--- controls: version: "cis-1.9" id: 5 text: "Kubernetes Policies" type: "policies" groups: - id: 5.1 text: "RBAC and Service Accounts" checks: - id: 5.1.1 text: "Ensure that the cluster-admin role is only used where required (Automated)" audit: | kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name --no-headers | while read -r role_name role_binding subject do if [[ "${role_name}" != "cluster-admin" && "${role_binding}" == "cluster-admin" ]]; then is_compliant="false" else is_compliant="true" fi; echo "**role_name: ${role_name} role_binding: ${role_binding} subject: ${subject} is_compliant: ${is_compliant}" done use_multiple_values: true tests: test_items: - flag: "is_compliant" compare: op: eq value: true remediation: | Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name] Condition: is_compliant is false if rolename is not cluster-admin and rolebinding is cluster-admin. scored: true - id: 5.1.2 text: "Minimize access to secrets (Automated)" audit: "echo \"canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)\"" tests: test_items: - flag: "canGetListWatchSecretsAsSystemAuthenticated" compare: op: eq value: no remediation: | Where possible, remove get, list and watch access to Secret objects in the cluster. scored: true - id: 5.1.3 text: "Minimize wildcard use in Roles and ClusterRoles (Automated)" audit: | # Check Roles kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name do role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules') if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then role_is_compliant="false" else role_is_compliant="true" fi; echo "**role_name: ${role_name} role_namespace: ${role_namespace} role_rules: ${role_rules} role_is_compliant: ${role_is_compliant}" done # Check ClusterRoles kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name do clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules') if echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then clusterrole_is_compliant="false" else clusterrole_is_compliant="true" fi; echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} clusterrole_is_compliant: ${clusterrole_is_compliant}" done use_multiple_values: true tests: bin_op: or test_items: - flag: "role_is_compliant" compare: op: eq value: true set: true - flag: "clusterrole_is_compliant" compare: op: eq value: true set: true remediation: | Where possible replace any use of wildcards ["*"] in roles and clusterroles with specific objects or actions. Condition: role_is_compliant is false if ["*"] is found in rules. Condition: clusterrole_is_compliant is false if ["*"] is found in rules. scored: true - id: 5.1.4 text: "Minimize access to create pods (Automated)" audit: | echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)" tests: test_items: - flag: "canCreatePodsAsSystemAuthenticated" compare: op: eq value: no remediation: | Where possible, remove create access to pod objects in the cluster. scored: true - id: 5.1.5 text: "Ensure that default service accounts are not actively used (Automated)" audit: | kubectl get serviceaccount --all-namespaces --field-selector metadata.name=default -o=json | jq -r '.items[] | " namespace: \(.metadata.namespace), kind: \(.kind), name: \(.metadata.name), automountServiceAccountToken: \(.automountServiceAccountToken | if . == null then "notset" else . end )"' | xargs -L 1 use_multiple_values: true tests: test_items: - flag: "automountServiceAccountToken" compare: op: eq value: false set: true remediation: | Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value `automountServiceAccountToken: false`. scored: true - id: 5.1.6 text: "Ensure that Service Account Tokens are only mounted where necessary (Automated)" audit: | kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken do # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or . svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's//notset/g' -e 's/null/notset/g') pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's//notset/g' -e 's/null/notset/g') if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then is_compliant="true" elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then is_compliant="true" else is_compliant="false" fi echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}" done use_multiple_values: true tests: test_items: - flag: "is_compliant" compare: op: eq value: true remediation: | Modify the definition of ServiceAccounts and Pods which do not need to mount service account tokens to disable it, with `automountServiceAccountToken: false`. If both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence. Condition: Pod is_compliant to true when - ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset - ServiceAccount is automountServiceAccountToken: true notset and Pod is automountServiceAccountToken: false scored: true - id: 5.1.7 text: "Avoid use of system:masters group (Manual)" type: "manual" remediation: | Remove the system:masters group from all users in the cluster. scored: false - id: 5.1.8 text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)" type: "manual" remediation: | Where possible, remove the impersonate, bind and escalate rights from subjects. scored: false - id: 5.1.9 text: "Minimize access to create persistent volumes (Manual)" type: "manual" remediation: | Where possible, remove create access to PersistentVolume