Minimize the admission of privileged containers

How it is checked

Audit method: Shell command

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.initContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.ephemeralContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && ($4=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

AKS Automatic already enforces baseline Pod Security Standards and Deployment Safeguards. Remove privileged mode from user workloads rather than adding another admission policy. To enforce the restricted Pod Security Standard for a namespace, set the pod-security.kubernetes.io/enforce label: kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted The command enforces the restricted policy for the specified namespace. Where an exception is required, use an approved namespace exclusion and limit who can manage it. Deployment Safeguards are already enabled in Enforce mode. Use Azure Policy only when additional centralized policy requirements are needed.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target aks-automatic