Red Hat OpenShift
TMA-OPENSHIFT-5.1.4
Minimize access to create pods
MediumLevel 1Manual reviewopenshift
Description
The ability to create pods in a namespace can provide a number of opportunities for privilege escalation, such as assigning privileged service accounts to these pods or mounting hostPaths with access to sensitive data (unless Pod Security Policies are implemented to restrict this access) As such, access to create new pods should be restricted to the smallest possible group of users. The benchmark marks this recommendation Manual.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Review the users who have create access to pod objects in the Kubernetes API with the following command: oc adm policy who-can create pod
How it is fixed
Fix method: Guidance or infrastructure patch
Where possible, remove create access to pod objects in the cluster.
Properties
- Operating systems
- Any
- Tags
- openshiftpoliciesrbac
- Reference
- CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 5.1.4 Minimize access to create pods