objects in the cluster. scored: false - id: 5.1.10 text: "Minimize access to the proxy sub-resource of nodes (Manual)" type: "manual" remediation: | Where possible, remove access to the proxy sub-resource of node objects. scored: false - id: 5.1.11 text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)" type: "manual" remediation: | Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. scored: false - id: 5.1.12 text: "Minimize access to webhook configuration objects (Manual)" type: "manual" remediation: | Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects scored: false - id: 5.1.13 text: "Minimize access to the service account token creation (Manual)" type: "manual" remediation: | Where possible, remove access to the token sub-resource of serviceaccount objects. scored: false - id: 5.2 text: "Pod Security Standards" checks: - id: 5.2.1 text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)" type: "manual" remediation: | Ensure that either Pod Security Admission or an external policy control system is in place for every namespace which contains user workloads. scored: false - id: 5.2.2 text: "Minimize the admission of privileged containers (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of privileged containers. scored: false - id: 5.2.3 text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostPID` containers. scored: false - id: 5.2.4 text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers. scored: false - id: 5.2.5 text: "Minimize the admission of containers wishing to share the host network namespace (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostNetwork` containers. scored: false - id: 5.2.6 text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. scored: false - id: 5.2.7 text: "Minimize the admission of root containers (Manual)" type: "manual" remediation: | Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` or `MustRunAs` with the range of UIDs not including 0, is set. scored: false - id: 5.2.8 text: "Minimize the admission of containers with the NET_RAW capability (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with the `NET_RAW` capability. scored: false - id: 5.2.9 text: "Minimize the admission of containers with added capabilities (Manual)" type: "manual" remediation: | Ensure that `allowedCapabilities` is not present in policies for the cluster unless it is set to an empty array. scored: false - id: 5.2.10 text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | Review the use of capabilites in applications running on your cluster. Where a namespace contains applicaions which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false - id: 5.2.11 text: "Minimize the admission of Windows HostProcess containers (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. scored: false - id: 5.2.12 text: "Minimize the admission of HostPath volumes (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `hostPath` volumes. scored: false - id: 5.2.13 text: "Minimize the admission of containers which use HostPorts (Manual)" type: "manual" remediation: | Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which use `hostPort` sections. scored: false - id: 5.3 text: "Network Policies and CNI" checks: - id: 5.3.1 text: "Ensure that the CNI in use supports NetworkPolicies (Manual)" type: "manual" remediation: | If the CNI plugin in use does not support network policies, consideration should be given to making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster. scored: false - id: 5.3.2 text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)" type: "manual" remediation: | Follow the documentation and create NetworkPolicy objects as you need them. scored: false - id: 5.4 text: "Secrets Management" checks: - id: 5.4.1 text: "Prefer using Secrets as files over Secrets as environment variables (Manual)" type: "manual" remediation: | If possible, rewrite application code to read Secrets from mounted secret files, rather than from environment variables. scored: false - id: 5.4.2 text: "Consider external secret storage (Manual)" type: "manual" remediation: | Refer to the Secrets management options offered by your cloud provider or a third-party secrets management solution. scored: false - id: 5.5 text: "Extensible Admission Control" checks: - id: 5.5.1 text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)" type: "manual" remediation: | Follow the Kubernetes documentation and setup image provenance. scored: false - id: 5.7 text: "General Policies" checks: - id: 5.7.1 text: "Create administrative boundaries between resources using namespaces (Manual)" type: "manual" remediation: | Follow the documentation and create namespaces for objects in your deployment as you need them. scored: false - id: 5.7.2 text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)" type: "manual" remediation: | Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. An example is as below: securityContext: seccompProfile: type: RuntimeDefault scored: false - id: 5.7.3 text: "Apply SecurityContext to your Pods and Containers (Manual)" type: "manual" remediation: | Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker Containers. scored: false - id: 5.7.4 text: "The default namespace should not be used (Manual)" type: "manual" remediation: | Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace. scored: false