Kubernetes Security Essentials: Consistent security posture management across your Kubernetes environments

Dynatrace Kubernetes Security Posture Management (KSPM) now includes Kubernetes Security Essentials: a default-on profile that checks supported monitored clusters for common security misconfigurations without requiring an additional node-level collector. It gives teams a consistent security baseline across supported Kubernetes distributions and versions, with findings connected to Kubernetes observability data to help prioritize action.

Across supported distributions and versions (including Google GKE, Red Hat OpenShift, K3s, and MicroK8s) - teams get a consistent security baseline with continuously updated posture findings to support security and compliance reviews. Findings connect to Kubernetes observability data to help prioritize action, while distribution-specific benchmark profiles can extend that baseline with deeper assessments where available.

Why Kubernetes environments need a consistent security baseline

Auditors and security leaders want proof that every Kubernetes cluster a platform team runs is configured securely. Standards and regulations such as the CIS Kubernetes Benchmark, PCI DSS, and DORA point to continuously updated posture findings that support security reviews aligned with hardening best practices, rather than a point-in-time snapshot from a manual review.

In practice, the Kubernetes estate is more fragmented than those frameworks assume. Organizations run Kubernetes across managed hyperscaler services, enterprise platforms such as OpenShift, and lightweight distributions such as K3s and MicroK8s at the edge. Each distribution ships its own defaults and in many cases its own benchmark, and those benchmarks have to be implemented one by one.

With estates this mixed, security teams need one posture standard across all their clusters. KSPM's distribution-specific benchmark profiles already cover platforms such as Amazon EKS, Microsoft AKS, and vanilla Kubernetes. Kubernetes Security Essentials extends that assessment to every other cluster, including GKE, OpenShift, K3s, and MicroK8s, so security teams get consistent posture findings to support security reviews of their Kubernetes deployments as a whole.

What does Kubernetes Security Essentials check?

Kubernetes Security Essentials is a profile in KSPM that groups the security checks that matter on every cluster, regardless of who operates the control plane. The checks are evaluated purely from Kubernetes API objects that Dynatrace already collects, such as:

• Workload specifications
• RBAC bindings
• Service accounts
• Namespaces
• Network policies

Distribution-specific benchmark checks, in contrast, often read node configuration files, which requires an additional node-level collector on every node. The Essentials checks don't, so there is no need to deploy additional components: the profile is on by default for a monitored cluster, and findings appear in the Kubernetes Security Posture Management app as soon as the cluster is connected.

The profile focuses on best practices that hold true across distributions and Kubernetes versions, for example:

• Workload hardening: containers running as root, privileged containers, privilege escalation, and unrestricted host access such as hostPath, hostNetwork, or hostPID.
• Identity and access: over-permissive RBAC roles and bindings, wildcard permissions, cluster-admin grants, and automatic mounting of default service account tokens.
• Isolation and exposure: namespaces without network policies, workloads exposed through unrestricted service types, and missing resource limits that could enable noisy-neighbor and denial-of-service conditions.
• Configuration hygiene: use of deprecated or unsupported API versions, unsafe image pull policies, and secrets exposed through environment variables.

How does Dynatrace contextualize Kubernetes posture findings?

Dynatrace stores posture findings alongside Kubernetes observability data in Grail and connects supported entities through Smartscape topology. Teams can investigate a finding in the context of the affected workload, namespace, and cluster.

For example, when a check flags a privileged container, a team can identify the affected workload and use its observability context to investigate the services it supports. This helps the team assess operational impact and plan the configuration change.

Each finding identifies the affected resource and explains the check. Dynatrace Assist can generate remediation guidance on demand, while DQL and Workflows let teams query findings, track posture trends, and route issues to the teams responsible for addressing them.

What's next

Kubernetes Security Essentials provides a common baseline that distribution-specific profiles can extend. We're also evaluating additional distribution-specific benchmark profiles, so that customers who need full CIS Benchmark coverage on platforms such as GKE and OpenShift can layer deeper node-level assessment on top of the general checks.

We are also working on broader compliance framework mappings, richer prioritization based on runtime exposure and reachable vulnerabilities, and additional automation templates.

Get started

Kubernetes Security Essentials is available to Dynatrace customers using Kubernetes Security Posture Management. To try it:

1. Connect your Kubernetes clusters to Dynatrace following the Kubernetes monitoring setup documentation.
2. Open the Kubernetes Security Posture Management app. The Kubernetes Security Essentials profile is already on for your monitored clusters.
3. Review your first findings, prioritize by affected workload, and automate remediation with Dynatrace Workflows.

Not a Dynatrace customer yet? Start your free trial to explore Kubernetes Security Posture Management.

You can also join the Dynatrace Community to share feedback on which checks you would like to see added next.

Dynatrace, Grail, and Smartscape are trademarks of the Dynatrace, Inc. group of companies. All other trademarks are the property of their respective owners