RBAC Minimization
Does the model reduce role bindings to least-privilege without breaking workloads?
PlannedVersion v0.1·Kubernetes Security & Configuration
Kubernetes Remediation Benchmark
Measures AI models on remediating Kubernetes misconfigurations — RBAC over-permissions, pod security, network policies, and admission controller violations.
Scope
What this benchmark measures
Quality of RBAC scope reductions
Pod Security Standard (Restricted/Baseline) compliance
NetworkPolicy minimal-surface fixes
Admission controller policy authoring (OPA/Kyverno)
Resource limit and request hygiene
Evaluation
Evaluation dimensions
Each model response is judged on these dimensions by an LLM-as-Judge calibrated against expert annotations.
PSS Compliance
Does the patched pod meet Restricted/Baseline standards?
Network Isolation
Are NetworkPolicies correctly scoped to actual traffic patterns?
Policy Authoring
Are OPA/Kyverno policies valid and aligned to intent?
Operational Safety
Do remediations preserve readiness/liveness probes and rollout strategy?
Example
Sample benchmark case
An illustrative case to show how the model is presented with a problem and how its response is scored.
Finding
Deployment "checkout" runs as root with privileged: true and hostNetwork: true.
Prompt summary
Generate a patch that removes privilege escalation while preserving the service's functionality.
Ideal answer
Remove hostNetwork, add securityContext.runAsNonRoot, drop ALL capabilities except NET_BIND_SERVICE if needed. Add seccompProfile: RuntimeDefault.
Scoring note
Suggestions that remove privileges but break liveness probes or in-cluster DNS are penalized.
Roadmap
Current version: v0.1
All Remediation Labs benchmarks evolve through three versions, increasing in difficulty and realism.
Current
v0.1Finding-only
Models are given the raw security finding and asked to recommend a remediation. No environment context provided.
v0.2Context-aware
Models receive the finding plus relevant system, code, and policy context. Evaluated on contextual reasoning quality.
v0.3Executable remediation
Models must produce a remediation that can be safely executed end-to-end — code patches, IaC changes, runbook steps — with verification.
Want the full Kubernetes Remediation report?
Get model leaderboards, scoring methodology, dataset details, and roadmap access — or discuss generating proprietary remediation datasets for your environment.
Or email us directly at info@remediationlabs.com