Cluster Overview: https://10.0.0.1:443
Smooth sailing within sight
Grade: C-
Score: 72%
Score is the percentage of passing checks. Warnings get half the weight of dangerous checks.
-
2097 passing checks
-
1129 warning checks
-
251 dangerous checks
Kubernetes Version:
1.31
Nodes:
4
Namespaces:
34
Controllers:
100
Pods:
0
Results by Category
EfficiencyScore: 57%
Configuring resource requests and limits for workloads running in Kubernetes helps ensure that every container will have access to all the resources it needs. These are also a crucial part of cluster autoscaling logic, as new nodes are only spun up when there is insufficient capacity on existing infrastructure for new pod(s). By default, Polaris validates that resource requests and limits are set, it also includes optional functionality to ensure these requests and limits fall within specified ranges. Refer to the Polaris documentation about Efficiency for more information.
ReliabilityScore: 66%
Kubernetes is built to reliabily run highly available applications. Polaris includes a number of checks to ensure that you are maximizing the reliability potential of Kubernetes. Refer to the Polaris documentation about Reliability for more information.
SecurityScore: 68%
Kubernetes provides a great deal of configurability when it comes to the security of your workloads. A key principle here involves limiting the level of access any individual workload has. Polaris has validations for a number of best practices, mostly focused on ensuring that unnecessary access has not been granted to an application workload. Refer to the Polaris documentation about Security for more information.
Filter by Namespace
Cluster Resources
ClusterRole:
cert-manager-cluster-view
ClusterRole:
cert-manager-controller-approve:cert-manager-io
ClusterRole:
cert-manager-controller-certificates
ClusterRole:
cert-manager-controller-certificatesigningrequests
ClusterRole:
cert-manager-controller-challenges
ClusterRole:
cert-manager-controller-clusterissuers
ClusterRole:
cert-manager-controller-ingress-shim
ClusterRole:
cert-manager-controller-issuers
ClusterRole:
cert-manager-controller-orders
ClusterRole:
cert-manager-webhook:subjectaccessreviews
ClusterRole:
container-health-log-reader
ClusterRole:
csi-azurefile-node-secret-role
ClusterRole:
pod-reader-all-namespaces
ClusterRole:
rabbitmq-operator-rabbitmq-cluster-operator-rabbitmq-operator
ClusterRole:
rabbitmq-operator-rabbitmq-cluster-operator-rabbitmq-operator-admin
ClusterRole:
rabbitmq-operator-rabbitmq-cluster-operator-rabbitmq-operator-edit
ClusterRole:
rabbitmq-operator-rabbitmq-cluster-operator-rabbitmq-operator-view
ClusterRole:
rabbitmq-operator-rabbitmq-messaging-topology-operator-rabbitmq
ClusterRole:
rabbitmq-operator-rabbitmq-messaging-topology-operator-rabbitmq-admin
ClusterRole:
rabbitmq-operator-rabbitmq-messaging-topology-operator-rabbitmq-edit
ClusterRole:
rabbitmq-operator-rabbitmq-messaging-topology-operator-rabbitmq-view
ClusterRole:
system:aggregate-to-admin
ClusterRole:
system:azure-cloud-provider
ClusterRole:
system:azure-cloud-provider-secret-getter
ClusterRole:
system:certificates.k8s.io:certificatesigningrequests:nodeclient
ClusterRole:
system:certificates.k8s.io:certificatesigningrequests:selfnodeclient
ClusterRole:
system:certificates.k8s.io:kube-apiserver-client-approver
ClusterRole:
system:certificates.k8s.io:kube-apiserver-client-kubelet-approver
ClusterRole:
system:certificates.k8s.io:kubelet-serving-approver
ClusterRole:
system:certificates.k8s.io:legacy-unknown-approver
ClusterRole:
system:controller:attachdetach-controller
ClusterRole:
system:controller:certificate-controller
ClusterRole:
system:controller:clusterrole-aggregation-controller
ClusterRole:
system:controller:cronjob-controller
ClusterRole:
system:controller:daemon-set-controller
ClusterRole:
system:controller:deployment-controller
ClusterRole:
system:controller:disruption-controller
ClusterRole:
system:controller:endpoint-controller
ClusterRole:
system:controller:endpointslice-controller
ClusterRole:
system:controller:endpointslicemirroring-controller
ClusterRole:
system:controller:ephemeral-volume-controller
ClusterRole:
system:controller:expand-controller
ClusterRole:
system:controller:generic-garbage-collector
ClusterRole:
system:controller:horizontal-pod-autoscaler
ClusterRole:
system:controller:job-controller
ClusterRole:
system:controller:legacy-service-account-token-cleaner
ClusterRole:
system:controller:namespace-controller
ClusterRole:
system:controller:node-controller
ClusterRole:
system:controller:persistent-volume-binder
ClusterRole:
system:controller:pod-garbage-collector
ClusterRole:
system:controller:pv-protection-controller
ClusterRole:
system:controller:pvc-protection-controller
ClusterRole:
system:controller:replicaset-controller
ClusterRole:
system:controller:replication-controller
ClusterRole:
system:controller:resourcequota-controller
ClusterRole:
system:controller:root-ca-cert-publisher
ClusterRole:
system:controller:route-controller
ClusterRole:
system:controller:service-account-controller
ClusterRole:
system:controller:service-controller
ClusterRole:
system:controller:statefulset-controller
ClusterRole:
system:controller:ttl-after-finished-controller
