Compliance

Compliance Frameworks Overview

Multiple compliance frameworks apply to Kubernetes-hosted workloads. The controls they require significantly overlap — a well-secured Kubernetes cluster simultaneously satisfies requirements across frameworks.

CIS Kubernetes Benchmark

The CIS Kubernetes Benchmark (current: v1.9.0 for Kubernetes 1.29+) defines configuration recommendations across six sections. Each check is scored (mandatory) or not scored (advisory).

Benchmark Sections

kube-bench: Automated CIS Scanning

Copy# Run kube-bench on control plane node
kube-bench run --targets master

# Run on worker node
kube-bench run --targets node

# Run all targets
kube-bench run

# Output as JSON for SIEM ingestion
kube-bench run --json > kube-bench-results.json

# Output as JUnit XML for CI integration
kube-bench run --junit > kube-bench-results.xml

# Run against specific benchmark version
kube-bench run --benchmark cis-1.9

kube-bench as In-Cluster Job

Copy# Run kube-bench as a Kubernetes Job (node perspective)
apiVersion: batch/v1
kind: Job
metadata:
  name: kube-bench
  namespace: kube-system
spec:
  template:
    spec:
      hostPID: true       # Required to inspect host processes
      nodeSelector:
        node-role.kubernetes.io/control-plane: ""
      tolerations:
      - key: node-role.kubernetes.io/control-plane
        operator: Exists
        effect: NoSchedule
      containers:
      - name: kube-bench
        image: aquasec/kube-bench:latest
        command: ["kube-bench", "run", "--targets", "master,etcd,policies", "--json"]
        volumeMounts:
        - name: var-lib-etcd
          mountPath: /var/lib/etcd
          readOnly: true
        - name: etc-kubernetes
          mountPath: /etc/kubernetes
          readOnly: true
      restartPolicy: Never
      volumes:
      - name: var-lib-etcd
        hostPath: { path: /var/lib/etcd }
      - name: etc-kubernetes
        hostPath: { path: /etc/kubernetes }

Key CIS Controls and Kubernetes Implementation

PCI DSS v4.0

PCI DSS applies when Kubernetes runs workloads that process, store, or transmit cardholder data (CHD). The entire cluster doesn't need to be in scope — scope reduction via network segmentation is critical.

Key PCI DSS Requirements → Kubernetes Controls

CHD Namespace Isolation Pattern

Copy# PCI-scoped namespace with all controls applied
apiVersion: v1
kind: Namespace
metadata:
  name: pci-cardholder
  labels:
    pci-scope: "true"
    # Pod Security Admission: enforce restricted
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: v1.29
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted
---
# Default-deny NetworkPolicy for CHD namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: pci-cardholder
spec:
  podSelector: {}
  policyTypes: [Ingress, Egress]
# Explicit allow policies added per service

SOC 2

SOC 2 audits against the AICPA Trust Services Criteria. The Security criteria (Common Criteria, CC) are required for every SOC 2 report; the others (Availability, Confidentiality, Processing Integrity, Privacy) are optional and selected based on the service's scope.

Common Criteria → Kubernetes Controls

HIPAA

HIPAA applies to covered entities (healthcare providers, health plans, clearinghouses) and their business associates who access electronic protected health information (ePHI).

§ 164.312 Technical Safeguards → Kubernetes

FedRAMP / NIST 800-53

FedRAMP authorizations are based on NIST SP 800-53 Rev 5 control baselines. The impact level (Low/Moderate/High) determines which controls are required.

ISO 27001:2022

Kubernetes Control Mapping

This master table maps Kubernetes security controls to multiple frameworks simultaneously. Implementing one control often satisfies requirements across all frameworks.

Automated Compliance Scanning

Polaris: Workload Best Practices

Copy# Polaris: audit workload configurations against best practices
# Install as in-cluster audit tool
helm repo add fairwinds-stable https://charts.fairwinds.com/stable
helm install polaris fairwinds-stable/polaris \
  --namespace polaris \
  --create-namespace

# Run as CLI audit against cluster
polaris audit --cluster --format pretty

# Run against a specific namespace
polaris audit --cluster --namespace production --format json > polaris-report.json

# Run against local YAML files (CI gate)
polaris audit --audit-path ./k8s/ --format pretty --set-exit-code-on-danger

# Polaris checks: readinessProbe, livenessProbe, resources, securityContext,
# image tags, privileged containers, hostPath, runAsNonRoot, etc.

