A practical Kubernetes hardening checklist for small teams
Most Kubernetes hardening guides read like a compliance checklist written for an audit, not for a team trying to ship. That’s useful once you’re at scale with a dedicated platform team — it’s overwhelming when you’re three engineers trying to get a cluster into production safely.
In practice, a small number of changes account for most of the risk reduction. Start with network policies: a default-deny policy between namespaces closes off the most common lateral-movement path we see in early-stage clusters. Pair that with pod security standards set to at least "baseline," which blocks the most dangerous container configurations (privileged mode, host networking, arbitrary host path mounts) without requiring you to redesign every workload.
Secrets management is the next place we usually find gaps. Kubernetes Secrets are base64-encoded, not encrypted, by default — anyone with read access to the etcd store or a sufficiently privileged service account can read them in plaintext. Enabling encryption at rest for the Secrets resource, and moving toward a proper secrets manager for anything sensitive, closes that gap without much engineering effort.
RBAC is worth a dedicated pass on its own. The default of granting broad `cluster-admin` access to CI service accounts is common because it’s the path of least resistance — and it’s also the single biggest blast radius if a pipeline credential leaks. Scoping service accounts to exactly the namespaces and verbs they need takes an afternoon and meaningfully limits what a compromised credential can do.
Finally, don’t skip image provenance. Pulling from public registries without pinning digests (not just tags) means your "known good" image can change under you. A minimal admission controller that enforces signed, digest-pinned images from an approved registry list stops a whole category of supply-chain risk before it reaches your cluster.
None of this requires a platform team or a six-month project — it’s a focused week of work that closes the gaps we most commonly find during cluster audits.