ClusterRole:
system:controller:ttl-controller
ClusterRole:
system:controller:validatingadmissionpolicy-status-controller
ClusterRole:
system:coredns-autoscaler
ClusterRole:
system:konnectivity-agent-autoscaler
ClusterRole:
system:kube-controller-manager
ClusterRole:
system:node-problem-detector
ClusterRole:
system:persistent-volume-provisioner
ClusterRole:
system:persistent-volume-secret-operator
ClusterRole:
system:public-info-viewer
ClusterRole:
system:service-account-issuer-discovery
ClusterRoleBinding:
acn-multitenancy-editor-binding
ClusterRoleBinding:
aks-cluster-admin-binding
ClusterRoleBinding:
aks-cluster-admin-binding-aad
ClusterRoleBinding:
aks-service-rolebinding
ClusterRoleBinding:
appmonitoringconfig-user-global
ClusterRoleBinding:
argocd-application-controller
ClusterRoleBinding:
argocd-server
ClusterRoleBinding:
auto-approve-csrs-for-group
ClusterRoleBinding:
auto-approve-renewals-for-nodes
ClusterRoleBinding:
cert-manager-cainjector
ClusterRoleBinding:
cert-manager-controller-approve:cert-manager-io
ClusterRoleBinding:
cert-manager-controller-certificates
ClusterRoleBinding:
cert-manager-controller-certificatesigningrequests
ClusterRoleBinding:
cert-manager-controller-challenges
ClusterRoleBinding:
cert-manager-controller-clusterissuers
ClusterRoleBinding:
cert-manager-controller-ingress-shim
ClusterRoleBinding:
cert-manager-controller-issuers
ClusterRoleBinding:
cert-manager-controller-orders
ClusterRoleBinding:
cert-manager-webhook:subjectaccessreviews
ClusterRoleBinding:
cilium
ClusterRoleBinding:
cilium-operator
ClusterRoleBinding:
cloud-node-manager
ClusterRoleBinding:
cluster-admin
ClusterRoleBinding:
container-health-read-logs-global
ClusterRoleBinding:
create-csrs-for-bootstrapping
ClusterRoleBinding:
csi-azuredisk-node-binding
ClusterRoleBinding:
csi-azurefile-node-secret-binding
ClusterRoleBinding:
hydra-hydra-maester-role-binding
ClusterRoleBinding:
ingress-nginx
ClusterRoleBinding:
metrics-server:system:auth-delegator
ClusterRoleBinding:
pod-reader-all-namespaces-binding
ClusterRoleBinding:
polaris
ClusterRoleBinding:
polaris-view
ClusterRoleBinding:
postgres-operator
ClusterRoleBinding:
rabbitmq-operator-rabbitmq-cluster-operator-rabbitmq-operator
ClusterRoleBinding:
rabbitmq-operator-rabbitmq-messaging-topology-operator-rabbitmq
ClusterRoleBinding:
redis-operator
ClusterRoleBinding:
reloader-reloader-role-binding
ClusterRoleBinding:
system:aks-client-node-proxier
ClusterRoleBinding:
system:azure-cloud-provider
ClusterRoleBinding:
system:azure-cloud-provider-secret-getter
ClusterRoleBinding:
system:basic-user
ClusterRoleBinding:
system:controller:attachdetach-controller
ClusterRoleBinding:
system:controller:certificate-controller
ClusterRoleBinding:
system:controller:clusterrole-aggregation-controller
ClusterRoleBinding:
system:controller:cronjob-controller
ClusterRoleBinding:
system:controller:daemon-set-controller
ClusterRoleBinding:
system:controller:deployment-controller
ClusterRoleBinding:
system:controller:disruption-controller
ClusterRoleBinding:
system:controller:endpoint-controller
ClusterRoleBinding:
system:controller:endpointslice-controller
ClusterRoleBinding:
system:controller:endpointslicemirroring-controller
ClusterRoleBinding:
system:controller:ephemeral-volume-controller
ClusterRoleBinding:
system:controller:expand-controller
ClusterRoleBinding:
system:controller:generic-garbage-collector
ClusterRoleBinding:
system:controller:horizontal-pod-autoscaler
ClusterRoleBinding:
system:controller:job-controller
ClusterRoleBinding:
system:controller:legacy-service-account-token-cleaner
ClusterRoleBinding:
system:controller:namespace-controller
ClusterRoleBinding:
system:controller:node-controller
ClusterRoleBinding:
system:controller:persistent-volume-binder
ClusterRoleBinding:
system:controller:pod-garbage-collector
ClusterRoleBinding:
system:controller:pv-protection-controller
ClusterRoleBinding:
system:controller:pvc-protection-controller
ClusterRoleBinding:
system:controller:replicaset-controller
ClusterRoleBinding:
system:controller:replication-controller
ClusterRoleBinding:
system:controller:resourcequota-controller
ClusterRoleBinding:
system:controller:root-ca-cert-publisher
ClusterRoleBinding:
system:controller:route-controller
ClusterRoleBinding:
system:controller:service-account-controller
ClusterRoleBinding:
system:controller:service-controller
ClusterRoleBinding:
system:controller:statefulset-controller
ClusterRoleBinding:
system:controller:ttl-after-finished-controller
ClusterRoleBinding:
system:controller:ttl-controller
ClusterRoleBinding:
system:controller:validatingadmissionpolicy-status-controller
ClusterRoleBinding:
system:coredns
ClusterRoleBinding:
system:coredns-autoscaler
ClusterRoleBinding:
system:discovery
ClusterRoleBinding:
system:konnectivity-agent-autoscaler
ClusterRoleBinding:
system:kube-controller-manager
ClusterRoleBinding:
system:kube-dns
ClusterRoleBinding:
system:kube-scheduler
ClusterRoleBinding:
system:metrics-server
ClusterRoleBinding:
system:monitoring
ClusterRoleBinding:
system:node
ClusterRoleBinding:
system:node-proxier
ClusterRoleBinding:
system:persistent-volume-binding
ClusterRoleBinding:
system:prometheus
ClusterRoleBinding:
system:public-info-viewer
