Free tools Windows power users keep installed
One-click scans. No signup required.
Secure an AI agent on Kubernetes by limiting both what its workload can reach and what its model can cause tools to do. Use Kubernetes controls to contain a compromised pod; use independent policy checks and approvals to constrain proposed agent actions. The checklist below covers both layers, but each control must be verified against your cluster, CNI, cloud provider, agent framework, and workload sensitivity. As the Kubernetes Security Checklist cautions, “Checklists are not sufficient for attaining a good security posture on their own.”
1. Define the agent’s authority before deployment
Start with the actions the agent is allowed to take, not just the container it will run in. An agent may interpret untrusted text, call tools, retain memory, and act on the results. A narrowly configured pod does not make an overpowered tool safe, and a cautious prompt is not an authorization boundary.
As an Amazon Associate I earn from qualifying purchases.
Inventory tools, data, and destinations
- List every tool, API, data source, memory store, model endpoint, and external destination the agent can use.
- For each tool, record which operations it supports, which resources it can affect, what credentials it uses, and whether access is read-only or can change state.
- Remove tools and data connections the agent does not need for its specific task. Review third-party integrations by the permissions they request, not only by their advertised function.
Authorize actions outside the model
Treat model output as a proposal, not permission. A separate policy or execution component should check the requested tool, target, parameters, scope, and approval status before carrying out an action. Require human approval for sensitive or irreversible operations. Bind each approval to the actor, tool, target resource, normalized parameters, timestamp, and expiry; use short-lived authorization artifacts and replay protection where relevant. The OWASP AI Agent Security Cheat Sheet provides guidance on agent-specific risks and controls.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Test agent-specific abuse cases
Include direct and indirect prompt injection, tool misuse, data exfiltration, memory poisoning, excessive autonomy, and cost exhaustion or unbounded loops in your abuse-case tests. Verify that the authorization layer blocks disallowed actions even when the model is manipulated or produces unexpected output.
#1 Best Overall
2. Give the workload a narrow Kubernetes identity
Use a dedicated ServiceAccount and least-privilege RBAC
Assign a dedicated ServiceAccount to each agent or trust boundary. Grant only the resources and verbs the workload requires, and avoid broad cluster-wide bindings. In particular, scrutinize create, update, patch, and delete permissions, as well as permissions to create or modify workloads and roles.
Kubernetes RBAC is coarse for pod resources: permission to create workloads can give a user or workload powerful access to schedulable nodes unless admission controls and namespace policies constrain what may be created. Do not let untrusted components create Pods in system namespaces or in namespaces where pod creation could enable privilege escalation. See the Kubernetes Application Security Checklist and guidance on securing a cluster.
Disable API credentials when they are unnecessary
Set automountServiceAccountToken: false when the agent does not need to call the Kubernetes API. If it does need API access, scope its permissions and prefer a bound, time-limited token rather than giving the pod a broadly useful credential.
3. Restrict network reachability
Verify that NetworkPolicy is enforced
Confirm that the selected CNI supports and enforces Kubernetes NetworkPolicy. A policy manifest alone does not prove traffic is restricted: behavior depends on the networking implementation. Where feasible, start with default-deny ingress and egress for the agent’s namespace or workload, then allow only required peers, ports, and destinations.
Allow only documented dependencies
Model APIs and agent tools are explicit egress dependencies. Document the destinations the agent needs and review that allowlist when tools or model endpoints change. Restrict access to cloud metadata APIs unless the workload explicitly needs it, because metadata services can expose instance credentials or provisioning data.
Protect cluster control-plane traffic
Keep the Kubernetes API, kubelet API, and etcd off the public internet. Limit access to etcd and use authenticated, encrypted connections. For sensitive workloads, consider service-mesh or other network encryption when the CNI does not provide encryption in transit. Kubernetes’ security checklist and application security checklist cover relevant cluster and workload protections.
Rank #3
4. Protect credentials, prompts, and agent data
Limit what the workload receives
Give each agent only the credentials it needs, with the narrowest practical scope and lifetime. Keep confidential values out of prompts, unvalidated agent memory, logs, and broadly readable environment variables. Do not give the agent’s ServiceAccount general read access to Kubernetes Secret resources merely to deliver one credential.
