An open source group is expanding its third-party security audits to include the popular but vulnerable Kubernetes cluster orchestrator.