ClusterRoleBinding:
system:service-account-issuer-discovery
ClusterRoleBinding:
system:volume-scheduler
ClusterRoleBinding:
vpa-actor
ClusterRoleBinding:
vpa-admission-controller
ClusterRoleBinding:
vpa-checkpoint-actor
ClusterRoleBinding:
vpa-evictionter-binding
ClusterRoleBinding:
vpa-metrics-reader
ClusterRoleBinding:
vpa-status-actor
ClusterRoleBinding:
vpa-status-reader-binding
Namespace: adminconsole
ConfigMap:
kube-root-ca.crt
ConfigMap:
mongodb-charts
Deployment:
adminconsole-ui
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container ui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- CPU requests should be set
- Memory requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- Image tag is specified
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
ServiceAccount:
adminconsole
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
Namespace: aks-command
Namespace: argocd
ConfigMap:
argocd-cm
ConfigMap:
argocd-cmd-params-cm
ConfigMap:
argocd-gpg-keys-cm
ConfigMap:
argocd-notifications-cm
ConfigMap:
argocd-rbac-cm
ConfigMap:
argocd-ssh-known-hosts-cm
ConfigMap:
argocd-tls-certs-cm
ConfigMap:
kube-root-ca.crt
Deployment:
argocd-applicationset-controller
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container argocd-applicationset-controller:
- Liveness probe should be configured
- Memory requests should be set
- Readiness probe should be configured
- CPU requests should be set
- Host port is not configured
- Image pull policy is "Always"
- Not running as privileged
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Privilege escalation not allowed
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any insecure capabilities
Deployment:
argocd-dex-server
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container copyutil:
- Host port is not configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Not running as privileged
- Privilege escalation not allowed
- Image pull policy is "Always"
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any dangerous capabilities
Container dex:
- CPU requests should be set
- Liveness probe should be configured
- Memory requests should be set
- Readiness probe should be configured
- Is not allowed to run as root
- Host port is not configured
- Image pull policy is "Always"
- Not running as privileged
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any insecure capabilities
- Privilege escalation not allowed
Deployment:
argocd-notifications-controller
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container argocd-notifications-controller:
- Readiness probe should be configured
- CPU requests should be set
- Memory requests should be set
- Privilege escalation not allowed
- Image pull policy is "Always"
- Host port is not configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Image tag is specified
- Is not allowed to run as root
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Liveness probe is configured
Deployment:
argocd-redis
Spec:
Pod Spec:
Container redis:
- Liveness probe should be configured
- Memory requests should be set
- Filesystem should be read only
- Readiness probe should be configured
- CPU requests should be set
- Container does not have any insecure capabilities
- Image pull policy is "Always"
- Not running as privileged
- Is not allowed to run as root
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Privilege escalation not allowed
- The container does not set potentially sensitive environment variables
Deployment:
argocd-repo-server
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host network is not configured
- Host PID is not configured
- The ServiceAccount will not be automounted
- Host IPC is not configured
Container copyutil:
- Image pull policy should be "Always"
- Is not allowed to run as root
- Host port is not configured
- Container does not have any insecure capabilities
- Filesystem is read only
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Privilege escalation not allowed
- Not running as privileged
Container argocd-repo-server:
- Memory requests should be set
- CPU requests should be set
- Filesystem is read only
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Liveness probe is configured
- Privilege escalation not allowed
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Image pull policy is "Always"
- Not running as privileged
- Is not allowed to run as root
- Container does not have any dangerous capabilities
- Host port is not configured
Deployment:
argocd-server
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container argocd-server:
- CPU requests should be set
- Memory requests should be set
- Host port is not configured
- Container does not have any insecure capabilities
- Liveness probe is configured
- Privilege escalation not allowed
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Readiness probe is configured
- Not running as privileged
- Image tag is specified
- Filesystem is read only
- Image pull policy is "Always"
- Is not allowed to run as root
NetworkPolicy:
argocd-application-controller-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-applicationset-controller-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-dex-server-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-notifications-controller-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-redis-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-repo-server-network-policy
