CIS Kubernetes Benchmark

Minimize access to create pods
Profile Applicability: Level 1 Description:  This check ensures that the ability to create pods is restricted to only trusted users and service accou...
Mon, 12 May, 2025 at 4:30 AM
Minimize access to the proxy sub-resource of nodes
 Profile Applicability: Level 1 Description: The proxy sub-resource of a node in Kubernetes allows users to access node-level services via the Kuber...
Mon, 12 May, 2025 at 4:38 AM
Ensure that the --anonymous-auth argument is set to false
Profile Applicability: Level 1 Description: This check ensures that the --anonymous-auth argument in the Kubernetes API server configuration is set to f...
Mon, 12 May, 2025 at 4:47 AM
If the kubelet config.yaml configuration file is being used, validate file ownership is set to root:root
Profile Applicability: Level 1 Description: This check ensures that the config.yaml file used by the kubelet has the correct file ownership set to root:...
Mon, 12 May, 2025 at 4:58 AM
Minimize access to create persistent volumes
Profile Applicability: Level 1 Description: Persistent Volumes (PVs) in Kubernetes are used to provision and manage storage resources that outlast t...
Mon, 12 May, 2025 at 5:06 AM
Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster
Profile Applicability: Level 1 Description:  Kubernetes provides Bind, Impersonate, and Escalate permissions in RBAC (Role-Based Access Control) to a...
Mon, 12 May, 2025 at 5:16 AM
Ensure that default service accounts are not actively used
Profile Applicability: Level 1 Description:  In Kubernetes, each namespace has a default service account (default), which is automatically assigned t...
Mon, 12 May, 2025 at 5:20 AM
Avoid use of system:masters group
Profile Applicability: Level 1 Description:  The system:masters group in Kubernetes provides unrestricted access to the cluster, including the abilit...
Mon, 12 May, 2025 at 5:23 AM
Ensure that Service Account Tokens are only mounted where necessary
Profile Applicability: Level 1 Description:  Kubernetes automatically mounts service account tokens into containers in the form of environment variab...
Mon, 12 May, 2025 at 5:30 AM