Kubernetes Kubernetes Misconfig - Security Checks

Checks Performed

• An Admission Policy Engine Should Enforce Workload Policy
• API Server Audit Log Maxage Should Be 30 Or More
• API Server Audit Log Maxbackup Should Be 10 Or More
• API Server Audit Log Maxsize Should Be 100 Or More
• API Server Authorization Mode Should Include Node
• API Server Authorization Mode Should Include RBAC
• API Server Authorization Mode Should Not Be AlwaysAllow
• API Server Encryption Providers Should Be Appropriately Configured
• API Server Pod Specification File Ownership Should Be root:root
• API Server Pod Specification File Permissions Should Be 600 Or More Restrictive
• API Server Request Timeout Should Be Set As Appropriate
• API Server Service Account Key File Should Be Set
• API Server Service Account Lookup Should Be True
• API Server Should Disable Anonymous Authentication
• API Server Should Disable Profiling
• API Server Should Disable Service Account Extend Token Expiration
• API Server Should Enable The AlwaysPullImages Admission Plugin
• API Server Should Enable The DenyServiceExternalIPs Admission Plugin
• API Server Should Enable The EventRateLimit Admission Plugin
• API Server Should Enable The NamespaceLifecycle Admission Plugin
• API Server Should Enable The NodeRestriction Admission Plugin
• API Server Should Enable The ServiceAccount Admission Plugin
• API Server Should Not Enable The AlwaysAdmit Admission Plugin
• API Server Should Set An Audit Log Path
• API Server Should Set Client CA File
• API Server Should Set Encryption Provider Config
• API Server Should Set Etcd CA File
• API Server Should Set Etcd Client Certificate And Key
• API Server Should Set Kubelet Certificate Authority
• API Server Should Set Kubelet Client Certificate And Key
• API Server Should Set TLS Certificate And Private Key
• API Server Should Use Strong Cryptographic Ciphers
• API Server Token Auth File Should Not Be Set
• Apply SecurityContext To Your Pods And Containers
• Audit Logging Should Be Enabled And Shipped Off-Cluster
• Avoid Use Of The System:Masters Group
• Bootstrap Token Authentication Should Not Be Used For Users
• Certificate Authorities File Permissions Set To 644 Or More Restrictive
• Client Certificate Authentication Should Not Be Used For Users
• Client Certificate Authorities File Ownership Set To root:root
• Configure Image Provenance Using ImagePolicyWebhook Admission Controller
• Consider External Secret Storage
• Container Images Should Not Use The latest Or Untagged Tag
• Container Network Interface File Ownership Should Be root:root
• Container Network Interface File Permissions Should Be 600 Or More Restrictive
• Containers Should Define Liveness And Readiness Probes
• Containers Should Disallow Privilege Escalation
• Containers Should Drop All Linux Capabilities
• Containers Should Not Run In Privileged Mode
• Containers Should Run As Non-Root
• Containers Should Set CPU And Memory Limits
• Containers Should Set CPU And Memory Requests
• Containers Should Use A Read-Only Root Filesystem
• Controller Manager Bind Address Should Be 127.0.0.1
• Controller Manager Kubeconfig File Ownership Should Be root:root
• Controller Manager Kubeconfig File Permissions Should Be 600 Or More Restrictive
• Controller Manager Pod Specification File Ownership Should Be root:root
• Controller Manager Pod Specification File Permissions Should Be 600 Or More Restrictive
• Controller Manager Should Disable Profiling
• Controller Manager Should Enable RotateKubeletServerCertificate
• Controller Manager Should Set Root CA File
• Controller Manager Should Set Service Account Private Key File
• Controller Manager Should Use Individual Service Account Credentials
• Controller Manager Terminated Pod GC Threshold Should Be Set
• Create Administrative Boundaries Between Resources Using Namespaces
• Default Administrative Credential File Ownership Should Be root:root
• Default Administrative Credential File Permissions Should Be 600
• Ensure A Unique Certificate Authority Is Used For Etcd
• Ensure All Namespaces Have NetworkPolicies Defined
• Ensure Anonymous Auth Argument Is False
• Ensure Bind Address Argument Is 127.0.0.1
• Ensure Default Service Accounts Are Not Actively Used
• Ensure DenyServiceExternalIPs Is Not Set
• Ensure Etcd Auto-TLS Argument Is Not Set To True
• Ensure Etcd Cert-File And Key-File Arguments Are Set
• Ensure Etcd Certfile And Etcd Keyfile Arguments Are Appropriate
• Ensure Etcd Client-Cert-Auth Argument Is Set To True
• Ensure Etcd Peer-Auto-TLS Argument Is Not Set To True
• Ensure Etcd Peer-Cert-File And Peer-Key-File Arguments Are Set
• Ensure Etcd Peer-Client-Cert-Auth Argument Is Set To True
• Ensure Kubelet Certificate Authority Argument Is Appropriate
• Ensure Profiling Argument Is Disabled
• Ensure Request Timeout Argument Is Appropriate
• Ensure Root CA File Argument Is Appropriate
