Lab 05 — Kubernetes Governance Assessment

Mission Information

Item	Details
Lab ID	K8S-COMPLIANCE-LAB-05
Difficulty	Advanced
Estimated Time	6–8 Hours
Environment	Kubernetes Training or Enterprise Cluster
Platform	Kubernetes, kubectl, Kyverno, Gatekeeper, kube-bench, Trivy
Cost	Free for Local Tools / Cloud Charges May Apply
Primary Role	Kubernetes Security Engineer
Supporting Roles	Cloud Security Engineer, Platform Engineer, DevSecOps Engineer, Compliance Analyst, Risk Manager
Module	Kubernetes Benchmarks & Compliance
Previous Lab	Lab 04 — Kubernetes Compliance Automation
Next Runbook	Runbook 01 — Kubernetes Compliance Assessment

Mission Scenario

CloudNova Technologies operates multiple Kubernetes environments supporting:

Customer-facing production applications
Internal business services
Financial workloads
Healthcare platforms
Artificial intelligence services
Development and testing environments

The organisation has implemented several technical security controls:

CIS Kubernetes Benchmark assessments
OPA Gatekeeper policies
Kyverno policies
Container-image scanning
Private registry governance
Image signing
Admission enforcement
Compliance automation
Central logging and monitoring

Despite these improvements, an internal audit identified a broader concern.

The organisation has strong individual security controls, but governance is inconsistent across clusters and business units.

The audit discovered:

Some clusters have no formally assigned owner.
Namespace ownership is incomplete.
Policy engines are configured differently across environments.
Security exceptions are not consistently time limited.
Production changes are sometimes made outside approved workflows.
Compliance reports are not reviewed by accountable business owners.
Cluster administrators have overlapping responsibilities.
Policy failures are not always assigned to remediation owners.
Development and production environments use different security baselines.
No central governance score exists for Kubernetes platforms.

The CISO has directed the Kubernetes Security team to perform a complete enterprise governance assessment.

Your mission is to evaluate whether CloudNova Technologies has the people, processes, policies, accountability, technical controls, evidence, and oversight required to operate Kubernetes securely at enterprise scale.

Learning Objectives

By completing this lab, you will learn how to:

Explain Kubernetes governance
Assess cluster ownership and accountability
Review policy frameworks
Evaluate namespace governance
Review RBAC responsibility models
Assess admission-control governance
Review compliance reporting
Evaluate security-exception management
Review change-control processes
Assess production-readiness approval
Evaluate multi-cluster consistency
Review policy ownership
Assess evidence and audit readiness
Measure governance maturity
Build a governance scorecard
Produce an executive governance report
Create a prioritised remediation roadmap

Enterprise Governance Architecture

                         Executive Governance

                                  │

                                  ▼

                          Security Leadership

                                  │

                ┌─────────────────┼─────────────────┐
                │                 │                 │

          Platform Owner    Security Owner    Compliance Owner

                │                 │                 │

                └─────────────────┼─────────────────┘

                                  │

                                  ▼

                       Kubernetes Governance Model

      ┌───────────────────────────┼───────────────────────────┐
      │                           │                           │

 Cluster Governance       Policy Governance          Access Governance

      │                           │                           │

 Namespace Ownership     Admission Controls          RBAC Accountability

      │                           │                           │

 Change Control          Compliance Reporting        Exception Management

      └───────────────────────────┼───────────────────────────┘

                                  │

                                  ▼

                        Production Approval Decision

Governance Assessment Workflow

Define Scope

     │

     ▼

Identify Owners

     │

     ▼

Review Governance Policies

     │

     ▼

Assess Technical Enforcement

     │

     ▼

Review Evidence and Reporting

     │

     ▼

Evaluate Exceptions

     │

     ▼

Measure Governance Maturity

     │

     ▼

Assign Risk

     │

     ▼

Create Remediation Plan

     │

     ▼

Executive Approval

Governance Principles

The assessment should apply the following principles:

Every cluster must have an accountable owner.
Every namespace must have a business and technical owner.
Security policies must be centrally governed.
Production changes must follow approved change control.
Exceptions must be specific, approved, monitored, and time limited.
Administrative access must be accountable.
Policy failures must have remediation owners.
Compliance evidence must be retained.
Production approval must be based on documented criteria.
Multi-cluster standards must be consistent.
Security responsibilities must be clearly separated.
Governance controls must be continuously reviewed.

Lab Outcomes

By the end of this lab, you will have:

Created a Kubernetes governance inventory
Identified cluster owners
Identified namespace owners
Reviewed governance policies
Assessed RBAC accountability
Reviewed admission-control ownership
Evaluated policy consistency
Assessed change-control processes
Reviewed exception governance
Evaluated compliance reporting
Reviewed remediation ownership
Assessed evidence-retention readiness
Evaluated multi-cluster consistency
Calculated a governance maturity score
Produced a governance risk register
Created a prioritised remediation roadmap
Produced an executive governance assessment report

Important Security Notice

Perform this assessment only in an authorised environment.

