Benchmark: ReplicaSet
Description
This section contains recommendations for configuring ReplicaSet resources.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/steampipe-mod-kubernetes-complianceStart the Powerpipe server:
steampipe service startpowerpipe serverOpen http://localhost:9033 in your browser and select ReplicaSet.
Run this benchmark in your terminal:
powerpipe benchmark run kubernetes_compliance.benchmark.all_controls_replicasetSnapshot and share results via Turbot Pipes:
powerpipe benchmark run kubernetes_compliance.benchmark.all_controls_replicaset --shareControls
- ReplicaSet containers should has admission capability restricted
- ReplicaSet containers admission control plugin should be set to 'always pull images'
- ReplicaSet containers admission control plugin should not be set to 'always admit'
- ReplicaSet containers peer client cert auth should be enabled
- ReplicaSet containers argument anonymous auth should be disabled
- ReplicaSet containers should have audit log max-age set to 30 or greater
- ReplicaSet containers should have audit log max backup set to 10 or greater
- ReplicaSet containers should have audit log max size set to 100 or greater
- ReplicaSet containers should have audit log path configured appropriately
- ReplicaSet containers argument authorization mode should not be set to 'always allow'
- ReplicaSet containers argument authorization mode should have node
- ReplicaSet containers argument authorization mode should have RBAC
- ReplicaSet containers argument etcd auto TLS should be disabled
- ReplicaSet containers argument etcd cafile should be set
- ReplicaSet containers should have etcd certfile and keyfile configured appropriately
- ReplicaSet containers argument etcd client cert auth should be enabled
- ReplicaSet containers should have etcd peer certfile and peer keyfile configured appropriately
- ReplicaSet containers argument event qps should be less than 5
- ReplicaSet containers argument insecure port should be set to 0
- ReplicaSet containers argument apiserver etcd certfile and keyfile should be configured
- ReplicaSet containers kube-apiserver profiling should be disabled
- ReplicaSet containers should have kube-apiserver TLS cert file and TLS private key file configured appropriately
- ReplicaSet containers argument kube-controller-manager bind address should be set to 127.0.0.1
- ReplicaSet containers kube controller manager profiling should be disabled
- ReplicaSet containers should have kube controller manager root CA file configured appropriately
- ReplicaSet containers argument kube controller manager service account credentials should be enabled
- ReplicaSet containers should have kube controller manager service account private key file configured appropriately
- ReplicaSet containers argument kube-scheduler bind address should be set to 127.0.0.1
- ReplicaSet containers kube scheduler profiling should be disabled
- ReplicaSet containers argument kubelet authorization mode should not be set to 'always allow'
- ReplicaSet containers should have kubelet client CA file configured appropriately
- ReplicaSet containers argument kubelet client certificate and key should be configured
- ReplicaSet containers argument kubelet HTTPS should be enabled
- ReplicaSet containers argument kubelet read-only port should be set to 0
- ReplicaSet containers should have kubelet terminated pod gc threshold configured appropriately
- ReplicaSet containers should have kubelet TLS cert file and TLS private key file configured appropriately
- ReplicaSet containers argument make iptables util chains should be enabled
- ReplicaSet containers argument admission control plugin NamespaceLifecycle should be enabled
- ReplicaSet containers argument admission control plugin NodeRestriction should be enabled
- ReplicaSet containers argument admission control plugin PodSecurityPolicy should be enabled
- ReplicaSet containers argument protect kernel defaults should be enabled
- ReplicaSet containers argument request timeout should be set as appropriate
- ReplicaSet containers argument rotate kubelet server certificate should be enabled
- ReplicaSet containers argument secure port should not be set to 0
- ReplicaSet containers argument admission control plugin where either PodSecurityPolicy or SecurityContextDeny should be enabled
- ReplicaSet containers argument admission control plugin ServiceAccount should be enabled
- ReplicaSet containers --service-account-key-file argument should be set as appropriate
- ReplicaSet containers argument service account lookup should be enabled
- ReplicaSet containers should minimize its admission with capabilities assigned
- ReplicaSet containers should has encryption providers configured appropriately
- ReplicaSet containers ports should not have host port specified
- ReplicaSet containers has image pull policy set to Always
- ReplicaSet containers have image tag specified which should be fixed not latest or blank
- ReplicaSet containers should have kubelet certificate authority configured appropriately
- ReplicaSet containers Kubernetes dashboard should not be deployed
- ReplicaSet containers should have liveness probe
- ReplicaSet containers argument basic auth file should not be set
- ReplicaSet containers argument hostname override should not be configured
- ReplicaSet containers argument insecure bind address should not be set
- ReplicaSet containers should not have privileged access
- ReplicaSet containers should not allow privilege escalation
- ReplicaSet containers should not be mapped with privilege ports
- ReplicaSet containers should have readiness probe
- ReplicaSet containers certificate rotation should be enabled
- ReplicaSet containers should have secrets defined as files
- ReplicaSet containers should have security context
- ReplicaSet containers argument --streaming-connection-idle-timeout should not be set to 0
- ReplicaSet containers kube-apiserver should only make use of strong cryptographic ciphers
- ReplicaSet containers kubelet should only make use of strong cryptographic ciphers
- ReplicaSet containers should not use CAP_SYS_ADMIN linux capability
- ReplicaSet containers token auth file should not be configured
- ReplicaSet containers should minimize the admission of containers with added capability
- ReplicaSet containers should have a CPU limit
- ReplicaSet containers should have a CPU request
- ReplicaSet definition should not use default namespace
- Seccomp profile is set to docker/default in your ReplicaSet definition
- ReplicaSet containers should not run with host network access
- ReplicaSet containers should not share the host process namespace
- ReplicaSet containers should run with a read only root file system
- ReplicaSet containers should have a memory limit
- ReplicaSet containers should have a memory request
- ReplicaSet containers should not run with root privileges