Kubernetes Misconfig - Security Checks

Checks Performed

• An Admission Policy Engine Should Enforce Workload Policy
• API Server Audit Log Maxage Should Be 30 Or More
• API Server Audit Log Maxbackup Should Be 10 Or More
• API Server Audit Log Maxsize Should Be 100 Or More
• API Server Authorization Mode Should Include Node
• API Server Authorization Mode Should Include RBAC
• API Server Authorization Mode Should Not Be AlwaysAllow
• API Server Encryption Providers Should Be Appropriately Configured
• API Server Pod Specification File Ownership Should Be root:root
• API Server Pod Specification File Permissions Should Be 600 Or More Restrictive
• API Server Request Timeout Should Be Set As Appropriate
• API Server Service Account Key File Should Be Set
• API Server Service Account Lookup Should Be True
• API Server Should Disable Anonymous Authentication
• API Server Should Disable Profiling
• API Server Should Disable Service Account Extend Token Expiration
• API Server Should Enable The AlwaysPullImages Admission Plugin
• API Server Should Enable The DenyServiceExternalIPs Admission Plugin
• API Server Should Enable The EventRateLimit Admission Plugin
• API Server Should Enable The NamespaceLifecycle Admission Plugin
• API Server Should Enable The NodeRestriction Admission Plugin
• API Server Should Enable The ServiceAccount Admission Plugin
• API Server Should Not Enable The AlwaysAdmit Admission Plugin
• API Server Should Set An Audit Log Path
• API Server Should Set Client CA File
• API Server Should Set Encryption Provider Config
• API Server Should Set Etcd CA File
• API Server Should Set Etcd Client Certificate And Key
• API Server Should Set Kubelet Certificate Authority
• API Server Should Set Kubelet Client Certificate And Key
• API Server Should Set TLS Certificate And Private Key
• API Server Should Use Strong Cryptographic Ciphers
• API Server Token Auth File Should Not Be Set
• Apply Security Context For Pods And Containers
• Apply SecurityContext To Your Pods And Containers
• Audit Logging Should Be Enabled And Shipped Off-Cluster
• Avoid Use Of System Masters Group
• Avoid Use Of The System:Masters Group
• Bootstrap Token Authentication Should Not Be Used For Users
• Certificate Authorities File Permissions Set To 644 Or More Restrictive
• Client Certificate Authentication Should Not Be Used For Users
• Client Certificate Authentication Should Not Be Used For Users
• Client Certificate Authorities File Ownership Set To root:root
• Configure Image Provenance ImagePolicyWebhook Admission Controller
• Configure Image Provenance Using ImagePolicyWebhook Admission Controller
• Consider External Secret Storage
• Consider External Secret Storage
• Container Images Should Not Use The latest Or Untagged Tag
• Container Network Interface File Ownership Should Be root:root
• Container Network Interface File Permissions Should Be 600 Or More Restrictive
• Containers Should Define Liveness And Readiness Probes
• Containers Should Disallow Privilege Escalation
• Containers Should Drop All Linux Capabilities
• Containers Should Not Run In Privileged Mode
• Containers Should Run As Non-Root
• Containers Should Set CPU And Memory Limits
• Containers Should Set CPU And Memory Requests
• Containers Should Use A Read-Only Root Filesystem
• Controller Manager Bind Address Should Be 127.0.0.1
• Controller Manager Kubeconfig File Ownership Should Be root:root
• Controller Manager Kubeconfig File Permissions Should Be 600 Or More Restrictive
• Controller Manager Pod Specification File Ownership Should Be root:root
• Controller Manager Pod Specification File Permissions Should Be 600 Or More Restrictive
• Controller Manager Should Disable Profiling
• Controller Manager Should Enable RotateKubeletServerCertificate
• Controller Manager Should Set Root CA File
• Controller Manager Should Set Service Account Private Key File
• Controller Manager Should Use Individual Service Account Credentials
• Controller Manager Terminated Pod GC Threshold Should Be Set
