Control: Kubernetes cluster containers should not share host process ID or host IPC namespace

Description

Block pod containers from sharing the host process ID namespace and host IPC namespace in a Kubernetes cluster. This recommendation is part of CIS 5.2.2 and CIS 5.2.3 which are intended to improve the security of your Kubernetes environments. This policy is generally available for Kubernetes Service (AKS), and preview for Azure Arc enabled Kubernetes. For more information, see https://aka.ms/kubepolicydoc.

Usage

Run the control in your terminal:

powerpipe control run azure_compliance.control.kubernetes_cluster_container_host_process_id_not_shared

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run azure_compliance.control.kubernetes_cluster_container_host_process_id_not_shared --share

SQL

This control uses a named query:

select
  id as resource,
  'info' as status,
  'Manual verification required.' as reason,
  display_name as subscription
from
  azure_subscription;

Control: Kubernetes cluster containers should not share host process ID or host IPC namespace

Description

Usage

SQL

Tags