KCSA security review cheat sheet

$kubectl auth whoami 2>&1 | head -6; echo "--- the admin is a client certificate in kubeconfig, in the cluster-admins group. No password, no server-side account"ATTRIBUTE                                           VALUEUsername                                            kubernetes-adminGroups                                              [kubeadm:cluster-admins system:authenticated]Extra: authentication.kubernetes.io/credential-id   [X509SHA256=da024493843d4cf0b1166a0d2defc96e9ea89084fc6d817e1a2bb955b1a28503]--- the admin is a client certificate in kubeconfig, in the cluster-admins group. No password, no server-side account

$kubectl auth can-i --list -n kcsa-cc --as=system:serviceaccount:kcsa-cc:appsa 2>/dev/null | grep -iE 'secrets|resources' | head -4; echo "--- what THIS app's ServiceAccount may do. A get,list on secrets is a common grant for an app that reads its own config"Resources                                       Non-Resource URLs                      Resource Names   Verbssecrets                                         []                                     []               [get list]--- what THIS app's ServiceAccount may do. A get,list on secrets is a common grant for an app that reads its own config

$kubectl get clusterrolebindings -o jsonpath='{range .items[?(@.roleRef.name=="cluster-admin")]}{.metadata.name}{" -> "}{.subjects[*].name}{"\n"}{end}' | grep -vE 'system:|^$' | head; echo "--- every cluster-admin binding and its subjects. kcsa-backdoor-admin is the one that does not belong"kcsa-backdoor-admin -> backdoorkubeadm:cluster-admins -> kubeadm:cluster-admins--- every cluster-admin binding and its subjects. kcsa-backdoor-admin is the one that does not belong

$kubectl get clusterroles -o jsonpath='{range .items[*]}{.metadata.name}{" "}{.rules[*].verbs}{"\n"}{end}' | grep -E 'escalate|bind|impersonate' | grep -vc '^system:'; echo "non-system ClusterRoles carrying escalate, bind or impersonate"; echo "--- these three verbs are how a limited grant becomes a larger one. They belong on every review checklist"2non-system ClusterRoles carrying escalate, bind or impersonate--- these three verbs are how a limited grant becomes a larger one. They belong on every review checklist

$kubectl create ns kcsa-trap >/dev/null 2>&1; kubectl -n kcsa-trap create sa viewer >/dev/null; kubectl -n kcsa-trap create sa editor >/dev/null; kubectl -n kcsa-trap create rolebinding v --clusterrole=view --serviceaccount=kcsa-trap:viewer >/dev/null; kubectl -n kcsa-trap create rolebinding e --clusterrole=edit --serviceaccount=kcsa-trap:editor >/dev/null; echo -n 'view  can get secrets: '; kubectl auth can-i get secrets -n kcsa-trap --as=system:serviceaccount:kcsa-trap:viewer; echo -n 'edit  can get secrets: '; kubectl auth can-i get secrets -n kcsa-trap --as=system:serviceaccount:kcsa-trap:editor; echo "--- the difference between the two roles people hand out casually"view  can get secrets: noedit  can get secrets: yes--- the difference between the two roles people hand out casually

$sudo grep -E 'admission-plugins' /etc/kubernetes/manifests/kube-apiserver.yaml; echo "--- the ONLY admission flag kubeadm sets. Everything else is a default"    - --enable-admission-plugins=NodeRestriction--- the ONLY admission flag kubeadm sets. Everything else is a default

$sudo grep -cE 'audit-log-path|audit-policy-file' /etc/kubernetes/manifests/kube-apiserver.yaml; echo "--- occurrences of the audit flags in the manifest. The same 0 this path measured by hand in domain 3, now reported as CIS 1.2.16 to 1.2.19"0--- occurrences of the audit flags in the manifest. The same 0 this path measured by hand in domain 3, now reported as CIS 1.2.16 to 1.2.19

$sudo find /etc/kubernetes/pki -name '*ca.crt' | sort; echo "--- THREE, not one. Client certs are only trusted by the CA that signed them, so these are three separate trust domains"/etc/kubernetes/pki/ca.crt/etc/kubernetes/pki/etcd/ca.crt/etc/kubernetes/pki/front-proxy-ca.crt--- THREE, not one. Client certs are only trusted by the CA that signed them, so these are three separate trust domains

