| V-242381 | | The Kubernetes Controller Manager must create unique service accounts for each work payload. | The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the API Server. Every... |
| V-242383 | | User-managed resources must be created in dedicated namespaces. | Creating namespaces for user-managed resources is important when implementing Role-Based Access Controls (RBAC). RBAC allows for the authorization of ... |
| V-242386 | | The Kubernetes API server must have the insecure port flag disabled. | By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also ... |
| V-242387 | | The Kubernetes Kubelet must have the "readOnlyPort" flag disabled. | Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no authentication or authorization security... |
| V-242388 | | The Kubernetes API server must have the insecure bind address not set. | By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the "insecure bin... |
| V-242390 | | The Kubernetes API server must have anonymous authentication disabled. | The Kubernetes API Server controls Kubernetes via an API interface. A user who has access to the API essentially has root access to the entire Kuberne... |
| V-242391 | | The Kubernetes Kubelet must have anonymous authentication disabled. | A user who has access to the Kubelet essentially has root access to the nodes contained within the Kubernetes Control Plane. To control access, users ... |
| V-242392 | | The Kubernetes kubelet must enable explicit authorization. | Kubelet is the primary agent on each node. The API server communicates with each kubelet to perform tasks such as starting/stopping pods. By default, ... |
| V-242397 | | The Kubernetes kubelet staticPodPath must not enable static pods. | Allowing kubelet to set a staticPodPath gives containers with root access permissions to traverse the hosting filesystem. The danger comes when the co... |
| V-242415 | | Secrets in Kubernetes must not be stored as environment variables. | Secrets, such as passwords, keys, tokens, and certificates must not be stored as environment variables. These environment variables are accessible ins... |
| V-242434 | | Kubernetes Kubelet must enable kernel protection. | System kernel is responsible for memory, disk, and task management. The kernel provides a gateway between the system hardware and software. Kubernetes... |
| V-242436 | | The Kubernetes API server must have the ValidatingAdmissionWebhook enabled. | Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated, or deleted. By applying... |
| V-242437 | | Kubernetes must have a pod security policy set. | Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated, or deleted. By applying... |
| V-245542 | | Kubernetes API Server must disable basic authentication to protect information in transit. | Kubernetes basic authentication sends and receives request containing username, uid, groups, and other fields over a clear text HTTP communication. Ba... |
| V-245543 | | Kubernetes API Server must disable token authentication to protect information in transit. | Kubernetes token authentication uses password known as secrets in a plaintext file. This file contains sensitive information such as token, username a... |
| V-245544 | | Kubernetes endpoints must use approved organizational certificate and key pair to protect information in transit. | Kubernetes control plane and external communication is managed by API Server. The main implementation of the API Server is to manage hardware resource... |
| V-254800 | | Kubernetes must have a Pod Security Admission control file configured. | An admission controller intercepts and processes requests to the Kubernetes API prior to persistence of the object, but after the request is authentic... |
| V-254801 | | Kubernetes must enable PodSecurity admission controller on static pods and Kubelets. | PodSecurity admission controller is a component that validates and enforces security policies for pods running within a Kubernetes cluster. It is resp... |
| V-274882 | | Kubernetes Secrets must be encrypted at rest. | Kubernetes Secrets may store sensitive information such as passwords, tokens, and keys. These values are stored in the etcd database used by Kubernete... |
| V-274883 | | Sensitive information must be stored using Kubernetes Secrets or an external Secret store provider. | Sensitive information, such as passwords, keys, and tokens must not be stored in application code.
Kubernetes offers a resource called Secrets that a... |
| V-242376 | | The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. | The Kubernetes Controller Manager will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.
The use o... |
| V-242377 | | The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. | The Kubernetes Scheduler will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.
The use of unsuppo... |
| V-242378 | | The Kubernetes API Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. | The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.
The use of unsupp... |
| V-242379 | | The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination. | Kubernetes etcd will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.
The use of unsupported prot... |
| V-242380 | | The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination. | The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication.
