Assess your Kubernetes cluster's security posture across 30 controls in 7 domains: Cluster Configuration, Workload Security, Network Security, Infrastructure as Code, Runtime Security, Secrets Management, and Compliance. Returns an overall security score, domain-level grades, critical findings, and a prioritized remediation roadmap.
Built by a CISSP/CISM certified security professional at ToolWeb.in
TOOLWEB_API_KEY — Get your API key from portal.toolweb.incurl must be available on the systemPOST https://portal.toolweb.in/apis/security/k8scorecard
1. Cluster Configuration (5 controls):
rbac_enabled — Is Role-Based Access Control enabled?anonymous_auth_disabled — Is anonymous authentication disabled?node_restriction_enabled — Is the NodeRestriction admission plugin enabled?audit_logging_enabled — Is Kubernetes audit logging enabled?etcd_encrypted — Is etcd data encrypted at rest?2. Workload Security (5 controls):
pod_security_policies — Are Pod Security Policies/Standards enforced?privileged_containers — Are privileged containers blocked? (true = no privileged containers)root_containers — Are root containers blocked? (true = no root containers)image_scanning_enabled — Is container image vulnerability scanning in place?admission_controller_enabled — Is a validating/mutating admission controller active?3. Network Security (4 controls):
network_policies_defined — Are Kubernetes NetworkPolicies defined?ingress_tls_enforced — Is TLS enforced on all ingress?service_mesh_enabled — Is a service mesh (Istio, Linkerd, etc.) in use?inter_pod_isolation — Is inter-pod network isolation implemented?4. Infrastructure as Code (4 controls):
iac_used — Is infrastructure managed as code (Terraform, Pulumi, etc.)?iac_scanning_enabled — Is IaC scanning (Checkov, tfsec, etc.) in the pipeline?gitops_workflow — Is GitOps used for deployments (ArgoCD, Flux)?drift_detection — Is configuration drift detection enabled?5. Runtime Security (5 controls):
runtime_monitoring_enabled — Is runtime security monitoring active?falco_or_equivalent — Is Falco or equivalent runtime threat detection deployed?fim_enabled — Is File Integrity Monitoring enabled?audit_trail_enabled — Is a comprehensive audit trail maintained?auto_incident_response — Is automated incident response configured?6. Secrets Management (3 controls):
secrets_encrypted_at_rest — Are K8s secrets encrypted at rest?external_secrets_manager — Is an external secrets manager used (Vault, AWS SM, etc.)?no_hardcoded_secrets — Are there no hardcoded secrets in manifests/images?7. Optional:
compliance_frameworks — Compliance standards to map (e.g., "CIS, SOC2, PCI-DSS")notes — Additional context about the clusterCluster info (required):
cluster_name — Name of the clusterenvironment — "production", "staging", or "development"k8s_version — Kubernetes version (e.g., "1.28", "1.29")cloud_provider — "AWS EKS", "Azure AKS", "GCP GKE", "On-Premise"Then ask yes/no for each of the 30 controls above. You can ask domain-by-domain:
Quick assessment shortcut: If the user says "we have a basic EKS cluster with defaults" or similar, you can set reasonable defaults (e.g., RBAC=true, most others=false for a default setup) and confirm with the user before calling.
curl -s -X POST "https://portal.toolweb.in/apis/security/k8scorecard" \
-H "Content-Type: application/json" \
-H "X-API-Key: $TOOLWEB_API_KEY" \
-d '{
"cluster_name": "<name>",
"environment": "<env>",
"k8s_version": "<version>",
"cloud_provider": "<provider>",
"rbac_enabled": true,
"anonymous_auth_disabled": true,
"node_restriction_enabled": false,
"audit_logging_enabled": false,
"etcd_encrypted": false,
"pod_security_policies": false,
"privileged_containers": false,
"root_containers": false,
"image_scanning_enabled": false,
"admission_controller_enabled": false,
"network_policies_defined": false,
"ingress_tls_enforced": true,
"service_mesh_enabled": false,
"inter_pod_isolation": false,
"iac_used": true,
"iac_scanning_enabled": false,
"gitops_workflow": false,
"drift_detection": false,
"runtime_monitoring_enabled": false,
"falco_or_equivalent": false,
"fim_enabled": false,
"audit_trail_enabled": false,
"auto_incident_response": false,
"secrets_encrypted_at_rest": false,
"external_secrets_manager": false,
"no_hardcoded_secrets": false,
"compliance_frameworks": "CIS, SOC2",
"notes": ""
}'
🛡️ Kubernetes Security Posture Scorecard
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Cluster: [cluster_name]
Environment: [environment]
K8s Version: [version]
Provider: [cloud_provider]
📊 Overall Security Score: [XX/100] — Grade: [A/B/C/D/F]
📋 Domain Scores:
⚙️ Cluster Configuration: [X/5] controls passed
📦 Workload Security: [X/5] controls passed
🌐 Network Security: [X/4] controls passed
🏗️ Infrastructure as Code: [X/4] controls passed
🔍 Runtime Security: [X/5] controls passed
🔑 Secrets Management: [X/3] controls passed
🔴 Critical Findings:
[List controls that failed with highest impact]
🟡 Warnings:
[Medium-priority items]
📋 Remediation Roadmap:
1. [Most urgent fix] — Impact: Critical
2. [Next priority] — Impact: High
3. [Next priority] — Impact: Medium
📎 Full scorecard powered by ToolWeb.in
TOOLWEB_API_KEY is not set: Tell the user to get an API key from https://portal.toolweb.inUser: "Assess the security of our production EKS cluster"
Agent flow:
Created by ToolWeb.in — a security-focused MicroSaaS platform with 200+ security APIs, built by a CISSP & CISM certified professional. Trusted by security teams in USA, UK, and Europe and we have platforms for "Pay-per-run", "API Gateway", "MCP Server", "OpenClaw", "RapidAPI" for execution and YouTube channel for demos.
共 1 个版本