Do not:

Modify production policies without change approval
Remove security controls to complete the assessment
Expose user identities or credentials in reports
Publish sensitive cluster information
Grant new permissions during an assessment without approval
Delete compliance evidence
Create broad exceptions
Treat documentation alone as proof of implementation
Assume a policy is effective without testing it
Mark a control as compliant without evidence

Prerequisites

Before starting, ensure that you have:

Access to an authorised Kubernetes cluster
kubectl
Access to cluster policies
Access to RBAC configuration
Access to Kyverno or Gatekeeper where installed
kube-bench results
Compliance reports from Lab 04
Cluster ownership information
Change-management records
Exception records
Visual Studio Code
Git Bash or PowerShell
Read-only access where possible

Tools Used

Tool	Purpose
kubectl	Cluster, RBAC, namespace and policy assessment
kube-bench	CIS Benchmark evidence
Kyverno	Policy governance and reporting
Gatekeeper	Policy governance and audit review
Trivy	Configuration and image evidence
jq	JSON processing
Git	Policy and configuration history
CI/CD Platform	Change-control review
Ticketing or GRC Platform	Remediation and exception tracking
VS Code	Reporting and evidence analysis

Recommended Lab File Structure

lab-05-kubernetes-governance-assessment/
├── inventory/
│   ├── cluster-inventory.md
│   ├── namespace-inventory.md
│   ├── policy-inventory.md
│   ├── access-inventory.md
│   └── owner-register.md
├── assessment/
│   ├── governance-framework.md
│   ├── accountability-matrix.md
│   ├── policy-governance-review.md
│   ├── namespace-governance-review.md
│   ├── rbac-governance-review.md
│   ├── change-control-review.md
│   ├── exception-review.md
│   ├── compliance-reporting-review.md
│   ├── multi-cluster-review.md
│   └── maturity-assessment.md
├── reports/
│   ├── governance-scorecard.md
│   ├── risk-register.md
│   ├── remediation-roadmap.md
│   └── enterprise-governance-report.md
└── evidence/
    ├── cluster-context.txt
    ├── namespaces.txt
    ├── clusterroles.yaml
    ├── clusterrolebindings.yaml
    ├── kyverno-policies.yaml
    ├── gatekeeper-constraints.yaml
    ├── policyreports.yaml
    ├── benchmark-summary.txt
    ├── exception-register.yaml
    └── change-records.md

Task 01 — Create the Assessment Workspace

Git Bash

mkdir -p lab-05-kubernetes-governance-assessment/{inventory,assessment,reports,evidence}

cd lab-05-kubernetes-governance-assessment

PowerShell

New-Item -ItemType Directory -Force `
  -Path lab-05-kubernetes-governance-assessment\inventory

New-Item -ItemType Directory -Force `
  -Path lab-05-kubernetes-governance-assessment\assessment

New-Item -ItemType Directory -Force `
  -Path lab-05-kubernetes-governance-assessment\reports

New-Item -ItemType Directory -Force `
  -Path lab-05-kubernetes-governance-assessment\evidence

Set-Location lab-05-kubernetes-governance-assessment

Task 02 — Define the Assessment Scope

Document:

Assessment Name:

Assessment Date:

Assessor:

Organisation:

Business Unit:

Cluster Name:

Cluster Type:

Environment:

Cloud Provider:

Region:

Kubernetes Version:

Namespaces in Scope:

Applications in Scope:

Policies in Scope:

Compliance Frameworks:

Assessment Exclusions:

Evidence Period:

Executive Sponsor:

Task 03 — Record the Cluster Context

kubectl config current-context

kubectl cluster-info

Save evidence.

kubectl config current-context \
  > evidence/cluster-context.txt

kubectl cluster-info \
  >> evidence/cluster-context.txt

Task 04 — Build the Cluster Governance Inventory

Create inventory/cluster-inventory.md.

Document:

Field	Details
Cluster name
Environment
Business purpose
Business owner
Technical owner
Security owner
Platform team
Cloud account or subscription
Region
Kubernetes version
Support status
Data classification
Regulatory scope
Production criticality
Disaster-recovery tier
Last security review
Next review date

Task 05 — Verify Cluster Ownership

Determine whether the cluster has:

Business owner
Technical owner
Security owner
Operational owner
Compliance owner
Incident-response owner
Disaster-recovery owner
Cost owner

Rate ownership as:

Complete
Partially Complete
Incomplete
Unassigned

A production cluster without an accountable owner should be classified as a high governance risk.

Task 06 — Review Cluster Labels and Metadata

Review node labels.

kubectl get nodes \
  --show-labels

Review namespaces.

kubectl get namespaces \
  --show-labels

Assess whether metadata identifies:

Environment
Owner
Business unit
Data classification
Cost centre
Application
Criticality
Compliance scope

Task 07 — Build the Namespace Inventory

Create inventory/namespace-inventory.md.

Retrieve namespaces.

kubectl get namespaces \
  -o wide

Save evidence.

kubectl get namespaces \
  -o yaml \
  > evidence/namespaces.yaml

Document:

Namespace	Environment	Business Owner	Technical Owner	Data Class	Purpose	Status

Task 08 — Review Namespace Ownership Labels

Review ownership labels.

kubectl get namespaces \
  -o custom-columns='NAME:.metadata.name,OWNER:.metadata.labels.owner,ENVIRONMENT:.metadata.labels.environment,APPLICATION:.metadata.labels.app'

Identify namespaces with:

Missing owner
Missing environment
Missing business purpose
Missing application label
Unknown ownership
Shared responsibilities

Task 09 — Identify Orphaned Namespaces

An orphaned namespace may have:

