Securing AI agents on Kubernetes takes controls at three points: policy and admission before a workload enters the cluster, scanning before it launches, and runtime monitoring or enforcement after it starts. No single tool category covers all three. Treat an agent’s generated or otherwise untrusted code as a workload-isolation problem as well as a software-supply-chain problem, and compare tools by what they inspect and what they can actually do in response.
What to compare before choosing a tool
“AI agent security” is not a single Kubernetes control. An admission policy can reject an unsafe Pod definition, but it does not inspect every action taken by a running process. A scanner can find image vulnerabilities or risky configuration, but scanning does not enforce runtime behavior. Runtime tooling can observe or restrict behavior after launch, but it may not prevent an unsafe workload definition from being admitted.
Compare tools against the control point and response you need, rather than relying on broad labels such as “agent security.”
| Dimension | What to verify | Why it matters |
|---|---|---|
| Enforcement point | Source or CI, Kubernetes API admission, node or kernel runtime, or more than one point | Each control sees a different stage of the workload lifecycle. |
| Response mode | Report, warn, audit, reject, alert, terminate, or prevent | Visibility is not the same as blocking an action. |
| Coverage | Images and dependencies, manifests, API requests, syscalls and processes, filesystems, network destinations, or Kubernetes API access | A tool can only find or control behavior within its actual scope. |
| Sandbox fit | RuntimeClass support, network restrictions, service-account token handling, host mounts, process isolation, and resource ceilings | These settings map directly to risks from untrusted agent code. |
| Operations and compatibility | CI/CD and GitOps integration, API-server or webhook dependencies, node privileges, policy authoring, Kubernetes version, kernel, container runtime, cloud provider, and cluster networking | These affect deployment effort, security responsibilities, and whether a control works in the target environment. |
| Rollout and exceptions | Audit or warn modes, narrow exceptions, observability, and rollback | Policies can affect availability when they change workload behavior or admission outcomes. |
Kubernetes documents native policy mechanisms and community policy tooling, while the Kubernetes SIG Security catalog describes scanner and runtime-tool categories. Those materials identify options, not a controlled product comparison: they do not establish relative effectiveness, false-positive rates, latency, pricing, or deployment experience. See Kubernetes policy concepts, the Kubernetes GRC Tool and Policy Catalog, and the Kubernetes Policy Management paper.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11#1 Best Overall
Policy and admission: control what may enter the cluster
Kubernetes provides several policy surfaces with different jobs. NetworkPolicy can restrict ingress and egress; LimitRanges and ResourceQuotas manage resource allocation; and admission controls validate or mutate API requests. Kubernetes ValidatingAdmissionPolicy uses CEL for in-API checks and supports block, audit, and warn outcomes. Dynamic admission webhooks can handle more complex checks or validation that depends on external data, including image verification. Admission components extend the API server, so they need to be secured and operated as part of the cluster’s trusted control plane.
For baseline Pod restrictions, Pod Security Standards define privileged, baseline, and restricted levels. Pod Security Admission can apply the selected standard in enforce, warn, or audit mode. Kubernetes documentation also recommends limiting which users and service accounts can create workloads and securing admission plugins and webhooks. These are useful controls for agent workloads, but they do not by themselves understand prompts, tool intent, or an agent’s decisions.
For ecosystem options, the Kubernetes SIG Security catalog describes Kyverno as supporting validation, mutation, generation, and image verification; OPA/Gatekeeper as admission control; and Kubewarden as a policy system based on WebAssembly modules. Kubernetes documentation also names Kyverno, OPA Gatekeeper, Kubewarden, and Polaris among policy implementations. Treat these as examples to investigate, not an endorsement or a claim that their capabilities are interchangeable.
Apply sandbox controls to untrusted agent code
The Kubernetes SIGs Agent Sandbox threat model addresses untrusted, LLM-generated code running in sandbox Pods. It identifies container escape, attacks across tenant networks, Kubernetes API abuse, and denial of service from resource exhaustion. Its secure admission-policy example translates those risks into Pod controls. It is an example for a particular setup—not a universal manifest to copy unchanged.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsControls in the Agent Sandbox policy example
- Require the gVisor RuntimeClass and, for the example’s GKE setup, node selection and toleration settings for gVisor nodes.
- Disable
hostNetwork,hostPID, andhostIPC; prohibit host ports andhostPathmounts. - Set
automountServiceAccountToken: falseand disallow projected service-account tokens and Pod certificates. - Require the default proc mount, disallow sysctls, set
privileged: false, drop all Linux capabilities, and prohibit adding capabilities. - Require CPU and memory limits and
runAsNonRoot: true.
The policy is a concrete example of admission enforcing workload settings; it does not make Agent Sandbox itself an isolation runtime. The project supports configuring secure runtimes such as gVisor or Kata Containers, but operators must configure the runtime and the surrounding controls. RuntimeClass availability, node scheduling, and workload requirements vary by environment. See the Agent Sandbox secure sandbox admission policy example and the Agent Sandbox threat model.
