GCP Kubernetes Misconfig for GCP - Security Checks

Checks Performed

• An Admission Policy Engine Should Enforce Workload Policy
• Apply Security Context To Pods And Containers
• Audit Logging Should Be Enabled And Shipped Off-Cluster
• Automate GKE Version Management Using Release Channels
• Avoid Bindings To System:anonymous
• Avoid Non-Default Bindings To System:authenticated
• Avoid Non-Default Bindings To System:unauthenticated
• Avoid Use Of System:masters Group
• Configure Image Provenance Using ImagePolicyWebhook Admission Controller
• Consider External Secret Storage
• Consider Firewalling GKE Worker Nodes
• Consider GKE Sandbox For Running Untrusted Workloads
• Container Images Should Not Use The latest Or Untagged Tag
• Containers Should Define Liveness And Readiness Probes
• Containers Should Disallow Privilege Escalation
• Containers Should Drop All Linux Capabilities
• Containers Should Not Run In Privileged Mode
• Containers Should Run As Non-Root
• Containers Should Set CPU And Memory Limits
• Containers Should Set CPU And Memory Requests
• Containers Should Use A Read-Only Root Filesystem
• Create Administrative Boundaries Between Resources Using Namespaces
• Enable Customer-Managed Encryption Keys (CMEK) For Boot Disks
• Enable Customer-Managed Encryption Keys (CMEK) For GKE Persistent Disks
• Enable Linux Auditd Logging
• Enable Security Posture
• Enable VPC Flow Logs And Intranode Visibility
• Enforce Pod Security Standard Baseline Profile Or Stricter For All Namespaces
• Ensure All Namespaces Have Network Policies Defined
• Ensure Authentication Using Client Certificates Is Disabled
• Ensure Cluster-Admin Role Is Only Used Where Required
• Ensure Clusters Are Created With Private Endpoint Enabled And Public Access Disabled
• Ensure Clusters Are Created With Private Nodes
• Ensure Container-Optimized OS Is Used For GKE Node Images
• Ensure Control Plane Authorized Networks Is Enabled
• Ensure Default Service Accounts Are Not Actively Used
• Ensure GKE Clusters Are Not Running Using The Compute Engine Default Service Account
• Ensure Image Vulnerability Scanning Is Enabled
• Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled
• Ensure Kube-Proxy Kubeconfig File Ownership Is Set To root:root
• Ensure Kube-Proxy Kubeconfig File Permissions Are 644 Or More Restrictive
• Ensure Kubelet Configuration File Ownership Is Set To root:root
• Ensure Kubelet Configuration File Permissions Are Set To 644
• Ensure Kubernetes Secrets Are Encrypted Using Keys Managed In Cloud KMS
• Ensure Kubernetes Web UI Is Disabled
• Ensure Legacy Authorization (ABAC) Is Disabled
• Ensure Logging And Cloud Monitoring Is Enabled
• Ensure Node Auto-Repair Is Enabled For GKE Nodes
• Ensure Node Auto-Upgrade Is Enabled For GKE Nodes
• Ensure Only Trusted Container Images Are Used
• Ensure Secure Boot For Shielded GKE Nodes Is Enabled
• Ensure Service Account Tokens Are Only Mounted Where Necessary
• Ensure Shielded GKE Nodes Are Enabled
• Ensure That Alpha Clusters Are Not Used For Production Workloads
• Ensure The CNI In Use Supports Network Policies
• Ensure The GKE Metadata Server Is Enabled
• Ensure The Seccomp Profile Is Set To RuntimeDefault In Pod Definitions
• Ensure Use Of Google-Managed SSL Certificates
• Ensure Use Of VPC-Native Clusters
• Every Non-System Namespace Should Have A Default-Deny NetworkPolicy
• Limit Use Of The Bind, Impersonate And Escalate Permissions
• Manage Kubernetes RBAC Users With Google Groups For GKE
• Minimize Access To Secrets
• Minimize Cluster Access To Read-Only For Container Image Repositories
• Minimize User Access To Container Image Repositories
• Minimize Wildcard Use In Roles And ClusterRoles
• Multi-Replica Deployments Should Have A PodDisruptionBudget
• Mutable Image Tags Should Use imagePullPolicy Always
• Namespaces Should Enforce Pod Security Admission Baseline Or Stricter
• No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users
• No ServiceAccount Should Be Bound To cluster-admin
• No Workloads Should Run In The default Namespace
• Pods Should Be Managed By A Controller
• Pods Should Not Mount HostPath Volumes
• Pods Should Not Share Host Namespaces
• Pods That Do Not Use The API Should Disable Token Automount
• pods/exec Should Not Be Granted To Broad Subjects
• Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens
• Prefer Using Dedicated GCP Service Accounts And Workload Identity
• Prefer Using Secrets As Files Over Secrets As Environment Variables
• Secrets Should Be Encrypted At Rest
• Sensitive Values Should Not Be Passed As Literal Env Vars
• Tenant Namespaces Should Have A ResourceQuota
• The Default Namespace Should Not Be Used