No owner
No active workloads
No recent deployment activity
No documented business purpose
Expired project ownership
Unknown Secrets
Unused Service Accounts

Review workloads.

kubectl get all \
  -A

Document orphaned namespaces and assign:

Investigation owner
Risk
Disposition
Cleanup date
Approval status

Task 10 — Review Namespace Security Baselines

Check Pod Security labels.

kubectl get namespaces \
  -o custom-columns='NAME:.metadata.name,ENFORCE:.metadata.labels.pod-security\.kubernetes\.io/enforce,AUDIT:.metadata.labels.pod-security\.kubernetes\.io/audit,WARN:.metadata.labels.pod-security\.kubernetes\.io/warn'

Assess whether production namespaces use:

restricted

Identify:

Unlabelled namespaces
Privileged namespaces
Inconsistent policy versions
Broad exemptions

Task 11 — Define the Enterprise Governance Framework

Create assessment/governance-framework.md.

Include:

Governance Framework Name:

Scope:

Policy Authority:

Business Ownership:

Technical Ownership:

Security Ownership:

Compliance Ownership:

Cluster Classification:

Namespace Standards:

RBAC Standards:

Admission-Control Standards:

Image Standards:

Logging Standards:

Change-Control Standards:

Exception Standards:

Evidence-Retention Standards:

Incident-Escalation Standards:

Review Frequency:

Task 12 — Review Governance Policies

Identify policies covering:

Kubernetes platform ownership
Cluster provisioning
Namespace creation
RBAC
Privileged access
Workload security
Network security
Secrets management
Container images
Admission control
Logging
Compliance
Change management
Exceptions
Incident response
Backup and recovery

For each policy, document:

Policy	Owner	Approval Date	Review Date	Enforcement	Status

Task 13 — Review Policy Ownership

Every policy should have:

Policy owner
Technical approver
Security approver
Effective date
Review date
Version
Enforcement mechanism
Exception process
Evidence requirements

Identify policies that are:

Unowned
Expired
Draft
Duplicated
Conflicting
Not technically enforced

Task 14 — Build the Policy Inventory

Create inventory/policy-inventory.md.

Policy	Engine	Mode	Scope	Owner	Severity
Require non-root	Kyverno	Enforce	Production	Security	High
Disallow privileged	Gatekeeper	Deny	All clusters	Security	Critical
Require image digest	Kyverno	Audit	Production	DevSecOps	High
Require labels	Gatekeeper	Deny	Namespaces	Platform	Medium

Task 15 — Export Kyverno Policies

kubectl get clusterpolicies \
  -o yaml \
  > evidence/kyverno-policies.yaml

kubectl get policies \
  -A \
  -o yaml \
  > evidence/kyverno-namespaced-policies.yaml

Review:

Policy owner
Validation mode
Background mode
Scope
Exclusions
Failure action
Readiness

Task 16 — Export Gatekeeper Constraints

kubectl get constraints \
  -o yaml \
  > evidence/gatekeeper-constraints.yaml

Review:

Constraint name
Enforcement action
Scope
Excluded namespaces
Violation count
Ownership
Change history

Task 17 — Review Policy Enforcement Consistency

Compare policies across:

Development
Testing
Staging
Production
Disaster recovery
Regional clusters

Identify differences in:

Enforce versus Audit
Scope
Exclusions
Trusted registries
Pod Security controls
Image signing requirements
Resource standards
Network controls

Task 18 — Review Policy Exclusions

Review:

Excluded namespaces
Excluded users
Excluded Service Accounts
Excluded resource types
Excluded applications
Emergency bypasses

Every exclusion should include:

Exclusion ID:

Policy:

Resource:

Namespace:

Reason:

Risk:

Owner:

Approver:

Compensating Controls:

Start Date:

Expiry Date:

Review Date:

Task 19 — Assess Policy-Engine Availability

Review Kyverno.

kubectl get pods \
  -n kyverno

Review Gatekeeper.

kubectl get pods \
  -n gatekeeper-system

Assess:

Replica count
Pod health
High availability
Resource limits
Pod disruption protection
Monitoring
Alerting
Fail-open or fail-closed behaviour

Task 20 — Review Admission Webhook Governance

kubectl get validatingwebhookconfigurations

kubectl get mutatingwebhookconfigurations

Assess:

Webhook owner
Failure policy
Timeout
Namespace selector
Object selector
CA bundle
Side effects
Review process
Change control

Critical production policies should not silently fail open without approved risk acceptance.

Task 21 — Review RBAC Governance

Export ClusterRoles.

kubectl get clusterroles \
  -o yaml \
  > evidence/clusterroles.yaml

Export ClusterRoleBindings.

kubectl get clusterrolebindings \
  -o yaml \
  > evidence/clusterrolebindings.yaml

Export namespace Roles and RoleBindings.

kubectl get roles \
  -A \
  -o yaml \
  > evidence/roles.yaml

kubectl get rolebindings \
  -A \
  -o yaml \
  > evidence/rolebindings.yaml

Task 22 — Identify Cluster Administrator Access

kubectl get clusterrolebindings \
  -o json \
  | jq -r '
      .items[]
      | select(.roleRef.name == "cluster-admin")
      | {
          binding: .metadata.name,
          subjects: .subjects
        }'

Document:

Identity	Type	Business Need	Owner	Approval	Review Date

Task 23 — Review Shared and Unaccountable Access

Identify:

Shared user accounts
Shared tokens
Generic Service Accounts
Old automation identities
Unknown groups
Unused bindings
Direct user bindings
Permanent administrator roles

Shared administrator access should be classified as high or critical risk.

