Member post originally published on the ARMO blog by Ben Hirschberg

Kubernetes security is a critical part of the app lifecycle, through the build, deployment and runtime stages. Kubernetes runtime environments are dynamic and continuously changing. As clusters are replaced and permissions reassigned, security becomes an innate part of DevOps. 

It is important to ensure that malware and other malicious attacks do not access the cloud, as they might lead to system failures, servers going down, and more. According to a paper by Red Hat, 93% of people faced a security issue in their Kubernetes environment in 2022. 

To ensure that your Kubernetes infrastructure is safe and protected, DevOps engineers leverage Kubernetes security tools. The tools check for vulnerabilities, misconfigurations, and other issues in the Kubernetes environment that increase the attack surface. Considering organizations may have vast environments with many clusters, containers, and nodes, engineers turn to security tools to streamline security. 

Kubernetes security domains

Kubernetes security can be divided into four layers. These 4 layers, also known as the 4Cs of Kubernetes security, are:

These are the four levels at which security must be ensured. But what do each of these layers signify, and what kind of security measures must one take? Don’t worry I’ve got you covered. Allow me to explain. 


The cloud is the base on which everything else is built and deployed. So if the security on this layer is not strong, then security measures on other layers will be rendered ineffective. Whether you’re using Amazon Web ServicesIBMGoogle Cloud Platform, or a different public cloud, they each offer security recommendations and best practices. As a rule of thumb, follow these to ensure your cloud’s safety. However, be aware of what they do and don’t cover under the shared responsibility model.


The next layer is the cluster layer. This layer has two concerns: the security of the cluster components and the applications running in these clusters.  Some of the practices to follow to secure your cluster and the application within it include:

Besides these, there are many other practices one must follow to ensure cluster component security.


Containers are the third layer of Kubernetes security. A few common security challenges and best practices include:

Area of Concern for ContainersRecommendation
Container Vulnerability Scanning and OS Dependency SecurityAs part of an image build step, you should scan your container images and your containers for known vulnerabilities.
Image Signing and EnforcementSign container images to maintain a system of trust for the content of your containers.
Disallow privileged usersWhen constructing containers, ensure you create users that have the least level of operating system privilege necessary to carry out the goal of the container.
Use container runtime with stronger isolationSelect container runtime classes that provide stronger isolation.


Code is the final layer of security where most attacks happen. Thus it is imperative to secure the code layer with the best security measures. Some of the common practices include:

Top Kubernetes security tools

Now that you have an overview of Kubernetes security, let’s look at some of the top Kubernetes security tools. They can help you ensure the safety of your Kubernetes environment. 


Kubescape is a security tool with features that cater specifically to Kubernetes environments and infrastructure. 

For additional aspects of security we suggest checking out some of the following security tools. Here are some examples of leading tools that specialize in different security domains:

Tool: Cillium

Domain: Network security

Description: A cloud-native solution for securing Kubernetes environments.

Tool: Falco

Domain: Runtime security

Description: An open-source activity monitoring and intrusion detection system.

Tool: Checkov

Domain: IaC security

Description: An open-source scanner for identifying misconfigurations and mitigating risks.

Tool: Kong

Domain: API server security

Description: An API gateway and service mesh platform designed to enhance security.

Tool: Kube-audit

Domain: Compliance and governance

Description: A tool for auditing and logging activities within a Kubernetes cluster


In conclusion, organizations that use Kubernetes should ensure they have strong security measures in place. As these environments become more complex and dynamic, the need for more effective security tools becomes critical.

Each tool discussed in this article can help you secure part of the 4Cs mentioned above. Consider using a combination of tools, best practices, and regular audits to stay safe.