Enforce baseline or restricted Pod Security Standards on workload namespaces

СредњаНиво 1Ручни прегледgke

Опис

Pod Security Standards provide predefined pod security profiles that can be applied to GKE Standard workload namespaces through the built in PodSecurity admission controller. At minimum, workload namespaces should enforce the baseline profile, with restricted used where stronger pod hardening is required. The benchmark marks this recommendation Manual.

Како се проверава

Метод провере: Ручни преглед

Ова препорука се не може проверити аутоматски. Скенирање је наводи са овим упутствима када проследите --include-manual.

Run the following command to list workload namespaces that do not enforce either the baseline or restricted Pod Security Standard. The restricted profile satisfies this control because it is more restrictive than baseline. PodSecurity is applied to namespaces with labels, and enforce mode rejects violating pod creation while audit and warn do not block pods.

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Update workload namespaces so Pod Security enforcement is applied consistently through namespace labels. Use restricted where workloads can support it, and use baseline where compatibility requires a less restrictive profile. • Identify all namespaces that host user workloads and confirm each one uses pod-security.kubernetes.io/enforce=baseline or pod-security.kubernetes.io/enforce=restricted. • Test the selected profile before enforcement using server side dry run, especially when moving from no enforcement to restricted. • Remediate violating workload specs by updating security contexts, privilege settings, host namespace usage, volume types, and Linux capability settings.

Својства

Оперативни системи: Било који
Ознаке: gkepoliciespod-security
Референца: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 4.2.1 Enforce baseline or restricted Pod Security Standards on workload namespaces