CIS Kubernetes Benchmark

Minimize the admission of containers wishing to share the host process ID namespace
Profile Applicability: Level 1 Description:  The hostPID setting in Kubernetes allows containers to share the host's process ID (PID) namespace. ...
Mon, 12 May, 2025 at 2:23 AM
Verify that the --read-only-port argument is set to 0
Profile Applicability: Level 1 Description:  The --read-only-port argument in Kubernetes controls whether the Kubelet exposes a read-only HTTP server...
Mon, 12 May, 2025 at 2:28 AM
Minimize the admission of privileged containers
 Profile Applicability: Level 1 Description:  Privileged containers have elevated access to the host system and can perform operations that normal co...
Mon, 12 May, 2025 at 2:32 AM
Ensure that the --streaming-connection-idle-timeout argument is not set to 0
Profile Applicability: Level 1 Description:  The --streaming-connection-idle-timeout argument in Kubernetes controls the timeout duration for idle st...
Mon, 12 May, 2025 at 2:34 AM
Ensure that the --make-iptables-util-chains argument is set to true
Profile Applicability: Level 1 Description:  The --make-iptables-util-chains argument in Kubernetes controls whether the Kubelet creates custom iptab...
Mon, 12 May, 2025 at 2:41 AM
Ensure that the cluster has at least one active policy control mechanism in place
Profile Applicability: Level 1 Description:  A policy control mechanism in Kubernetes is crucial for managing and enforcing security, resource, and o...
Mon, 12 May, 2025 at 2:45 AM
Ensure that the --hostname-override argument is not set
Profile Applicability: Level 1 Description:  The --hostname-override argument in Kubernetes allows the Kubernetes component (such as the Kubelet or A...
Mon, 12 May, 2025 at 2:47 AM
Minimize access to the service account token creation
Profile Applicability: Level 1 Description:  Service accounts in Kubernetes are used to provide an identity for processes running in pods. By default...
Mon, 12 May, 2025 at 2:57 AM
Minimize access to webhook configuration object
Profile Applicability: Level 1 Description:  Webhook configuration objects in Kubernetes, such as MutatingAdmissionWebhook and ValidatingAdmissionWeb...
Mon, 12 May, 2025 at 3:04 AM
Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
 Profile Applicability: Level 1 Description:  The --tls-cert-file and --tls-private-key-file arguments in Kubernetes control the paths to the certifi...
Mon, 12 May, 2025 at 3:22 AM