CNTR-K8-000460 – Kubernetes DynamicKubeletConfig must not be enabled – manifest
Details Kubernetes allows a user to configure kubelets with dynamic configurations. When dynamic configuration is used, the kubelet will watch...
- Home
- Security Hardening
- DISA STIG Kubernetes V1R4
DISA STIG Kubernetes V1R4
CNTR-K8-000320 – The Kubernetes API server must have the insecure port flag disabled.
Details By default, the API server will listen on two ports. One port is the secure port and the other...CNTR-K8-000470 – The Kubernetes API server must have Alpha APIs disabled.
Details Kubernetes allows alpha API calls within the API server. The alpha features are disabled by default since they are...CNTR-K8-000330 – The Kubernetes Kubelet must have the read-only port flag disabled.
Details Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no...CNTR-K8-000600 – The Kubernetes API Server must have an audit policy set.
Details When Kubernetes is started, components and user services are started. For auditing startup events, and events for components and...CNTR-K8-000340 – The Kubernetes API server must have the insecure bind address not set.
Details By default, the API server will listen on two ports and addresses. One address is the secure address and...CNTR-K8-000350 – The Kubernetes API server must have the secure port set.
Details By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests...CNTR-K8-000360 – The Kubernetes API server must have anonymous authentication disabled.
Details The Kubernetes API Server controls Kubernetes via an API interface. A user who has access to the API essentially...CNTR-K8-000860 – The Kubernetes manifests must be owned by root.
Details The manifest files contain the runtime configuration of the API server, proxy, scheduler, controller, and etcd. If an attacker...CNTR-K8-000880 – The Kubernetes kubelet configuration file must be owned by root.
Details The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to...