$sudo kubeadm certs check-expiration 2>/dev/null | sed -n '4,14p'; echo "--- one year on the leaf certificates. kubeadm renews them on upgrade, which is why a cluster left un-upgraded for a year stops working"CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGEDadmin.conf                 Aug 25, 2027 11:22 UTC   364d            ca                      noapiserver                  Aug 25, 2027 11:22 UTC   364d            ca                      noapiserver-etcd-client      Aug 25, 2027 11:22 UTC   364d            etcd-ca                 no

$kubectl label ns kcsa-trap pod-security.kubernetes.io/enforce=restricted --overwrite >/dev/null; kubectl -n kcsa-trap run rootpod2 --image=docker.io/library/busybox:1.37 --restart=Never --command -- sh -c 'sleep 300' 2>&1 | head -3; echo "--- restricted refuses the identical Pod, and names every field it wanted. That list IS the difference between the two levels"Warning: existing pods in namespace "kcsa-trap" violate the new PodSecurity enforce level "restricted:latest"Warning: both (and 2 other pods): allowPrivilegeEscalation != false, unrestricted capabilities, runAsNonRoot != true, seccompProfileError from server (Forbidden): pods "rootpod2" is forbidden: violates PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "rootpod2" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "rootpod2" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "rootpod2" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "rootpod2" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")--- restricted refuses the identical Pod, and names every field it wanted. That list IS the difference between the two levels

$kubectl -n kcsa-cc exec app -- sh -c 'mkdir -p /mnt 2>/dev/null; mount -t proc proc /mnt 2>&1; grep CapEff /proc/1/status'; echo "--- mount is refused although we are root: CAP_SYS_ADMIN is not in the set. CapEff is the bounded default containerd grants, not the full capability set"mount: mounting proc on /mnt failed: Permission deniedCapEff:	00000000a80425fb--- mount is refused although we are root: CAP_SYS_ADMIN is not in the set. CapEff is the bounded default containerd grants, not the full capability set

$printf 'apiVersion: v1\nkind: Pod\nmetadata:\n  name: guaranteed\nspec:\n  containers:\n  - name: c\n    image: docker.io/library/busybox:1.37\n    command: ["sh","-c","sleep 900"]\n    resources:\n      requests:\n        cpu: 100m\n        memory: 64Mi\n      limits:\n        cpu: 100m\n        memory: 64Mi\n' | kubectl -n kcsa-dos apply -f - >/dev/null && kubectl -n kcsa-dos wait --for=condition=Ready pod/guaranteed --timeout=120s >/dev/null; kubectl -n kcsa-dos get pods -o custom-columns='NAME:.metadata.name,QOS:.status.qosClass,CPU-REQ:.spec.containers[0].resources.requests.cpu,MEM-REQ:.spec.containers[0].resources.requests.memory,MEM-LIM:.spec.containers[0].resources.limits.memory' --no-headers; echo "--- hog set memory request == limit and is still Burstable. Guaranteed needs CPU AND memory equal on EVERY container"greedy       BestEffort   <none>   <none>   <none>guaranteed   Guaranteed   100m     64Mi     64Mihog          Burstable    <none>   64Mi     64Mi--- hog set memory request == limit and is still Burstable. Guaranteed needs CPU AND memory equal on EVERY container

$kubectl -n kcsa-dos exec greedy -- sh -c 'echo -n "nproc: "; nproc; echo -n "cpu.max: "; cat /sys/fs/cgroup/cpu.max; echo -n "memory.max: "; cat /sys/fs/cgroup/memory.max'; echo "--- the container sees every node CPU, and both cgroup ceilings read max. A busy loop here is a node-wide outage"nproc: 2cpu.max: max 100000memory.max: max--- the container sees every node CPU, and both cgroup ceilings read max. A busy loop here is a node-wide outage