Task 24 — Review Privileged-Access Governance

Assess whether privileged access uses:

Named identities
MFA
Just-in-time access
Approval
Session logging
Time limits
Emergency access procedure
Regular access review
Automatic revocation

Document the privileged-access process.

Task 25 — Create the Accountability Matrix

Create assessment/accountability-matrix.md.

Activity	Business Owner	Platform	Security	DevSecOps	Compliance
Approve cluster creation	A	R	C	C	C
Operate cluster	C	R	C	C	I
Define security baseline	C	C	A/R	C	C
Approve policy exception	A	C	R	C	C
Manage RBAC	C	R	A	C	I
Review compliance	A	C	R	C	R
Respond to incident	C	R	A/R	C	I
Approve production	A	R	R	R	C

Use:

R — Responsible
A — Accountable
C — Consulted
I — Informed

Task 26 — Review Separation of Duties

Determine whether one identity can:

Create a cluster
Assign administrators
Disable admission controls
Push container images
Sign images
Approve exceptions
Deploy workloads
Approve production release
Delete audit evidence

Identify conflicting responsibilities.

Task 27 — Review Service Account Governance

kubectl get serviceaccounts \
  -A

Assess:

Purpose
Owner
Namespace
Token mounting
RBAC permissions
Credential lifetime
External identity integration
Last use
Removal process

Task 28 — Review Namespace-Creation Governance

Determine whether namespace creation requires:

Request ticket
Business owner
Technical owner
Environment classification
Data classification
Cost centre
Security baseline
NetworkPolicy
ResourceQuota
LimitRange
Pod Security labels
Approval

Task 29 — Review Resource Governance

Check ResourceQuotas.

kubectl get resourcequotas \
  -A

Check LimitRanges.

kubectl get limitranges \
  -A

Assess:

Resource ownership
Capacity governance
Denial-of-service protection
Cost accountability
Namespace standards
Exception process

Task 30 — Review Network Governance

kubectl get networkpolicies \
  -A

Assess whether:

Default-deny policies are required
Namespace communication is approved
External egress is governed
Policy owners are assigned
Changes require review
Exceptions are documented
Policy drift is monitored

Task 31 — Review Container-Image Governance

Assess whether production workloads require:

Approved private registry
Immutable digest
Vulnerability scan
Secret scan
SBOM
Signature
Trusted signer
Build provenance
Admission verification
Image-retention policy

Use evidence from earlier labs.

Task 32 — Review Secrets Governance

Assess:

Secret ownership
Secret classification
Secret rotation
External secret manager use
Kubernetes encryption at rest
RBAC access
Audit logging
Break-glass procedures
Secret deletion
Incident response

Task 33 — Review Logging and Monitoring Governance

Assess whether the organisation has defined owners for:

Kubernetes audit logs
Control-plane logs
Node logs
Application logs
Admission events
Policy violations
Registry events
Runtime alerts
SIEM integration

Document retention and review frequency.

Task 34 — Review Compliance Reporting

Export Kyverno reports.

kubectl get policyreports \
  -A \
  -o yaml \
  > evidence/policyreports.yaml

Export ClusterPolicyReports.

kubectl get clusterpolicyreports \
  -o yaml \
  > evidence/clusterpolicyreports.yaml

Review whether reports are:

Generated consistently
Assigned to owners
Reviewed on schedule
Retained
Escalated
Included in management reporting
Used for remediation tracking

Task 35 — Review CIS Benchmark Governance

Review the most recent kube-bench results.

Assess:

Assessment frequency
Benchmark version
Scope
Findings owner
Remediation status
Risk acceptance
Evidence retention
Management approval
Reassessment schedule

Task 36 — Review Change-Control Governance

Create assessment/change-control-review.md.

Review whether changes to the following require approval:

Cluster configuration
RBAC
Admission policies
Network policies
Namespace security labels
Registry settings
Image-trust policy
Logging configuration
Secrets configuration
Backup settings
Upgrade settings

Task 37 — Review GitOps and CI/CD Governance

Assess:

Protected branches
Pull-request approval
Required reviewers
Security review
Policy validation
Signed commits
Build logs
Deployment identity
Separation of duties
Emergency changes
Rollback procedure

Task 38 — Review Direct Production Changes

Identify whether administrators can bypass GitOps or CI/CD.

Review recent audit logs for:

Direct kubectl apply
Direct RBAC changes
Direct policy changes
Direct image updates
Direct namespace changes
Emergency modifications

Every direct production change should have:

Ticket
Approver
Reason
Time
Operator
Evidence
Post-change review

Task 39 — Review Emergency-Change Governance

Document:

Emergency Change Process:

Authorised Roles:

Approval Required:

Maximum Duration:

Logging:

Evidence:

Post-Change Review:

Rollback:

Escalation:

Emergency access should not create permanent bypasses.

Task 40 — Review Exception Management

Create assessment/exception-review.md.

Review active exceptions for:

Unique identifier
Policy or control
Business justification
Risk
Owner
Approver
Compensating controls
Start date
Expiration date
Review date
Status

Task 41 — Identify Expired Exceptions

Review the exception register.