The use of unsupp... |
| V-242382 | | The Kubernetes API Server must enable Node,RBAC as the authorization mode. | To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD syst... |
| V-242384 | | The Kubernetes Scheduler must have secure binding. | Limiting the number of attack vectors and implementing authentication and encryption on the endpoints available to external sources is paramount when ... |
| V-242385 | | The Kubernetes Controller Manager must have secure binding. | Limiting the number of attack vectors and implementing authentication and encryption on the endpoints available to external sources is paramount when ... |
| V-242389 | | The Kubernetes API server must have the secure port set. | By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication ... |
| V-242393 | | Kubernetes Worker Nodes must not have sshd service running. | Worker Nodes are maintained and monitored by the Control Plane. Direct access and manipulation of the nodes should not take place by administrators. W... |
| V-242394 | | Kubernetes Worker Nodes must not have the sshd service enabled. | Worker Nodes are maintained and monitored by the Control Plane. Direct access and manipulation of the nodes must not take place by administrators. Wor... |
| V-242395 | | Kubernetes dashboard must not be enabled. | While the Kubernetes dashboard is not inherently insecure on its own, it is often coupled with a misconfiguration of Role-Based Access control (RBAC) ... |
| V-242396 | | Kubernetes Kubectl cp command must give expected access and results. | One of the tools heavily used to interact with containers in the Kubernetes cluster is kubectl. The command is the tool System Administrators used to ... |
| V-242398 | | Kubernetes DynamicAuditing must not be enabled. | Protecting the audit data from change or deletion is important when an attack occurs. One way an attacker can cover their tracks is to change or delet... |
| V-242399 | | Kubernetes DynamicKubeletConfig must not be enabled. | Kubernetes allows a user to configure kubelets with dynamic configurations. When dynamic configuration is used, the kubelet will watch for changes to ... |
| V-242400 | | The Kubernetes API server must have Alpha APIs disabled. | Kubernetes allows alpha API calls within the API server. The alpha features are disabled by default since they are not ready for production and likely... |
| V-242402 | | The Kubernetes API Server must have an audit log path set. | When Kubernetes is started, components and user services are started for auditing startup events, and events for components and services, it is import... |
| V-242403 | | Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event. | Within Kubernetes, audit data for all components is generated by the API server. This audit data is important when there are issues, to include securi... |
| V-242404 | | Kubernetes Kubelet must deny hostname override. | Kubernetes allows for the overriding of hostnames. Allowing this feature to be implemented within the kubelets may break the TLS setup between the kub... |
| V-242405 | | The Kubernetes manifests must be owned by root. | The manifest files contain the runtime configuration of the API server, proxy, scheduler, controller, and etcd. If an attacker can gain access to thes... |
| V-242406 | | The Kubernetes KubeletConfiguration file must be owned by root. | The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be ... |
| V-242407 | | The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive. | The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be ... |
| V-242408 | | The Kubernetes manifest files must have least privileges. | The manifest files contain the runtime configuration of the API server, scheduler, controller, and etcd. If an attacker can gain access to these files... |
| V-242409 | | Kubernetes Controller Manager must disable profiling. | Kubernetes profiling provides the ability to analyze and troubleshoot Controller Manager events over a web interface on a host port. Enabling this ser... |
| V-242410 | | The Kubernetes API Server must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). | Kubernetes API Server PPSs must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be blocked. Instructions on t... |
| V-242411 | | The Kubernetes Scheduler must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). | Kubernetes Scheduler PPS must be controlled and conform to the PPSM CAL. Those ports, protocols, and services that fall outside the PPSM CAL must be b... |
| V-242412 | | The Kubernetes Controllers must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). | Kubernetes Controller ports, protocols, and services must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be ... |
| V-242413 | | The Kubernetes etcd must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). | Kubernetes etcd PPS must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be blocked. Instructions on the PPSM... |
