What DSPM actually measures in a Kubernetes estate

DLP programs fail in Kubernetes because they start at the policy. A rule that says “do not put PAN in object storage” does nothing if you cannot list the buckets the cluster can write to, the service accounts that can assume a role to those buckets, and the jobs that already did it last Tuesday. DSPM, done honestly, is that inventory plus a judgment about exposure — not a new scanner logo.

Inventory the stores, not the slides

In a typical estate the sensitive data is not in the Postgres you know about. It is in a debug dump on a PVC, a Fluent Bit buffer, a CI cache, a “temporary” S3 prefix from a migration, and a warehouse replica that never got the production ACL. Walk the workload spec: volume mounts, envFrom, projected tokens, IRSA/Workload Identity annotations, and egress NetworkPolicies (or the absence of them).

$ kubectl get deploy,cronjob -A -o json \
  | jq -r '.items[]
    | [.metadata.namespace, .metadata.name,
       (.spec.template.spec.serviceAccountName // "default")]
    | @tsv'

Classify along the path, not the table

A column labeled “ssn” is easy. A JSON blob in a log line that happens to include an ID card scan is the actual loss. Sample the egress: sidecar logs, object PUT prefixes, and the SaaS connectors your data team stood up without a security ticket. DSPM tools help when they can see those paths. They do not help when they only see the RDS instance you already have on a diagram.

Then write a DLP rule that can fire

• Bind the control to an identity (the job’s service account) and a destination (bucket, topic, or SaaS app), not to a hopeful regex on the laptop.
• Alert on first-seen prefixes and first-seen principals. Volume thresholds miss the quiet copy.
• Put the break-glass path in the same change as the block. If production restore needs a bulk export, script it with a ticket and a time-boxed role.

If your DSPM score went up and you still cannot answer “which service account can take the customer table out of the cluster,” you measured coverage of agents, not exposure of data.