AccuKnox is the best example of how to achieve NIST & MITRE conformance out-of-the-box. The team has done a great job of simplifying security concepts ....
KubeArmor On AWS Bottlerocket
KubeArmor provides enhanced security by using BPF-LSM to protect Bottlerocket containers from within by limiting system behavior with respect to processes, files, etc. For e.g., a k8s security access token that is mounted within the pod is accessible by default across all the containers. KubeArmor can restrict access to such tokens only for certain processes. Similarly KubeArmor can be used to protect other sensitive information e.g., k8s secrets, x509 certs, within the container.