Kubernetes Pod Security Context Compliance Auditor

This security audit script interfaces with the Kubernetes API to evaluate all running container pods across cluster namespaces for compliance against pod security standards. Internally, it uses the official kubernetes Python client library to query list_pod_for_all_namespaces, iterating through container specification objects to evaluate securityContext settings including runAsNonRoot, privileged, and readOnlyRootFilesystem attributes.

Infrastructure teams execute this script during pre-deployment integration checks or as a regular out-of-band compliance job in production environments. It offers immediate visibility into high-risk pod configurations violating zero-trust container security policies before static policy admission engines strictly reject deployment manifests.

Executing cluster-wide scans requires granting specific read-only ClusterRole bindings (get, list on pods and namespaces), which must be protected against abuse. In large environments with tens of thousands of running containers, unpaginated API queries can cause high control plane memory consumption, requiring pagination parameters using continue tokens during list requests.

> System.Execute()

from kubernetes import client, config

def audit_pod_security():
    config.load_kube_config()
    v1 = client.CoreV1Api()
    pods = v1.list_pod_for_all_namespaces(watch=False)
    
    for pod in pods.items:
        for container in pod.spec.containers:
            sec_ctx = container.security_context or client.V1SecurityContext()
            if sec_ctx.privileged or not sec_ctx.read_only_root_filesystem:
                print(f"[!] Non-compliant Pod: {pod.metadata.namespace}/{pod.metadata.name} | Container: {container.name} | Privileged: {sec_ctx.privileged} | ReadOnlyFS: {sec_ctx.read_only_root_filesystem}")

audit_pod_security()

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-E42F89E6BEF7