How to Security-Harden Kubernetes Against Unknown Unknowns