Azure Kubernetes Service (AKS) Benchmark
48 articles
- Enable Audit Logs
- Ensure that the kubeconfig file permissions are set to 644 or more restrictive
- Ensure that the kubelet kubeconfig file ownership is set to root:root
- Ensure that the azure.json file has permissions set to 644 or more restrictive
- Ensure that the azure.json file ownership is set to root:root
- Ensure that the --anonymous-auth argument is set to false
- Ensure that the --authorization-mode argument is not set to AlwaysAllow
- Ensure that the --client-ca-file argument is set as appropriate
- Ensure that the --read-only-port is secured
- Ensure that the --streaming-connection-idle-timeout argument is not set to 0
- Ensure that the --make-iptables-util-chains argument is set to true
- Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture
- Ensure that the --rotate-certificates argument is not set to false
- Ensure that the RotateKubeletServerCertificate argument is set to true
- Ensure that the cluster-admin role is only used where required
- Minimize access to secrets
- Minimize wildcard use in Roles and ClusterRoles
- Minimize access to create pods
- Ensure that default service accounts are not actively used
- Ensure that Service Account Tokens are only mounted where necessary
- Minimize the admission of privileged containers
- Minimize the admission of containers wishing to share the host process ID namespace
- Minimize the admission of containers wishing to share the host IPC namespace
- Minimize the admission of containers wishing to share the host network namespace
- Minimize the admission of containers with allowPrivilegeEscalation
- Ensure latest CNI version is used
- Ensure that all Namespaces have Network Policies defined
- Prefer using secrets as files over secrets as environment variables
- Consider external secret storage
- Create administrative boundaries between resources using namespaces
- Apply Security Context to Your Pods and Containers
- The default namespace should not be used
- Ensure Image Vulnerability Scanning using Microsoft Defender for Cloud (MDC) image scanning or a third-party provider
- Minimize user access to Azure Container Registry
- Minimize cluster access to read-only for Azure Container Registry (ACR)
- Minimize Container Registries to only those approved
- Prefer using dedicated AKS Service Accounts
- Ensure Kubernetes Secrets are encrypted
- Restrict Access to the Control Plane Endpoint
- Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled
- Ensure clusters are created with Private Nodes
- Ensure Network Policy is Enabled and set as appropriate
- Encrypt traffic to HTTPS load balancers with TLS certificates
- Manage Kubernetes RBAC users with Azure AD
- Use Azure RBAC for Kubernetes Authorization
- Apply Security Context to Your Pods and Containers
- The default namespace should not be used
- Ensure that the seccomp profile is set to docker/default in your pod definitions