Detections
Analytics

4.6.3 Require hardened security contexts for all workload Pods and containers

Information

Require hardened security contexts for GKE Autopilot workload Pods and containers. Security contexts should define workload level and container level controls that reduce privilege, limit host exposure, and enforce safer runtime behavior.

Security contexts control important runtime security settings for Pods and containers, including user and group identity, privilege escalation, Linux capabilities, privileged mode, seccomp profile, and related container isolation settings. GKE Autopilot applies multiple Pod security constraints by default, but workload manifests should still define applicable security context settings for controls that remain workload configurable.

A hardened configuration should normally include settings such as runAsNonRoot=true, allowPrivilegeEscalation=false, privileged=false, dropped Linux capabilities, and the RuntimeDefault seccomp profile where explicitly specified. Custom Localhost seccomp profiles are not supported in GKE Autopilot, and Unconfined should be limited to documented exceptions. These align with restricted Pod security expectations and can also be enforced or audited with admission controls such as Pod Security Admission and Policy Controller.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Update workload manifests, Helm charts, overlays, or GitOps sources so hardened security contexts are defined before deployment. Apply settings at the Pod level when they apply to all containers, and use container level settings where a specific container requires a different configuration.

 -

Set workloads to run as non root where compatible.

 -

Set allowPrivilegeEscalation=false for workload containers.

 -

Set privileged=false and remove host level access unless explicitly required.

 -

Drop unnecessary Linux capabilities, and use drop: ["ALL"] where the application supports it.

 -

Set seccompProfile.type=RuntimeDefault where seccomp is explicitly defined, and remove unsupported custom Localhost seccomp profiles from GKE Autopilot workloads.

Redeploy the workload and validate application behavior in a lower environment before broad rollout. Use admission controls such as Pod Security Admission or Policy Controller to prevent future workloads from being admitted without the required security context settings.

Impact:

Incorrectly configured security contexts can cause workloads to fail at startup or lose required runtime behavior, especially applications that expect root privileges, writable root filesystems, elevated capabilities, host access, or unrestricted system calls. Teams should test hardened settings in lower environments, document approved exceptions, and apply container level overrides only where a specific workload requirement exists.

See Also

https://workbench.cisecurity.org/benchmarks/24958

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, CSCv7|5.1

Plugin: GCP

Control ID: fd40b1a8e5cde8d2d0331edec219a4fba2839866f76163f18402e3008292e83d