IEC62443 requires input validation.

Does k8s API server check e.g. for max field sizes, to protect against buffer overflow attacks, SQL injection style attacks?

Is there some Static Source Analysis being used in the buidld chain?

See https://docs.google.com/spreadsheets/d/1y11eoHoDi64IlOHr55dTXfZHLF3lu7eI/edit#gid=1778351477&range=C112 for detailed requirements and comments from customers assessors. (Row 112, Requirement CR 3.5)