Aqua Vulnerability Database
Get Demo
Vulnerabilities
Misconfiguration
Compliance
Compliance
>
Kubernetes
>
CIS Kubernetes Benchmarks V1.23 1.23
Apply Security Context to Your Pods and Containers
Client certificate authentication should not be used for users (Manual)
Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)
Consider external secret storage (Manual)
Create administrative boundaries between resources using namespaces (Manual)
Ensure that a minimal audit policy is created (Manual)
Ensure that all Namespaces have Network Policies defined
Ensure that Service Account Tokens are only mounted where necessary
Ensure that the --anonymous-auth argument is set to false
Ensure that the --anonymous-auth argument is set to false
Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
Ensure that the --audit-log-path argument is set
Ensure that the --authorization-mode argument includes Node
Ensure that the --authorization-mode argument includes RBAC
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --authorization-mode argument is not set to AlwaysAllow
Ensure that the --auto-tls argument is not set to true
Ensure that the --bind-address argument is set to 127.0.0.1
Ensure that the --bind-address argument is set to 127.0.0.1
Ensure that the --cert-file and --key-file arguments are set as appropriate
Ensure that the --client-ca-file argument is set appropriate
Ensure that the --client-ca-file argument is set as appropriate
Ensure that the --client-cert-auth argument is set to true
Ensure that the --DenyServiceExternalIPs is not set
Ensure that the --encryption-provider-config argument is set as appropriate
Ensure that the --etcd-cafile argument is set as appropriate
Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
Ensure that the --hostname-override argument is not set
Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive
Ensure that the --kubelet-certificate-authority argument is set as appropriate
Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
Ensure that the --kubelet-https argument is set to true
Ensure that the --make-iptables-util-chains argument is set to true
Ensure that the --peer-auto-tls argument is not set to true
Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
Ensure that the --peer-client-cert-auth argument is set to true
Ensure that the --profiling argument is set to false
Ensure that the --profiling argument is set to false
Ensure that the --protect-kernel-defaults argument is set to true
Ensure that the --root-ca-file argument is set as appropriate
Ensure that the --rotate-certificates argument is not set to false
Ensure that the --secure-port argument is not set to 0
Ensure that the --service-account-key-file argument is set as appropriate
Ensure that the --service-account-lookup argument is set to true
Ensure that the --service-account-private-key-file argument is set as appropriate
Ensure that the --streaming-connection-idle-timeout argument is not set to 0
Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
Ensure that the --token-auth-file parameter is not set
Ensure that the --use-service-account-credentials argument is set to true
Ensure that the admin.conf file ownership is set to root:root
Ensure that the admin.conf file permissions are set to 600
Ensure that the admission control plugin AlwaysAdmit is not set
Ensure that the admission control plugin AlwaysPullImages is set
Ensure that the admission control plugin EventRateLimit is set
Ensure that the admission control plugin NamespaceLifecycle is set
Ensure that the admission control plugin NodeRestriction is set
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
Ensure that the admission control plugin ServiceAccount is set
Ensure that the API server pod specification file ownership is set to root:root
Ensure that the API server pod specification file permissions are set to 600 or more restrictive
Ensure that the audit policy covers key security concerns (Manual)
Ensure that the certificate authorities file permissions are set to 600 or more restrictive
Ensure that the client certificate authorities file ownership is set to root:root
Ensure that the cluster-admin role is only used where required
Ensure that the CNI in use supports Network Policies (Manual)
Ensure that the Container Network Interface file ownership is set to root:root
Ensure that the Container Network Interface file permissions are set to 600 or more restrictive
Ensure that the controller manager pod specification file ownership is set to root:root
Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive
Ensure that the controller-manager.conf file ownership is set to root:root
Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive
Ensure that the etcd data directory ownership is set to etcd:etcd
Ensure that the etcd data directory permissions are set to 700 or more restrictive
Ensure that the etcd pod specification file ownership is set to root:root
Ensure that the etcd pod specification file permissions are set to 600 or more restrictive
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
Ensure that the kubelet service file ownership is set to root:root
Ensure that the kubelet service file permissions are set to 600 or more restrictive
Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive
Ensure that the Kubernetes PKI directory and file ownership is set to root:root
Ensure that the Kubernetes PKI key file permissions are set to 600
Ensure that the RotateKubeletServerCertificate argument is set to true
Ensure that the scheduler pod specification file ownership is set to root:root
Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive
Ensure that the scheduler.conf file ownership is set to root:root
Ensure that the scheduler.conf file permissions are set to 600 or more restrictive
Ensure that the seccomp profile is set to docker/default in your pod definitions
If proxy kubeconfig file exists ensure ownership is set to root:root
If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive
If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root
If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive
Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster
Minimize access to secrets
Minimize the admission of containers which use HostPorts
Next >>
Aqua Container Security