Azure Kubernetes Service (AKS) Benchmark

Minimize the admission of privileged containers
 Profile Applicability: Level 1 Description:  Privileged containers are containers that have extended capabilities, including full access to the host...
Fri, 9 May, 2025 at 12:58 AM
Minimize the admission of containers wishing to share the host process ID namespace
Profile Applicability: Level 1 Description:  Containers that share the host’s process ID (PID) namespace have the ability to access and interact with...
Fri, 9 May, 2025 at 1:05 AM
Minimize the admission of containers wishing to share the host IPC namespace
Profile Applicability: Level 1 Description:  Containers that share the host’s Inter-Process Communication (IPC) namespace can access and interact with...
Fri, 9 May, 2025 at 1:08 AM
Minimize the admission of containers wishing to share the host network namespace
Profile Applicability: Level 1 Description:  Containers that share the host’s network namespace gain access to the host’s network interfaces and ports...
Fri, 9 May, 2025 at 1:12 AM
Minimize the admission of containers with allowPrivilegeEscalation
Profile Applicability: Level 1 Description:  The allowPrivilegeEscalation flag in Kubernetes controls whether a process can gain more privileges than ...
Fri, 9 May, 2025 at 1:16 AM
Ensure latest CNI version is used
Profile Applicability: Level 1 Description:  The Container Network Interface (CNI) is used in Kubernetes to configure networking for pods. Ensuring th...
Fri, 9 May, 2025 at 1:19 AM
Ensure that all Namespaces have Network Policies defined
Profile Applicability: Level 2 Description:  Network Policies in Kubernetes are used to control the communication between pods and services within a c...
Fri, 9 May, 2025 at 1:24 AM
Prefer using secrets as files over secrets as environment variables
Profile Applicability: Level 2 Description:  Kubernetes allows secrets to be exposed either as environment variables or as files within a container. I...
Fri, 9 May, 2025 at 2:14 AM
Consider external secret storage
Profile Applicability: Level 2 Description:  Storing secrets directly within Kubernetes should be avoided when possible. Instead, consider using an ex...
Fri, 9 May, 2025 at 2:20 AM
Create administrative boundaries between resources using namespaces
Profile Applicability: Level 1 Description:  Namespaces in Kubernetes provide a way to organize and isolate resources within a cluster. By creating na...
Fri, 9 May, 2025 at 2:24 AM