Checkov: IaC Compliance Scanning

Copy# Checkov: static analysis of Kubernetes manifests and Terraform
pip install checkov

# Scan Kubernetes manifests
checkov -d ./k8s/ --framework kubernetes

# Scan with specific checks only (CIS benchmark checks)
checkov -d ./k8s/ --framework kubernetes \
  --check CKV_K8S_1,CKV_K8S_2,CKV_K8S_8,CKV_K8S_9

# Output as SARIF for GitHub Security tab
checkov -d ./k8s/ --framework kubernetes \
  --output sarif --output-file checkov-results.sarif

# Scan Helm charts
checkov -d ./charts/ --framework helm

Trivy: Combined Vulnerability + Misconfiguration Scan

Copy# Trivy: scan cluster for both CVEs and misconfigurations
trivy k8s --report summary cluster

# Detailed report with misconfig and CVE findings
trivy k8s --report all \
  --format json \
  --output trivy-cluster-report.json \
  cluster

# Scan specific namespace
trivy k8s --namespace production --report all cluster

# Scan Kubernetes manifests for misconfigurations (CI gate)
trivy config ./k8s/ --exit-code 1 --severity HIGH,CRITICAL

OPA Gatekeeper: Policy-as-Code for Compliance

Copy# Gatekeeper ConstraintTemplate: require resource limits (PCI/SOC2/CIS 5.2)
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: k8srequiredresources
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredResources
  targets:
  - target: admission.k8s.gatekeeper.sh
    rego: |
      package k8srequiredresources

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        not container.resources.limits.memory
        msg := sprintf("Container '%v' must have memory limit", [container.name])
      }

      violation[{"msg": msg}] {
        container := input.review.object.spec.containers[_]
        not container.resources.requests.cpu
        msg := sprintf("Container '%v' must have CPU request", [container.name])
      }

Evidence Collection

Compliance audits require producing evidence that controls are in place and operating effectively. This section provides commands to collect evidence for each major control area.

Access Control Evidence

Copy# List all ClusterRoleBindings (evidence of privilege assignment)
kubectl get clusterrolebindings -o json | \
  jq '.items[] | {name:.metadata.name, role:.roleRef.name, subjects:.subjects}'

# List all users with cluster-admin
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects[]'

# RBAC permissions for a specific service account
kubectl auth can-i --list \
  --as=system:serviceaccount:production:myapp-sa \
  --namespace production

# All RoleBindings in a namespace
kubectl get rolebindings,clusterrolebindings -n production -o yaml

Encryption Evidence

Copy# Verify API server has encryption config flag
kubectl get pod kube-apiserver-$(hostname) -n kube-system -o yaml | \
  grep encryption-provider-config

# Verify a secret is encrypted in etcd
ETCDCTL_API=3 etcdctl \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets/production/db-password | head -c 40
# Must start with: k8s:enc:

# Check KMS health endpoint
kubectl get --raw /healthz/kms-providers

Audit Logging Evidence

Copy# Verify audit logging is enabled
kubectl get pod kube-apiserver-$(hostname) -n kube-system -o yaml | \
  grep -E "audit-log-path|audit-policy-file"

# Show audit policy in use
cat /etc/kubernetes/audit-policy.yaml

# Verify audit logs are being written
ls -lh /var/log/kubernetes/audit/
tail -1 /var/log/kubernetes/audit/audit.log | jq .stageTimestamp

# Count audit events in last hour (proves logging is active)
find /var/log/kubernetes/audit/ -newer /tmp/one-hour-ago | \
  xargs wc -l

Network Security Evidence

Copy# List all NetworkPolicies (evidence of network segmentation)
kubectl get networkpolicies --all-namespaces -o wide

# Verify default-deny exists in sensitive namespaces
kubectl get networkpolicy -n pci-cardholder default-deny-all -o yaml

# Show namespaces WITHOUT NetworkPolicy (compliance gap)
for ns in $(kubectl get namespaces -o jsonpath='{.items[*].metadata.name}'); do
  count=$(kubectl get networkpolicies -n "$ns" --no-headers 2>/dev/null | wc -l)
  if [ "$count" -eq 0 ]; then
    echo "NO NetworkPolicy: $ns"
  fi
done