Identify:

Expired exceptions
Exceptions without expiry
Exceptions with no owner
Exceptions without compensating controls
Repeated extensions
Broad namespace exclusions
Cluster-wide bypasses

Expired exceptions should be treated as non-compliant.

Task 42 — Review Risk-Acceptance Governance

A risk acceptance should include:

Risk ID:

Finding:

Severity:

Business Impact:

Likelihood:

Affected Resource:

Compensating Controls:

Risk Owner:

Security Recommendation:

Acceptance Period:

Expiration Date:

Approved By:

Residual Risk:

Technical teams should not approve their own unresolved critical risks without accountable business acceptance.

Task 43 — Review Remediation Ownership

Every finding should include:

Finding ID
Control
Severity
Owner
Due date
Status
Evidence
Verification result
Risk acceptance where applicable

Identify unassigned or overdue findings.

Task 44 — Review Escalation Procedures

Define escalation for:

Condition	Escalation
Critical policy disabled	CISO, Platform Head and SOC
Cluster-admin granted without approval	Security Leadership
Expired critical exception	Risk Owner and CISO
CIS critical finding overdue	Platform Owner
Compliance evidence missing	Compliance Owner
Production deployment bypass	DevSecOps and SOC
Unowned production namespace	Business Unit Head
Repeated failed audit	Executive Risk Committee

Task 45 — Review Evidence Governance

Assess whether evidence is:

Complete
Accurate
Time stamped
Access controlled
Encrypted
Retained
Searchable
Tamper evident
Associated with an assessment
Associated with an owner

Task 46 — Review Evidence Retention

Document retention for:

Evidence	Retention
CIS Benchmark reports
Policy reports
Admission denials
RBAC reviews
Change records
Exceptions
Production approvals
Incident evidence
Registry logs
Audit logs

Task 47 — Review Production-Readiness Governance

Production approval should require:

Assigned ownership
Security assessment
CIS Benchmark review
RBAC review
Network controls
Secrets controls
Logging
Backup
Image security
Admission enforcement
Compliance evidence
Risk acceptance
Change approval
Rollback plan

Task 48 — Create the Production Governance Gate

Document:

Application:

Cluster:

Namespace:

Business Owner:

Technical Owner:

Security Owner:

Data Classification:

Compliance Scope:

RBAC Approved:

Network Security Approved:

Secrets Management Approved:

Image Security Approved:

Admission Policies Approved:

Logging Approved:

Backup Approved:

CIS Assessment Approved:

Open Critical Findings:

Open High Findings:

Active Exceptions:

Rollback Plan:

Production Decision:

Approved

Conditionally Approved

Rejected

Task 49 — Review Multi-Cluster Governance

Create assessment/multi-cluster-review.md.

Compare clusters for:

Kubernetes version
Pod Security baseline
Kyverno policies
Gatekeeper constraints
RBAC model
Logging
Image policy
Network policy
Compliance schedule
Exception handling
Ownership

Task 50 — Identify Governance Drift

Governance drift may include:

Policy missing from one cluster
Policy in Audit instead of Enforce
Different exclusions
Different trusted registries
Inconsistent namespace labels
Different cluster-admin assignments
Outdated benchmark version
Missing logging
Different exception processes

Classify drift as:

Critical
High
Medium
Low

Task 51 — Review Cluster Lifecycle Governance

Assess governance for:

Cluster request
Architecture review
Security review
Provisioning
Production approval
Upgrade
Maintenance
Backup
Incident response
Decommissioning

Task 52 — Review Upgrade Governance

Assess:

Supported version policy
Upgrade owner
Testing
Security validation
Rollback
Change approval
Application compatibility
Node maintenance
Post-upgrade review

Unsupported Kubernetes versions should be classified as high risk.

Task 53 — Review Decommissioning Governance

Cluster decommissioning should include:

Business approval
Workload migration
Data retention
Secret revocation
Credential removal
Registry cleanup
DNS cleanup
Logging retention
Backup disposition
Access removal
Evidence preservation
Cost closure

Task 54 — Assess Governance Training

Review whether the following roles receive training:

Cluster administrators
Developers
DevSecOps engineers
Security engineers
Compliance teams
Incident responders
Application owners
Risk owners

Training should cover:

RBAC
Policy enforcement
Exceptions
Change control
Image security
Secrets
Incident response
Compliance evidence

Task 55 — Review Governance Metrics

Recommended metrics:

Metric	Purpose
Clusters with assigned owner	Ownership coverage
Namespaces with assigned owner	Namespace accountability
Critical policies in Enforce mode	Enforcement maturity
Unowned policy count	Policy governance
Expired exception count	Exception risk
Overdue critical findings	Remediation risk
Cluster-admin identity count	Privileged access exposure
Compliance-report completion	Reporting maturity
Policy drift count	Multi-cluster consistency
Direct production changes	Change-control maturity
Unsupported clusters	Lifecycle risk
Evidence completeness	Audit readiness

Task 56 — Create the Governance Maturity Model

Create assessment/maturity-assessment.md.

Use the following maturity levels.

Level 1 — Initial

Governance is informal.
Ownership is unclear.
Policies are inconsistent.
Reviews are reactive.
Evidence is incomplete.

Level 2 — Developing

Basic standards exist.
Some owners are assigned.
Policies are partially enforced.
Reviews are manual.
Exceptions are inconsistently tracked.

