Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Hardening an Amazon EKS cluster takes more than adding admission policies. Use Terraform to manage infrastructure and review changes, Kubernetes controls to restrict access and workloads, Kyverno where its policy capabilities are useful, and network, secrets, and detection controls to cover risks those tools do not address. The right configuration depends on your EKS, Kubernetes, add-on, Terraform provider, and module versions.
Start with shared responsibility and security boundaries
AWS states in its EKS security documentation: “Security is a shared responsibility between AWS and you.” AWS operates the Kubernetes control plane infrastructure, including its control-plane nodes and etcd database. You remain responsible for security configuration in your AWS environment and for the workloads you deploy. Managed control-plane operations reduce some work, but do not secure your identities, pods, network paths, data, or application supply chain for you.
As an Amazon Associate I earn from qualifying purchases.
A useful hardening plan follows the breadth of AWS’s EKS security best practices: identity and access management, pod and runtime security, network security, tenancy, detective controls, infrastructure, encryption and secrets, compliance, incident response and forensics, and image security. Treat these as connected control areas rather than assuming one policy engine can cover them all.
Restrict human and workload access
Map people and automation to least privilege
Review both AWS IAM permissions and Kubernetes RBAC: a narrowly scoped AWS identity can still have broad Kubernetes permissions, and the reverse can also be true. AWS notes that the principal that creates an EKS cluster receives system:masters access in the control plane. Record the creator identity, maintain explicit access mappings, and periodically review who can administer clusters.
#1 Best Overall
Audit effective permissions, not just role names. In particular, review ClusterRoles and bindings for CSI drivers, DaemonSets, and other add-ons; remove grants they do not need. Separate routine deployment identities from privileged infrastructure or cluster-administration credentials, and make changes traceable through your deployment process.
Choose IRSA or EKS Pod Identity for AWS API access
IRSA and EKS Pod Identity both let a Kubernetes service account obtain temporary AWS credentials associated with an IAM role. Neither is universally preferable; select based on cluster setup, workload compatibility, and operational requirements.
| Option | How it provides identity | Operational considerations |
|---|---|---|
| IRSA | Uses an OIDC-backed service-account token exchange. | Scope the role trust to the intended cluster, namespace, and service account, and grant only the AWS actions the workload needs. |
| EKS Pod Identity | Associates a service account with an IAM role through EKS Pod Identity. | Requires the Pod Identity Agent on eligible worker nodes and supported AWS SDKs. Check the requirements for the cluster and workload before adopting it. |
For either option, minimize the role’s permissions and constrain which service account can assume it. Workloads that do not need Kubernetes API access generally should not receive an unnecessary service-account token mount. AWS warns that tokens exposed through compromised node processes can be abused; a token associated with an IAM role can also lead to AWS credentials.
Free tools Windows power users keep installed
One-click scans. No signup required.
Set pod security controls, then decide whether to add Kyverno
Use Pod Security Admission for standard pod restrictions
Kubernetes Pod Security Admission (PSA) is built in and applies the Pod Security Standards profiles: Privileged, Baseline, and Restricted. It is a comparatively simple starting point when standard pod restrictions meet your needs. Restricted settings can affect application functionality, and privileged access may be necessary for some system-wide components, so assess actual workloads before enforcing a profile broadly.
Add Kyverno when you need broader policy behavior
Kyverno is a policy-as-code option, not a replacement for sound IAM, network, or data controls. Like other dynamic admission controllers, it can inspect API requests before they are persisted. Kyverno policies are Kubernetes resources and can validate, mutate, or generate resources; Kyverno can also check OCI image supply-chain security. Its CLI can test policies in a CI/CD pipeline.
| Decision | Pod Security Admission / Standards | Kyverno |
|---|---|---|
| Operation | Built into Kubernetes; no separate policy engine to install and operate. | Requires installing, upgrading, and operating an additional component. |
| Scope | Applies standard pod-security profiles. | Can cover broader Kubernetes resources and behaviors, including validation, mutation, and generation. |
| Policy workflow | Uses the built-in profiles and configuration model. | Policies can be tested with the CLI in CI/CD; teams must maintain policy logic and exceptions. |
| Best fit | A straightforward baseline for pod restrictions. | More granular controls or policies beyond pod restrictions. |
Roll out workload rules in stages
A practical rollout pattern, consistent with AWS guidance to test controls and avoid disrupting legitimate workloads, is to inventory first, test in CI or a non-production cluster, remediate exceptions, then enforce progressively. Begin with audit or warn behavior where the selected control supports it. Review system components and application owners’ needs before moving to blocking enforcement; a broad rule can prevent a valid system component from starting or block an application release.
