Ensure required workloads are covered by Kubernetes network policies

Trung bìnhCấp 1Xem xét thủ côngeks

Mô tả

The Amazon VPC CNI plugin for Kubernetes can enforce Kubernetes network policies in EKS, but workload isolation depends on the relevant workloads actually being covered by NetworkPolicy or ClusterNetworkPolicy rules. NetworkPolicy provides namespace-scoped pod traffic segmentation, while ClusterNetworkPolicy can apply a common security posture across all or a selected subset of workloads in the cluster. The benchmark marks this recommendation Manual.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Review the Kubernetes network policy model in the EKS cluster and verify that every required workload is selected by either a namespace-scoped NetworkPolicy or a cluster-scoped ClusterNetworkPolicy. A separate policy in every namespace is not required, because cluster-scoped policies can apply a shared posture across all workloads or a selected subset. Workloads that are not matched by policy remain effectively unsegmented because Pod traffic is allowed by default until policy restricts it.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Create and apply Kubernetes NetworkPolicy or ClusterNetworkPolicy objects so every required workload is explicitly covered by policy. Start with a default deny posture and then add only the ingress and egress rules needed for approved traffic such as DNS and required service-to-service flows. Use namespace-scopedNetworkPolicy where application-level segmentation is sufficient, and use ClusterNetworkPolicy where a shared security posture must apply across multiple namespaces or workload groups. Keep in mind that coverage depends on the Amazon VPC CNI network policy feature being enabled, applies to Amazon EC2 Linux nodes, and is limited to a Pod’s primary interface.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ekspoliciesnetwork
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 4.3.2 Ensure required workloads are covered by Kubernetes network policies