# Security Hardening and Compliance Assessment of Kubernetes Control Plane and Workloads
## 2 Related Works  
[PERSON] and [PERSON] [1] analyzed four years of Stack Overflow discussions using AI, identifying Kubernetes security as a top concern, representing 12.3% of posts. While awareness is high, they noted a lack of tools and actionable guidance. Their study also revealed that security interest has grown significantly, yet the practical implementation of best practices still lags. [PERSON] et al. [2] conducted a large-scale study of 2039 open-source Kubernetes manifests, uncovering 1051 security misconfigurations across 11 categories. They developed SLI-KUBE, a static analysis tool to detect these flaws. Despite promising detection rates, the challenge remained in convincing developers to consistently remediate issues--only 60% of their recommended fixes were applied. [PERSON] et al. [3] proposed KubeRM, a distributed, rule-based system for real-time Kubernetes security enforcement. Their system enabled exploits and abnormal traffic detection without centralized bottlenecks. However, the authors faced issues scaling detection consistency across large clusters and noted difficulties in synchronizing rules efficiently across all nodes. [PERSON] et al. [4] investigated under-reported security defects in Kubernetes manifests by analyzing over 5000 commits from open-source repositories. Only 0.79% of commits addressed security issues, suggesting a significant under-reporting trend. Their key issue was inconsistent commit messaging, which made it hard to identify all relevant security-related changes. [PERSON] [5] discussed security strategies for Kubernetes in multi-cloud setups, emphasizing the use of CNAPP platforms and Zero Trust principles. She identified configuration and compliance issues as main threats, but found implementing integrated solutions complex due to tool incompatibility, high customization requirements, and overlapping security scopes. [PERSON] [6] explored Kubernetes-specific threats like API exposure, unscanned images, and misconfigured RBAC policies. The paper reviewed current tools and mitigation strategies. However, the author noted that many recommendations lacked empirical validation, making it hard for practitioners to assess their effectiveness in real-world scenarios. [PERSON] et al. [7] enhanced Kubernetes with an algorithm for application-aware provisioning of security services. They demonstrated improved service-level performance and security. Nevertheless, integration proved difficult in existing clusters due to limitations in the default scheduler and increased system overhead in high-availability environments. [PERSON] and [PERSON] [8] developed K8s Pro Sentinel to automate encryption and RBAC configuration for Secret Objects. Their operator reduced human error and improved cluster confidentiality. Still, they acknowledged the complexity of integrating it with Kubernetes API server extensions and potential configuration conflicts in real deployments. [PERSON] et al. [9] compared three Kubernetes distributions--K8s, K3s, and K0s--on performance and security. K0s outperformed others in both areas, while K3s struggled with scalability. However, differences in infrastructure and edge device limitations made it difficult to draw generalizable conclusions applicable to all environments. [PERSON] and [PERSON] [10] evaluated container security tools in Kubernetes clusters, emphasizing real-time monitoring. They found most tools lacked cohesion and had high false-positive rates, reducing their effectiveness. They called for improved integration and better event correlation to avoid operator fatigue and alert oversaturation. [PERSON] and [PERSON] [11] proposed Kub-Sec, a system to auto-generate AppArmor profiles for Kubernetes containers. Their method successfully blocked XML-RPC attacks on WordPress apps. However, the approach required extensive behavioral data collection, raising concerns about data privacy and the feasibility of continuous profiling in dynamic environments.