Kubernetes security: what I actually enforce

The controls I run on real clusters: network policies, RBAC, secrets and image scanning — with the actual manifests.