Ensure that the admission control policy is not set to AlwaysAdmit
Details Do not allow all requests. Rationale: Setting admission control policy to ‘AlwaysAdmit’ allows all requests and do not filter...
- Home
- Security Hardening
- CIS Kubernetes 1.8 Benchmark V1.2.0 L1
CIS Kubernetes 1.8 Benchmark V1.2.0 L1
Ensure that the admission control policy is set to AlwaysPullImages
Details Always pull images. Rationale: Setting admission control policy to ‘AlwaysPullImages’ forces every new pod to pull the required images...Ensure that the admission control policy is set to DenyEscalatingExec
Details Deny execution of ‘exec’ and ‘attach’ commands in privileged pods. Rationale: Setting admission control policy to ‘DenyEscalatingExec’ denies ‘exec’...Ensure that the admission control policy is set to EventRateLimit
Details Limit the rate at which the API server accepts requests. Rationale: Using ‘EventRateLimit’ admission control enforces a limit on...Ensure that the admission control policy is set to NamespaceLifecycle
Details Reject creating objects in a namespace that is undergoing termination. Rationale: Setting admission control policy to ‘NamespaceLifecycle’ ensures that...Ensure that the admission control policy is set to NodeRestriction
Details Limit the ‘Node’ and ‘Pod’ objects that a kubelet could modify. Rationale: Using the ‘NodeRestriction’ plug-in ensures that the...Ensure that the admission control policy is set to PodSecurityPolicy
Details Reject creating pods that do not match Pod Security Policies. Rationale: A Pod Security Policy is a cluster-level resource...Ensure that the admission control policy is set to SecurityContextDeny
Details Restrict pod level SecurityContext customization. Instead of using a customized SecurityContext for your pods, use a Pod Security Policy...Ensure that the admission control policy is set to ServiceAccount
Details Automate service accounts management. Rationale: When you create a pod, if you do not specify a service account, it...Ensure that the AdvancedAuditing argument is not set to false – AdvancedAuditing
Details Do not disable advanced auditing. Rationale: ‘AdvancedAuditing’ enables a much more general API auditing pipeline, which includes support for...