Detections
Analytics

4.2.1 Ensure that the cluster enforces Pod Security Standard Baseline profile or stricter for all namespaces.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Pod Security Standard Baseline profile defines a baseline for container security. You can enforce this by using the built-in Pod Security Admission controller.

Without an active mechanism to enforce the Pod Security Standard Baseline profile, it is not possible to limit the use of containers with access to underlying cluster nodes, via mechanisms like privileged containers, or the use of hostPath volume mounts.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Ensure that Pod Security Admission is in place for every namespace which contains user workloads.

Run the following command to enforce the Baseline profile in a namespace:

kubectl label namespace <namespace-name> pod-security.kubernetes.io/enforce=baseline

Impact:

Enforcing a baseline profile will limit the use of containers.

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.1, CSCv7|5.2

Plugin: GCP

Control ID: 3bca10dc11b994bf4fbea8caadc4885ecb74a8291459e5df9ccf7abd3b36f530