• Create Administrative Boundaries Between Resources Namespaces
• Create Administrative Boundaries Between Resources Using Namespaces
• Default Administrative Credential File Ownership Should Be root:root
• Default Administrative Credential File Permissions Should Be 600
• Ensure A Unique Certificate Authority Is Used For Etcd
• Ensure Admin Configuration File Ownership Is Root
• Ensure Admin Configuration File Permissions Are 600
• Ensure Admission Control Plugin AlwaysAdmit Is Not Set
• Ensure Admission Control Plugin AlwaysPullImages Is Set
• Ensure Admission Control Plugin EventRateLimit Is Set
• Ensure Admission Control Plugin NamespaceLifecycle Is Set
• Ensure Admission Control Plugin NodeRestriction Is Set
• Ensure Admission Control Plugin SecurityContextDeny Is Set If PodSecurityPolicy Is Not Used
• Ensure Admission Control Plugin ServiceAccount Is Set
• Ensure All Namespaces Have NetworkPolicies Defined
• Ensure All Namespaces Network Policies Defined
• Ensure Anonymous Auth Argument Is Disabled
• Ensure Anonymous Auth Argument Is False
• Ensure API Server Only Uses Strong Cryptographic Ciphers
• Ensure API Server Pod Specification File Ownership Is Root
• Ensure API Server Pod Specification Permissions Are Restrictive
• Ensure Audit Log Maxage Argument Is Appropriate
• Ensure Audit Log Maxbackup Argument Is Appropriate
• Ensure Audit Log Path Argument Is Set
• Ensure Audit Policy Covers Key Security Concerns
• Ensure Audit-Log-Maxsize Argument Is Appropriate
• Ensure Authorization Mode Argument Includes Node
• Ensure Authorization Mode Argument Includes RBAC
• Ensure Authorization Mode Argument Is Not AlwaysAllow
• Ensure Authorization Mode Argument Is Not AlwaysAllow
• Ensure Auto Tls Argument Is Disabled
• Ensure Bind Address Argument Is 127.0.0.1
• Ensure Bind Address Argument Is 127.0.0.1
• Ensure Cert File And Key File Arguments Are Appropriate
• Ensure Certificate Authorities File Permissions Are Restrictive
• Ensure Client Ca File Argument Is Appropriate
• Ensure Client Ca File Argument Is Appropriate
• Ensure Client Cert Auth Argument Is Enabled
• Ensure Client Certificate Authorities File Ownership Is Root
• Ensure Cluster Active Policy Control Mechanisms In Place
• Ensure Cluster Admin Role Is Only Used Where Required
• Ensure CNI Supports Network Policies
• Ensure Container Network Interface File Ownership Is Root
• Ensure Container Network Interface File Permissions Are Restrictive
• Ensure Controller Manager Configuration File Ownership Is Root
• Ensure Controller Manager Configuration File Permissions Are Restrictive
• Ensure Controller Manager Pod Specification File Ownership Is Root
• Ensure Controller Manager Pod Specification File Permissions Are Restrictive
• Ensure Controller Profiling Argument Is False
• Ensure Default Service Accounts Are Not Actively Used
• Ensure Default Service Accounts Are Not Actively Used.
• Ensure DenyServiceExternalIPs Is Not Set
• Ensure Encryption Provider Config Argument Is Appropriate
• Ensure Encryption Providers Are Appropriately Configured
• Ensure Etcd Auto-TLS Argument Is Not Set To True
• Ensure Etcd Cafile Argument Is Appropriate
• Ensure Etcd Cert-File And Key-File Arguments Are Set
• Ensure Etcd Certfile And Etcd Keyfile Arguments Are Appropriate
• Ensure Etcd Client-Cert-Auth Argument Is Set To True
• Ensure Etcd Data Directory Ownership Is Etcd
• Ensure Etcd Data Directory Permissions Are Restrictive
• Ensure Etcd Peer-Auto-TLS Argument Is Not Set To True
• Ensure Etcd Peer-Cert-File And Peer-Key-File Arguments Are Set
• Ensure Etcd Peer-Client-Cert-Auth Argument Is Set To True
• Ensure Etcd Pod Specification File Ownership Is Root
• Ensure Etcd Pod Specification File Permissions Are Restrictive
• Ensure EventRecordQPS Argument Is Level Which Ensures Appropriate Event Capture
• Ensure Hostname Override Argument Is Disabled
• Ensure Kubeconfig Kubelet Conf File Ownership Is Root
• Ensure Kubeconfig Kubelet Conf File Permissions Are Restrictive
• Ensure Kubelet Certificate Authority Argument Is Appropriate
