Safeguard Docs
Compliance ConnectorsSetup by categoryCloud Infrastructure

Kubernetes

Connect Kubernetes to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect Kubernetes to collect cloud infrastructure evidence with automated compliance tests, switched on per workspace.

CategoryCloud Infrastructure
Connect withAPI token
What a connection producesAutomated compliance tests
Kubernetes's guidekubernetes.io

Connect with an API token

  1. In Kubernetes:

    1. Create a service account for Safeguard, for example kubectl create serviceaccount safeguard -n kube-system.
    2. Create a long-lived token by applying a Secret of type kubernetes.io/service-account-token with the annotation kubernetes.io/service-account.name: safeguard in the same namespace (kubectl apply -f secret.yaml).
    3. Read the token: kubectl get secret <secret-name> -n kube-system -o jsonpath='\{.data.token\}' | base64 --decode.
    4. Create a read-only ClusterRole: kubectl create clusterrole safeguard-read --verb=get,list --resource=clusterrolebindings,clusterroles,roles,rolebindings,namespaces,nodes,pods,serviceaccounts,networkpolicies (resources outside the core API group are written as resource.group, for example replicasets.apps).
    5. Bind it to the service account: kubectl create clusterrolebinding safeguard-read --clusterrole=safeguard-read --serviceaccount=kube-system:safeguard.

    Where to find the other values:

    • API server URL: The address of your cluster's Kubernetes API server (for example https://203.0.113.10:6443).
    • Cluster CA certificate (PEM) (optional): The cluster's CA certificate; a service-account token Secret also includes the CA in its ca.crt data.

    Kubernetes issues this credential through its API or its support team, not through its admin screens.

    Source: kubernetes.io, kubernetes.io, checked 2026-10-07.

    The permissions Safeguard needs: get, list: clusterrolebindings, clusterroles, roles, rolebindings, namespaces, nodes, pods, serviceaccounts, networkpolicies, get, list: constraints.gatekeeper.sh, kyverno.io policies.

  2. On Compliance › Connectors, open Kubernetes, click Connect, choose API token and fill in:

    FieldWhat to enter
    API server URLOptional. For example: https://203.0.113.10:6443
    Service account tokenOptional. Stored encrypted and never shown again.
    Cluster CA certificate (PEM) (optional)Paste the whole key, including the BEGIN and END lines.
    Cluster name (optional)—

    Or, instead: Kubeconfig (optional).

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read Kubernetes and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsA1.1, C1.1, CC6.1, CC6.3, CC6.6, CC6.7, CC6.8, CC7.2, CC8.149
ISO/IEC 27001Automated testsA.5.17, A.8.2, A.8.5, A.8.6, A.8.9, A.8.15, A.8.20, A.8.24, A.8.3249
HIPAA Security RuleAutomated tests164.308(a)(4), 164.312(a)(1), 164.312(b), 164.312(d), 164.312(e)(1)40
PCI DSSAutomated tests1.3.1, 2.2.1, 3.5.1, 4.2.1, 6.5.1, 7.2.2, 8.6.3, 10.2.148
NIST CSF 2.0Automated testsDE.CM-09, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.IR-01, PR.IR-03, PR.PS-0149
CIS Kubernetes BenchmarkAutomated tests1.2.1, 1.2.2, 1.2.4, 1.2.5, 1.2.6, 1.2.7, 1.2.8, 1.2.10, 1.2.12, 1.2.13, 1.2.14, 1.2.15, 1.2.16, 1.2.17, 1.2.18, 1.2.19, 1.2.21, 1.2.22, 1.2.23, 1.2.24, 1.2.25, 1.2.26, 1.2.27, 1.2.29, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.7, 1.4.1, 1.4.2, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.1.8, 5.1.9, 5.1.10, 5.1.11, 5.1.12, 5.1.13, 5.2.1, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10, 5.2.11, 5.2.12, 5.2.13, 5.4.1, 5.7.2, 5.7.441

For a CIS benchmark, the numbers are its recommendations.

These tests are switched on per workspace by the Safeguard team.

Gatekeeper OPA, Kyverno connect to the same provider as Kubernetes, and these tests run for a connection made through any of them.

IBM Cloud

Connect IBM Cloud to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Linode

Connect Linode to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with an API tokenFrameworksRelated