Runbook 01 — Kubernetes Network Security Assessment

Runbook Information

Item	Details
Runbook ID	K8S-NET-RB-01
Category	Kubernetes Network Security
Difficulty	Advanced
Estimated Time	2–4 Hours
Environment	Kubernetes Cluster
Platform	Amazon EKS / Azure AKS / Google GKE / OpenShift / Rancher
Primary Role	Kubernetes Security Engineer
Supporting Teams	Platform Engineering, Network Engineering, Cloud Operations, SOC
Escalation	Cloud Security Architect

Purpose

This runbook provides a structured methodology for assessing the overall network security posture of a Kubernetes cluster.

It enables security engineers to validate:

Kubernetes networking configuration
Cluster communication paths
Namespace isolation
Network Policy implementation
Service exposure
Ingress security
Service Mesh security
TLS encryption
Zero Trust implementation
Production readiness

This assessment should be performed:

Before production go-live
Quarterly security reviews
After major infrastructure changes
Following penetration tests
During compliance audits
After significant Kubernetes upgrades

Enterprise Scenario

CloudNova Technologies operates several production Kubernetes clusters supporting customer-facing applications, internal APIs, databases, monitoring platforms, and CI/CD pipelines.

The organisation is preparing for an annual external security assessment.

The CISO has requested a comprehensive review of Kubernetes network security controls to ensure that production environments follow Zero Trust principles and comply with enterprise security standards.

As the Kubernetes Security Engineer, you are responsible for evaluating the entire networking stack and identifying any security gaps before the external audit begins.

Assessment Objectives

Review and validate:

Cluster networking
CNI configuration
Pod networking
Service networking
DNS security
Network Policies
Namespace isolation
East-west traffic
North-south traffic
Ingress configuration
TLS implementation
Service Mesh
mTLS
Zero Trust controls
Logging and monitoring
Compliance

Success Criteria

The assessment is successful when:

Default deny Network Policies are implemented.
Namespace isolation is enforced.
Services are not unnecessarily exposed.
HTTPS is enforced for external traffic.
mTLS protects internal service communication.
Only approved communication paths exist.
Zero Trust networking is implemented.
No high-risk network findings remain.

Enterprise Network Architecture

                    Internet
                        │
                   HTTPS (443)
                        │
             Cloud Load Balancer / WAF
                        │
               Ingress Controller
                        │
        ┌───────────────┼───────────────┐
        │                               │
  Customer Portal                Inventory API
        │                               │
        ▼                               ▼
 ClusterIP Services              ClusterIP Services
        │                               │
        └───────────────┬───────────────┘
                        │
                 PostgreSQL Database

        East-West Traffic Protected
      by Network Policies + Service Mesh

Assessment Workflow

Cluster Review

      │

      ▼

Networking Review

      │

      ▼

Network Policies

      │

      ▼

Ingress Security

      │

      ▼

Service Mesh

      │

      ▼

TLS Validation

      │

      ▼

Zero Trust Review

      │

      ▼

Compliance Assessment

      │

      ▼

Final Report

Phase 1 — Verify Cluster Health

Verify connectivity.

kubectl cluster-info

kubectl get nodes

Review:

Kubernetes Version
Cluster Status
Node Status
CNI Plugin

Phase 2 — Review Cluster Networking

Review node networking.

kubectl get nodes -o wide

Review Pod networking.

kubectl get pods -A -o wide

Confirm:

Pod CIDR
Node CIDR
Pod IP allocation
Internal routing

Phase 3 — Review CNI Configuration

Identify the Container Network Interface (CNI).

Examples:

Amazon VPC CNI
Calico
Cilium
Flannel
Weave Net

Review:

kubectl get pods -A

Verify:

CNI Pods healthy
No networking errors
Correct version

Questions:

Does the CNI support Network Policies?
Is eBPF used?
Is encryption available?

Phase 4 — Review Namespaces

List namespaces.

kubectl get namespaces

Verify separation between:

Development
Testing
Production
Monitoring
Security
Shared Services

Confirm:

Namespace ownership
Labels
Environment isolation

Phase 5 — Review Network Policies

List policies.

kubectl get networkpolicy -A

Inspect policies.

kubectl describe networkpolicy

Review:

Default deny policies
Namespace selectors
Pod selectors
Allowed ports
Ingress rules
Egress rules

Questions:

Is every production namespace protected?
Are policies documented?
Are wildcard selectors avoided?

Phase 6 — Validate Pod-to-Pod Communication

Test communication.

Examples:

Frontend

↓

Backend

↓

Database

Attempt unauthorised communication.

Expected:

Connection Timed Out

Access Denied

Document allowed and denied traffic.

Phase 7 — Review Services

List Services.

kubectl get svc -A

Review:

ClusterIP
NodePort
LoadBalancer
ExternalName

Questions:

Are unnecessary NodePort Services present?
Are internal applications using ClusterIP?
Are external services justified?

Phase 8 — Review Ingress Security

List Ingress resources.

kubectl get ingress -A

Inspect.

kubectl describe ingress

Review:

TLS
Hostnames
Paths
Backend Services
HTTPS redirection
Security annotations

Confirm:

HTTPS enforced
No HTTP-only applications

Phase 9 — Review TLS Configuration

Validate:

Certificates
Expiry dates
TLS versions
Cipher suites

Review TLS Secrets.

kubectl get secrets

Confirm:

Certificates valid
No expired certificates
Secure algorithms used

Phase 10 — Review Service Mesh

If Istio or Linkerd is deployed:

Review:

kubectl get peerauthentication

kubectl get authorizationpolicy

kubectl get destinationrule

kubectl get gateway

Validate:

Sidecar injection
mTLS enabled
Authorization policies
Workload identities

Phase 11 — Validate Zero Trust Networking

Review communication matrix.

