 │ Pod Security Standards                     │
 │ Security Context                           │
 │ Runtime Privileges                         │
 │ Service Accounts                           │
 │ Network Policies                           │
 │ Images                                     │
 │ Resources                                  │
 │ Volumes                                    │
 │ Health Checks                              │
 │ Runtime Security                           │

 └────────────────────────────────────────────┘

                        │

             Enterprise Security Report

Assessment Scope

The assessment includes:

Namespaces
Deployments
StatefulSets
DaemonSets
Pods
Containers
Services
Network Policies
Service Accounts
ConfigMaps
Secrets
Persistent Volumes
Images
Resource Controls

Required Tools

Tool	Purpose
kubectl	Kubernetes administration
jq	JSON parsing
Helm	Application review
kube-bench	CIS Benchmark validation
kubescape	Kubernetes posture assessment
Trivy	Image vulnerability scanning
Falco	Runtime validation
Visual Studio Code	Manifest review

Assessment Phases

Phase	Objective
Phase 1	Cluster Preparation
Phase 2	Namespace Review
Phase 3	Workload Discovery
Phase 4	Pod Security Assessment
Phase 5	Runtime Hardening Review
Phase 6	Resource Governance
Phase 7	Networking Assessment
Phase 8	Storage Assessment
Phase 9	Image Security Review
Phase 10	Runtime Security Review
Phase 11	Production Readiness
Phase 12	Reporting

Phase 1 — Verify Cluster Health

Confirm connectivity.

kubectl cluster-info

Review nodes.

kubectl get nodes -o wide

Check cluster version.

kubectl version

Confirm:

API Server reachable
Worker nodes healthy
Required permissions available

Phase 2 — Review Namespaces

List namespaces.

kubectl get namespaces

Review Pod Security labels.

kubectl get namespace --show-labels

Validate:

Restricted enforcement
Audit labels
Warning labels
Environment labels
Ownership labels

Phase 3 — Discover Workloads

Review Deployments.

kubectl get deployments --all-namespaces

Review StatefulSets.

kubectl get statefulsets --all-namespaces

Review DaemonSets.

kubectl get daemonsets --all-namespaces

Review Pods.

kubectl get pods --all-namespaces -o wide

Document:

Workload owners
Images
Namespaces
Replica counts

Phase 4 — Assess Pod Security

For each workload verify:

Pod Security Standards

kubectl get namespace \
<namespace> --show-labels

Confirm:

Restricted

Security Context

kubectl get deployment \
<deployment> \
-n <namespace> \
-o yaml

Validate:

runAsNonRoot
runAsUser
runAsGroup
fsGroup
seccompProfile

Container Security Context

Confirm:

allowPrivilegeEscalation: false

privileged: false

readOnlyRootFilesystem: true

capabilities:
  drop:
    - ALL

Phase 5 — Runtime Hardening Review

Validate:

Non-root execution
Read-only filesystem
Dropped capabilities
RuntimeDefault seccomp
No host networking
No host PID
No host IPC

Commands:

kubectl describe pod

kubectl exec

Review runtime identity.

id

Phase 6 — Service Account Assessment

List Service Accounts.

kubectl get sa --all-namespaces

Review workload.

kubectl get deployment \
-o yaml

Confirm:

automountServiceAccountToken: false

Check mounted credentials.

kubectl exec

Review:

ls

/var/run/secrets

Phase 7 — Network Security Assessment

Review Services.

kubectl get svc --all-namespaces

Review Network Policies.

kubectl get networkpolicy \
--all-namespaces

Confirm:

Default deny
Explicit allow rules
ClusterIP usage
No unnecessary NodePorts

Phase 8 — Resource Governance

Review.

kubectl describe pod

Confirm:

CPU requests

CPU limits

Memory requests

Memory limits

Resource quotas.

Phase 9 — Storage Assessment

Review volumes.

kubectl get pod \
-o yaml

Check:

HostPath usage
emptyDir
PVCs
Secret volumes
ConfigMaps

Confirm:

No sensitive HostPath volumes.

