Apply Security Context to Your Pods and Containers
Details Apply Security Context to Your Pods and Containers Rationale: A security context defines the operating system security settings (uid,...
- Home
- Security Hardening
- CIS Kubernetes V1.20 Benchmark V1.0.0 L2 Master
CIS Kubernetes V1.20 Benchmark V1.0.0 L2 Master
CIS_Kubernetes_v1.20_v1.0.0_Level_2_Master.audit from CIS Kubernetes v1.20 Benchmark v1.0.0
Details NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance. Supportive Information...Configure Image Provenance using ImagePolicyWebhook admission controller
Details Configure Image Provenance for your deployment. Rationale: Kubernetes supports plugging in provenance rules to accept or reject the images...Consider external secret storage
Details Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you...Ensure that all Namespaces have Network Policies defined
Details Use network policies to isolate traffic in your cluster network. Rationale: Running different applications on the same Kubernetes cluster...Ensure that a unique Certificate Authority is used for etcd
Details Use a different certificate authority for etcd from the one used for Kubernetes. Rationale: etcd is a highly available...Ensure that the audit policy covers key security concerns
Details Ensure that the audit policy created for the cluster covers key security concerns. Rationale: Security audit logs should cover...Ensure that the RotateKubeletServerCertificate argument is set to true
Details Enable kubelet server certificate rotation on controller-manager. Rationale: RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after...Ensure that the seccomp profile is set to docker/default in your pod definitions
Details Enable docker/default seccomp profile in your pod definitions. Rationale: Seccomp (secure computing mode) is used to restrict the set...Minimize the admission of containers with capabilities assigned
Details Do not generally permit containers with capabilities Rationale: Containers run with a default set of capabilities as assigned by...