Lion Cipher Lab
Score your Kubernetes cluster against NSA-CISA hardening with Kubescape
- Cloud Security
- Intermediate
- ~50 min
- Free · no account required
Why it matters
There are two completely different questions hiding inside 'is my Kubernetes cluster hardened?', and confusing them is one of the most common cloud-security mistakes. Question one is about the cluster's PLUMBING: are the kubelet and API server started with safe flags, are the control-plane files locked down? That is what the CIS Kubernetes Benchmark and kube-bench answer, and it lives on the node. Question two is about what you actually DEPLOY: does this Deployment run as root, can its container escalate privilege, can it write anywhere on its own filesystem, does it grab every Linux…
What you'll learn
- what a Kubernetes posture/compliance score actually measures
- how Kubescape differs from kube-bench (workloads + RBAC + images vs node/component config)
- installing the Kubescape CLI and scanning a live cluster
- scanning against the NSA-CISA and CIS frameworks and reading the compliance score
- reading per-control pass/fail down to the failing resource and field
- hardening a Deployment with a real securityContext (runAsNonRoot, drop ALL caps, seccomp RuntimeDefault, read-only root fs, resource limits)
- re-scanning to prove a failing control flipped to pass and the score rose
- running Kubescape's image-vulnerability scan and mapping findings to control frameworks
- knowing a posture score is a point-in-time config claim, not runtime protection
Steps in this lab
- Two different questions: kube-bench vs Kubescape
- What the frameworks are (NSA-CISA, CIS, MITRE ATT&CK for Kubernetes)
- Spin up your own throwaway cluster with kind
- Install the Kubescape CLI
- Deploy a deliberately sloppy workload to scan
- Scan against NSA-CISA and CIS, and read the compliance SCORE
- Drill into one failing control and understand it
- Fix it: add a real securityContext and resource limits
- Re-scan and watch the score rise
- Scan a container image and map findings to the frameworks
- The judgment: a green score is a snapshot, not a shield