Generating a Compliance Report

Copy# Generate comprehensive compliance snapshot
#!/bin/bash
REPORT_DIR="compliance-evidence-$(date +%Y%m%d)"
mkdir -p "$REPORT_DIR"

# kube-bench CIS scan
kube-bench run --json > "$REPORT_DIR/kube-bench.json"

# Polaris workload audit
polaris audit --cluster --format json > "$REPORT_DIR/polaris.json"

# Trivy cluster scan
trivy k8s --report all --format json \
  --output "$REPORT_DIR/trivy-cluster.json" cluster

# RBAC snapshot
kubectl get clusterrolebindings -o json > "$REPORT_DIR/clusterrolebindings.json"
kubectl get rolebindings --all-namespaces -o json > "$REPORT_DIR/rolebindings.json"

# NetworkPolicy snapshot
kubectl get networkpolicies --all-namespaces -o json > "$REPORT_DIR/networkpolicies.json"

# Encrypt the evidence package before storing
tar czf - "$REPORT_DIR/" | \
  gpg --symmetric --cipher-algo AES256 \
  > "compliance-evidence-$(date +%Y%m%d).tar.gz.gpg"

echo "Compliance evidence collected in $REPORT_DIR"

Continuous Compliance

Point-in-time compliance scans create gaps between audits. Continuous compliance uses policy enforcement and automated scanning to detect drift immediately.

Kyverno Policy Reports

Copy# Kyverno generates PolicyReport and ClusterPolicyReport CRDs
# Policy Reporter UI provides dashboard over these reports

# View policy violations in a namespace
kubectl get policyreport -n production -o yaml

# View cluster-scoped policy violations
kubectl get clusterpolicyreport -o yaml

# Install Policy Reporter for dashboard
helm install policy-reporter policy-reporter/policy-reporter \
  --namespace policy-reporter \
  --create-namespace \
  --set ui.enabled=true \
  --set kyvernoPlugin.enabled=true

Continuous Compliance Architecture

Copy# kube-bench CronJob — daily scheduled CIS scan
apiVersion: batch/v1
kind: CronJob
metadata:
  name: kube-bench-daily
  namespace: kube-system
spec:
  schedule: "0 2 * * *"    # Daily at 2 AM
  jobTemplate:
    spec:
      template:
        spec:
          hostPID: true
          nodeSelector:
            node-role.kubernetes.io/control-plane: ""
          tolerations:
          - key: node-role.kubernetes.io/control-plane
            operator: Exists
            effect: NoSchedule
          containers:
          - name: kube-bench
            image: aquasec/kube-bench:v0.7.3
            command: ["kube-bench", "run", "--json"]
            volumeMounts:
            - name: etc-kubernetes
              mountPath: /etc/kubernetes
              readOnly: true
          restartPolicy: Never
          volumes:
          - name: etc-kubernetes
            hostPath: { path: /etc/kubernetes }

Metrics, Alerts & Runbooks

Key Metrics

Alerts

Copy# Alert: Compliance policy violations above threshold
- alert: CompliancePolicyViolations
  expr: sum(kyverno_policy_results_total{result="fail",policy_type="validate"}) > 10
  for: 15m
  annotations:
    summary: "More than 10 active compliance policy violations"

# Alert: New namespace without NetworkPolicy
- alert: NamespaceWithoutNetworkPolicy
  expr: namespaces_without_network_policy > 0
  for: 10m
  annotations:
    summary: "Namespace created without NetworkPolicy — open network access"

# Alert: kube-bench FAIL count increased
- alert: CISBenchmarkRegressions
  expr: kube_bench_failed_checks_total > kube_bench_failed_checks_total offset 24h
  annotations:
    summary: "CIS benchmark failure count increased since yesterday — configuration regression"

# Alert: Critical CVE in PCI-scoped namespace
- alert: CriticalCVEInPCIScope
  expr: sum by (namespace, workload) (trivy_vulnerability_id{severity="CRITICAL", namespace="pci-cardholder"}) > 0
  for: 5m
  severity: critical
  annotations:
    summary: "Critical CVE in PCI-scoped workload — immediate remediation required"

Runbooks

Best Practices