Services in this catalog
- apiserver - 29 checks
- controllermanager - 7 checks
- core - 13 checks
- etcd - 7 checks
- kubelet - 16 checks
- rbac - 9 checks
- scheduler - 2 checks
apiserver
29 checks.| Check ID | Title | Severity |
|---|---|---|
apiserver_always_pull_images_plugin | API server pod has AlwaysPullImages admission control plugin enabled | MEDIUM |
apiserver_anonymous_requests | API server pod has anonymous-auth disabled | HIGH |
apiserver_audit_log_maxage_set | API server pod has —audit-log-maxage set to 30 (or the cluster-configured value) | MEDIUM |
apiserver_audit_log_maxbackup_set | API server pod has —audit-log-maxbackup set to 10 or the configured value | MEDIUM |
apiserver_audit_log_maxsize_set | API server pod has —audit-log-maxsize set to 100 MB or the configured value | MEDIUM |
apiserver_audit_log_path_set | API server pod has —audit-log-path set | HIGH |
apiserver_auth_mode_include_node | API server pod has Node in —authorization-mode | HIGH |
apiserver_auth_mode_include_rbac | API server pod authorization mode includes RBAC | HIGH |
apiserver_auth_mode_not_always_allow | API server pod does not use the AlwaysAllow authorization mode | CRITICAL |
apiserver_client_ca_file_set | API server pod has the —client-ca-file argument set | HIGH |
apiserver_deny_service_external_ips | API server pod has DenyServiceExternalIPs admission controller enabled | HIGH |
apiserver_disable_profiling | API server pod has profiling disabled (—profiling=false) | MEDIUM |
apiserver_encryption_provider_config_set | API server pod has the —encryption-provider-config argument set | HIGH |
apiserver_etcd_cafile_set | API server pod has the —etcd-cafile argument set | CRITICAL |
apiserver_etcd_tls_config | API server pod has —etcd-certfile and —etcd-keyfile configured for etcd TLS | CRITICAL |
apiserver_event_rate_limit | API server pod has the EventRateLimit admission control plugin enabled | MEDIUM |
apiserver_kubelet_cert_auth | API server pod has —kubelet-certificate-authority configured | CRITICAL |
apiserver_kubelet_tls_auth | API server pod has —kubelet-client-certificate and —kubelet-client-key arguments configured | CRITICAL |
apiserver_namespace_lifecycle_plugin | API server pod has NamespaceLifecycle admission control plugin enabled | HIGH |
apiserver_no_always_admit_plugin | API server pod does not have the AlwaysAdmit admission control plugin enabled | CRITICAL |
apiserver_no_token_auth_file | API server pod does not have —token-auth-file enabled | HIGH |
apiserver_node_restriction_plugin | API server pod has NodeRestriction admission control plugin enabled | HIGH |
apiserver_request_timeout_set | API server pod has —request-timeout configured | MEDIUM |
apiserver_security_context_deny_plugin | API server pod uses PodSecurityPolicy or has the SecurityContextDeny admission plugin enabled | HIGH |
apiserver_service_account_key_file_set | API server pod has —service-account-key-file configured | HIGH |
apiserver_service_account_lookup_true | API server pod has —service-account-lookup set to true | HIGH |
apiserver_service_account_plugin | API server pod has ServiceAccount admission control plugin enabled | HIGH |
apiserver_strong_ciphers_only | API Server pod uses only strong cryptographic TLS cipher suites | MEDIUM |
apiserver_tls_config | API server pod has —tls-cert-file and —tls-private-key-file configured | HIGH |
controllermanager
7 checks.| Check ID | Title | Severity |
|---|---|---|
controllermanager_bind_address | Controller Manager pod is bound to the loopback address 127.0.0.1 | HIGH |
controllermanager_disable_profiling | Controller Manager pod has —profiling=false configured | MEDIUM |
controllermanager_garbage_collection | Controller Manager pod does not use the default —terminated-pod-gc-threshold value | HIGH |
controllermanager_root_ca_file_set | Controller Manager pod has —root-ca-file argument set | CRITICAL |
controllermanager_rotate_kubelet_server_cert | Controller Manager pod has RotateKubeletServerCertificate set to true | MEDIUM |
controllermanager_service_account_credentials | Controller Manager pod has —use-service-account-credentials=true | HIGH |
controllermanager_service_account_private_key_file | Controller Manager pod has the —service-account-private-key-file argument set | HIGH |
core
13 checks.| Check ID | Title | Severity |
|---|---|---|
core_minimize_admission_hostport_containers | Pod does not use HostPorts | HIGH |
core_minimize_admission_windows_hostprocess_containers | Pod does not allow Windows HostProcess containers | HIGH |
core_minimize_allowPrivilegeEscalation_containers | Pod does not allow privilege escalation in any container | HIGH |
core_minimize_containers_added_capabilities | Pod has no containers with added capabilities | HIGH |
