Detections
Analytics

Item Search

NameAudit NamePluginCategory
1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictiveCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictiveCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictiveCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictiveCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootCIS Kubernetes Benchmark v1.6.1 L1 MasterUnix
3.1.2 Ensure that the proxy kubeconfig file ownership is set to root:rootCIS Google Kubernetes Engine (GKE) v1.1.0 L1 WorkerUnix
3.1.3 Ensure that the kubelet configuration file has permissions set to 644 or more restrictiveCIS Google Kubernetes Engine (GKE) v1.4.0 L1 NodeUnix
4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictiveCIS Kubernetes Benchmark v1.6.1 L1 WorkerUnix
4.1.2 Minimize access to secretsCIS Google Kubernetes Engine (GKE) v1.1.0 L1 MasterGCP
4.1.2 Minimize access to secretsCIS Google Kubernetes Engine (GKE) v1.3.0 L1GCP
4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:rootCIS Kubernetes Benchmark v1.6.1 L1 WorkerUnix
4.1.4 Minimize access to create podsCIS Google Kubernetes Engine (GKE) v1.1.0 L1 MasterGCP
4.1.6 Ensure that Service Account Tokens are only mounted where necessaryCIS Google Kubernetes Engine (GKE) v1.1.0 L1 MasterGCP
4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictiveCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictiveCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
4.2 Ensure that containers use only trusted base imagesCIS Docker v1.3.1 L1 Docker LinuxUnix
4.2.7 Minimize the admission of containers with the NET_RAW capabilityCIS Google Kubernetes Engine (GKE) v1.1.0 L1 MasterGCP
4.2.8 Minimize the admission of containers with added capabilitiesCIS Google Kubernetes Engine (GKE) v1.1.0 L1 MasterGCP
4.3 Ensure that unnecessary packages are not installed in the containerCIS Docker v1.3.1 L1 Docker LinuxUnix
4.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS Google Kubernetes Engine (GKE) v1.1.0 L2 MasterGCP
4.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS Google Kubernetes Engine (GKE) v1.3.0 L2GCP
4.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS Google Kubernetes Engine (GKE) v1.4.0 L2GCP
5.1.4 Minimize Container Registries to only those approvedCIS Google Kubernetes Engine (GKE) v1.4.0 L2GCP
5.2.2 Minimize the admission of containers wishing to share the host process ID namespaceCIS RedHat OpenShift Container Platform 4 v1.2.0 L1OpenShift
5.2.2 Minimize the admission of containers wishing to share the host process ID namespaceCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
5.2.7 Minimize the admission of containers with the NET_RAW capabilityCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.2.7 Minimize the admission of containers with the NET_RAW capabilityCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
5.2.7 Minimize the admission of containers with the NET_RAW capabilityCIS RedHat OpenShift Container Platform 4 v1.5.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - defaultAddCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.3.0 L1OpenShift
5.2.8 Minimize the admission of containers with added capabilities - defaultAddCapabilitiesCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.2.8 Minimize the admission of containers with the NET_RAW capabilityCIS Kubernetes Benchmark v1.8.0 L1 MasterUnix
5.2.9 Minimize the admission of containers with capabilities assignedCIS RedHat OpenShift Container Platform 4 v1.2.0 L2OpenShift
5.2.9 Minimize the admission of containers with capabilities assignedCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.2.9 Minimize the admission of containers with capabilities assignedCIS RedHat OpenShift Container Platform 4 v1.5.0 L2OpenShift
5.2.9 Minimize the admission of containers with capabilities assignedCIS RedHat OpenShift Container Platform 4 v1.3.0 L2OpenShift
5.4.2 Ensure the GKE Metadata Server is EnabledCIS Google Kubernetes Engine (GKE) v1.3.0 L2GCP
5.5.1 Ensure Container-Optimized OS (cos_containerd) is used for GKE node imagesCIS Google Kubernetes Engine (GKE) v1.4.0 L2GCP
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS RedHat OpenShift Container Platform 4 v1.2.0 L2OpenShift
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS RedHat OpenShift Container Platform 4 v1.5.0 L2OpenShift
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS Kubernetes Benchmark v1.8.0 L2 MasterUnix
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS Kubernetes Benchmark v1.7.1 L2 MasterUnix
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS RedHat OpenShift Container Platform 4 v1.4.0 L1OpenShift
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitionsCIS RedHat OpenShift Container Platform 4 v1.4.0 L2OpenShift
5.10.5 Ensure use of Binary AuthorizationCIS Google Kubernetes Engine (GKE) v1.1.0 L2 MasterGCP
5.18 Ensure that the default ulimit is overwritten at runtime if neededCIS Docker v1.5.0 L1 Docker LinuxUnix
5.18 Ensure that the default ulimit is overwritten at runtime if neededCIS Docker v1.3.1 L1 Docker LinuxUnix
5.27 Ensure that Docker commands always make use of the latest version of their imageCIS Docker v1.3.1 L1 Docker LinuxUnix
5.28 Ensure that the PIDs cgroup limit is usedCIS Docker v1.5.0 L1 Docker LinuxUnix