Enforce baseline or restricted Pod Security Standards on workload namespaces

СреднийУровень 1Ручная проверкаgke

Описание

Pod Security Standards provide predefined pod security profiles that can be applied to GKE Standard workload namespaces through the built in PodSecurity admission controller. At minimum, workload namespaces should enforce the baseline profile, with restricted used where stronger pod hardening is required. The benchmark marks this recommendation Manual.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Run the following command to list workload namespaces that do not enforce either the baseline or restricted Pod Security Standard. The restricted profile satisfies this control because it is more restrictive than baseline. PodSecurity is applied to namespaces with labels, and enforce mode rejects violating pod creation while audit and warn do not block pods.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Update workload namespaces so Pod Security enforcement is applied consistently through namespace labels. Use restricted where workloads can support it, and use baseline where compatibility requires a less restrictive profile. • Identify all namespaces that host user workloads and confirm each one uses pod-security.kubernetes.io/enforce=baseline or pod-security.kubernetes.io/enforce=restricted. • Test the selected profile before enforcement using server side dry run, especially when moving from no enforcement to restricted. • Remediate violating workload specs by updating security contexts, privilege settings, host namespace usage, volume types, and Linux capability settings.

Свойства

Операционные системы: Любая
Теги: gkepoliciespod-security
Источник: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.2.1 Enforce baseline or restricted Pod Security Standards on workload namespaces