Running regulated workloads on Kubernetes requires meeting specific compliance requirements. Here’s how to map common frameworks to Kubernetes controls.
SOC 2
Security Principle Requirements
| Requirement | Kubernetes Control |
|---|---|
| Access Control | RBAC, OIDC integration |
| Encryption | TLS, secrets encryption |
| Logging | Audit logs, monitoring |
| Change Management | GitOps, admission control |
Implementation
YAML
# Audit logging for SOC 2
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: RequestResponse
resources:
- group: ""
resources: ["secrets", "configmaps"]
- level: Metadata
resources:
- group: ""
resources: ["pods", "services"]PCI DSS
Key Requirements
Requirement 1: Network Segmentation
YAML
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: cardholder-data-isolation
spec:
podSelector:
matchLabels:
pci-scope: "in-scope"
policyTypes:
- Ingress
- Egress
# Strict controls...Requirement 7: Access Restriction
YAML
# Minimal RBAC for PCI workloads
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pci-readonly
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]Requirement 10: Audit Trails
- Enable comprehensive audit logging
- Retain logs for required period
- Monitor for suspicious activity
HIPAA
Technical Safeguards
- Encryption at rest and in transit
- Access controls and audit logging
- Automatic session termination
- Data integrity controls
YAML
# Encryption configuration
apiVersion: apiserver.config.k8s.io/v1
kind: EncryptionConfiguration
resources:
- resources:
- secrets
providers:
- aescbc:
keys:
- name: key1
secret: <key>Compliance Tools
NSA/CISA Hardening Guide
Use kube-bench to validate:
BASH
kube-bench run --targets master,nodeCIS Benchmarks
BASH
# Check against CIS benchmarks
kube-bench run --benchmark cis-1.8Continuous Compliance
- Automate compliance checks in CI/CD
- Regular audits with tools like Polaris
- Drift detection with policy engines
- Documented evidence collection
Compliance is not a one-time effort—it requires continuous monitoring.