• Ensure Kubelet Client Certificate And Key Arguments Are Appropriate
• Ensure Kubelet Config File Ownership Is Root
• Ensure Kubelet Config File Permissions Are Restrictive
• Ensure Kubelet Https Argument Is Enabled
• Ensure Kubelet Only Makes Use Strong Cryptographic Ciphers
• Ensure Kubelet Service File Ownership Is Root
• Ensure Kubelet Service File Permissions Are Restrictive
• Ensure Kubernetes PKI Certificate File Permissions Are Restrictive
• Ensure Kubernetes PKI Directory And File Ownership Is Root
• Ensure Kubernetes PKI Key File Permissions Are 600
• Ensure Make Iptables Util Chains Argument Is Enabled
• Ensure Minimal Audit Policy Is Created
• Ensure Peer Auto Tls Argument Is Disabled
• Ensure Peer Cert File And Peer Key File Arguments Are Appropriate
• Ensure Peer Client Cert Auth Argument Is Enabled
• Ensure Profiling Argument Is Disabled
• Ensure Profiling Argument Is Set False
• Ensure Protect Kernel Defaults Argument Is Enabled
• Ensure Request Timeout Argument Is Appropriate
• Ensure Root CA File Argument Is Appropriate
• Ensure Rotate Certificates Argument Is Enabled
• Ensure Rotate Kubelet Server Certificate Argument Is Enabled
• Ensure Scheduler Configuration File Ownership Is Root
• Ensure Scheduler Configuration File Permissions Are Restrictive
• Ensure Scheduler Pod Specification File Ownership Is Root
• Ensure Scheduler Pod Specification File Permissions Are Restrictive
• Ensure Seccomp Profile Is docker Default Your Pod Definitions
• Ensure Secure Port Argument Is Not Set 0
• Ensure Service Account key File Argument Is Appropriate
• Ensure Service Account Lookup Argument Is Set True
• Ensure Service Account Private Key File Argument Is Appropriate
• Ensure Service Account Tokens Are Only Mounted Where Necessary
• Ensure Service Account Tokens Are Only Mounted Where Necessary
• Ensure Streaming Connection Idle Timeout Argument Is Not Set 0
• Ensure Terminated Pod GC Threshold Argument Appropriate
• Ensure That A Minimal Audit Policy Is Created
• Ensure That The Audit Policy Covers Key Security Concerns
• Ensure The Cluster Has At Least One Active Policy Control Mechanism
• Ensure The Cluster-Admin Role Is Only Used Where Required
• Ensure The CNI In Use Supports NetworkPolicies
• Ensure The Seccomp Profile Is Set To docker/default In Pod Definitions
• Ensure Tls Cert File And Tls Private Key File Arguments Are Appropriate
• Ensure Tls Cert File And Tls Private Key File Arguments Are Appropriate
• Ensure Token Auth File Parameter Is Not Set
• Ensure Unique Certificate Authority Is Used For Etcd
• Ensure Use Service Account Credentials Argument Is Enabled
• Etcd Data Directory Ownership Should Be etcd:etcd
• Etcd Data Directory Permissions Should Be 700 Or More Restrictive
• Etcd Pod Specification File Ownership Should Be root:root
• Etcd Pod Specification File Permissions Should Be 600 Or More Restrictive
• Every Non-System Namespace Should Have A Default-Deny NetworkPolicy
• If Proxy Kubeconfig File Exists Ensure Ownership Is Root
• If Proxy Kubeconfig File Exists Ensure Permissions Are Restrictive
• Kube-Proxy Metrics Service Bound To Localhost
• Kubelet Anonymous Auth Argument Set To False
• Kubelet Authorization Mode Not Set To AlwaysAllow
• Kubelet Client CA File Argument Set As Appropriate
• Kubelet config.yaml File Ownership Set To root:root
• Kubelet config.yaml File Permissions Set To 600 Or More Restrictive
• Kubelet Event Record QPS Set To Ensure Appropriate Event Capture
• Kubelet Hostname Override Argument Not Set
• Kubelet Kubeconfig File Ownership Set To root:root
• Kubelet Kubeconfig File Permissions Set To 600 Or More Restrictive
• Kubelet Make Iptables Util Chains Argument Set To True
• Kubelet Only Makes Use Of Strong Cryptographic Ciphers
• Kubelet Pod PIDs Limit Is Set
• Kubelet Read Only Port Argument Set To 0
• Kubelet Rotate Certificates Argument Not Set To False
• Kubelet RotateKubeletServerCertificate Argument Set To True
• Kubelet Seccomp Default Parameter Set To True
• Kubelet Service File Ownership Set To root:root
