Question

A DevSecOps engineer is hardening a production Kubernetes cluster after an audit found that several application pods run with privileged security contexts, mount the host filesystem, and use the default service account with cluster-wide RBAC bindings. The applications are standard stateless web APIs that do not require host-level access. The engineer must reduce the container breakout and lateral movement risk with the least disruption to legitimate workloads. Which combination of controls MOST directly addresses the identified weaknesses?

Accepted Answer

Enforce a restricted Pod Security Standard admission policy that disallows privileged containers and hostPath mounts, and bind each workload to a dedicated least-privilege service account

Answer

Enable network policies to isolate namespaces and deploy a service mesh with mutual TLS between pods

Answer

Rotate the cluster's certificate authority, re-issue all node kubelet certificates, and enable audit logging to the SIEM

Answer

Scan all container images for CVEs in the CI pipeline and enforce image signing with an admission controller before deployment