Prevent workloads from running privileged containers

점검 방법

감사 방식: 셸 명령

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.initContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.ephemeralContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($4=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure Pod Security Admission on workload namespaces so privileged containers are denied when new pods are created. For this control, baseline is sufficient to block privileged containers, but restricted is the stronger setting for workload namespaces when the applications can meet the additional pod hardening requirements. EKS pod security documentation shows these controls being applied through namespace labels and explains that multiple modes can be used together for enforcement, warning, and audit visibility. Label each workload namespace to enforce restricted, or use baseline where restricted would break valid workloads. Add warn and audit labels during rollout so violations are visible to users and audit logs while enforcement blocks new noncompliant pods. Set the variable $NAMESPACE to the namespace name being updated.

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target eks-auto