Spec: no checks applied
NetworkPolicy:
argocd-server-network-policy
Spec: no checks applied
RoleBinding:
argocd-application-controller
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
RoleBinding:
argocd-applicationset-controller
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
argocd-dex-server
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
argocd-notifications-controller
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
argocd-redis
Spec:
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a Role that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
RoleBinding:
argocd-server
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
argocd-application-controller
Spec: no checks applied
ServiceAccount:
argocd-applicationset-controller
Spec: no checks applied
ServiceAccount:
argocd-dex-server
Spec: no checks applied
ServiceAccount:
argocd-notifications-controller
Spec: no checks applied
ServiceAccount:
argocd-redis
Spec: no checks applied
ServiceAccount:
argocd-repo-server
Spec: no checks applied
ServiceAccount:
argocd-server
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
StatefulSet:
argocd-application-controller
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container argocd-application-controller:
- Memory requests should be set
- CPU requests should be set
- Liveness probe should be configured
- Image tag is specified
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Privilege escalation not allowed
- Image pull policy is "Always"
- Is not allowed to run as root
- Container does not have any dangerous capabilities
- Filesystem is read only
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
- Readiness probe is configured
Namespace: azure-agent
ConfigMap:
kube-root-ca.crt
Deployment:
dotgov-test-agent
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgov-test-agent:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image tag should be specified
- Privilege escalation should not be allowed
- Liveness probe should be configured
- Container should not have insecure capabilities
- Memory requests should be set
- Readiness probe should be configured
- Should not be allowed to run as root
- CPU requests should be set
- Filesystem should be read only
- Container does not have any dangerous capabilities
- Image pull policy is "Always"
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Host port is not configured
ServiceAccount:
default
Spec: no checks applied
Namespace: cert-manager
ConfigMap:
kube-root-ca.crt
Deployment:
cert-manager
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container cert-manager-controller:
- Image pull policy should be "Always"
- Readiness probe should be configured
- CPU requests should be set
- Memory requests should be set
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Not running as privileged
- Container does not have any insecure capabilities
- Liveness probe is configured
- Is not allowed to run as root
- Host port is not configured
- Privilege escalation not allowed
- The container does not set potentially sensitive environment variables
- Image tag is specified
Deployment:
cert-manager-cainjector
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container cert-manager-cainjector:
- Liveness probe should be configured
- Image pull policy should be "Always"
- CPU requests should be set
- Readiness probe should be configured
- Memory requests should be set
- Host port is not configured
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Privilege escalation not allowed
- Not running as privileged
- Image tag is specified
Deployment:
cert-manager-webhook
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container cert-manager-webhook:
- Memory requests should be set
- Image pull policy should be "Always"
- CPU requests should be set
- Liveness probe is configured
- Filesystem is read only
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Privilege escalation not allowed
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Image tag is specified
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
RoleBinding:
cert-manager-webhook:dynamic-serving
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
ServiceAccount:
cert-manager
Spec: no checks applied
ServiceAccount:
cert-manager-cainjector
Spec: no checks applied
ServiceAccount:
cert-manager-webhook
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
Namespace: cloudadmin
ConfigMap:
kube-root-ca.crt
RoleBinding:
azdev-rb-azdev-sa-6aa184-admin-on-cloudadmin
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-6aa184
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
Namespace: default
Namespace: dge
Namespace: dotgovadmin
Namespace: dotgovdocs
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovdocs-api
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container api:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Readiness probe is configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Host port is not configured
- Liveness probe is configured
- Container does not have any dangerous capabilities
