Enforce baseline or restricted Pod Security Standards on workload namespaces

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Run the following command to list workload namespaces that do not enforce either the baseline or restricted Pod Security Standard. The restricted profile satisfies this control because it is more restrictive than baseline. PodSecurity is applied to namespaces with labels, and enforce mode rejects violating pod creation while audit and warn do not block pods.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Update workload namespaces so Pod Security enforcement is applied consistently through namespace labels. Use restricted where workloads can support it, and use baseline where compatibility requires a less restrictive profile. • Identify all namespaces that host user workloads and confirm each one uses pod-security.kubernetes.io/enforce=baseline or pod-security.kubernetes.io/enforce=restricted. • Test the selected profile before enforcement using server side dry run, especially when moving from no enforcement to restricted. • Remediate violating workload specs by updating security contexts, privilege settings, host namespace usage, volume types, and Linux capability settings.