Earlier this month, we introduced our Kubernetes Rule Pack, built to accelerate secure cluster configurations with out-of-the-box alignment to the CIS Kubernetes Benchmark v1.11.1. We started strong by covering critical areas like RBAC enforcement and pod-level hardening.

Today, we’re excited to announce the next phase of that rollout: a new set of Kubernetes CIS rules that go even deeper across identity, secrets management, networking, and workload isolation.

🔍 What’s New in This Release?

This latest update builds on the foundational 5.1 and 5.2 controls by expanding into:

Secrets Management & Secure Workloads (5.4.x & 5.6.x):

• Prefer Secrets as Files (5.4.1): Flags containers using secrets as environment variables, which are easier to exfiltrate and harder to rotate securely.

• Encourage External Secret Stores (5.4.2): Identifies workloads not integrated with tools like HashiCorp Vault, AWS Secrets Manager, or Kubernetes CSI drivers.

• Enforce Namespace Boundaries (5.6.1): Detects clusters lacking proper namespace segmentation—a must for multi-team or multi-tenant environments.

• Security Context Compliance (5.6.2 – 5.6.4): Finds pods missing baseline settings like seccomp, runAsNonRoot, and those running in the default namespace.

These rules target real-world misconfigurations that attackers exploit: from overexposed secrets to overly permissive pods. They help you shift left on Kubernetes security while enabling dev teams to focus on shipping code.

📌 What You Need to Do

1. Review the rule pack in our GitHub repo
2. Test against your dev or staging clusters using these new detection style rules
3. Roll out enforcement incrementally by namespace or environment.