Container Service for Kubernetes:Scan workload configuration risks

RAM and RBAC authorization for RAM users

Skip this section if you use an Alibaba Cloud account instead of a Resource Access Management (RAM) user.

RAM authorization

Grant the RAM user permissions to operate the Inspections page. Without these permissions, the page is inaccessible. For instructions, see Create a custom RAM policy.

Use the following policy to grant permissions for the Inspections page:

{
  "Statement": [
    {
      "Action": [
        "cs:DescribePolarisConfig",
        "cs:DescribePolarisJob",
        "cs:DescribePolarisCronJob",
        "cs:UpdatePolarisJob",
        "cs:UpdatePolarisCronJob"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:cs:*:*:cluster/<yourclusterID>"
      ]
    }
  ],
  "Version": "1"
}

To view inspection reports, also grant the RAM user read permissions for the Simple Log Service (SLS) project used by your cluster's log collection component. For instructions, see Use custom policies to grant permissions to a RAM user.

Use the following policy to grant SLS read permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": "acs:log:*:*:project/<Project name>/*",
      "Effect": "Allow"
    }
  ]
}

RBAC authorization

After completing RAM authorization, grant the RAM user administrator-level RBAC permissions to manage your cluster. This authorizes the RAM user to manage the Kubernetes resources displayed on the Inspections page. For instructions, see Grant RBAC permissions to RAM users or RAM roles.

Inspection details

The Inspections tab shows per-workload results. Use the Passed or Failed, Namespace, and Workload Type filters to focus on workloads with security issues.

For each workload, the table shows the Number of Passed Items and Number of Failed Items. Click Details to see:

• Pass/fail status for each inspection item, broken down by pod and container

• Description and security hardening suggestions for each failed item

To suppress a false positive, click Add to Whitelist next to the failed item.

To view the raw configuration, click the workload's YAML link.

Inspection reports

The Reports tab shows the results from the most recent inspection, including:

• Overview: total inspection items, count and percentage of each resource type, and overall cluster health status

• Category breakdown: results grouped by health checks, images, networks, resources, and security conditions

• Workload details: resource category, name, namespace, inspection type, inspection item, and result for each workload configuration

Host isolation

These checks detect pod configurations that break namespace isolation between containers and the host.

Privilege control

These checks detect configurations that grant containers elevated privileges, the most common path for container breakouts.

Resource governance

These checks detect missing CPU and memory constraints. Pods without requests may be scheduled onto nodes with insufficient resources. Pods without limits can consume all node resources, triggering OOM kills or node-level evictions that affect other workloads.

Image integrity and service reliability

These checks detect configuration gaps that can cause service disruptions.