1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true | SYSTEM AND COMMUNICATIONS PROTECTION |
2.7 Ensure that a unique Certificate Authority is used for etcd | CONFIGURATION MANAGEMENT |
3.2.2 Ensure that the audit policy covers key security concerns | AUDIT AND ACCOUNTABILITY |
5.2.6 Minimize the admission of root containers | CONFIGURATION MANAGEMENT |
5.2.9 Minimize the admission of containers with capabilities assigned | CONFIGURATION MANAGEMENT |
5.3.2 Ensure that all Namespaces have Network Policies defined | SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
5.4.1 Prefer using secrets as files over secrets as environment variables | SYSTEM AND COMMUNICATIONS PROTECTION |
5.4.2 Consider external secret storage | SYSTEM AND COMMUNICATIONS PROTECTION |
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller | |
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions | |
5.7.3 Apply Security Context to Your Pods and Containers | |
5.7.4 The default namespace should not be used | ACCESS CONTROL |
CIS_Kubernetes_v1.6.1_Level_2_Master.audit from CIS Kubernetes Benchmark v1.6.1 | CONFIGURATION MANAGEMENT |