In Kubernetes, truth means strict control over who can touch what, when, and how. For teams under PCI DSS, access control isn’t just a policy. It’s survival.
Kubernetes access for PCI DSS compliance demands more than Role-Based Access Control (RBAC) set once and forgotten. PCI requires least privilege, separation of duties, and provable audit logs. You must enforce strong authentication for every user and service account. You must bind fine-grained roles that limit commands, namespaces, and resources. Access must expire when it’s no longer needed, and logs must be immutable for at least a year.
Start with identity. Integrate Kubernetes with single sign-on (SSO) and multi-factor authentication (MFA) to meet PCI DSS requirements for unique IDs and secure authentication. Tie every subject to a human or service identity you can track. Avoid static credentials or long-lived API tokens; they violate the principle of least privilege and increase audit risk.
Lock down cluster access paths. Disable anonymous access. Audit kubeconfig files and make sure client certificates expire quickly. Use Kubernetes API server flags to disable insecure ports. Restrict kubectl commands with aggregated roles. Enforce read-only permissions for most users. Apply network policies to isolate workloads and protect cardholder data environments (CDE).