what it checks
Kubernetes checks in Varman
Monitor Kubernetes cluster security: RBAC least privilege, Pod Security Standards, privileged workloads, and network policies. Varman runs 4 checks against Kubernetes on a schedule and records each result as evidence.
RBAC Least Privilege
critical severityVerify that no ClusterRoleBinding grants cluster-admin to anonymous, everyone groups, or other broad subjects.
Pod Security Standards Enforced
high severityVerify that non-system namespaces enforce Pod Security admission (baseline or restricted).
No Privileged Containers
high severityVerify that running pods are not privileged and are configured to run as a non-root user.
Network Policies Present
medium severityVerify that each non-system namespace has at least one NetworkPolicy.
how to connect
Connecting Kubernetes
An admin adds the details below in Varman under Integrations. Secret values are encrypted before they are stored.
- API Server URL
- The cluster API server endpoint (kubectl config view -o jsonpath="{.clusters[0].cluster.server}").
- Service Account Token
- A bearer token for a read-only ServiceAccount (ClusterRole with get/list on the audited resources).
- CA Certificate (PEM)
- PEM-encoded cluster CA certificate. Required for managed clusters (EKS/AKS/GKE) and any self-signed API server: paste the certificate-authority-data from your kubeconfig (base64-decoded). The runner trusts this CA for the connection.
- Skip TLS verification
- Set to "true" to skip API-server certificate verification. Lab/testing only: prefer providing the CA certificate above.