$echo -n "StorageClasses: "; kubectl get storageclass --no-headers 2>/dev/null | wc -l; echo -n "CSI drivers:    "; kubectl get csidrivers --no-headers 2>/dev/null | wc -l; kubectl get csinodes -o custom-columns='NODE:.metadata.name,DRIVERS:.spec.drivers[*].name' --no-headers; echo "--- no StorageClass, no CSI driver, and not one node registers a driver. Dynamic provisioning is something you INSTALL"StorageClasses: 0CSI drivers:    0cka5001          <none>cka5001-node01   <none>cka5001-node02   <none>cka5001-node03   <none>--- no StorageClass, no CSI driver, and not one node registers a driver. Dynamic provisioning is something you INSTALL

$printf 'apiVersion: v1\nkind: PersistentVolume\nmetadata:\n  name: kcsa-static\nspec:\n  capacity:\n    storage: 128Mi\n  accessModes: ["ReadWriteOnce"]\n  storageClassName: manual\n  hostPath:\n    path: /mnt/kcsa-store\n' | kubectl apply -f - 2>&1 | tail -1; kubectl get pv kcsa-static -o custom-columns='NAME:.metadata.name,CAPACITY:.spec.capacity.storage,RECLAIM:.spec.persistentVolumeReclaimPolicy,STATUS:.status.phase,PATH:.spec.hostPath.path' --no-headers; echo "--- a PV is CLUSTER-SCOPED and it names a path on a node. Note the reclaim policy nobody set"persistentvolume/kcsa-static createdkcsa-static   128Mi   Retain   Available   /mnt/kcsa-store--- a PV is CLUSTER-SCOPED and it names a path on a node. Note the reclaim policy nobody set

$sudo cat /mnt/kcsa-store/records.txt; echo "--- the claim is gone and the data is still here. Deleting a PVC is not deleting data"CUSTOMER-RECORDS-2026--- the claim is gone and the data is still here. Deleting a PVC is not deleting data

$kubectl create ns kcsa-sec >/dev/null && kubectl -n kcsa-sec create secret generic dbcreds --from-literal=username=svcuser --from-literal=password=Hunter2-VerySecret >/dev/null && kubectl -n kcsa-sec describe secret dbcreds | tail -6; echo "--- describe shows SIZES, never values. That is deliberate"Type:  Opaque Data====password:  18 bytes

$kubectl -n kcsa-sec exec envpod -- sh -c 'tr "\0" "\n" < /proc/1/environ | grep -i password'; echo "--- and in /proc/1/environ, readable by ANY process in that container"password=Hunter2-VerySecret--- and in /proc/1/environ, readable by ANY process in that container

$kubectl -n kcsa-tm exec probe -- sh -c 'cat /var/run/secrets/kubernetes.io/serviceaccount/token' | cut -d. -f2 | base64 -d 2>/dev/null | tr ',' '\n' | grep -E 'serviceaccount|"sub"|namespace' | head -5; echo "--- the token decodes to system:serviceaccount:kcsa-tm:default. Anyone who reads this file IS that identity""kubernetes.io":{"namespace":"kcsa-tm""serviceaccount":{"name":"default""sub":"system:serviceaccount:kcsa-tm:default"}--- the token decodes to system:serviceaccount:kcsa-tm:default. Anyone who reads this file IS that identity

$kubectl -n kcsa-cc run notoken --image=docker.io/library/busybox:1.37 --restart=Never --overrides='{"spec":{"automountServiceAccountToken":false}}' --command -- sh -c 'sleep 600' >/dev/null && kubectl -n kcsa-cc wait --for=condition=Ready pod/notoken --timeout=120s >/dev/null && kubectl -n kcsa-cc exec notoken -- ls /var/run/secrets/kubernetes.io/serviceaccount/ 2>&1 | head -2; echo "--- automountServiceAccountToken:false and the credential is simply not there. Nothing to steal"ls: /var/run/secrets/kubernetes.io/serviceaccount/: No such file or directorycommand terminated with exit code 1--- automountServiceAccountToken:false and the credential is simply not there. Nothing to steal

$kubectl -n kcsa-reg get secret regcred -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d; echo; echo "--- the registry, the username, the password in clear, and an auth field. Anyone who can read Secrets in this namespace can log in to that registry"{"auths":{"ghcr.io":{"username":"ci-bot","password":"s3cr3t-ci-token","auth":"Y2ktYm90OnMzY3IzdC1jaS10b2tlbg=="}}}--- the registry, the username, the password in clear, and an auth field. Anyone who can read Secrets in this namespace can log in to that registry

