Control: Kubernetes cluster pods should only use approved host network and port range
Description
Restrict pod access to the host network and the allowable host port range in a Kubernetes cluster. This recommendation is part of CIS 5.2.4 which is intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.kubernetes_cluster_pod_use_approved_host_network_and_port_rangeSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.kubernetes_cluster_pod_use_approved_host_network_and_port_range --shareSQL
This control uses a named query:
manual_control