OCI Kubernetes Engine (OKE) Monitoring
Checks Performed
- OCI OKE Ability to Create Pods Should Be Restricted
- OCI OKE Access to Kubernetes Control Plane Should Be Restricted
- OCI OKE Access to Secrets Should Be Restricted
- OCI OKE Anonymous Requests to Kubelet Server Should Be Disabled
- OCI OKE cluster-admin Role Usage Should Be Restricted
- OCI OKE Clusters Should Have Network Policy Support Enabled
- OCI OKE CNI Plugin Should Support Network Policies
- OCI OKE Kubelet Authorization Mode Should Not Be AlwaysAllow
- OCI OKE Kubelet Client Certificates Should Be Auto-Rotated
- OCI OKE Kubelet Configuration File Ownership Should Be root:root
- OCI OKE Kubelet Configuration File Permissions Should Be 644
- OCI OKE Kubelet Read-Only Port Should Be Disabled
- OCI OKE Kubelet Server Certificates Should Be Auto-Rotated
- OCI OKE Kubelet Servers Should Serve Only HTTPS Traffic
- OCI OKE Kubelet Should Authenticate Using SSL/TLS Certificates
- OCI OKE Kubelet Should Be Allowed to Manage IPtables
- OCI OKE Kubelet streamingConnectionIdleTimeout Should Not Be 0
- OCI OKE kubelet-config.json File Ownership Should Be root:root
- OCI OKE kubelet-config.json File Permissions Should Be 644
- OCI OKE Kubernetes API Public Endpoint Should Be Disabled
- OCI OKE Node Pools Should Use Private Nodes
- OCI OKE Roles and ClusterRoles Should Avoid Wildcard Use
- OCI OKE Service Account Token Mounting Should Be Restricted
- OCI OKE Should Capture Security-Relevant Events Without Restriction
- OCI OKE Should Limit Default Service Account Usage
- OCI OKE Should Minimize Admission of Privileged Containers
- OCI OKE Should Minimize Containers Sharing the Host IPC Namespace
- OCI OKE Should Minimize Containers Sharing the Host Network Namespace
- OCI OKE Should Minimize Containers Sharing the Host PID Namespace
- OCI OKE Should Mount Secrets as Files Instead of Environment Variables
- OCI OKE Should Prevent Container Privilege Escalation
- OCI OKE Should Use Dedicated Service Accounts
- OCI OKE Should Use Network Policies to Control Traffic
- OCI OKE Should Use Non-Default Namespaces