Azure Kubernetes Service (AKS) Benchmark

Ensure that the --make-iptables-util-chains argument is set to true
Profile Applicability: Level 1 Description:  The --make-iptables-util-chains flag in Kubernetes controls whether the Kubernetes components create use...
Thu, 8 May, 2025 at 11:24 PM
Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture
Profile Applicability: Level 2 Description:  The --eventRecordQPS flag in Kubernetes controls the number of events that the API server records per se...
Thu, 8 May, 2025 at 11:27 PM
Ensure that the --rotate-certificates argument is not set to false
Profile Applicability: Level 2 Description:  The --rotate-certificates flag in Kubernetes controls whether the certificates for the Kubernetes compone...
Thu, 8 May, 2025 at 11:30 PM
Ensure that the RotateKubeletServerCertificate argument is set to true
Profile Applicability: Level 1 Description:  The RotateKubeletServerCertificate argument controls whether the Kubelet should automatically rotate its...
Thu, 8 May, 2025 at 11:34 PM
Ensure that the cluster-admin role is only used where required
Profile Applicability: Level 1 Description:  The cluster-admin role is a powerful role in Kubernetes that grants unrestricted access to the entire clu...
Thu, 8 May, 2025 at 11:37 PM
Minimize access to secrets
Profile Applicability: Level 1 Description:  Access to Kubernetes secrets should be restricted to only those users and service accounts that absolute...
Thu, 8 May, 2025 at 11:41 PM
Minimize wildcard use in Roles and ClusterRoles
Profile Applicability: Level 1 Description:  Roles and ClusterRoles in Kubernetes are used to define permissions for accessing resources within a clu...
Thu, 8 May, 2025 at 11:45 PM
Minimize access to create pods
Profile Applicability: Level 1 Description:  The ability to create Pods in Kubernetes should be restricted to only those users and service accounts w...
Thu, 8 May, 2025 at 11:48 PM
Ensure that default service accounts are not actively used
Profile Applicability: Level 1 Description: By default, Kubernetes creates a default service account in every namespace. While this service account ca...
Thu, 8 May, 2025 at 11:53 PM
Ensure that Service Account Tokens are only mounted where necessary
Profile Applicability: Level 1 Description:  Service account tokens are mounted by default in Kubernetes pods and used by applications within the pod ...
Thu, 8 May, 2025 at 11:58 PM