Require hardened security contexts for all workload Pods and containers

BajaNivel 2Revisión manualgke

Descripción

Require hardened security contexts for GKE workload Pods and containers. Security contexts should define workload level and container level controls that reduce privilege, limit host exposure, and enforce safer runtime behavior. The benchmark marks this recommendation Manual.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Review workload Pods and controller templates to confirm hardened security contexts are explicitly defined at the Pod and container level. Focus the audit on workload namespaces and verify settings such as runAsNonRoot=true, allowPrivilegeEscalation=false, privileged=false, dropped Linux capabilities where practical, and seccompProfile.type=RuntimeDefault or an approved custom profile. GKE Standard supports using Pod Security Admission, Policy Controller, and security posture scanning to identify and enforce workload configuration risks.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Update workload manifests, Helm charts, overlays, or GitOps sources so hardened security contexts are defined before deployment. Apply settings at the Pod level when they apply to all containers, and use container level settings where a specific container requires a different configuration. • Set workloads to run as non root where compatible. • Set allowPrivilegeEscalation=false for workload containers. • Set privileged=false and remove host level access unless explicitly required. • Drop unnecessary Linux capabilities, and use drop: ["ALL"] where the application supports it. • Set seccompProfile.type=RuntimeDefault or use an approved custom Localhost profile. Redeploy the workload and validate application behavior in a lower environment before broad rollout.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: gkepoliciespod-security
Referencia: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.6.3 Require hardened security contexts for all workload Pods and containers