Inventory
Distribution, Kubernetes version, nodes, add-ons, workloads, access and dependencies.
Upgrade path and version skew
Permitted version differences under the version skew policy and the steps to a supported version.
Backup and restore
etcd, cluster definitions, persistent volumes and databases, plus the recovery path.
Kubernetes security audit and cluster review at a fixed price
In short: we review the configuration, versions, access, network and backups of your cluster and deliver a report with prioritised actions. A configuration review, not a penetration test.
- CIS Kubernetes Benchmark
- BSI IT-Grundschutz APP.4.4
- Restore review
- Report with actions
Starting point
When a cluster audit makes sense
A cluster often runs without anyone having reviewed its state, versions and recovery together.
Cluster taken over or inherited
Access, versions and responsibilities are unclear. An assessment comes before any commitment to operate it.
Version at end of support
Kubernetes maintains only the most recent minor versions. Older clusters no longer receive security fixes.
Backup without a tested restore
Backups and snapshots exist, but a full recovery has never been rehearsed.
Evidence for customers or auditors
What is asked for is the status against the CIS Kubernetes Benchmark or BSI IT-Grundschutz.
Services
What the cluster audit covers
Two areas with three parts each. The yardsticks are the CIS Kubernetes Benchmark and BSI IT-Grundschutz.
Comparison with CIS and BSI
Review against the CIS Kubernetes Benchmark and the requirements of the APP.4.4 Kubernetes module.
RBAC, service accounts, secrets
Permissions against the RBAC good practices, service accounts and handling of secrets.
Network policies
Network policies, separation of namespaces and services reachable from outside.
Process
From access to report
Four steps. We make no changes to the cluster during the audit.
- 01
Agree the scope
Number of clusters, distribution, infrastructure and reason. The fixed price is stated in the proposal.
- 02
Access and inventory
After commissioning we receive access and record versions, add-ons, workloads and access paths.
- 03
Review
Comparison with CIS and APP.4.4, upgrade path, RBAC, network policies, secrets, backup and restore path.
- 04
Report
Findings by priority with recommended actions. Operating the cluster can follow on request.
The report assigns a priority to every finding and names the action.
- Findingnamespace without a network policy
- Prioritymedium
- Actiondefault deny with exceptions
Pricing
Fixed price for the cluster audit
The fixed price is stated in the proposal before work begins.
Kubernetes cluster auditfrom €1,490 excl. VAT one-timeCreditable against the first month of Managed Kubernetes operations
Payment
- Bank transfer
All prices are net and exclude statutory VAT. The offers are addressed to businesses. As of October 2026.
Comparison
Audit versus pentest and other audits
The cluster audit reviews the configuration and operation of a cluster. What is not part of it is listed here.
Not included
What is not part of the audit
- Penetration test and attack simulation
- Hypervisor, cloud account and servers outside the cluster, see security audit
- Implementing the actions, which is done by effort or within operations
| Criterion | Kubernetes cluster audit (this page) | Security audit | Linux server audit |
|---|---|---|---|
| Subject | A Kubernetes cluster | Servers, cloud accounts and network | A single Linux instance |
| Areas reviewed | Versions, upgrade path, RBAC, network, secrets, backup, comparison with CIS and BSI | Configuration, hardening, access, patch level, logging, backup | Configuration, access, patch level, backups |
| Fits when | a cluster is to be taken over, upgraded or evidenced | several systems are to be reviewed together | a single Linux server is to be reviewed |
Frequently asked questions
Answers to the most important questions
- A Kubernetes security audit reviews the configuration of a cluster against recognised guidance such as the CIS Kubernetes Benchmark. The WZ-IT cluster audit combines this with an operational review: versions and upgrade path, backup and restore path, access, network policies and secrets. The result is a report with prioritised actions.
- No. It is a configuration review. We do not carry out penetration tests, attack simulations or tests from outside. We review configuration, versions, access, network policies, secrets and backups.
- The cluster audit costs from €1,490 excl. VAT one-time. The fixed price for your environment is stated in the proposal before work begins. The amount is credited against the first month of Managed Kubernetes operations. As of October 2026.
- The CIS Kubernetes Benchmark describes secure configuration settings for the control plane, nodes and policies. The APP.4.4 Kubernetes module of the IT-Grundschutz Compendium sets out requirements on identity and permission management, cluster backup, network separation and configuration files, among others. The audit compares the cluster with both and lists deviations in the report. No certification is attached to it.
- For clusters on Proxmox, bare metal and at cloud providers, including Amazon EKS and Azure AKS, regardless of the distribution such as kubeadm, k3s, RKE2 or Talos.
- The cluster audit is the entry point for taking a cluster into operations. The audit price is credited against the first month of operations. Managed Kubernetes costs from €590 excl. VAT per cluster and month including 3 worker nodes and can be cancelled monthly, with 30 days' notice to the end of the month. As of October 2026.
- The cluster audit reviews a Kubernetes cluster. The security audit reviews servers, cloud accounts and network, the Linux server audit a single Linux instance. The checklist Taking over a Kubernetes cluster describes the operational part.
Knowledge
Sources and further reading
Primary sources, guides and related services.
Guides
Primary sources
- CIS Kubernetes BenchmarkSecure configuration of control plane, nodes and policies.
- BSI IT-Grundschutz: APP.4.4 KubernetesModule of the IT-Grundschutz Compendium, 2023 edition.
- Kubernetes version skew policyPermitted version differences between components.
- Kubernetes security checklistChecklist from the Kubernetes documentation.
Related services
- Managed KubernetesOperations for existing and hosted clusters with upgrades, backups and hardening.
- SLA & service levelsResponse times for P1 incidents per level.
- Monitoring as a ServiceMonitoring runs 24/7, alerts are reviewed.
- Kubernetes supportHelp billed by effort without a standing contract.
- Managed Kubernetes hostingClusters provided by WZ-IT in Germany, operations included.
Reviews & projects
Operations that visibly relieve customers
Customer feedback on monitoring, updates, maintenance, support and stable production systems.
Networking & Provisioning
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
Enquiry
Which cluster should we review?
For an initial assessment, the distribution, version, number of nodes and the reason are sufficient. We only need access credentials after commissioning.
- Straight with Timo and Robin - no sales team, no pitch
- A professional assessment of your situation
- Concrete next steps for infrastructure, software or AI
The conversation is free and non-binding.
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.
Jakob ÖschlbergerInno7 GmbH
WZ-IT's advice on our Azure migration was technically sound and completely non-binding right from the intro call - we took away a great deal.