Enforce baseline or restricted Pod Security Standards on workload namespaces

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Run the following command to list workload namespaces that do not enforce either the baseline or restricted Pod Security Standard. The restricted profile satisfies this control because it is more restrictive than baseline. PodSecurity is applied to namespaces with labels, and enforce mode rejects violating pod creation while audit and warn do not block pods.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Update workload namespaces so Pod Security enforcement is applied consistently through namespace labels. Use restricted where workloads can support it, and use baseline where compatibility requires a less restrictive profile. • Identify all namespaces that host user workloads and confirm each one uses pod-security.kubernetes.io/enforce=baseline or pod-security.kubernetes.io/enforce=restricted. • Test the selected profile before enforcement using server side dry run, especially when moving from no enforcement to restricted. • Remediate violating workload specs by updating security contexts, privilege settings, host namespace usage, volume types, and Linux capability settings.