# How to Find Kubernetes Security Issues with ZopNight: Step by Step

> How to Find Kubernetes Security Issues with ZopNight. A practical walkthrough with ZopNight: read-only setup, production excluded by default, reversible at every step.

Source: https://zop.dev/learn/how-to/find-k8s-security-issues
Published: 2026-07-01 · Author: avinash-gaurav · Tags: zopnight, how-to, learn

---

Use the ZopNight Kubernetes workload rules to find privileged containers, missing TLS, and root users on EKS, GKE, and AKS. 41 rules per cluster.

This is the practical version, the one you can follow in a single sitting. It starts read-only, touches no production resource by default, and every step is reversible, so there is no point at which you are committed to something you cannot undo. Budget about 20 minutes. Before you start you will want: An EKS, GKE, or AKS cluster with at least one workload; Permission to grant cluster read access; A ZopNight account.

## The steps

1. Connect the cluster.
2. Wait for the first scan.
3. Filter to security findings.
4. Triage by severity and blast radius.
5. Apply exemptions for legitimate cases.
6. Optionally enable auto-remediation for certified rules.

## Why this is safe to do today

The reason this is a low-stakes change is that nothing here is destructive. Scheduling stops and starts resources; it never deletes them, and your data persists across a stop exactly as it does across a normal reboot. Production is excluded by default, actions run in dependency order, and every state change is logged with what triggered it.

If you want the fuller context behind this task, the [FinOps](https://zop.dev/learn/finops) guide covers where it fits, and the [AWS EC2 scheduling](https://zop.dev/zopnight/aws/ec2) page shows the same loop applied to a specific resource.

## Getting started

Getting started is intentionally low-stakes:

- Connect your cloud provider with a read-only role. Nothing is scheduled or changed at this stage.
- Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status.
- Create a schedule in your timezone and attach the non-production resources or groups you want it to cover.
- Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing.

Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action.

## Frequently asked questions

### Does ZopNight need cluster admin?

Read access is enough for detection. Cluster admin is required only if you want auto-remediation to apply manifest changes back to the cluster.

### How do I exempt platform workloads?

Add a namespace or label exemption in Settings. The default exemption list covers kube-system and common infrastructure namespaces (calico, cilium, csi drivers). Custom exemptions are scoped per cluster.