CIS Kubernetes Benchmark

If the kubelet config.yaml configuration file is being used, validate permissions set to 600 or more restrictive
Profile Applicability: Level 1 Description: The kubelet config.yaml configuration file contains critical settings for the kubelet, which is respons...
Fri, 9 May, 2025 at 4:07 AM
Ensure that the client certificate authorities file ownership is set to root:root
Profile Applicability: Level 1 Description: The client certificate authorities (CA) file contains critical information used to authenticate client ...
Fri, 9 May, 2025 at 4:48 AM
Ensure that the seccomp profile is set to docker/default in your pod definitions
Profile Applicability: Level 1 Description:  The seccomp (secure computing mode) profile in Kubernetes allows you to restrict the system calls that ...
Fri, 9 May, 2025 at 5:25 AM
The default namespace should not be used
Profile Applicability: Level 1 Description:  Kubernetes automatically creates a default namespace for all resources that are not explicitly assigned...
Fri, 9 May, 2025 at 5:27 AM
Apply Security Context to Your Pods and Containers
Profile Applicability: Level 1 Description:  A Security Context in Kubernetes defines privilege and access control settings for a Pod or Container. I...
Fri, 9 May, 2025 at 5:30 AM
Ensure that the certificate authorities file permissions are set to 600 or more restrictive
Profile Applicability: Level 1 Description: Certificate authority (CA) files store the public key data used to verify certificates, ensuring that c...
Fri, 9 May, 2025 at 5:30 AM
Create administrative boundaries between resources using namespaces
Profile Applicability: Level 1 Description:  Kubernetes namespaces provide a way to organize and isolate resources within a cluster. By using namesp...
Fri, 9 May, 2025 at 5:37 AM
Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
Profile Applicability: Level 1 Description: The --kubeconfig argument specifies the path to the kubelet's kubeconfig file, which contains sensit...
Fri, 9 May, 2025 at 5:39 AM
Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)
Profile Applicability: Level 1 Description:  The ImagePolicyWebhook admission controller is used to enforce policies on container images before they ...
Fri, 9 May, 2025 at 5:43 AM
Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive
Profile Applicability: Level 1 Description: The --kubeconfig argument specifies the path to the kubelet's kubeconfig file, which contains sensi...
Fri, 9 May, 2025 at 5:45 AM