Source	Destination	Expected
Internet	Ingress	Allowed
Ingress	Frontend	Allowed
Frontend	Backend	Allowed
Backend	Database	Allowed
Frontend	Database	Denied
Monitoring	Database	Denied
Development	Production	Denied

Phase 12 — Review DNS Security

Inspect CoreDNS.

kubectl get pods -n kube-system

Review:

CoreDNS health
DNS resolution
DNS exposure
External DNS configuration

Confirm:

No unauthorised DNS modifications
Logging enabled

Phase 13 — Review Logging & Monitoring

Validate:

Network Policy logs
Ingress logs
Service Mesh logs
Audit logs
Flow logs

Review integrations:

Amazon CloudWatch
Azure Monitor
Google Cloud Logging
Prometheus
Grafana

Phase 14 — Security Assessment

Evaluate:

Namespace isolation
East-west security
North-south security
TLS
mTLS
Least privilege networking
Zero Trust implementation
Service exposure

Phase 15 — Compliance Assessment

Assess against:

CIS Kubernetes Benchmark
NIST Cybersecurity Framework
NIST SP 800-207 (Zero Trust)
ISO/IEC 27001
CIS Controls
OWASP Kubernetes Top 10

Network Security Checklist

Control	Status
Network Policies Implemented	☐
Default Deny Enabled	☐
Namespace Isolation	☐
East-West Segmentation	☐
HTTPS Enforced	☐
TLS Certificates Valid	☐
mTLS Enabled	☐
Service Mesh Protected	☐
Zero Trust Implemented	☐
Logging Enabled	☐

Network Security Maturity Assessment

Domain	Rating (1–5)
Cluster Networking
CNI Configuration
Network Policies
Namespace Isolation
Service Exposure
Ingress Security
TLS Implementation
Service Mesh
Zero Trust
Monitoring

Risk Classification

Critical

Examples:

No Network Policies
No TLS
Public databases
Missing namespace isolation
Unencrypted service communication

High

Examples:

Excessive NodePort Services
Missing HTTPS redirection
Weak TLS configuration
Missing ingress restrictions
No mTLS

Medium

Examples:

Incomplete documentation
Missing monitoring
Legacy Services
Broad allow rules

Low

Examples:

Naming inconsistencies
Documentation improvements
Minor optimisation opportunities

Recommendations

Priority 1

Implement default deny policies.
Remove unnecessary public Services.
Enable HTTPS everywhere.
Enforce namespace isolation.

Priority 2

Deploy a Service Mesh.
Enable mTLS.
Restrict east-west communication.
Integrate WAF protection.

Priority 3

Automate compliance checks.
Improve monitoring.
Review Network Policies quarterly.
Perform annual penetration testing.

Escalation Matrix

Severity	Action
Critical	Immediate escalation to Cloud Security Architect and Platform Engineering
High	Priority 1 remediation within 24 hours
Medium	Schedule remediation during the current sprint
Low	Record for continuous improvement

Enterprise Network Security Report

Cluster Name:

Cloud Provider:

Assessment Date:

Assessor:

CNI Plugin:

Namespaces Reviewed:

Network Policies:

Ingress Review:

Service Mesh Review:

TLS Review:

Zero Trust Assessment:

Compliance Status:

Critical Findings:

High Findings:

Medium Findings:

Recommendations:

Overall Network Security Rating:

Production Approval:

Approved

Conditionally Approved

Rejected

Evidence Collection

Collect evidence for:

Cluster information
CNI configuration
Network Policies
Namespace configuration
Service inventory
Ingress resources
TLS certificates
Service Mesh configuration
Connectivity tests
Zero Trust validation
Assessment report

Operational Best Practices

Always:

Apply default deny Network Policies.
Restrict communication using least privilege.
Keep applications internal with ClusterIP where possible.
Publish applications only through secure Ingress Controllers.
Enforce HTTPS and modern TLS standards.
Use Service Mesh with mTLS for production workloads.
Review Network Policies quarterly.
Continuously monitor network traffic and policy changes.
Validate Zero Trust controls after every infrastructure change.

Troubleshooting Quick Reference

Issue	Investigation
Pod cannot communicate	Review Network Policies and Service configuration
Ingress unavailable	Check Ingress Controller Pods and Load Balancer
TLS errors	Verify certificate validity and TLS Secret
DNS failures	Review CoreDNS health and configuration
Network Policy not enforced	Confirm CNI supports Network Policies
mTLS failures	Review PeerAuthentication and sidecar injection
Unexpected connectivity	Inspect ingress/egress rules and namespace selectors

Runbook Summary

This runbook provides a comprehensive framework for assessing Kubernetes network security across the entire platform. It evaluates cluster networking, CNI capabilities, namespace isolation, Network Policies, Services, Ingress configuration, TLS, Service Mesh, and Zero Trust controls to ensure secure communication between workloads and external users.

Following this assessment enables Cloud Security and Platform Engineering teams to identify misconfigurations, reduce the attack surface, prevent lateral movement, validate compliance with industry frameworks, and maintain a production-ready Kubernetes networking environment aligned with enterprise security best practices.