A Multi-Layer Security Evaluation Framework for Hardening Kubernetes in Devsecops Pipelines: A Quantitative Experimental Evaluation

Abstract

Background: Kubernetes is widely used to orchestrate containerised workloads in DevSecOps environments; however, its complex configuration, access-control mechanisms, software supply chain, and runtime operations create multiple security challenges. Existing security controls often address these risks independently, creating a need for an integrated and measurable framework that evaluates prevention, software-supply-chain integrity, and runtime detection and response within a unified Kubernetes environment. Aims: To design, implement, and quantitatively evaluate a Multi-Layer Security Evaluation Framework (MSEF) that hardens Kubernetes workloads across prevention, software-supply-chain integrity, and runtime detection and response. Study Design: A controlled quantitative experimental design using comparative baseline and hardened Kubernetes environments. Place and Duration of Study: A cloud-based experimental testbed implemented on Google Kubernetes Engine (GKE) and operated through a DevSecOps toolchain during the 2026 evaluation period. Methodology: The Prevention Layer used OPA Gatekeeper and Kubernetes Pod Security Admission to measure Manifest Blocking Rate (MBR), Network Policy Enforcement Rate (NPER), and Secrets Management Enforcement Rate (SMER); the Integrity Layer used Kyverno and Sigstore Cosign to measure Secrets Management Enforcement Rate (SMER) and Signature Policy Rejection Rate (SPR); and the Detection Layer used Falco, Falcosidekick, and a Kubernetes Runtime Evaluation (KRE) handler to evaluate Runtime Detection Rate (RDR), Mean Time to Detect (MTTD), Operational False Positive Rate (OFPR), and Runtime Response Success Rate (RRSR). Layer-level effectiveness composite scores were defined for prevention, integrity, and detection. Terraform set up and configured the cloud infrastructure, ArgoCD reconciled platform services and workloads, and GitHub Actions deployed the repeatable evaluation. Results: The final validated prevention experiments achieved MBR = 1.00, SMER = 1.00, and NPER = 1.00; the integrity experiment achieved SPR = 1.00; and, in the detection experiment, Falco detected all five evaluated runtime attack windows (RDR = 1.00). The measured MTTD was 23.00 seconds, and no operational false-positive windows (OFPR = 0.00) were observed in the five benign workload windows. The initial MBR of 0.95 exposed a secret-access RBAC policy gap that was subsequently corrected. The recorded RRSR run produced 0.78 because Falco event-to-KRE response-rule alignment was still under validation; this value is therefore treated as an integration result rather than evidence of successful automated remediation. Layer-level effectiveness composite scores for prevention and integrity are 100%, while detection is 90%. Conclusion: MSEF's unique contribution to knowledge is the multi-layer integration of controls with explicit experiments, quantitative metrics, feedback-driven policy refinement, and browser-based reporting, rather than the deployment of individual security tools, because it provides a replicable and measurable defence-in-depth model for Kubernetes security.