Apply Security Context to Your Pods and Containers
Details Apply Security Context to Your Pods and Containers Rationale: A security context defines the operating system security settings (uid,...
- Home
- Security Hardening
- CIS Kubernetes 1.11 Benchmark V1.3.0 L2
CIS Kubernetes 1.11 Benchmark V1.3.0 L2
Configure Image Provenance using ImagePolicyWebhook admission controller
Details Configure Image Provenance for your deployment. Rationale: Kubernetes supports plugging in provenance rules to accept or reject the images...Configure Network policies as appropriate
Details Configure Network policies as appropriate. Rationale: The Network Policy API is now stable. Network policy, implemented through a network...Create network segmentation using Network Policies
Details Use network policies to isolate your cluster network. Rationale: Running different applications on the same Kubernetes cluster creates a...Do not admit containers with dangerous capabilities
Details Do not generally permit containers with potentially dangerous capabilities. Rationale: Containers run with a default set of capabilities as...Do not admit root containers
Details Do not generally permit containers to be run as the root user. Rationale: Containers may run as any Linux...Ensure that a unique Certificate Authority is used for etcd
Details Use a different certificate authority for etcd from the one used for Kubernetes. Rationale: etcd is a highly available...Ensure that the seccomp profile is set to docker/default in your pod definitions
Details Enable ‘docker/default’ seccomp profile in your pod definitions. Rationale: Seccomp (secure computing mode) is used to restrict the set...Place compensating controls in the form of PSP and RBAC for privileged containers usage – clusterrolebinding
Details Use Pod Security Policies (PSP) and RBAC authorization to mitigate the risk arising from using privileged containers. Rationale: A...Place compensating controls in the form of PSP and RBAC for privileged containers usage – psp
Details Use Pod Security Policies (PSP) and RBAC authorization to mitigate the risk arising from using privileged containers. Rationale: A...