More Info:
Every Kubernetes cluster should have at least one policy control mechanism in place to enforce the other requirements in this section. This could be the in-built Pod Security Admission controller, or a third party policy control system.Risk Level
MediumAddress
SecurityCompliance Standards
- CIS Kubernetes
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
Pod Security Admission is enabled by default on all clusters using Kubernetes 1.23 orhigher. To assess what controls, if any, are in place using this mechanism, review thenamespaces in the cluster to see if the required labels have been appliedkubectl get namespaces -o yamlTo confirm if any external policy control system is in use, review the cluster for thepresence of validatingadmissionwebhook and mutatingadmissionwebhook objects.kubectl get validatingwebhookconfigurationskubectl get mutatingwebhookconfigurations