| V-242414 | | The Kubernetes cluster must use non-privileged host ports for user pods. | Privileged ports are those ports below 1024 and that require system privileges for their use. If containers can use these ports, the container must be... |
| V-242417 | | Kubernetes must separate user functionality. | Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the s... |
| V-242418 | | The Kubernetes API server must use approved cipher suites. | The Kubernetes API server communicates to the kubelet service on the nodes to deploy, update, and delete resources. If an attacker were able to get be... |
| V-242419 | | Kubernetes API Server must have the SSL Certificate Authority set. | Kubernetes control plane and external communication are managed by API Server. The main implementation of the API Server is to manage hardware resourc... |
| V-242420 | | Kubernetes Kubelet must have the SSL Certificate Authority set. | Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and per... |
| V-242421 | | Kubernetes Controller Manager must have the SSL Certificate Authority set. | The Kubernetes Controller Manager is responsible for creating service accounts and tokens for the API Server, maintaining the correct number of pods f... |
| V-242422 | | Kubernetes API Server must have a certificate for communication. | Kubernetes control plane and external communication is managed by API Server. The main implementation of the API Server is to manage hardware resource... |
| V-242423 | | Kubernetes etcd must enable client authentication to secure service. | Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and per... |
| V-242424 | | Kubernetes Kubelet must enable tlsPrivateKeyFile for client authentication to secure service. | Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and per... |
| V-242425 | | Kubernetes Kubelet must enable tlsCertFile for client authentication to secure service. | Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and per... |
| V-242426 | | Kubernetes etcd must enable client authentication to secure service. | Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and per... |
| V-242427 | | Kubernetes etcd must have a key file for secure communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242428 | | Kubernetes etcd must have a certificate for communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242429 | | Kubernetes etcd must have the SSL Certificate Authority set. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242430 | | Kubernetes etcd must have a certificate for communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242431 | | Kubernetes etcd must have a key file for secure communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242432 | | Kubernetes etcd must have peer-cert-file set for secure communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242433 | | Kubernetes etcd must have a peer-key-file set for secure communication. | Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively contr... |
| V-242438 | | Kubernetes API Server must configure timeouts to limit attack surface. | Kubernetes API Server request timeouts sets the duration a request stays open before timing out. Since the API Server is the central component in the ... |
| V-242442 | | Kubernetes must remove old components after updated versions have been installed. | Previous versions of Kubernetes components that are not removed after updates have been installed may be exploited by adversaries by allowing the vuln... |
| V-242443 | | Kubernetes must contain the latest updates as authorized by IAVMs, CTOs, DTMs, and STIGs. | Kubernetes software must stay up to date with the latest patches, service packs, and hot fixes. Not updating the Kubernetes control plane will expose ... |
| V-242444 | | The Kubernetes component manifests must be owned by root. | The Kubernetes manifests are those files that contain the arguments and settings for the Control Plane services. These services are etcd, the api serv... |
| V-242445 | | The Kubernetes component etcd must be owned by etcd. | The Kubernetes etcd key-value store provides a way to store data to the Control Plane. If these files can be changed, data to API object and the Contr... |
| V-242446 | | The Kubernetes conf files must be owned by root. | The Kubernetes conf files contain the arguments and settings for the Control Plane services. These services are controller and scheduler. If these fil... |
| V-242447 | | The Kubernetes Kube Proxy kubeconfig must have file permissions set to 644 or more restrictive. | The Kubernetes Kube Proxy kubeconfig contain the argument and setting for the Control Planes. These settings contain network rules for restricting net... |
| V-242448 | | The Kubernetes Kube Proxy kubeconfig must be owned by root. | The Kubernetes Kube Proxy kubeconfig contain the argument and setting for the Control Planes. These settings contain network rules for restricting net... |