Rank #3
Evaluate controls such as running as non-root where feasible, dropping unnecessary Linux capabilities, disallowing privilege escalation, avoiding privileged containers, restricting host namespaces and host-path mounts, disabling unused service-account token mounts, and using a read-only root filesystem when the application supports it. These are candidates for policy, not a universal identical rule set for every pod.
Segment pod traffic deliberately
Kubernetes pod-to-pod communication is broadly allowed by default, so define the traffic relationships workloads actually require. Kubernetes NetworkPolicy provides Layer 3/4 pod traffic boundaries; AWS also recommends security groups for pods where AWS-level network access controls are appropriate. These controls can be layered.
Do not assume EKS network policy enforcement is active simply because NetworkPolicy objects exist. AWS says VPC CNI Network Policy functionality must be enabled and requires a supported add-on version. Check the networking mode, VPC CNI configuration, and add-on version deployed in your cluster before relying on a policy or applying version-specific setup instructions.
A service mesh may add Layer 7 policy, mutual TLS, traffic management, or richer observability, but it brings additional operational complexity. A simpler deployment may prefer native network policy. Both approaches can coexist when their responsibilities are clear. Avoid running multiple network policy engines without a deliberate migration plan: overlapping enforcement can behave unexpectedly. Test converted policies in a separate cluster before production migration.
Protect secrets and Terraform state
Kubernetes Secret values are Base64-encoded; Base64 is not encryption or access control. AWS Prescriptive Guidance says encoding alone is insufficient to prevent unauthorized access to sensitive data. Select a secret-management design that limits access and fits the workload and compute environment. AWS documents Secrets Manager integration using the Secrets Store CSI Driver and ASCP for EC2-backed EKS, and External Secrets Operator patterns for Fargate. Confirm integration and version support for your deployment before applying example configuration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Terraform state can contain sensitive values. Treat it as sensitive: restrict which people and automation can read it, use a secured remote backend with appropriate encryption and locking controls, and avoid exposing secret values through outputs. Backend setup details vary, so follow the current documentation for the backend you choose rather than assuming a particular configuration is safe by default.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use Terraform to make infrastructure changes reviewable
Terraform can provision AWS infrastructure through the EKS module, while Kubernetes and Helm providers can manage resources inside the cluster. The Terraform Registry’s terraform-aws-modules/eks/aws module is actively released; pin a reviewed version rather than relying on an unbounded latest version. Provider and module compatibility changes over time, so validate the versions used in your own pipeline.
Decide intentionally whether infrastructure and in-cluster resources belong in one state or separate states/workspaces. HashiCorp’s Kubernetes-provider EKS example describes separating them to limit change scope and avoid provider configuration dependency problems. Separation is a pattern to evaluate, not a universal requirement: ownership, pipeline dependencies, and recovery procedures affect the right boundary.
| State design | Potential advantage | Trade-off to assess |
|---|---|---|
| One combined state | Keeps related infrastructure and Kubernetes changes together. | A change can affect a wider set of resources; provider initialization and dependency ordering may be harder to manage. |
| Separate infrastructure and Kubernetes states or workspaces | Can narrow the scope of changes and separate team or deployment responsibilities. | Requires explicit coordination of outputs, dependencies, access, and recovery across state boundaries. |
A disciplined change path is:
- Review source changes, pinned module/provider versions, and the intended permissions of the deployment identity.
- Run Terraform validation and inspect the plan before applying infrastructure changes; confirm the plan’s scope matches the review.
- Test Kyverno policies and other Kubernetes manifests in CI or a non-production cluster, including expected exceptions.
- Apply through the controlled deployment identity, then verify cluster access, workload health, and relevant audit signals.
- Retain the plan/apply and policy-test records so later responders can determine what changed and when.
Make detection and response part of the design
Preventive controls do not replace detective controls. Monitor Kubernetes API activity and audit access changes, privileged actions, and policy-relevant events. Maintain a response path for suspicious credentials, unexpected workload permissions, blocked deployments, or network-policy failures. Include image security and incident response/forensics in the same cluster-hardening plan; admission policy is only one point in the workload lifecycle.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBefore rollout, verify version-sensitive behavior against current AWS, Kubernetes, Kyverno, Terraform provider, and module documentation: EKS and Kubernetes compatibility, add-on support, Pod Identity agent and SDK requirements, and the policy APIs available in the installed Kyverno release can change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
