Your Kubernetes cluster runs production workloads. An auditor from your compliance team schedules a meeting: "We need evidence that access controls meet SOC2 requirements." You've configured RBAC, NetworkPolicies, and Pod Security Standards throughout this chapter. But can you explain how those controls satisfy compliance requirements?
This lesson teaches you to connect Kubernetes security primitives to regulatory frameworks. By the end, you'll articulate which Kubernetes controls support which compliance requirements—a critical skill when engineering teams interface with compliance auditors.
This is compliance AWARENESS, not compliance CERTIFICATION guidance. Completing this lesson does not make you a compliance expert. SOC2 and HIPAA certifications require:
Use this lesson to understand HOW Kubernetes controls support compliance. Work with qualified compliance professionals for actual certification.
Security and compliance are related but distinct:
A secure system without documentation fails compliance audits. A well-documented system without actual security controls passes audits but gets breached. You need both.
SOC2 (Service Organization Control 2) audits evaluate controls across five trust service criteria. This lesson focuses on Security (Common Criteria), specifically access control.
When an auditor asks "How do you restrict access?", you point to three controls you've configured throughout this chapter:
RBAC answers: "Who can perform what actions on which resources?"
SOC2 mapping: CC6.1 requires that "logical access to information assets is restricted." RBAC implements this by binding specific permissions to specific identities.
NetworkPolicy answers: "Which pods can communicate with which other pods?"
SOC2 mapping: CC6.6 requires "system boundaries are protected." NetworkPolicy creates boundaries between application components, restricting lateral movement.
PSS answers: "What can containers do on the host system?"
SOC2 mapping: CC6.3 requires "physical and logical access is restricted." PSS prevents container escape and privilege escalation—logical access restrictions at the container level.
HIPAA (Health Insurance Portability and Accountability Act) applies to Protected Health Information (PHI). If your Task API handles healthcare data, these controls matter.
HIPAA requires encryption for PHI both at rest and in transit:
Encryption at Rest:
Kubernetes Secrets are base64-encoded by default—NOT encrypted. For HIPAA, enable etcd encryption:
Evidence for auditors: Encryption configuration file showing secrets are encrypted at rest.
Encryption in Transit:
All Kubernetes API traffic uses TLS. For service-to-service traffic, enable mTLS via Dapr (Lesson 7) or a service mesh.
Output:
Evidence for auditors: mTLS status showing Sentry CA is healthy and issuing certificates.
When auditors arrive, they request evidence. Preparation means knowing what to export and where to find it.
Create a compliance evidence export:
Output:
Kubernetes audit logging records who did what when. Configure audit policy for compliance. Create audit-policy.yaml:
What this policy captures:
Let's apply these frameworks to your Task API. Here's how your security controls map to compliance requirements:
Auditor: "How do you ensure only authorized users can access the Task API database?"
Your response: "Access is restricted through three layers:
Let me export the evidence for your records."
Compliance certification requires more than technical controls:
Your role as an engineer: Implement and document technical controls. Work with compliance professionals for the complete program.
Test your cloud-security skill against compliance scenarios:
If any answers are "no," update your skill with the compliance mapping patterns from this lesson.
Test your understanding of compliance-to-control mapping and evidence collection.
Prompt 1:
What you're learning: Access lifecycle management. The answer involves ServiceAccount deletion, RBAC binding removal, and audit logs showing access revocation. Notice if AI explains the connection between identity management and Kubernetes RBAC.
Prompt 2:
What you're learning: HIPAA technical safeguard mapping. The answer involves etcd encryption configuration and evidence collection (encryption config files, API server flags). Notice if AI distinguishes between base64 encoding (not encryption) and actual encryption.
Prompt 3:
What you're learning: Evidence demonstration for encryption in transit. The answer uses dapr status -k to show Sentry health and certificate inspection commands from Lesson 7. Notice if AI provides specific commands versus general guidance.
Compliance is not a one-time achievement. Controls must be continuously monitored, evidence regularly collected, and documentation kept current. The controls you've built throughout this chapter form the technical foundation—but compliance requires organizational commitment beyond engineering.