Vulnerabilities
Misconfiguration
Runtime Security
Compliance
Compliance > Kubernetes

Apply Security Context to Your Pods and Containers

Audit log aging

Audit log path is configure

Audit policy is configure (Manual)

AWS CIS Foundations V1.2 1.2

AWS CIS Foundations V1.4 1.4

Check encryption provider

Check that encryption resource has been set

CIS ACK 1.0

CIS AKS 1.0

CIS EKS 1.0.1

CIS EKS 1.1.0

CIS EKS Stig Kubernetes V1r6

CIS GKE 1.0

CIS GKE 1.2.0

CIS Redhat 0.7

CIS Redhat 1.0

CIS 1.20

CIS 1.23

CIS 1.24

CIS 1.25

CIS 1.5

CIS 1.6

CIS 1.6 K3s

CIS Docker Community Edition Benchmark V1.1.0 1.1.0

CIS Kubernetes Benchmarks V1.23 1.23

Client certificate authentication should not be used for users (Manual)

Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)

Consider external secret storage (Manual)

Control plan disable insecure port (Manual)

Create administrative boundaries between resources using namespaces (Manual)

disable-unused-credentials

disable-unused-credentials-45-days

enable-access-analyzer

enable-all-regions

enable-object-read-logging

enable-object-write-logging

Encrypt etcd communication

enforce-root-hardware-mfa

enforce-root-mfa

enforce-root-mfa

enforce-user-mfa

Ensure a user for the container has been created

Ensure Content trust for Docker is Enabled (Manual)

Ensure COPY is used instead of ADD in Dockerfile

Ensure HEALTHCHECK instructions have been added to the container image

Ensure kube config file permission (Manual)

Ensure secrets are not stored in Dockerfiles (Manual)

Ensure setuid and setgid permissions are removed in the images (Manual)

Ensure that a minimal audit policy is created (Manual)

Ensure that all Namespaces have Network Policies defined

Ensure that containers use trusted base images (Manual)

Ensure that Service Account Tokens are only mounted where necessary

Ensure that the --anonymous-auth argument is set to false

Ensure that the --anonymous-auth argument is set to false

Ensure that the --audit-log-maxage argument is set to 30 or as appropriate

Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate

Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate

Ensure that the --audit-log-path argument is set

Ensure that the --authorization-mode argument includes Node

Ensure that the --authorization-mode argument includes RBAC

Ensure that the --authorization-mode argument is not set to AlwaysAllow

Ensure that the --authorization-mode argument is not set to AlwaysAllow

Ensure that the --auto-tls argument is not set to true

Ensure that the --bind-address argument is set to 127.0.0.1

Ensure that the --bind-address argument is set to 127.0.0.1

Ensure that the --cert-file and --key-file arguments are set as appropriate

Ensure that the --client-ca-file argument is set appropriate

Ensure that the --client-ca-file argument is set as appropriate

Ensure that the --client-cert-auth argument is set to true

Ensure that the --DenyServiceExternalIPs is not set

Ensure that the --encryption-provider-config argument is set as appropriate

Ensure that the --etcd-cafile argument is set as appropriate

Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate

Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture

Ensure that the --hostname-override argument is not set

Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root

Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive

Ensure that the --kubelet-certificate-authority argument is set as appropriate

Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate

Ensure that the --kubelet-https argument is set to true

Ensure that the --make-iptables-util-chains argument is set to true

Ensure that the --peer-auto-tls argument is not set to true

Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate

Ensure that the --peer-client-cert-auth argument is set to true

Ensure that the --profiling argument is set to false

Ensure that the --profiling argument is set to false

Ensure that the --protect-kernel-defaults argument is set to true

Ensure that the --root-ca-file argument is set as appropriate

Ensure that the --rotate-certificates argument is not set to false

Ensure that the --secure-port argument is not set to 0

Ensure that the --service-account-key-file argument is set as appropriate

Ensure that the --service-account-lookup argument is set to true

Ensure that the --service-account-private-key-file argument is set as appropriate

Ensure that the --streaming-connection-idle-timeout argument is not set to 0

Ensure that the --terminated-pod-gc-threshold argument is set as appropriate

Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate

Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate

Ensure that the --token-auth-file parameter is not set
Next >>
Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2023 Aqua Security Software Ltd.   Privacy Policy | Terms of Use