Identifying Security Vulnerabilities in Kubernetes Environments

This research aims to develop a practical methodology for identifying security misconfigurations in Kubernetes environments, across both Infrastructure-as-Code (IaC) and live cluster states. Using Amazon Elastic Kubernetes Service (EKS), ten intentionally vulnerable Kubernetes manifests that aligned with the OWASP Kubernetes Top 10 were deployed to support controlled experimentation. Five test scenarios assess tool performance across repository and live-cluster scans. These scenarios illustrate how combining multiple scanning approaches can provide broader visibility into environmental risk. The findings highlight the importance of a multi-tool strategy and of continuously validating both code and cluster state to maintain a secure Kubernetes environment.