Network and router boundaries need separate attention
In the Agent Sandbox managed NetworkPolicy mode for SandboxTemplates, ingress is restricted to the sandbox router and egress to the public Internet; internal RFC1918 ranges and cloud metadata endpoints are blocked by default. Sidecar ports may need explicit allowances. For bare Sandbox CRDs, the project says operators should use admission control to enforce controls. In the described router path, the default authorizer is AllowAll; the project recommends a custom authorizer to limit access to authorized IP addresses or namespaces. Check which mode and path your deployment uses instead of assuming one network policy covers every sandbox type.
Rank #3
Scanning: find issues before deployment
Kubernetes guidance recommends scanning images before deployment, commonly in CI/CD, and using pipeline compliance rules to keep unpatched images out of production. Image scanning and Kubernetes configuration scanning answer different questions: one examines software in an image or its dependencies, while the other examines deployment settings. Neither, by itself, observes a process once it is running.
| Scan job | Examples in the Kubernetes SIG Security catalog | What the category is for |
|---|---|---|
| Image, filesystem, repository, and SBOM vulnerability scanning | Trivy and Grype | The catalog describes Trivy as also scanning Kubernetes configuration and generating SBOMs. |
| Kubernetes configuration and risk scanning | Kubescape | The catalog describes coverage for risk analysis, security compliance, and misconfiguration scanning. |
| Benchmark conformance | kube-bench | Checks a deployment against the CIS Kubernetes Benchmark. |
These descriptions come from the Kubernetes SIG Security catalog; they are category summaries rather than product evaluations. A vulnerability scanner should not be assumed to assess cluster configuration, and a configuration scanner should not be assumed to block admission or detect live behavior.
Make scan results actionable in the delivery path
- Scan before deployment. Run image and configuration checks in the build or release workflow, before the workload reaches production.
- Gate on defined compliance rules. Decide which findings block promotion and which are reported for review; a scan that only produces a report is not a deployment gate.
- Deploy an immutable image reference. Kubernetes guidance recommends image digests rather than mutable tags. Consider admission-time signature verification where it fits the image-provenance process.
- Keep scan scope explicit. Record whether each check covers image contents, dependencies, an SBOM, Kubernetes configuration, or benchmark conformance so teams do not mistake one result for another.
Runtime protection: observe and constrain live behavior
Runtime controls address what a workload does after it starts. Kubernetes SIG Security policy-management guidance describes examples such as inspecting or terminating offending syscalls or processes, restricting access to protected filesystems, preventing code injection or kernel-module loading, and limiting connections to host services, cloud metadata, the Kubernetes API, or destinations associated with binary downloads and data exfiltration.
The SIG Security catalog lists Falco for monitoring kernel events for unwanted node activity, KubeArmor for workload system policy using eBPF and Linux Security Modules, and Tetragon for eBPF-based security observability and runtime enforcement. These descriptions indicate different approaches and possible response modes; they do not establish that every tool observes or blocks every listed behavior. Verify feature scope, supported kernels and runtimes, and whether a policy alerts, denies, or terminates against the project’s current official documentation before procurement. See the Kubernetes Policy Management paper and the Kubernetes GRC Tool and Policy Catalog.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build a layered baseline and roll it out safely
Use ordinary Kubernetes security controls as the foundation for agent workloads, then add sandbox-specific boundaries according to the workload’s risk and environment.
- Restrict workload-creation privileges with least-privilege RBAC.
- Apply an appropriate Pod Security Standard and use admission policy for additional workload-specific requirements.
- Set resource requests and limits deliberately. CPU limits can throttle work and affect efficiency or autoscaling; memory limits that exceed requests can contribute to node OOM problems.
- Use seccomp profiles where supported. Seccomp is Linux-only; Kubernetes documentation says Kubernetes 1.27 supports enabling
RuntimeDefaultas the default profile for workloads. Confirm the cluster version and configuration rather than assuming it is active. - Prefer image digests, scan before deployment, and consider image signature verification at admission.
- Secure admission plugins and webhooks, and account for their effect on API-server availability and workload admission.
For changes that could disrupt workloads, begin with audit or warn where available, inspect the resulting findings, and then enforce narrowly scoped policies with an explicit exception and rollback process. Test policy changes in the target environment: admission hooks and runtime rules can affect availability, and compatibility depends on the cluster, Linux kernel, runtime, networking implementation, and—where applicable—cloud-provider-specific scheduling.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →See the Kubernetes Security Checklist for the baseline guidance on RBAC, Pod Security Standards, resource controls, seccomp, image scanning, and admission security.
Choose by the gap you need to close
- If unsafe Pod settings are the immediate risk, start with Pod Security Admission and a validating policy or admission controller for requirements such as disabled tokens, prohibited host access, and resource limits.
- If vulnerable or noncompliant artifacts are the concern, put image and configuration scans in CI/CD and make the promotion gate explicit.
- If agent processes may behave unexpectedly after launch, evaluate runtime tools for the specific process, syscall, filesystem, network, or API behaviors you need to observe or block.
- If code is genuinely untrusted, treat a secure runtime and its host, network, credential, filesystem, and resource boundaries as essential design decisions; a scanner or policy label alone does not create isolation.
These controls are complementary: admission decides what may enter, scanning finds certain known issues before launch, and runtime protection addresses behavior in a running workload. Select and validate each layer against the threat and response you require.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