RoleBinding:
azdev-rb-azdev-sa-4aa615-admin-on-dotgovdocs
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-4aa615
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovdocs
Spec: no checks applied
Namespace: dotgovengine
ConfigMap:
eservices-dgf-dotgovengine-api
ConfigMap:
eservices-dgf-dotgovengine-ui
ConfigMap:
eservices-dgf-dotgovengine-web
ConfigMap:
intranet-dgf-dotgovengine-api
ConfigMap:
intranet-dgf-dotgovengine-ui
ConfigMap:
intranet-dgf-dotgovengine-web
ConfigMap:
kube-root-ca.crt
Deployment:
eservices-dgf-dotgovengine-api
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- The ServiceAccount will not be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgovengine-api:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Should not be allowed to run as root
- Readiness probe should be configured
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Memory requests are set
- CPU requests are set
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Liveness probe is configured
- Not running as privileged
- Image tag is specified
Deployment:
eservices-dgf-dotgovengine-ui
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will not be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgovengine-ui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Filesystem should be read only
- Image pull policy should be "Always"
- Readiness probe should be configured
- Container should not have insecure capabilities
- Liveness probe should be configured
- Memory requests are set
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Host port is not configured
- Not running as privileged
- Image tag is specified
- Container does not have any dangerous capabilities
Deployment:
eservices-dgf-dotgovengine-web
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host network is not configured
- Host PID is not configured
- The ServiceAccount will not be automounted
- Host IPC is not configured
Container dotgovengine-web:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Readiness probe should be configured
- Filesystem should be read only
- Should not be allowed to run as root
- Host port is not configured
- Liveness probe is configured
- Memory requests are set
- Image tag is specified
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
- Not running as privileged
Deployment:
intranet-dgf-dotgovengine-api
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will not be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgovengine-api:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Readiness probe should be configured
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Host port is not configured
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Image tag is specified
- CPU requests are set
- Container does not have any dangerous capabilities
- Liveness probe is configured
- Not running as privileged
Deployment:
intranet-dgf-dotgovengine-ui
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- The ServiceAccount will not be automounted
- Host IPC is not configured
- Host network is not configured
Container dotgovengine-ui:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Liveness probe should be configured
- Image pull policy should be "Always"
- Filesystem should be read only
- Readiness probe should be configured
- Should not be allowed to run as root
- Not running as privileged
- CPU requests are set
- Host port is not configured
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any dangerous capabilities
Deployment:
intranet-dgf-dotgovengine-web
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will not be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgovengine-web:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Readiness probe should be configured
- Container should not have insecure capabilities
- Filesystem should be read only
- CPU requests are set
- Liveness probe is configured
- Memory requests are set
- Container does not have any dangerous capabilities
- Host port is not configured
- Not running as privileged
- Image tag is specified
- The container does not set potentially sensitive environment variables
RoleBinding:
azdev-rb-azdev-sa-05973c-admin-on-dotgovengine
Spec:
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-05973c
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
eservices-dgf-dotgovengine
Spec: no checks applied
ServiceAccount:
intranet-dgf-dotgovengine
Spec: no checks applied
Namespace: dotgovframework
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovframework-backofficeapi
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container workspace-webasm:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Filesystem should be read only
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Privilege escalation not allowed
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Is not allowed to run as root
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
Container workspace-zims:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Privilege escalation not allowed
- Image tag is specified
- Host port is not configured
- Not running as privileged
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