$kubectl -n kcsa-attacker exec atk -- curl -s --max-time 5 http://web.kcsa-victim.svc.cluster.local:8080/; echo "--- a Pod in kcsa-attacker reached an internal service in kcsa-victim with no credential and no policy in the way"INTERNAL-ADMIN-PANEL-OK--- a Pod in kcsa-attacker reached an internal service in kcsa-victim with no credential and no policy in the way

$printf 'apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: default-deny-ingress\n  namespace: kcsa-victim\nspec:\n  podSelector: {}\n  policyTypes: ["Ingress"]\n' | kubectl apply -f - 2>&1 | tail -1; kubectl -n kcsa-attacker exec atk -- curl -s --max-time 6 -o /dev/null -w 'exit-then-code %{http_code}\n' http://web.kcsa-victim.svc.cluster.local:8080/ 2>&1; echo "curl exit code: $?"; echo "--- default-deny ingress in kcsa-victim, enforced by Cilium. The connection now times out. Same attacker, same network, one policy"networkpolicy.networking.k8s.io/default-deny-ingress createdexit-then-code 000command terminated with exit code 28curl exit code: 28--- default-deny ingress in kcsa-victim, enforced by Cilium. The connection now times out. Same attacker, same network, one policy

$AG=$(kubectl -n kube-system get pod -l k8s-app=cilium --field-selector spec.nodeName=cka5001-node01 -o jsonpath='{.items[0].metadata.name}'); for i in $(seq 20); do D=$(kubectl -n kube-system exec $AG -c cilium-agent -- hubble observe -n kcsa-obs --verdict DROPPED --last 2 2>/dev/null); [ -n "$D" ] && break; sleep 3; done; echo "$D"; echo "--- DROPPED, and the reason is named: Policy denied. This is the difference between a timeout you can explain and one you cannot"Aug 25 15:24:47.901: kcsa-obs/client:48108 (ID:2369) <> kcsa-obs/web:8080 (ID:26486) policy-verdict:none INGRESS DENIED (TCP Flags: SYN)Aug 25 15:24:47.901: kcsa-obs/client:48108 (ID:2369) <> kcsa-obs/web:8080 (ID:26486) Policy denied DROPPED (TCP Flags: SYN)--- DROPPED, and the reason is named: Policy denied. This is the difference between a timeout you can explain and one you cannot

$kubectl -n kube-system exec ds/cilium -c cilium-agent -- cilium-dbg status 2>/dev/null | grep -E 'Encryption|KubeProxyReplacement|Host firewall'; echo "--- Encryption DISABLED. Pod-to-pod traffic between nodes crosses the network in clear"KubeProxyReplacement:    FalseHost firewall:           DisabledEncryption:              Disabled--- Encryption DISABLED. Pod-to-pod traffic between nodes crosses the network in clear

$kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations --no-headers 2>&1 | tail -1; kubectl get validatingadmissionpolicies --no-headers 2>&1 | tail -1; echo "--- no webhooks and no policies. Every admission decision so far has come from a plugin compiled into the apiserver"No resources foundNo resources found--- no webhooks and no policies. Every admission decision so far has come from a plugin compiled into the apiserver

$sleep 8; kubectl -n kcsa-adm run nolabel --image=docker.io/library/busybox:1.37 --restart=Never --command -- sh -c 'sleep 300' 2>&1 | tail -2; echo "--- refused at admission. The message names the policy, the binding, and the reason a human wrote"The pods "nolabel" is invalid: : ValidatingAdmissionPolicy 'kcsa-require-owner' with binding 'kcsa-require-owner-binding' denied request: every Pod must carry an owner label naming a team--- refused at admission. The message names the policy, the binding, and the reason a human wrote