core_minimize_containers_capabilities_assigned | Pod containers have no added Linux capabilities and include capability drops when capabilities are defined | HIGH |
core_minimize_hostIPC_containers | Pod does not use the host IPC namespace | HIGH |
core_minimize_hostNetwork_containers | Pod does not use hostNetwork | HIGH |
core_minimize_hostPID_containers | Pod does not use the host PID namespace | HIGH |
core_minimize_net_raw_capability_admission | Pod containers do not have the NET_RAW capability | HIGH |
core_minimize_privileged_containers | Pod does not contain a privileged container | HIGH |
core_minimize_root_containers_admission | Pod does not run any container as the root user | HIGH |
core_no_secrets_envs | Pod does not contain secret environment variables | HIGH |
core_seccomp_profile_docker_default | Pod has the docker/default (RuntimeDefault) seccomp profile at pod level or for all containers | HIGH |
etcd
7 checks.| Check ID | Title | Severity |
|---|---|---|
etcd_client_cert_auth | Etcd pod has client certificate authentication enabled (—client-cert-auth=true) | HIGH |
etcd_no_auto_tls | Etcd pod has —auto-tls disabled | HIGH |
etcd_no_peer_auto_tls | Etcd pod does not use automatically generated self-signed certificates for peer TLS connections | HIGH |
etcd_peer_client_cert_auth | Etcd pod has peer client certificate authentication enabled | HIGH |
etcd_peer_tls_config | Etcd pod uses TLS for peer connections | HIGH |
etcd_tls_encryption | Etcd pod has TLS encryption configured | HIGH |
etcd_unique_ca | Etcd pod uses a unique Certificate Authority distinct from the Kubernetes API server CA | HIGH |
kubelet
16 checks.| Check ID | Title | Severity |
|---|---|---|
kubelet_authorization_mode | Kubelet —authorization-mode is not set to AlwaysAllow | HIGH |
kubelet_client_ca_file_set | Kubelet has a client CA file configured for authentication | HIGH |
kubelet_conf_file_ownership | Node kubelet.conf file ownership is set to root:root | HIGH |
kubelet_conf_file_permissions | Node kubelet.conf file permissions are set to 600 or more restrictive | HIGH |
kubelet_config_yaml_ownership | Node kubelet config.yaml file ownership is root:root | HIGH |
kubelet_config_yaml_permissions | Kubelet config.yaml file permissions on the node are set to 600 or more restrictive | HIGH |
kubelet_disable_anonymous_auth | Kubelet anonymous authentication is disabled | HIGH |
kubelet_disable_read_only_port | Kubelet read-only port is disabled (set to 0) | MEDIUM |
kubelet_event_record_qps | Kubelet eventRecordQPS is set to a positive value | HIGH |
kubelet_manage_iptables | Kubelet configuration has makeIPTablesUtilChains set to true | MEDIUM |
kubelet_rotate_certificates | Kubelet client certificate rotation is enabled | HIGH |
kubelet_service_file_ownership_root | Kubelet service file on the node is owned by root:root | HIGH |
kubelet_service_file_permissions | Node kubelet service file permissions are set to 600 or more restrictive | HIGH |
kubelet_streaming_connection_timeout | Kubelet streaming connection idle timeout is not set to 0 | MEDIUM |
kubelet_strong_ciphers_only | Kubelet uses only strong TLS cipher suites | MEDIUM |
kubelet_tls_cert_and_key | Kubelet has TLS certificate and private key files configured | HIGH |
rbac
9 checks.| Check ID | Title | Severity |
|---|---|---|
rbac_cluster_admin_usage | Cluster role binding does not grant the cluster-admin role | CRITICAL |
rbac_minimize_csr_approval_access | User or group lacks update and patch access to the certificatesigningrequests/approval sub-resource | HIGH |
rbac_minimize_node_proxy_subresource_access | User or group has no get, list, or watch permissions on the nodes/proxy sub-resource | HIGH |
rbac_minimize_pod_creation_access | Role or ClusterRole does not grant create permission on pods | HIGH |
rbac_minimize_pv_creation_access | User or group does not have permission to create PersistentVolumes | HIGH |
rbac_minimize_secret_access | Role or ClusterRole does not grant get, list, or watch access to Kubernetes Secrets | HIGH |
rbac_minimize_service_account_token_creation | User or group does not have permission to create service account tokens | HIGH |
rbac_minimize_webhook_config_access | User or group does not have create, update, or delete permissions on webhook configurations | HIGH |
rbac_minimize_wildcard_use_roles | Role or ClusterRole does not use wildcard resources or verbs | HIGH |
scheduler
2 checks.| Check ID | Title | Severity |
|---|---|---|
scheduler_bind_address | Scheduler pod has —bind-address set to 127.0.0.1 | HIGH |
scheduler_profiling | Scheduler pod has profiling disabled | MEDIUM |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.