A check in CI protects only the pipeline that runs it. Anyone with direct API access can still create the resource, so the rule has to run in the API server's admission path to hold for every team and every tool.
- Label every namespace for Pod Security Admission, starting with
auditandwarnand moving toenforce. - Write cluster-specific rules as ValidatingAdmissionPolicy (CEL), or with a policy engine such as Kyverno, OPA Gatekeeper or Kubewarden when you need more.
- Enforce image provenance at admission: allowed registries, or a verified signature from the expected builder.
- Roll new policies out in audit or warn mode first, plan for the policy engine failing, and send admission decisions to your logging.
Guides on this site
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Verify artifact signatures against an explicit trust policy
Require the expected artifact, signer and release context before allowing a signed package or image to proceed.
Harden container images from Dockerfile to admission
Build minimal, non-root images pinned by digest, keep secrets out of every layer, then scan, sign and verify the exact digest before it runs with dropped privileges.
Practice
- Signed artifact provenance lab: Reject a release from the wrong producer · Browser lab
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- Build and verify a signed software release · Local project
- Verify Kubernetes admission and network boundaries · Local project
- Repair a security pipeline for GitHub Actions and GitLab CI · Local project
- Gate an image build on a CIS scan and a deviation register · Local project
References
- K04:2025 Lack Of Cluster Level Policy Enforcement (OWASP)
- Kubernetes documentation: Validating Admission Policy
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.