Recommended Free Tools
Choose a controlled secret-delivery path
Do not use ConfigMaps for confidential values. Enable encryption at rest for Kubernetes Secret data and encrypt backups. Where practical, prefer controlled file or volume injection with restrictive file permissions over environment variables; Kubernetes guidance notes that environment variables can be more prone to leakage in crash dumps and logs. A third-party secret store or CSI integration can support centralized delivery and rotation, but the injected secret still needs access controls.
Rotate and review credentials
Review and rotate cloud, model, and tool credentials, and minimize their scope and lifetime. The Kubernetes Security Checklist, cluster security guidance, OWASP Kubernetes Security Cheat Sheet, and OWASP AI Agent Security Cheat Sheet address related protections.
5. Harden the pod and container
Reduce privileges and writable surfaces
- Run as a non-root user with
runAsNonRoot: trueand an appropriate UID and GID. - Set
allowPrivilegeEscalation: falseand avoid privileged containers. - Set
readOnlyRootFilesystem: truewhere the application supports it. - Drop all Linux capabilities, then add back only those the application demonstrably requires.
Apply isolation appropriate to the workload
Enforce an appropriate Pod Security Standard. For sensitive workloads, configure Seccomp, AppArmor, or SELinux profiles, and evaluate a more isolated RuntimeClass, such as a sandboxed or virtualized runtime. These controls can improve isolation, but compatibility and performance trade-offs should be tested with the actual agent and its dependencies.
Bound resource use
Set CPU and memory requests and limits appropriate to the workload. Namespace quotas can also constrain resource use and help bound runaway compute consumption. Kubernetes’ Application Security Checklist and Security Checklist describe workload-hardening considerations.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
6. Secure images and the software supply chain
Use minimal production images and run them as an unprivileged user. Scan images before deployment and patch known vulnerable software. Pin images by digest or validate signed provenance at admission time so that the deployed image is the one you intended to approve.
Apply the same scrutiny to integrations and deployment components as to the agent itself. An integration that can read all Secrets or create Pods in a permissive namespace may have authority far beyond its apparent task. The Kubernetes Security Checklist, Application Security Checklist, and cluster security guidance provide further supply-chain and deployment protections.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Monitor, test, and revisit controls
Make activity reviewable
Enable Kubernetes API audit logging and store audit records securely for investigation. Monitor security-relevant process activity and network communications between services and with external clients or servers. Keep agent logs useful for security review while redacting secrets and sensitive data.
Make abuse-case testing part of release decisions
Maintain tests and CI/CD release gates for prompt injection, unauthorized tool calls, data leakage, and approval of high-impact actions. Check both sides of the boundary: whether Kubernetes prevents the workload from reaching unauthorized resources, and whether the agent’s execution layer rejects unauthorized actions.
Reassess after meaningful changes
Review policy effectiveness when the cluster, CNI, agent tools, model endpoints, or workload sensitivity changes. A change in any of these can alter what the agent can reach or what its actions could affect. The Kubernetes guidance on securing a cluster is available at kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/; use it alongside the OWASP Kubernetes Security Cheat Sheet and OWASP AI Agent Security Cheat Sheet when reviewing controls.
How the security layers fit together
| Layer | Primary purpose | What to validate |
|---|---|---|
| Kubernetes identity and pod controls | Limit the workload’s privileges and local exposure. | ServiceAccount scope, RBAC, admission constraints, container settings, and runtime isolation. |
| Network controls | Limit reachable services and external destinations. | CNI enforcement, ingress and egress behavior, metadata access, and allowed dependencies. |
| Agent tool policy | Limit the actions the agent can request and execute. | Independent authorization, resource scope, parameter validation, and approval handling. |
| Monitoring and testing | Reveal misuse and catch regressions as the system changes. | Audit retention, useful redacted logs, abuse-case tests, and release gates. |
These layers address different failure modes. Kubernetes hardening can reduce the blast radius of a compromised workload, but it does not decide whether an agent should delete a resource or disclose data through an allowed tool. Conversely, agent-level authorization cannot contain a pod that has excessive Kubernetes permissions or unrestricted network access. Validate both boundaries in the environment where the agent will run.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
