Prevent workloads from running privileged containers

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

out=$(kubectl get pods -A -o go-template='{{range .items}}{{$ns:=.metadata.namespace}}{{$p:=.metadata.name}}{{range .spec.containers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.initContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{range .spec.ephemeralContainers}}{{$ns}} {{$p}} {{.name}} {{with .securityContext}}{{.privileged}}{{end}}{{"\n"}}{{end}}{{end}}') || exit 1
bad=$(printf '%s\n' "$out" | awk -v ex='^(kube-system|kube-public|kube-node-lease)$' 'NF && $1 !~ ex && ($4=="true")')
if [ -z "$bad" ]; then echo compliant; else printf '%s\n' "$bad" | head -n 25; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Configure Pod Security Admission on workload namespaces so privileged containers are denied when new pods are created. For this control, baseline is sufficient to block privileged containers, but restricted is the stronger setting for workload namespaces when the applications can meet the additional pod hardening requirements. EKS pod security documentation shows these controls being applied through namespace labels and explains that multiple modes can be used together for enforcement, warning, and audit visibility. Label each workload namespace to enforce restricted, or use baseline where restricted would break valid workloads. Add warn and audit labels during rollout so violations are visible to users and audit logs while enforcement blocks new noncompliant pods. Set the variable $NAMESPACE to the namespace name being updated.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target eks-auto