Level 3 — Defined

Governance policies are documented.
Roles are assigned.
Core controls are enforced.
Compliance reviews are scheduled.
Exceptions are formally approved.

Level 4 — Managed

Governance metrics are monitored.
Compliance is automated.
Multi-cluster standards are consistent.
Remediation is tracked.
Executive reporting is established.

Level 5 — Optimised

Governance is continuous.
Policies are centrally managed.
Exceptions expire automatically.
Drift is automatically detected.
Risk decisions are data driven.

Task 57 — Score the Governance Domains

Score each domain from 0 to 5.

Domain	Score
Cluster ownership
Namespace governance
Policy governance
RBAC accountability
Admission controls
Change control
Exception management
Compliance reporting
Evidence governance
Multi-cluster consistency
Production readiness
Lifecycle governance

Calculate:

Governance Score =
Total Domain Score
÷
Maximum Possible Score
×
100

Task 58 — Assign the Governance Rating

Score	Rating
90–100	Optimised
75–89	Managed
60–74	Defined
40–59	Developing
Below 40	Initial

The score provides a management summary and must not replace detailed risk analysis.

Task 59 — Create the Governance Scorecard

Create reports/governance-scorecard.md.

Governance Domain	Score	Rating	Key Finding	Owner
Cluster ownership
Namespace governance
Policy governance
RBAC accountability
Admission controls
Change control
Exception management
Compliance reporting
Evidence governance
Multi-cluster consistency
Production readiness
Lifecycle governance

Task 60 — Perform the Enterprise Governance Assessment

Complete the assessment.

Governance Domain	Expected Control	Status
Cluster ownership	Accountable owners assigned
Namespace ownership	Business and technical owners assigned
Policy framework	Approved and current
Policy ownership	Every policy owned
Admission control	Centrally governed
Policy enforcement	Critical policies enforced
RBAC governance	Access reviewed and approved
Privileged access	Time bound and monitored
Separation of duties	Conflicts controlled
Change control	Production changes approved
GitOps governance	Protected workflow used
Emergency changes	Controlled and reviewed
Exception management	Time limited and approved
Risk acceptance	Business owned
Compliance reporting	Scheduled and reviewed
Remediation ownership	Findings assigned
Evidence retention	Defined and enforced
Production readiness	Formal approval gate
Multi-cluster consistency	Standards aligned
Governance metrics	Reported
Lifecycle governance	Cluster lifecycle controlled
Training	Required roles trained

Rate each domain as:

Effective
Partially Effective
Ineffective
Not Applicable

Task 61 — Assign the Governance Risk Rating

Critical Risk

Examples:

No accountable owner for a production cluster
Admission controls intentionally bypassed
Unauthorised cluster-admin access
Critical policy disabled without approval
Compliance evidence falsified
Production changes made through unauthorised identities
Permanent cluster-wide policy exemption
No ownership for critical incident response

High Risk

Examples:

Unowned production namespaces
Shared administrator accounts
Critical policies remain in Audit mode
Exceptions have no expiry
RBAC reviews are not performed
Unsupported Kubernetes version
Compliance findings have no owner
Policy drift across production clusters
Direct production changes bypass GitOps

Medium Risk

Examples:

Incomplete namespace metadata
Manual compliance reporting
Policy ownership unclear
Evidence-retention gaps
Incomplete training
Missing governance metrics
Weak change documentation

Low Risk

Examples:

Minor naming inconsistency
Missing policy annotation
Reporting-format issue
Non-critical metadata gap

Task 62 — Create the Governance Risk Register

Create reports/risk-register.md.

Risk ID	Finding	Severity	Impact	Likelihood	Status
K8S-GOV-001	Production cluster has no business owner	Critical	High	Medium	Open
K8S-GOV-002	Critical Kyverno policy remains in Audit mode	High	High	High	Open
K8S-GOV-003	Namespace owner labels incomplete	Medium	Medium	High	Open
K8S-GOV-004	Expired exception remains active	High	High	Medium	Open

Task 63 — Create the Remediation Roadmap

Create reports/remediation-roadmap.md.

Immediate — 0 to 7 Days

Assign owners to production clusters.
Revoke unauthorised cluster-admin access.
Remove expired critical exceptions.
Restore disabled admission controls.
Investigate unauthorised production changes.
Assign owners to critical findings.

Short-Term — 8 to 30 Days

Standardise namespace governance.
Move critical policies to Enforce mode.
Implement privileged-access approval.
Complete RBAC review.
Establish formal exception workflow.
Implement production governance gates.
Correct policy drift.

Medium-Term — 31 to 90 Days

Centralise policy management.
Implement multi-cluster governance dashboards.
Automate ownership checks.
Automate exception expiry.
Improve evidence retention.
Establish recurring governance reviews.
Train accountable owners.

Long-Term — 90+ Days

Implement organisation-wide governance automation.
Integrate governance metrics with GRC tooling.
Automate control mapping.
Implement continuous policy drift detection.
Establish executive Kubernetes risk dashboards.
Conduct annual governance maturity assessments.

Task 64 — Create the Executive Governance Report

Create reports/enterprise-governance-report.md.

