Ensure that the –address argument is set to 127.0.0.1 Details Do not bind the scheduler service to non-loopback insecure addresses. Rationale: The Scheduler API service which runs on port...
Ensure that the admission control plugin AlwaysAdmit is not set Details Do not allow all requests. Rationale: Setting admission control plugin AlwaysAdmit allows all requests and do not filter any...
Ensure that the admission control plugin AlwaysPullImages is set Details Always pull images. Rationale: Setting admission control policy to AlwaysPullImages forces every new pod to pull the required images...
Ensure that the admission control plugin DenyEscalatingExec is set Details Deny execution of exec and attach commands in privileged pods. Rationale: Setting admission control policy to DenyEscalatingExec denies exec...
Ensure that the admission control plugin EventRateLimit is set Details Limit the rate at which the API server accepts requests. Rationale: Using EventRateLimit admission control enforces a limit on...
Ensure that the admission control plugin NamespaceLifecycle is set Details Reject creating objects in a namespace that is undergoing termination. Rationale: Setting admission control policy to NamespaceLifecycle ensures that...
Ensure that the admission control plugin NodeRestriction is set Details Limit the Node and Pod objects that a kubelet could modify. Rationale: Using the NodeRestriction plug-in ensures that the...
Ensure that the admission control plugin PodSecurityPolicy is set Details Reject creating pods that do not match Pod Security Policies. Rationale: A Pod Security Policy is a cluster-level resource...
Ensure that the admission control plugin SecurityContextDeny is set Details Restrict pod level SecurityContext customization. Instead of using a customized SecurityContext for your pods, use a Pod Security Policy...
Ensure that the admission control plugin ServiceAccount is set Details Automate service accounts management. Rationale: When you create a pod, if you do not specify a service account, it...