5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller

Information

Configure Image Provenance for your deployment.

Rationale:

Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster.

Impact:

You need to regularly maintain your provenance configuration based on container image updates.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Follow the Kubernetes documentation and setup image provenance.

Default Value:

By default, image provenance is not set.

See Also

https://workbench.cisecurity.org/files/3891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|5.2

Plugin: Unix

Control ID: 3ea39c7be2629ddb91117c2a38d30d3ff125db2bb67acbf4acaaa2fadceb0fe2