Production Kubernetes security that goes beyond CIS benchmarks
Kubernetes misconfigurations — privileged pods, exposed dashboards, RBAC bindings that grant cluster-admin — are a leading cause of container-based breaches. Onam audits every cluster object without deploying a sidecar or daemonset.
One platform on Kubernetes
Connect Kubernetes once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every Kubernetes resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not Kubernetes.
Posture, identity, attack paths, workloads and compliance for Kubernetes. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which Kubernetes billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for Kubernetes.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in Kubernetes today.
Services we monitor on Kubernetes
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: GKE Autopilot, EKS Fargate, OpenShift, Rancher-managed clusters, and self-hosted kubeadm clusters.
Compliance frameworks
Onam maps every Kubernetes finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Grant read-only cluster access
Apply the Onam ClusterRole manifest — one kubectl apply. It grants get, list, and watch on every resource, and nothing else. No exec, no port-forward, no impersonation.
Bind to Onam's service account
Federated OIDC binding to Onam's service account — no long-lived kubeconfig files exchanged. For self-managed clusters, the token is stored in AWS Secrets Manager, encrypted with AWS KMS.
Findings from the first scan
Onam watches the API server for drift and audits workloads against CIS Kubernetes and image-supply-chain rules — no runtime agent required.
Kubernetes in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on Kubernetes
Beyond CIS — real attack paths
Privileged pods on nodes that reach the metadata service, service accounts with cluster-admin bindings, and NetworkPolicy gaps are correlated into concrete attack paths — not disconnected findings.
RBAC effective-permission graph
Every RoleBinding, ClusterRoleBinding, and ServiceAccount is resolved into what a pod can actually do — including cross-namespace escalation via aggregation rules and impersonation verbs.
Image supply-chain analysis
Container images are traced back to their registries and their base layers. Unscanned images, missing signatures, and vulnerable OS packages are surfaced with the workloads that run them.
Questions we get a lot
Kubernetes security — related reading
How the engines behind Kubernetes coverage work, and what the categories actually mean.
Cluster workloads across every distribution, agentlessly.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your Kubernetes environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.