Detections
Analytics

5.3.1 Ensure that the CNI in use supports Network Policies

Information

There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster.

Kubernetes network policies are enforced by the CNI plugin in use. As such it is important to ensure that the CNI plugin supports both Ingress and Egress network policies.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

If the CNI plugin in use does not support network policies, consideration should be given to making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster.

Impact:

None

See Also

https://workbench.cisecurity.org/benchmarks/26831

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CA-9, 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.5

Plugin: Unix

Control ID: 5725465b2a3b2438367809f4fc06d92c9057bec2ec08b07fe8c55622b93daf62