Container Security
A misconfigured cluster is not a vulnerability. It is an open door to every workload you run.
Sherlock Forensics provides Kubernetes and container security assessments covering RBAC review, container escape testing, secrets management, network policies, pod security standards and CI/CD pipeline security. Cloud-managed and self-hosted clusters. Over 20 years of certified security experience. Contact 604.229.1994.
Kubernetes clusters run your most critical workloads. They hold your application code, your secrets, your database credentials and your customer data. A single RBAC misconfiguration or privileged container can give an attacker full control of every pod in your cluster. Container orchestration adds layers of complexity that traditional security testing does not address. Your Kubernetes configuration is your security posture.
Scope
We audit every Role, ClusterRole, RoleBinding and ClusterRoleBinding in your cluster. We identify overly permissive rules, wildcard permissions, default service account tokens with excessive privileges and bindings that grant cluster-admin to workloads that do not need it. RBAC misconfigurations are the most common path from a compromised pod to full cluster takeover. We map the actual permission graph and flag every escalation path.
We test whether a compromised container can break out of its isolation boundary. This includes testing for privileged containers, dangerous Linux capabilities (SYS_ADMIN, SYS_PTRACE), host namespace sharing, host path volume mounts, writable hostPath volumes, Docker socket mounts and kernel exploit paths. A successful container escape gives the attacker access to the host node and potentially every workload running on it.
Kubernetes secrets are base64-encoded, not encrypted at rest by default. We check etcd encryption configuration, secret access permissions, environment variable exposure, volume mount permissions and whether secrets are accessible from pods that should not have them. We verify integration with external secret stores (Vault, AWS Secrets Manager, GCP Secret Manager) and test for secret leakage through logs, error messages and API responses.
Without network policies, every pod in a Kubernetes cluster can communicate with every other pod. We test for missing network policies, overly permissive ingress and egress rules, namespace isolation gaps and DNS-based exfiltration paths. We verify that network policies enforce the principle of least privilege at the network layer and that sensitive workloads (databases, secret stores) are properly segmented from application pods.
We evaluate pod security contexts against the Kubernetes Pod Security Standards (Privileged, Baseline, Restricted). We check for containers running as root, missing security contexts, allowPrivilegeEscalation settings, read-only root filesystems, seccomp and AppArmor profiles and resource limits. Each misconfiguration widens the attack surface if a container is compromised.
Your build pipeline is the supply chain for your cluster. We test pipeline access controls, image signing and verification with tools like Cosign or Notary, container registry security, build environment isolation, deployment credential storage and whether your pipeline enforces admission policies before deploying to production. A compromised pipeline means compromised production.
Supply Chain
Environments
EKS integrates Kubernetes RBAC with AWS IAM through the aws-auth ConfigMap and EKS Pod Identity. We test IAM role mappings, IRSA (IAM Roles for Service Accounts) configurations, node group security, VPC networking and EKS-specific API server access controls. Misconfigured IAM-to-RBAC mappings are a frequent finding that grants broader cluster access than intended.
GKE offers Autopilot and Standard modes with different security implications. We test Workload Identity configurations, GKE-specific network policies, Binary Authorization enforcement, node auto-upgrade settings and GCP IAM integration. GKE Autopilot enforces stricter pod security by default but still requires proper Workload Identity and network policy configuration.
Self-hosted Kubernetes (kubeadm, k3s, Rancher) means you manage the control plane. We test etcd encryption and access controls, API server configuration flags, kubelet authentication and authorization, controller manager and scheduler security and certificate management. Self-hosted clusters carry the full responsibility for control plane security that cloud providers handle in managed offerings.
References
Joint guidance from the National Security Agency and CISA on securing Kubernetes clusters. Our assessments validate compliance with these recommendations.
The Center for Internet Security benchmark for Kubernetes. We test cluster configuration against CIS benchmark controls for both managed and self-hosted environments.
MITRE's framework for container-specific attack techniques. We map findings to MITRE ATT&CK to contextualize risks within known adversary behavior patterns.
Frequently Asked Questions
Related
Our full penetration testing methodology covering web applications, APIs, infrastructure and mobile platforms.
API penetration testing for REST, GraphQL and gRPC covering OWASP API Top 10, OAuth/JWT and authorization testing.
Multi-tenant security testing for SaaS companies including API security, data isolation and compliance-ready reporting.
Get Started
Kubernetes security assessment covering RBAC, container escape, network policies and CI/CD pipeline review.
Tell us about your cluster architecture, cloud provider, workload count and compliance requirements. We will scope an assessment for your specific environment.
Call 604.229.1994