$kubectl create ns kcsa-img >/dev/null 2>&1; kubectl -n kcsa-img run bytag --image=docker.io/library/busybox:1.37 --restart=Never --command -- sh -c 'sleep 900' >/dev/null && kubectl -n kcsa-img wait --for=condition=Ready pod/bytag --timeout=120s >/dev/null && kubectl -n kcsa-img get pod bytag -o jsonpath='spec.image:  {.spec.containers[0].image}{"\n"}status.imageID: {.status.containerStatuses[0].imageID}{"\n"}pullPolicy:   {.spec.containers[0].imagePullPolicy}{"\n"}'; echo "--- you asked for a TAG. What ran is a DIGEST, and the two are recorded in different fields"spec.image:  docker.io/library/busybox:1.37status.imageID: docker.io/library/busybox@sha256:9db7b59979c38555a39def84a31fb98b5296952f9e3afd4f6f11f05b07adfab0pullPolicy:   IfNotPresent--- you asked for a TAG. What ran is a DIGEST, and the two are recorded in different fields

$kubectl -n kcsa-img run bylatest --image=docker.io/library/busybox:latest --restart=Never --command -- sh -c 'sleep 900' >/dev/null; kubectl -n kcsa-img get pods bytag bylatest -o custom-columns='NAME:.metadata.name,IMAGE:.spec.containers[0].image,PULLPOLICY:.spec.containers[0].imagePullPolicy' --no-headers; echo "--- neither Pod set imagePullPolicy. The tag decides it: :latest defaults to Always, anything else to IfNotPresent"bytag      docker.io/library/busybox:1.37     IfNotPresentbylatest   docker.io/library/busybox:latest   Always--- neither Pod set imagePullPolicy. The tag decides it: :latest defaults to Always, anything else to IfNotPresent

$for i in $(seq 60); do S=$(kubectl -n kcsa-cis get job kube-bench-master -o jsonpath='{.status.succeeded}' 2>/dev/null); [ "$S" = "1" ] && break; sleep 3; done; kubectl -n kcsa-cis logs job/kube-bench-master 2>/dev/null | grep -A5 '== Summary master =='; echo "--- a number for each outcome. Note that WARN is nearly as large as FAIL"== Summary master ==38 checks PASS9 checks FAIL12 checks WARN0 checks INFO --- a number for each outcome. Note that WARN is nearly as large as FAIL

$kubectl -n kcsa-cis logs job/kube-bench-policies 2>/dev/null | grep -E '^\[FAIL\]'; echo "--- and the six it CAN automate are every finding this path made by hand, in the benchmark's own words"[FAIL] 5.1.1 Ensure that the cluster-admin role is only used where required (Automated)[FAIL] 5.1.2 Minimize access to secrets (Automated)[FAIL] 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Automated)[FAIL] 5.1.4 Minimize access to create pods (Automated)[FAIL] 5.1.5 Ensure that default service accounts are not actively used (Automated)[FAIL] 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Automated)--- and the six it CAN automate are every finding this path made by hand, in the benchmark's own words

$for i in $(seq 100); do S=$(kubectl -n kcsa-scan get job trivy -o jsonpath='{.status.succeeded}' 2>/dev/null); [ "$S" = "1" ] && break; sleep 5; done; kubectl -n kcsa-scan logs job/trivy 2>/dev/null | sed -n '/===old-severity===/,/===old-findings===/p' | head -n -1; echo "--- nginx:1.20, a base image a few years old. Every one of these is a KNOWN, PUBLISHED vulnerability in a package the image ships"===old-severity===     32 CRITICAL    197 HIGH    229 LOW    317 MEDIUM     23 UNKNOWN--- nginx:1.20, a base image a few years old. Every one of these is a KNOWN, PUBLISHED vulnerability in a package the image ships

$echo -n "containers running on this cluster: "; kubectl get pods -A -o jsonpath='{range .items[*].spec.containers[*]}{.name}{"\n"}{end}' | grep -c .; echo -n "with no resource limits at all: "; kubectl get pods -A -o jsonpath='{range .items[*].spec.containers[*]}{.resources.limits}{"\n"}{end}' | grep -c '^$'; echo -n "LimitRanges and ResourceQuotas that could default them: "; kubectl get limitrange,resourcequota -A --no-headers 2>/dev/null | wc -l; echo "--- 20 of 22 containers have no ceiling, and nothing exists to give them one"containers running on this cluster: 22with no resource limits at all: 20LimitRanges and ResourceQuotas that could default them: 0--- 20 of 22 containers have no ceiling, and nothing exists to give them one