Skip to content
Start free
Best Practices

50 Kubernetes configuration checks, scored per cluster.

Security, reliability, scheduling and resource settings, ranked by severity, with the YAML to fix each one.

Start freeBook a demo
  • Every permission listed
  • Severity-ranked
  • Copy-paste fixes

  • 50

    configuration checks

  • 6

    categories

  • 3

    findings on this example

What we check

50 checks in six categories.

Each finding names the resource, its severity, and the setting to change.

Security

11 checks

7crit3warn1info
  • SEC-001Running as root
  • SEC-002Privileged container
  • SEC-007Read-only root FS missing
Open audit

Reliability

11 checks

2crit6warn3info
  • REL-001Single replica
  • REL-005No liveness probe
  • REL-006No readiness probe
Open audit

Workload Config

9 checks

1crit5warn3info
  • WRK-002Missing PDB
  • WRK-003No graceful shutdown
  • WRK-004No revision history
Open audit

Scheduling & Placement

6 checks

0crit4warn2info
  • SCH-001No anti-affinity
  • SCH-002No topology spread
  • SCH-003Missing tolerations
Open audit

Namespace Org

5 checks

0crit2warn3info
  • NS-001Missing resource quota
  • NS-002No limit range
  • NS-003Missing labels
Open audit

Resource Config

8 checks

0crit5warn3info
  • RES-001No CPU limits
  • RES-002No memory limits
  • RES-003No requests set
Open audit

Checks informed by the Kubernetes Pod Security Standards and NSA/CISA hardening guidance

Finding → fix

From finding to copy-paste fix.

Each finding comes with the exact resource, why it matters, how to fix it, and the YAML.

CriticalSEC-001Example finding

payment-service

Deploymentproduction

Why it matters

Container runs as UID 0. A pod escape grants root on the node.

How to fix

  1. 1

    Add securityContext.runAsNonRoot: true

  2. 2

    Set securityContext.runAsUser: 10001

  3. 3

    Rebuild image with non-root USER directive

Suggested change
spec:  template:    spec:+     securityContext:+       runAsNonRoot: true+       runAsUser: 10001      containers:        - name: api          image: payment:1.4.2

  • Exact resource

    Cluster, namespace, kind and name.

  • Step-by-step

    Each finding has numbered remediation steps.

  • Real YAML

    Copy-paste YAML for the fix.

Score over time

Track the score as you fix findings.

Each cluster gets one score. It rises as findings are fixed.

Example · best-practices score · 8 weeks

prod-east cluster

Now

92

from 38

Privileged containers removed
OOM fixes applied
Anti-affinity added

Install in 5 minutes

Stop paying for unused capacity.

Free up to 100 vCPU. After that, $1.99 per vCPU per month, dropping to $0.60 at volume.

Start freeBook a demo
Agent runs in your clusterNo credit card