turbot/kubernetes_compliance

Control: Seccomp profile is set to docker/default in Job definition

Description

In Job definition seccomp profile should be set to docker/default. Seccomp (secure computing mode) is used to restrict the set of system calls applications can make, allowing cluster administrators greater control over the security of workloads running in the cluster. Kubernetes disables seccomp profiles by default for historical reasons. It should be enabled to ensure that the workloads have restricted actions available within the container.

Usage

Run the control in your terminal:

powerpipe control run kubernetes_compliance.control.job_default_seccomp_profile_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run kubernetes_compliance.control.job_default_seccomp_profile_enabled --share

SQL

This control uses a named query:

job_default_seccomp_profile_enabled

Tags