Detections
Analytics

CNTR-K8-002001 - Kubernetes must have a Pod Security Admission feature gate set.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

'In order to implement Pod Security Admission controller feature gates must be enabled.

Feature gates are a set of key=value pairs that describe Kubernetes features. You can turn these features on or off using the --feature-gates command line flag on each Kubernetes component.'

Solution

Add the '--feature-gates=PodSecurity=true' argument to every component of Kubernetes.

kube-apiserver, kube-controller-manager and kube-scheduler:
These components are started as static pods, you can find their manifests in the /etc/kubernetes/manifests/ folder.
add '--feature-gates=PodSecurity=true' argument in each of the files.

Kubelet:
Edit the Kubernetes Kubelet file in the --config directory on the Kubernetes Control Plane:
Add '--feature-gates=PodSecurity=true'

Reset Kubelet service using the following command:
service kubelet restart

Note: if your cluster has multiple nodes you will need to make the changes on every node where the components are deployed.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R8_STIG.zip

Item Details

References: CAT|I, CCI|CCI-002263, Rule-ID|SV-254801r864044_rule, STIG-ID|CNTR-K8-002001, Vuln-ID|V-254801

Plugin: Unix

Control ID: 1916f219a982951e3c202aaf4fcf732e0d8a4722fb8c7e1c069b68bd7c7a4376