• Ensure Rotate Certificates Argument Is Enabled
• Ensure Service Account key File Argument Is Appropriate
• Ensure Service Account Lookup Argument Is Set True
• Ensure Service Account Tokens Are Only Mounted Where Necessary
• Ensure That A Minimal Audit Policy Is Created
• Ensure That The Audit Policy Covers Key Security Concerns
• Ensure The Cluster Has At Least One Active Policy Control Mechanism
• Ensure The Cluster-Admin Role Is Only Used Where Required
• Ensure The CNI In Use Supports NetworkPolicies
• Ensure The Seccomp Profile Is Set To docker/default In Pod Definitions
• Etcd Data Directory Ownership Should Be etcd:etcd
• Etcd Data Directory Permissions Should Be 700 Or More Restrictive
• Etcd Pod Specification File Ownership Should Be root:root
• Etcd Pod Specification File Permissions Should Be 600 Or More Restrictive
• Every Non-System Namespace Should Have A Default-Deny NetworkPolicy
• Kube-Proxy Metrics Service Bound To Localhost
• Kubelet Anonymous Auth Argument Set To False
• Kubelet Authorization Mode Not Set To AlwaysAllow
• Kubelet Client CA File Argument Set As Appropriate
• Kubelet config.yaml File Ownership Set To root:root
• Kubelet config.yaml File Permissions Set To 600 Or More Restrictive
• Kubelet Event Record QPS Set To Ensure Appropriate Event Capture
• Kubelet Hostname Override Argument Not Set
• Kubelet Kubeconfig File Ownership Set To root:root
• Kubelet Kubeconfig File Permissions Set To 600 Or More Restrictive
• Kubelet Make Iptables Util Chains Argument Set To True
• Kubelet Only Makes Use Of Strong Cryptographic Ciphers
• Kubelet Pod PIDs Limit Is Set
• Kubelet Read Only Port Argument Set To 0
• Kubelet Rotate Certificates Argument Not Set To False
• Kubelet RotateKubeletServerCertificate Argument Set To True
• Kubelet Seccomp Default Parameter Set To True
• Kubelet Service File Ownership Set To root:root
• Kubelet Service File Permissions Set To 600 Or More Restrictive
• Kubelet Streaming Connection Idle Timeout Not Set To 0
• Kubelet TLS Cert File And Private Key File Arguments Set As Appropriate
• Kubernetes PKI Certificate File Permissions Should Be 644 Or More Restrictive
• Kubernetes PKI Directory And File Ownership Should Be root:root
• Kubernetes PKI Key File Permissions Should Be 600
• Limit Use Of The Bind, Impersonate And Escalate Permissions
• Minimize Access To Create Persistent Volumes
• Minimize Access To Create Pods
• Minimize Access To Secrets
• Minimize Access To Service Account Token Creation
• Minimize Access To The Approval Sub-Resource Of CertificateSigningRequests
• Minimize Access To The Proxy Sub-Resource Of Nodes
• Minimize Access To Webhook Configuration Objects
• Minimize The Admission Of Containers Sharing The Host IPC Namespace
• Minimize The Admission Of Containers Sharing The Host Network Namespace
• Minimize The Admission Of Containers Sharing The Host Process ID Namespace
• Minimize The Admission Of Containers Which Use HostPorts
• Minimize The Admission Of Containers With allowPrivilegeEscalation
• Minimize The Admission Of Containers With Capabilities Assigned
• Minimize The Admission Of Containers With The NET_RAW Capability
• Minimize The Admission Of HostPath Volumes
• Minimize The Admission Of Privileged Containers
• Minimize The Admission Of Root Containers
• Minimize The Admission Of Windows HostProcess Containers
• Minimize Wildcard Use In Roles And ClusterRoles
• Multi-Replica Deployments Should Have A PodDisruptionBudget
• Mutable Image Tags Should Use imagePullPolicy Always
• Namespaces Should Enforce Pod Security Admission Baseline Or Stricter
• No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users
• No ServiceAccount Should Be Bound To cluster-admin
• No Workloads Should Run In The default Namespace
• Pods Should Be Managed By A Controller
• Pods Should Not Mount HostPath Volumes
• Pods Should Not Share Host Namespaces
• Pods That Do Not Use The API Should Disable Token Automount
• pods/exec Should Not Be Granted To Broad Subjects
• Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens
• Prefer Using Secrets As Files Over Secrets As Environment Variables
• Proxy Kubeconfig File Ownership Set To root:root
• Proxy Kubeconfig File Permissions Set To 600 Or More Restrictive
• Scheduler Bind Address Should Be 127.0.0.1
• Scheduler Kubeconfig File Ownership Should Be root:root
• Scheduler Kubeconfig File Permissions Should Be 600 Or More Restrictive
• Scheduler Pod Specification File Ownership Should Be root:root
• Scheduler Pod Specification File Permissions Should Be 600 Or More Restrictive
• Scheduler Should Disable Profiling
• Secrets Should Be Encrypted At Rest
• Sensitive Values Should Not Be Passed As Literal Env Vars
• Service Account Token Authentication Should Not Be Used For Users
• Tenant Namespaces Should Have A ResourceQuota
• The Default Namespace Should Not Be Used