Assessment Title:
Enterprise Kubernetes Governance Assessment

Assessment Date:

Assessor:

Organisation:

Business Unit:

Cluster:

Environment:

Kubernetes Version:

Executive Sponsor:

Business Owner:

Technical Owner:

Security Owner:

Compliance Owner:

Namespaces Reviewed:

Policies Reviewed:

Cluster Ownership Status:

Namespace Ownership Coverage:

Policy Ownership Coverage:

Critical Policies in Enforce Mode:

Critical Policies in Audit Mode:

Cluster-Admin Identities:

Unapproved Privileged Access:

Active Exceptions:

Expired Exceptions:

Open Critical Findings:

Open High Findings:

Direct Production Changes:

Policy Drift Findings:

CIS Benchmark Status:

Compliance Reporting Status:

Evidence Completeness:

Production Readiness:

Governance Score:

Governance Rating:

Critical Risks:

High Risks:

Medium Risks:

Low Risks:

Immediate Remediation:

Short-Term Remediation:

Medium-Term Remediation:

Residual Risk:

Overall Assessment:

Production Decision:

Approved

Conditionally Approved

Rejected

Executive Decision:

Approvals:

Business Owner:

Platform Engineering:

Kubernetes Security:

Cloud Security:

Compliance:

Risk Owner:

CISO:

Task 65 — Collect Assessment Evidence

Collect:

Cluster context
Cluster inventory
Namespace inventory
Ownership register
Policy inventory
Kyverno policies
Gatekeeper constraints
Admission webhooks
ClusterRoles
ClusterRoleBindings
Roles
RoleBindings
Service Accounts
ResourceQuotas
LimitRanges
NetworkPolicies
PolicyReports
ClusterPolicyReports
CIS Benchmark summary
Exception register
Change records
Governance scorecard
Risk register
Remediation roadmap
Executive report

Suggested filenames:

01-cluster-context.txt
02-cluster-inventory.md
03-namespace-inventory.md
04-owner-register.md
05-policy-inventory.md
06-kyverno-policies.yaml
07-gatekeeper-constraints.yaml
08-admission-webhooks.yaml
09-clusterroles.yaml
10-clusterrolebindings.yaml
11-roles.yaml
12-rolebindings.yaml
13-serviceaccounts.yaml
14-resourcequotas.yaml
15-limitranges.yaml
16-networkpolicies.yaml
17-policyreports.yaml
18-clusterpolicyreports.yaml
19-cis-benchmark-summary.txt
20-exception-register.yaml
21-change-records.md
22-governance-scorecard.md
23-risk-register.md
24-remediation-roadmap.md
25-enterprise-governance-report.md

Task 66 — Validate Evidence Completeness

Complete the evidence checklist.

Evidence	Collected	Reviewed	Approved
Cluster ownership	☐	☐	☐
Namespace ownership	☐	☐	☐
Policy inventory	☐	☐	☐
RBAC evidence	☐	☐	☐
Admission controls	☐	☐	☐
Exceptions	☐	☐	☐
Change records	☐	☐	☐
Compliance reports	☐	☐	☐
Governance scorecard	☐	☐	☐
Risk register	☐	☐	☐
Executive report	☐	☐	☐

Task 67 — Conduct the Governance Review Meeting

Participants should include:

Business owner
Platform owner
Kubernetes Security
Cloud Security
DevSecOps
Compliance
Risk owner
Application owners
Incident response
CISO representative

Agenda:

Assessment scope
Governance score
Critical findings
High findings
Ownership gaps
Policy gaps
Exception risks
Remediation roadmap
Production decision
Executive acceptance

Task 68 — Record Decisions and Actions

Document:

Meeting Date:

Participants:

Governance Score:

Production Decision:

Accepted Risks:

Rejected Risks:

Required Remediation:

Assigned Owners:

Due Dates:

Escalations:

Follow-Up Date:

Executive Approval:

Task 69 — Define the Reassessment Schedule

Recommended reassessment frequency:

Activity	Frequency
Namespace ownership review	Monthly
Policy ownership review	Quarterly
Cluster-admin review	Monthly
RBAC certification	Quarterly
Exception review	Weekly
Compliance reporting	Monthly
Governance scorecard	Quarterly
Multi-cluster drift review	Monthly
Production readiness review	Before release
Full governance assessment	Annually or after major change

Task 70 — Archive the Assessment

Archive:

Final reports
Evidence
Approvals
Meeting decisions
Risk acceptance
Remediation ownership
Reassessment date

Store the assessment in an approved evidence repository.

Do not delete findings that remain open.

Enterprise Kubernetes Governance Checklist

Control	Status
Assessment scope documented	☐
Cluster owner assigned	☐
Technical owner assigned	☐
Security owner assigned	☐
Compliance owner assigned	☐
Namespace owners documented	☐
Orphaned namespaces reviewed	☐
Governance framework approved	☐
Policies inventoried	☐
Policy owners assigned	☐
Kyverno policies reviewed	☐
Gatekeeper constraints reviewed	☐
Policy enforcement consistency reviewed	☐
Policy exclusions reviewed	☐
Admission webhooks reviewed	☐
Cluster-admin access reviewed	☐
Shared access identified	☐
Privileged access governed	☐
Separation of duties assessed	☐
Service Accounts reviewed	☐
Namespace creation governed	☐
Resource governance reviewed	☐
Network governance reviewed	☐
Image governance reviewed	☐
Secrets governance reviewed	☐
Logging governance reviewed	☐
Compliance reporting reviewed	☐
CIS governance reviewed	☐
Change control reviewed	☐
GitOps governance reviewed	☐
Direct production changes reviewed	☐
Emergency changes reviewed	☐
Exceptions reviewed	☐
Expired exceptions identified	☐
Risk acceptance reviewed	☐
Remediation owners assigned	☐
Escalation procedures defined	☐
Evidence governance reviewed	☐
Production gate created	☐
Multi-cluster consistency reviewed	☐
Governance drift identified	☐
Cluster lifecycle reviewed	☐
Upgrade governance reviewed	☐
Decommissioning governance reviewed	☐
Training reviewed	☐
Governance metrics defined	☐
Maturity score calculated	☐
Risk register completed	☐
Remediation roadmap completed	☐
Executive report completed	☐
Governance review meeting completed	☐
Reassessment scheduled	☐

