Some security-relevant events, such as issuing client certificates and service account tokens, leave no record in the cluster datastore. Only the API server audit log shows who created a credential, and many distributions do not enable it by default.
- Enable API server audit logging with a policy that records credential issuance and access to Secrets, RBAC and workloads, and retain it.
- Collect node and workload logs with tooling that follows pods across nodes.
- Buffer logs on the node and decouple ingestion from storage so an outage downstream does not lose the trail.
- Alert on the events you expect attackers to cause, and rehearse reconstructing an incident from the logs.
Guides on this site
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
Detect container and host threats at runtime with eBPF sensors and cloud services
Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
OWASP does not publish a mapping between the 2022 and 2025 lists. The 2022 entry shown for each risk is the one with the same subject, matched by title; 2022's K02 Supply Chain Vulnerabilities has no 2025 counterpart.