| V-242449 | | The Kubernetes Kubelet certificate authority file must have file permissions set to 644 or more restrictive. | The Kubernetes kubelet certificate authority file contains settings for the Kubernetes Node TLS certificate authority. Any request presenting a client... |
| V-242450 | | The Kubernetes Kubelet certificate authority must be owned by root. | The Kubernetes kube proxy kubeconfig contain the argument and setting for the Control Planes. These settings contain network rules for restricting net... |
| V-242451 | | The Kubernetes component PKI must be owned by root. | The Kubernetes PKI directory contains all certificates (.crt files) supporting secure network communications in the Kubernetes Control Plane. If these... |
| V-242452 | | The Kubernetes kubelet KubeConfig must have file permissions set to 644 or more restrictive. | The Kubernetes kubelet agent registers nodes with the API Server, mounts volume storage for pods, and performs health checks to containers within pods... |
| V-242453 | | The Kubernetes kubelet KubeConfig file must be owned by root. | The Kubernetes kubelet agent registers nodes with the API server and performs health checks to containers within pods. If these files can be modified,... |
| V-242454 | | The Kubernetes kubeadm.conf must be owned by root. | The Kubernetes kubeeadm.conf contains sensitive information regarding the cluster nodes configuration. If this file can be modified, the Kubernetes Pl... |
| V-242455 | | The Kubernetes kubeadm.conf must have file permissions set to 644 or more restrictive. | The Kubernetes kubeadm.conf contains sensitive information regarding the cluster nodes configuration. If this file can be modified, the Kubernetes Pla... |
| V-242456 | | The Kubernetes kubelet config must have file permissions set to 644 or more restrictive. | The Kubernetes kubelet agent registers nodes with the API server and performs health checks to containers within pods. If this file can be modified, t... |
| V-242457 | | The Kubernetes kubelet config must be owned by root. | The Kubernetes kubelet agent registers nodes with the API Server and performs health checks to containers within pods. If this file can be modified, t... |
| V-242459 | | The Kubernetes etcd must have file permissions set to 644 or more restrictive. | The Kubernetes etcd key-value store provides a way to store data to the Control Plane. If these files can be changed, data to API object and Control P... |
| V-242460 | | The Kubernetes admin kubeconfig must have file permissions set to 644 or more restrictive. | The Kubernetes admin kubeconfig files contain the arguments and settings for the Control Plane services. These services are controller and scheduler. ... |
| V-242461 | | Kubernetes API Server audit logs must be enabled. | Kubernetes API Server validates and configures pods and services for the API object. The REST operation provides frontend functionality to the cluster... |
| V-242462 | | The Kubernetes API Server must be set to audit log max size. | The Kubernetes API Server must be set for enough storage to retain log information over the period required. When audit logs are large in size, the mo... |
| V-242463 | | The Kubernetes API Server must be set to audit log maximum backup. | The Kubernetes API Server must set enough storage to retain logs for monitoring suspicious activity and system misconfiguration, and provide evidence ... |
| V-242464 | | The Kubernetes API Server audit log retention must be set. | The Kubernetes API Server must set enough storage to retain logs for monitoring suspicious activity and system misconfiguration, and provide evidence ... |
| V-242465 | | The Kubernetes API Server audit log path must be set. | Kubernetes API Server validates and configures pods and services for the API object. The REST operation provides frontend functionality to the cluster... |
| V-242466 | | The Kubernetes PKI CRT must have file permissions set to 644 or more restrictive. | The Kubernetes PKI directory contains all certificates (.crt files) supporting secure network communications in the Kubernetes Control Plane. If these... |
| V-242467 | | The Kubernetes PKI keys must have file permissions set to 600 or more restrictive. | The Kubernetes PKI directory contains all certificate key files supporting secure network communications in the Kubernetes Control Plane. If these fil... |
| V-245541 | | Kubernetes Kubelet must not disable timeouts. | Idle connections from the Kubelet can be used by unauthorized users to perform malicious activity to the nodes, pods, containers, and cluster within t... |
| V-274884 | | Kubernetes must limit Secret access on a need-to-know basis. | Kubernetes secrets may store sensitive information such as passwords, tokens, and keys. Access to these secrets should be limited to a need-to-know ba... |
