Project: Kubernetes Security Baseline

This project packages a practical container-platform security baseline that runs without access to a private enterprise cluster.

The Kubernetes Security Baseline repository uses a local kind cluster and documents how the same controls can be adapted to AKS or EKS.

What the repo includes

1. A local kind demo path.
2. Secure and intentionally insecure workloads.
3. OPA Gatekeeper constraints for privileged pods, unsafe capabilities, host networking, and image rules.
4. NetworkPolicy examples that show allowed and blocked traffic.
5. Trivy scans in CI and a short runtime detection runbook.

Control flow

The interesting part is not that a scanner runs. The interesting part is how the platform responds when a workload asks for something unsafe.

Examples:

insecure workload -> admission denied -> finding explained -> safe workload example

That flow shows the control, the developer experience, and the remediation path.

Why this matters

Kubernetes security is not one setting. It is identity, network boundaries, workload policy, image trust, runtime visibility, and documentation that engineers can actually use.

The project brings that chain together in a compact, reproducible form.