Phase 10 — Image Security

List images.

kubectl get pods \
-A \
-o jsonpath="{..image}"

Review:

Registry
Image tag
Mutable tags
Digests

Scan.

trivy image

Review vulnerabilities.

Phase 11 — Runtime Security

Validate:

Falco installed.

kubectl get pods -n falco

Review alerts.

kubectl logs

Review:

Shell execution
Package installation
Privilege escalation
Container drift

Phase 12 — Production Readiness

Review:

Replicas
Rolling Updates
Health probes
PDB
Resource controls
Security labels
Monitoring
Logging

Enterprise Workload Security Checklist

Control	Status
Restricted Pod Security	☐
Non-root execution	☐
runAsUser configured	☐
runAsGroup configured	☐
fsGroup configured	☐
Seccomp enabled	☐
Privileged disabled	☐
Privilege escalation disabled	☐
ReadOnly filesystem	☐
Linux capabilities dropped	☐
Service Account protected	☐
Resource requests	☐
Resource limits	☐
Health probes	☐
Network Policies	☐
ClusterIP Service	☐
Image version pinned	☐
Trusted registry	☐
Runtime monitoring	☐
Logging enabled	☐
Monitoring enabled	☐

Findings Classification

Critical

Examples:

Privileged Pods
Root containers
HostPath mounting /
Host networking
Missing security context

High

Examples:

Writable filesystem
Missing seccomp
Missing Network Policies
Service Account mounted unnecessarily
Mutable image tags

Medium

Examples:

Missing limits
Missing labels
Missing probes
Single replica

Low

Examples:

Documentation improvements
Naming standards
Metadata updates

Remediation Priorities

Immediate

Remove privileged containers
Disable root execution
Disable privilege escalation
Enable Restricted Pod Security
Protect Service Accounts

Short-Term

Implement Network Policies
Configure RuntimeDefault seccomp
Drop Linux capabilities
Configure read-only filesystems
Configure probes

Long-Term

Image signing
Admission Controllers
GitOps enforcement
Runtime detection automation
Continuous posture assessments

Assessment Report Template

Assessment Name:

Assessment Date:

Assessor:

Cluster:

Namespace(s):

Applications Reviewed:

Total Workloads:

Pod Security Standard:

Security Context Review:

Container Security Review:

Runtime Security Review:

Network Assessment:

Storage Assessment:

Resource Governance:

Image Security:

Monitoring:

Logging:

Critical Findings:

High Findings:

Medium Findings:

Low Findings:

Overall Risk Rating:

Recommendations:

Production Approval:

Approved

Conditionally Approved

Rejected

Evidence Collection

Collect:

Namespace labels
Deployment YAML
Security Context configuration
Pod descriptions
Runtime identity
Network Policies
Service configuration
Resource settings
Image inventory
Trivy reports
kube-bench report
Kubescape report
Falco alerts
Production assessment report

Production Approval Criteria

A workload may be considered Production Ready only when:

Restricted Pod Security Standard enforced
Non-root execution configured
Security Context fully implemented
Privileged mode disabled
Privilege escalation disabled
Linux capabilities minimised
RuntimeDefault seccomp enabled
Read-only root filesystem configured where applicable
Service Account token protected
Network Policies implemented
Resource governance configured
Health probes configured
Images originate from approved registries
Runtime monitoring enabled
Logging and monitoring integrated
Critical findings remediated or formally accepted through an approved risk exception process

Success Criteria

The assessment is successful when:

Every workload has been reviewed against enterprise security standards.
Security misconfigurations are documented and prioritised.
Evidence has been collected for audit purposes.
A remediation plan has been created for all findings.
A clear production readiness decision has been recorded.

Runbook Summary

This runbook provides a repeatable, enterprise-grade process for assessing Kubernetes workload security across the full workload lifecycle. It validates preventive controls such as Pod Security Standards, Security Contexts, least-privilege configuration, secure networking, image governance, resource management, and runtime protections, while also confirming that workloads are operationally ready for production.

Following this assessment before deployment—and on a regular review cycle—helps organisations reduce the risk of container compromise, improve compliance with industry frameworks such as the CIS Kubernetes Benchmark and NIST guidance, and establish consistent security baselines across Kubernetes environments.