Systemic Kubernetes hardening gaps (377 Checkov failures)

• Severity: Medium (systemic, large attack-surface-amplifier; individual issues are low-to-medium but compounded)
• CVSS 3.1: N/A (this is a hardening/defense-in-depth finding, not a single exploitable bug)
• CWE: CWE-1008 (Weak Security Feature), CWE-732 (Incorrect Permission Assignment), CWE-269 (Improper Privilege Management)
• Asset: corezoid/helm repository (deployed to production EKS clusters)
• Discovered: 2026-04-26
• Status: Open — recommend phased hardening over 1 quarter
• Reporter: Claude (CVP pentest)

Summary

Checkov IaC scan of the corezoid/helm umbrella chart reports 377 failed checks across 110 resources (1387 passing). The failures cluster into systemic Kubernetes hardening gaps — none of them is an immediate exploit, but together they eliminate multiple layers of defense-in-depth and mean that a single compromised container has much broader options for lateral movement, privilege escalation, and data exfiltration than it should.

Findings by check type (Checkov)

Full details: tools-out/checkov-helm.json

Impact scenarios

Scenario A — compromised container + privilege escalation: Attacker lands RCE in any pod (via an application vuln, malicious image layer, or stolen deploy key). With allowPrivilegeEscalation: true + root containers + writable root FS, they can:

• Run setuid binaries
• Persist malware across pod restarts (write to PVC, scheduled cronjobs)
• Install kernel modules (if capabilities include SYS_MODULE)
• Read mounted service-account token → hit k8s API → enumerate/modify other pods

Scenario B — east-west lateral movement: Without NetworkPolicy, a compromised pod in namespace A can directly connect to:

• Pods in namespace B (including database pods)
• Kubernetes API server (if reachable from pod network)
• Other cluster services via coredns (internal service discovery works unchecked)

Scenario C — supply chain via mutable tags: Images pulled by myregistry/app:latest instead of myregistry/app@sha256:.... If an attacker pushes a malicious layer with the same tag, next pod restart runs the malicious image — without any code or config change detected by GitOps tooling.

Scenario D — secrets exposure via env vars: Secrets mounted as env vars appear in:

• /proc/<pid>/environ (readable by any co-located sidecar or debug tool)
• Application crash dumps
• Accidental logging (process.env dumps)
• OOMKilled events (some k8s versions log pod env on kill)

Remediation

Priority 1 — chart-level defaults (1 PR, one helm chart umbrella change):

# values.yaml — apply to all subcharts
podSecurityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001
  fsGroup: 10001
  seccompProfile:
    type: RuntimeDefault

securityContext:
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]
  runAsNonRoot: true

automountServiceAccountToken: false  # enable only where the pod genuinely needs the API

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

Override only where a workload legitimately needs exceptions (e.g., postgres init container needs runAsUser:0 to chown PVC).

Priority 2 — network segmentation (1-2 sprints):

1. Install Cilium or Calico if not already (EKS supports both).
2. Default-deny NetworkPolicy per namespace.
3. Allow-list specific service-to-service traffic.

Priority 3 — supply chain (ongoing):

1. Pin all images by SHA digest (image: nginx@sha256:...), not tag.
2. Enable cosign verification on pod admission (you already have init-verify-image-signature in account! extend it cluster-wide via Kyverno or Gatekeeper).
3. Automate digest-updates via Renovate or digestabot.

Priority 4 — namespaces (1 sprint):

Create purpose-named namespaces (account, apigw, workers, simulator, etc.) and migrate resources out of default. This also enables per-namespace ResourceQuotas.

Verification after remediation

Re-run checkov: expected to drop to <50 failed checks (from 377) once umbrella defaults are set. Add CI gate:

# .gitlab-ci.yml / .github/workflows/
- name: Checkov gate
  run: checkov -d . --framework helm --compact --soft-fail=false

References

• CIS Kubernetes Benchmark
• NSA/CISA Kubernetes Hardening Guidance
• Pod Security Standards
• Checkov docs: https://www.checkov.io/5.Policy%20Index/kubernetes.html