Mods

turbot/kubernetes_compliance

5 Stars
Overview
80Controls
80Queries
GitHub
NSA and CISA Kubernetes Hardening Guidance v1.0
Kubernetes Pod Security
Containers should not use hostPath mounts
Pod Security Policy should prohibit hostPaths volumes
Pod containers should not allow privilege escalation
Containers should not have privileged access
DaemonSet containers should not have privileged access
Deployment containers should not have privileged access
Job containers should not have privileged access
Pod containers should not have privileged access
Pod Security Policy should prohibit containers to run with privilege access
ReplicaSet containers should not have privileged access
ReplicationController containers should not have privileged access
Containers should not allow privilege escalation
DaemonSet containers should not allow privilege escalation
Deployment containers should not allow privilege escalation
Job containers should not allow privilege escalation
Pod containers should not allow privilege escalation
Pod Security Policy should prohibit privilege escalation
ReplicaSet containers should not allow privilege escalation
ReplicationController containers should not allow privilege escalation
Containerized applications should use security services
Containerized applications should use security services such as SELinux or AppArmor or Seccomp
Containers should not run with host network access
DaemonSet containers should not run with host network access
Deployment containers should not run with host network access
Job containers should not run with host network access
Pod containers should not run with host network access
Pod Security Policy should prohibit host network access
ReplicaSet containers should not run with host network access
ReplicationController containers should not run with host network access
Containers should not share the host process namespace
DaemonSet containers should not share the host process namespace
Deployment containers should not share the host process namespace
Job containers should not share the host process namespace
Pod containers should not share the host process namespace
Pod Security Policy should prohibit containers from sharing the host process namespaces
ReplicaSet containers should not share the host process namespace
ReplicationController containers should not share the host process namespace
Containers should run with a read only root file system
DaemonSet containers should run with a read only root file system
Deployment containers should run with a read only root file system
Job containers should run with a read only root file system
Pod containers should run with a read only root file system
Pod Security Policy should force containers to run with read only root file system
ReplicaSet containers should run with a read only root file system
ReplicationController containers should run with a read only root file system
Containers should not run with root privileges
DaemonSet containers should not run with root privileges
Deployment containers should not run with root privileges
Job containers should not run with root privileges
Pod containers should not run with root privileges
Pod Security Policy should prohibit containers from running as root
ReplicaSet containers should not run with root privileges
ReplicationController containers should not run with root privileges
Automatic mapping of the service account tokens should be disabled
Automatic mapping of the service account tokens should be disabled in Pod
Automatic mapping of the service account tokens should be disabled in service account
Network Separation and Hardening
Containers should have a CPU limit
DaemonSet containers should have a CPU limit
Deployment containers should have a CPU limit
Job containers should have a CPU limit
Namespaces should have default CPU limit in limitRange policy
Namespaces should be restricted on CPU usage with resourceQuota CPU limit
ReplicaSet containers should have a CPU limit
ReplicationController containers should have a CPU limit
Containers should have a CPU request
DaemonSet containers should have a CPU request
Deployment containers should have a CPU request
Job containers should have a CPU request
Namespaces should have default CPU request in limitRange policy
Namespaces should have resourceQuota CPU request
ReplicaSet containers should have a CPU request
ReplicationController containers should have a CPU request
Kubernetes API should serve on secure port
Kubernetes API should serve on secure port
Containers should have a memory limit
DaemonSet containers should have a memory limit
Deployment containers should have a memory limit
Job containers should have a memory limit
Namespaces should have default memory limit in limitRange policy
Namespaces should be restricted on memory usage with resourceQuota memory limit
ReplicaSet containers should have a memory limit
ReplicationController containers should have a memory limit
Containers should have a memory request
DaemonSet containers should have a memory request
Deployment containers should have a memory request
Job containers should have a memory request
Namespaces should have default memory request in limitRange policy
Namespaces should have resourceQuota memory request
ReplicaSet containers should have a memory request
ReplicationController containers should have a memory request
Network policy should have a default policy to deny all ingress and egress traffic
Namespaces should have a default network policy to deny all egress traffic
Namespaces should have a default network policy to deny all ingress traffic
Network policies should not have a default policy to allow all egress traffic
Network policies should not have a default policy to allow all ingress traffic

Benchmarks & Controls in Kubernetes Compliance

The Kubernetes Compliance mod includes 18 benchmarks & 80 controls.

Usage

steampipe check all

Benchmarks