API server enables the SecurityContextDeny admission plugin

​

What this check verifies

Kubernetes API server admission configuration is reviewed for PodSecurityPolicy or SecurityContextDeny, indicating whether pods using high-risk securityContext fields (privileged, host access, extra capabilities) would be blocked during admission.

​

Risk

Without these controls, pods can request privileged mode, host namespaces, or excessive capabilities, enabling container escape, node compromise, and data exfiltration. This undermines integrity and confidentiality, and can impact availability via lateral movement or disruptive actions.

​

Recommendation

Apply defense-in-depth at admission:

• Prefer Pod Security Admission with restricted policies
• For legacy clusters, enable SecurityContextDeny or an equivalent policy engine
• Enforce least privilege: set allowPrivilegeEscalation=false, drop unnecessary capabilities, and avoid host namespaces.

​

Remediation

Dashboard steps

1. SSH to a control-plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[0].command:
   • If —enable-admission-plugins=… exists, append “,SecurityContextDeny” to its list
   • If absent, add a new arg line: - —enable-admission-plugins=SecurityContextDeny
4. Save; the kubelet will restart the API server

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#securitycontextdeny

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_security_context_deny_plugin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks