A cluster is only as current as its oldest node image and Kubernetes minor version. Upstream Kubernetes gives each minor release about a year of patch support, and a container escape in the runtime reaches every pod on the node regardless of how well the pods are configured.
- Harden components against the CIS Kubernetes Benchmark, or the provider benchmark on a managed cluster, and treat tool output as a work list rather than a score.
- Run a minimal, container-focused node OS and keep node images on a regular upgrade channel.
- Track the support window of the Kubernetes version and distribution you run, and upgrade before it ends.
- Patch the container runtime as well as the images: runtime escapes need a node update.
Guides on this site
Harden managed Kubernetes on EKS, AKS and GKE
Know what your provider secures and what you still own, then lock down API access, cloud identity, nodes, pod privileges and admission with settings that are generally available in Kubernetes 1.37, checked against the CIS and NSA/CISA baselines.
Harden the images you ship against CIS, STIG and SCAP benchmarks
Hold each image your team ships (container base images, golden VM images, Kubernetes node images) to a published benchmark through a pinned SCAP Security Guide profile, scan every build with OpenSCAP, and fail the build on any failure that a deviation register does not explain with an owner, an approver and an expiry.
Practice
- Gate an image build on a CIS scan and a deviation register · Local project
Gaps on this site
Hardening here is written for managed EKS, AKS and GKE clusters. No guide covers a control plane you run yourself, such as one built with kubeadm.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.