Container Service for Kubernetes:Configure the inspection feature to check for workload security risks in a registered cluster

Check ID

Check item

Description and security risk

Remediation

hostNetworkSet

Prevent containers from sharing the host network namespace

Checks whether hostNetwork: true is configured in the pod spec of a workload. If this setting is enabled, containers can access the host's network namespace, creating a risk of network attacks and data sniffing from within the pod.

Modify the pod spec to remove the hostNetwork field.

      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2

hostIPCSet

Prevent containers from sharing the host IPC namespace

Checks whether hostIPC: true is configured in the pod spec of a workload. If this setting is enabled, containers can access the host's IPC namespace, which allows them to attack or sniff data from other processes on the host.

Modify the pod spec to remove the hostIPC field.

      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2

hostPIDSet

Prevent containers from sharing the host PID namespace

Checks whether hostPID: true is configured in the pod spec of a workload. If this setting is enabled, containers can access the host's process ID (PID) namespace, which allows them to attack or collect data from other processes on the host.

Modify the pod spec to remove the hostPID field.

      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2

hostPortSet

Prevent container processes from listening on node ports

Checks whether hostPort is configured in the pod spec of a workload. If a container port is mapped to a port on the host node, it can occupy the host port and may receive requests from unintended sources.

Modify the pod spec to remove the hostPort field.

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

runAsRootAllowed

Prevent containers from running as the root user

Checks whether runAsNonRoot: true is configured in the pod spec of a workload. If this setting is not configured, containers run as the root user by default. This creates a risk of malicious processes compromising your applications, the host, or the entire cluster.

Modify the pod spec to add runAsNonRoot: true.

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext:
          runAsNonRoot: true

runAsPrivileged

Prevent containers from running in privileged mode

Checks whether privileged: true is configured in the pod spec of a workload. If this setting is enabled, the container has root access to the host. This creates a severe risk of malicious processes compromising your applications, the host, or the entire cluster.

Modify the pod spec to remove the privileged field.

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext: {}

privilegeEscalationAllowed

Prevent privilege escalation in containers

Checks whether allowPrivilegeEscalation: false is configured in the pod spec of a workload. If this setting is not configured, a child process in a container can gain more privileges than its parent process. This creates a risk of privilege escalation attacks.

Modify the pod spec to add the allowPrivilegeEscalation: false field.

        ports:
        - containerPort: 80
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        volumeMounts:

capabilitiesAdded

Drop unnecessary Linux capabilities

Checks the capabilities field in the pod spec of a workload for high-privilege Linux capabilities such as SYS_ADMIN, NET_ADMIN, or ALL. If these capabilities are granted, malicious processes can use them to compromise your applications, components, or cluster.

Modify the pod spec to add only the required Linux capabilities and drop all others.

If no extra Linux capabilities are required, drop all of them. Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext:
          capabilities:
            drop:
            - ALL

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext:
          capabilities:
            add:
            - CHOWN
            drop:
            - ALL

notReadOnlyRootFilesystem

Use a read-only root filesystem for containers

Checks whether readOnlyRootFilesystem: true is configured in the pod spec of a workload. If this setting is not configured, the container's root filesystem is writable. This creates a risk of malicious processes modifying system files.

Modify the pod spec to add readOnlyRootFilesystem: true. If you need to write to a specific directory, use volumeMounts.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext:
          readOnlyRootFilesystem: true

If you need to modify files in a specific directory, use a volumeMounts field.

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
        securityContext:
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        volumeMounts:
        - mountPath: /path/to/write
          name: writeable
      volumes:
      - emptyDir: {}
        name: writeable

cpuRequestsMissing

Set CPU requests for containers

Checks whether resources.requests.cpu is configured in the pod spec of a workload. If this setting is not configured, pods may be scheduled to nodes with insufficient CPU resources, which can cause slow performance.

Modify the pod spec to add a resources.requests.cpu field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        resources:
          requests:
            cpu: 100m

cpuLimitsMissing

Set CPU limits for containers

Checks whether resources.limits.cpu is configured in the pod spec of a workload. If this setting is not configured, abnormal processes in a container may consume excessive node resources, potentially exhausting the CPU resources of the node or the entire cluster.

Modify the pod spec to add a resources.limits.cpu field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        resources:
          requests:
            cpu: 100m
          limits:
            cpu: 100m

memoryRequestsMissing

Set memory requests for containers

Checks whether resources.requests.memory is configured in the pod spec of a workload. If this setting is not configured, pods may be scheduled to nodes with insufficient memory, leading to out-of-memory (OOM) errors.

Modify the pod spec to add a resources.requests.memory field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        resources:
          requests:
            cpu: 100m
            memory: 128Mi

memoryLimitsMissing

Set memory limits for containers

Checks whether resources.limits.memory is configured in the pod spec of a workload. If this setting is not configured, abnormal processes in a container may consume excessive node resources, potentially exhausting the memory of the node or the entire cluster.

Modify the pod spec to add a resources.limits.memory field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 100m
            memory: 128Mi

readinessProbeMissing

Configure readiness probes for containers

Checks whether a readinessProbe is configured in the pod spec of a workload. Without a readiness probe, traffic may be sent to a container before it is ready to serve requests, which can cause application errors.

Modify the pod spec to add a readinessProbe field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 20

livenessProbeMissing

Configure liveness probes for containers

Checks whether a livenessProbe is configured in the pod spec of a workload. Without a liveness probe, an unresponsive container is not automatically restarted, which can lead to application downtime.

Modify the pod spec to add a livenessProbe field.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 20

tagNotSpecified

Use a specific image tag for containers

Checks whether the image field in the pod spec of a workload lacks an image tag or uses the latest tag. If a specific image tag is not used, the workload might run an unexpected version of the container image, which can cause application errors.

Modify the image field in the pod spec to use a specific image tag. Do not use the latest tag.

Example:

    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2

anonymousUserRBACBinding

Prohibit anonymous user access to the cluster

Checks the Role-Based Access Control (RBAC) bindings in the cluster to find any configurations that grant access to anonymous users. If anonymous access is allowed, malicious users can steal sensitive information or attack the cluster.

Modify the RBAC bindings to remove any permissions that allow anonymous users to access cluster resources.

Example:

  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: 'foo-group'