Container / Kubernetes Security Baseline

A set of foundational security controls that must be in place in a Kubernetes cluster and container workloads: Pod Security Admission, least privilege RBAC, default-deny network policies, image/supply chain verification, control plane and etcd hardening, runtime detection, and secrets management. Framework is SANS CIS Controls v8; concrete values are drawn from the NSA/CISA Kubernetes Hardening Guide, CIS Kubernetes/Docker Benchmark, and NIST SP 800-190.