Ensure that the admission control policy is not set to AlwaysAdmit
Details Do not allow all requests. Rationale: Setting admission control policy to `AlwaysAdmit` allows all requests and do not filter...
- Home
- Security Hardening
- CIS Kubernetes 1.7.0 Benchmark V1.1.0 L1
CIS Kubernetes 1.7.0 Benchmark V1.1.0 L1
Ensure that the admission control policy is set to AlwaysPullImages
Details Always pull images. Rationale: Setting admission control policy to `AlwaysPullImages` forces every new pod to pull the required images...Ensure that the admission control policy is set to DenyEscalatingExec
Details Deny execution of `exec` and `attach` commands in privileged pods. Rationale: Setting admission control policy to `DenyEscalatingExec` denies `exec`...Ensure that the admission control policy is set to NamespaceLifecycle
Details Reject creating objects in a namespace that is undergoing termination. Rationale: Setting admission control policy to `NamespaceLifecycle` ensures that...Ensure that the admission control policy is set to NodeRestriction
Details Limit the `Node` and `Pod` objects that a kubelet could modify. Rationale: Using the `NodeRestriction` plug-in ensures that the...Ensure that the admission control policy is set to PodSecurityPolicy
Details Reject creating pods that do not match Pod Security Policies. Rationale: A Pod Security Policy is a cluster-level resource...Ensure that the admission control policy is set to SecurityContextDeny
Details Restrict pod level SecurityContext customization. Instead of using a customized SecurityContext for your pods, use a Pod Security Policy...Ensure that the admission control policy is set to ServiceAccount
Details Automate service accounts management. Rationale: When you create a pod, if you do not specify a service account, it...Ensure that the –allow-privileged argument is set to false
Details Do not allow privileged containers. Rationale: The privileged container has all the system capabilities, and it also lifts all...Ensure that the –anonymous-auth argument is set to false
Details Disable anonymous requests to the API server. Rationale: When enabled, requests that are not rejected by other configured authentication...