Ensure that the admission control policy is not set to AlwaysAdmit Details Do not allow all requests. Rationale: Setting admission control policy to `AlwaysAdmit` allows all requests and do not filter...
Ensure that the admission control policy is set to AlwaysPullImages Details Always pull images. Rationale: Setting admission control policy to `AlwaysPullImages` forces every new pod to pull the required images...
Ensure that the admission control policy is set to DenyEscalatingExec Details Deny execution of `exec` and `attach` commands in privileged pods. Rationale: Setting admission control policy to `DenyEscalatingExec` denies `exec`...
Ensure that the admission control policy is set to NamespaceLifecycle Details Reject creating objects in a namespace that is undergoing termination. Rationale: Setting admission control policy to `NamespaceLifecycle` ensures that...
Ensure that the admission control policy is set to NodeRestriction Details Limit the `Node` and `Pod` objects that a kubelet could modify. Rationale: Using the `NodeRestriction` plug-in ensures that the...
Ensure that the admission control policy is set to PodSecurityPolicy Details Reject creating pods that do not match Pod Security Policies. Rationale: A Pod Security Policy is a cluster-level resource...
Ensure that the admission control policy is set to SecurityContextDeny Details Restrict pod level SecurityContext customization. Instead of using a customized SecurityContext for your pods, use a Pod Security Policy...
Ensure that the admission control policy is set to ServiceAccount Details Automate service accounts management. Rationale: When you create a pod, if you do not specify a service account, it...
Ensure that the –allow-privileged argument is set to false Details Do not allow privileged containers. Rationale: The privileged container has all the system capabilities, and it also lifts all...
Ensure that the –anonymous-auth argument is set to false Details Disable anonymous requests to the API server. Rationale: When enabled, requests that are not rejected by other configured authentication...