No containers run with privileged flag or securityContext.privileged: true

A privileged container (securityContext.privileged: true) has direct access to the host kernel, all devices, and the host network namespace — it is functionally equivalent to running as root on the node itself (CWE-250). Any exploit in a privileged container breaks out of containment immediately. NIST 800-53 CM-7 requires minimal functionality. CIS Kubernetes 5.2.1 prohibits privileged containers. Even when a container has a legitimate need for elevated access (e.g., packet capture), specific capabilities (NET_ADMIN, NET_RAW) are always preferable to blanket privilege.

Remove securityContext.privileged: true from all container definitions. If the workload genuinely needs elevated access, grant the minimum required Linux capability instead. In your Deployment manifest:

containers:
  - name: app
    securityContext:
      runAsNonRoot: true
      runAsUser: 1001
      allowPrivilegeEscalation: false
      capabilities:
        drop:
          - ALL
        add:
          - NET_BIND_SERVICE  # Only if binding ports < 1024
      readOnlyRootFilesystem: true

For monitoring sidecars that historically required privilege, evaluate eBPF-based alternatives (e.g., Falco, Cilium) that operate without privileged mode.