• Kubelet Service File Permissions Set To 600 Or More Restrictive
• Kubelet Streaming Connection Idle Timeout Not Set To 0
• Kubelet TLS Cert File And Private Key File Arguments Set As Appropriate
• Kubernetes PKI Certificate File Permissions Should Be 644 Or More Restrictive
• Kubernetes PKI Directory And File Ownership Should Be root:root
• Kubernetes PKI Key File Permissions Should Be 600
• Limit Use Of Bind Impersonate And Escalate Permissions Kubernetes Cluster
• Limit Use Of The Bind, Impersonate And Escalate Permissions
• Minimize Access To Create Persistent Volumes
• Minimize Access To Create Pods
• Minimize Access To Create Pods
• Minimize Access To Secrets
• Minimize Access To Secrets
• Minimize Access To Service Account Token Creation
• Minimize Access To The Approval Sub-Resource Of CertificateSigningRequests
• Minimize Access To The Proxy Sub-Resource Of Nodes
• Minimize Access To Webhook Configuration Objects
• Minimize Admission Containers AllowPrivilegeEscalation
• Minimize Admission Containers Wishing Host IPC Namespace
• Minimize Admission Containers Wishing Host Network Namespace
• Minimize Admission Containers Wishing Host Process ID Namespace
• Minimize Admission Of Containers Added Capabilities
• Minimize Admission Of Containers Capabilities Assigned
• Minimize Admission Of Containers HostPorts
• Minimize Admission Of Containers With NET_RAW Capability
• Minimize Admission Of HostPath Volumes
• Minimize Admission Of Privileged Containers
• Minimize Admission Of Root Containers
• Minimize Admission Of Windows HostProcess Containers
• Minimize The Admission Of Containers Sharing The Host IPC Namespace
• Minimize The Admission Of Containers Sharing The Host Network Namespace
• Minimize The Admission Of Containers Sharing The Host Process ID Namespace
• Minimize The Admission Of Containers Which Use HostPorts
• Minimize The Admission Of Containers With allowPrivilegeEscalation
• Minimize The Admission Of Containers With Capabilities Assigned
• Minimize The Admission Of Containers With The NET_RAW Capability
• Minimize The Admission Of HostPath Volumes
• Minimize The Admission Of Privileged Containers
• Minimize The Admission Of Root Containers
• Minimize The Admission Of Windows HostProcess Containers
• Minimize Wildcard Use In Roles And ClusterRoles
• Minimize Wildcard Use Roles And ClusterRoles
• Multi-Replica Deployments Should Have A PodDisruptionBudget
• Mutable Image Tags Should Use imagePullPolicy Always
• Namespaces Should Enforce Pod Security Admission Baseline Or Stricter
• No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users
• No ServiceAccount Should Be Bound To cluster-admin
• No Workloads Should Run In The default Namespace
• Pods Should Be Managed By A Controller
• Pods Should Not Mount HostPath Volumes
• Pods Should Not Share Host Namespaces
• Pods That Do Not Use The API Should Disable Token Automount
• pods/exec Should Not Be Granted To Broad Subjects
• Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens
• Prefer Secrets Files Over Secrets Environment Variables
• Prefer Using Secrets As Files Over Secrets As Environment Variables
• Proxy Kubeconfig File Ownership Set To root:root
• Proxy Kubeconfig File Permissions Set To 600 Or More Restrictive
• Scheduler Bind Address Should Be 127.0.0.1
• Scheduler Kubeconfig File Ownership Should Be root:root
• Scheduler Kubeconfig File Permissions Should Be 600 Or More Restrictive
• Scheduler Pod Specification File Ownership Should Be root:root
• Scheduler Pod Specification File Permissions Should Be 600 Or More Restrictive
• Scheduler Should Disable Profiling
• Secrets Should Be Encrypted At Rest
• Sensitive Values Should Not Be Passed As Literal Env Vars
• Service Account Token Authentication Should Not Be Used For Users
• Tenant Namespaces Should Have A ResourceQuota
• The Default Namespace Should Not Be Used
• The Default Namespace Should Not Used
• Verify Read Only Port Argument Is Set 0
• Verify RotateKubeletServerCertificate Argument Is Enabled