Aqua Vulnerability Database
Get Demo
Vulnerabilities
Misconfiguration
Runtime Security
Compliance
Compliance
> Kubernetes
/proc Mount Type
/proc Mount Type
AppArmor
AppArmor
Apply Security Context to Your Pods and Containers
Audit log aging
Audit log path is configure
Audit policy is configure (Manual)
AWS CIS Foundations V1.2 1.2
AWS CIS Foundations V1.4 1.4
Capabilities
Capabilities
Capabilities
Check encryption provider
Check that encryption resource has been set
CIS ACK 1.0
CIS AKS 1.0
CIS EKS 1.0.1
CIS EKS 1.1.0
CIS EKS 1.2.0
CIS EKS Stig Kubernetes V1r6
CIS GKE 1.0
CIS GKE 1.2.0
CIS Redhat 0.7
CIS Redhat 1.0
CIS 1.20
CIS 1.23
CIS 1.24
CIS 1.5
CIS 1.6
CIS 1.6 K3s
CIS 1.7
CIS Docker Community Edition Benchmark V1.1.0 1.1.0
CIS Kubernetes Benchmarks V1.23 1.23
Client certificate authentication should not be used for users (Manual)
Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)
Consider external secret storage (Manual)
Control plan disable insecure port (Manual)
Create administrative boundaries between resources using namespaces (Manual)
disable-unused-credentials
disable-unused-credentials-45-days
enable-access-analyzer
enable-all-regions
enable-object-read-logging
enable-object-write-logging
Encrypt etcd communication
enforce-root-hardware-mfa
enforce-root-mfa
enforce-root-mfa
enforce-user-mfa
Ensure a user for the container has been created
Ensure Content trust for Docker is Enabled (Manual)
Ensure COPY is used instead of ADD in Dockerfile
Ensure HEALTHCHECK instructions have been added to the container image
Ensure images are scanned and rebuilt to include security patches
Ensure kube config file permission (Manual)
Ensure secrets are not stored in Dockerfiles
Ensure setuid and setgid permissions are removed in the images (Manual)
Ensure that a minimal audit policy is created (Manual)
Ensure that all Namespaces have Network Policies defined
Ensure that containers use trusted base images (Manual)
Ensure that Service Account Tokens are only mounted where necessary
Ensure that the --anonymous-auth argument is set to false
Ensure that the --anonymous-auth argument is set to false
Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
Ensure that the --audit-log-path argument is set
Ensure that the --authorization-mode argument includes Node
Ensure that the --authorization-mode argument includes RBAC
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --auto-tls argument is not set to true
Ensure that the --bind-address argument is set to 127.0.0.1
Ensure that the --bind-address argument is set to 127.0.0.1
Ensure that the --cert-file and --key-file arguments are set as appropriate
Ensure that the --client-ca-file argument is set appropriate
Ensure that the --client-ca-file argument is set as appropriate
Ensure that the --client-cert-auth argument is set to true
Ensure that the --DenyServiceExternalIPs is not set
Ensure that the --encryption-provider-config argument is set as appropriate
Ensure that the --etcd-cafile argument is set as appropriate
Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
Ensure that the --hostname-override argument is not set
Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive
Ensure that the --kubelet-certificate-authority argument is set as appropriate
Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
Ensure that the --kubelet-https argument is set to true
Ensure that the --make-iptables-util-chains argument is set to true
Ensure that the --peer-auto-tls argument is not set to true
Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
Ensure that the --peer-client-cert-auth argument is set to true
Ensure that the --profiling argument is set to false
Ensure that the --profiling argument is set to false
Ensure that the --protect-kernel-defaults argument is set to true
Ensure that the --root-ca-file argument is set as appropriate
Ensure that the --rotate-certificates argument is not set to false
Ensure that the --secure-port argument is not set to 0
Next >>
Aqua Container Security