Remediation Priorities

Immediate

Assign accountable owners to all production clusters.
Revoke unapproved administrative access.
Restore critical admission controls.
Remove expired critical exceptions.
Assign owners to critical findings.
Investigate unauthorised production changes.
Preserve incomplete or disputed evidence.

Short-Term

Standardise namespace ownership.
Complete policy ownership mapping.
Move critical controls to Enforce mode.
Implement formal privileged-access governance.
Standardise exception workflows.
Establish formal production-readiness gates.
Complete RBAC certification.

Medium-Term

Centralise multi-cluster policy governance.
Automate ownership validation.
Automate exception expiration.
Build governance dashboards.
Integrate findings with GRC systems.
Standardise change control.
Establish recurring governance committees.

Long-Term

Implement continuous Kubernetes governance.
Automate policy drift detection.
Establish organisation-wide maturity targets.
Integrate governance metrics into executive risk reporting.
Automate evidence integrity validation.
Implement governance controls across the entire cluster lifecycle.

Skills Developed

By completing this lab, you will be able to:

Perform an enterprise Kubernetes governance assessment
Assess cluster and namespace ownership
Review policy governance
Evaluate RBAC accountability
Assess admission-control governance
Review privileged-access controls
Evaluate separation of duties
Assess change-control maturity
Review policy exceptions
Evaluate compliance reporting
Assess production readiness
Review multi-cluster consistency
Identify governance drift
Measure governance maturity
Build governance scorecards
Create risk registers
Develop remediation roadmaps
Produce executive governance reports

Knowledge Check

Question 1

Why must every production Kubernetes cluster have an accountable owner?

Answer: An accountable owner is responsible for risk decisions, funding, operational oversight, remediation, and production approval.

Question 2

What is governance drift?

Answer: Governance drift occurs when clusters, policies, ownership, access controls, or operating processes become inconsistent with approved organisational standards.

Question 3

Why should policy exceptions have expiration dates?

Answer: Expiration prevents temporary bypasses from becoming permanent, unmanaged security weaknesses.

Question 4

What is the difference between responsibility and accountability?

Answer: The responsible party performs the work, while the accountable party owns the outcome and approves the final decision.

Question 5

Why should cluster-admin access be reviewed regularly?

Answer: Cluster-admin provides unrestricted control over the cluster and should be limited to approved, current, and accountable identities.

Question 6

Why is technical enforcement important for governance?

Answer: Documentation defines expectations, but technical enforcement helps prevent non-compliant actions and provides measurable evidence.

Question 7

What should happen when a critical policy remains in Audit mode?

Answer: The risk should be documented, assigned to an owner, reviewed for operational impact, and moved to Enforce mode or formally accepted with compensating controls.

Question 8

Why should production changes follow GitOps or controlled CI/CD?

Answer: Controlled workflows provide review, traceability, repeatability, evidence, separation of duties, and rollback capability.

Question 9

Does a high governance score guarantee a secure cluster?

Answer: No. The score summarises governance maturity but must be combined with technical security testing, monitoring, threat detection, and risk analysis.

Question 10

Who should approve unresolved production risk?

Answer: The accountable business or risk owner should approve residual risk with input from security, compliance, and technical teams.

Lab Summary

In this lab, you performed a complete enterprise Kubernetes governance assessment.

You evaluated:

Cluster ownership
Namespace ownership
Governance policies
Policy ownership
Admission-control governance
RBAC accountability
Privileged access
Separation of duties
Service Account governance
Namespace standards
Resource and network governance
Image and Secrets governance
Logging and compliance reporting
Change control
GitOps and CI/CD governance
Security exceptions
Risk acceptance
Evidence retention
Production readiness
Multi-cluster consistency
Cluster lifecycle management
Governance maturity

You created:

A cluster governance inventory
Namespace ownership inventory
Policy inventory
Accountability matrix
Governance framework
Governance scorecard
Governance risk register
Remediation roadmap
Executive governance report

Kubernetes governance ensures that technical security controls are supported by:

Clear ownership
Defined accountability
Approved policies
Controlled access
Repeatable processes
Evidence
Oversight
Risk-based decision-making

Without governance, even technically secure Kubernetes environments can become inconsistent, unauditable, and difficult to operate safely at enterprise scale.

What’s Next?

Next Runbook: Runbook 01 — Kubernetes Compliance Assessment

In the next runbook, you will perform a structured enterprise compliance review covering CIS Benchmark results, policy compliance, RBAC, workload security, evidence validation, risk classification, remediation tracking, and executive compliance reporting.