CIS Kubernetes Benchmark

Minimize the admission of HostPath volumes
Profile Applicability Level 1 Description:  HostPath volumes allow containers to mount files or directories from the host node’s filesystem into a p...
Fri, 9 May, 2025 at 6:30 AM
Ensure that a minimal audit policy is created
Profile Applicability: Level 1 Description: An audit policy in Kubernetes defines the level of detail captured in the audit logs. A minimal audit p...
Fri, 9 May, 2025 at 6:33 AM
Minimize the admission of Windows HostProcess Containers
Profile Applicability: Level 1 Description:  Windows HostProcess Containers allow containers to run directly on the Windows host, with access to the...
Fri, 9 May, 2025 at 6:36 AM
Bootstrap token authentication should not be used for users
Profile Applicability: Level 1 Description: Bootstrap token authentication is a mechanism primarily used during the initial setup and bootstrapping of...
Fri, 9 May, 2025 at 6:38 AM
Service account token authentication should not be used for users
Profile Applicability: Level 1 Description: Service account token authentication is a mechanism used in Kubernetes for service accounts to authenti...
Fri, 9 May, 2025 at 6:43 AM
Minimize the admission of containers with capabilities assigned
Profile Applicability: Level 1 Description:  Kubernetes allows containers to run with additional Linux capabilities, granting them extended privileg...
Fri, 9 May, 2025 at 6:46 AM
Client certificate authentication should not be used for users
Profile Applicability: Level 1 Description: Client certificate authentication for users involves using certificates to authenticate users to the Ku...
Fri, 9 May, 2025 at 6:49 AM
Ensure that a unique Certificate Authority is used for etcd
Profile Applicability: Level 2 Description: The etcd component of Kubernetes stores critical cluster data, including configuration and state inform...
Fri, 9 May, 2025 at 6:52 AM
Ensure that the --peer-auto-tls argument is not set to true
Profile Applicability: Level 1 Description: The --peer-auto-tls argument controls whether automatic TLS encryption is enabled for peer-to-peer comm...
Fri, 9 May, 2025 at 6:56 AM
Ensure that the --peer-client-cert-auth argument is set to true
Profile Applicability: Level 1 Description: Ensure that the --peer-client-cert-auth argument is set to true in the Kubernetes API server configurati...
Fri, 9 May, 2025 at 7:01 AM