Minimize the admission of privileged containers

Kako se proverava

Metod provere: Komanda ljuske

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.initContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.ephemeralContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease|gatekeeper-system|azure-arc)$' 'NF && $1 !~ ex && ($4=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

AKS Automatic already enforces baseline Pod Security Standards and Deployment Safeguards. Remove privileged mode from user workloads rather than adding another admission policy. To enforce the restricted Pod Security Standard for a namespace, set the pod-security.kubernetes.io/enforce label: kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted The command enforces the restricted policy for the specified namespace. Where an exception is required, use an approved namespace exclusion and limit who can manage it. Deployment Safeguards are already enabled in Enforce mode. Use Azure Policy only when additional centralized policy requirements are needed.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target aks-automatic