Container workspace-applibs:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Filesystem should be read only
- Container does not have any dangerous capabilities
- Host port is not configured
- Not running as privileged
- Privilege escalation not allowed
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Image tag is specified
Container backofficeapi:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Filesystem should be read only
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
- CPU requests are set
- Memory requests are set
- Not running as privileged
Deployment:
dotgovframework-backofficeui
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container backofficeui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Image tag is specified
- Memory requests are set
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Host port is not configured
- Not running as privileged
- Liveness probe is configured
- Readiness probe is configured
- Container does not have any dangerous capabilities
Deployment:
dotgovframework-frontofficeapi
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container workspace-webasm:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Filesystem should be read only
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Privilege escalation not allowed
- Not running as privileged
- Image tag is specified
- Host port is not configured
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
Container workspace-zims:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Filesystem should be read only
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Container does not have any dangerous capabilities
- Host port is not configured
- Privilege escalation not allowed
- Not running as privileged
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Image tag is specified
Container workspace-applibs:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- Privilege escalation not allowed
- Not running as privileged
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
Container frontofficeapi:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Filesystem should be read only
- Readiness probe is configured
- Host port is not configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Image tag is specified
- CPU requests are set
- Liveness probe is configured
Deployment:
dotgovframework-frontofficeui
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container frontofficeui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- CPU requests are set
- Memory requests are set
- Readiness probe is configured
- Image tag is specified
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
RoleBinding:
azdev-rb-azdev-sa-2b7fa7-admin-on-dotgovframework
Spec:
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-2b7fa7
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovframework
Spec: no checks applied
Namespace: dotgovmobileid
Namespace: dotgovnotify
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovnotify-admin
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container admin:
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- CPU requests should be set
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Image tag is specified
- Liveness probe is configured
- Host port is not configured
- Readiness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
Deployment:
dotgovnotify-api
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container api:
- The container sets potentially sensitive environment variables
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- Readiness probe is configured
- Host port is not configured
- Liveness probe is configured
- Image tag is specified
- Not running as privileged
- Container does not have any dangerous capabilities
Deployment:
dotgovnotify-firebase
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container firebase:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image tag should be specified
- Privilege escalation should not be allowed
- CPU requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- Image pull policy should be "Always"
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Readiness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Liveness probe is configured
Deployment:
dotgovnotify-jobservice
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container jobservice:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Image tag should be specified
- Filesystem should be read only
- CPU requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Should not be allowed to run as root
- Memory requests should be set
- Host port is not configured
- Liveness probe is configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Not running as privileged
Deployment:
dotgovnotify-otp
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container otp:
- The container sets potentially sensitive environment variables
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Filesystem should be read only
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- CPU requests should be set
- Host port is not configured
- Container does not have any dangerous capabilities
- Liveness probe is configured
- Not running as privileged
- Readiness probe is configured
- Image tag is specified
Deployment:
dotgovnotify-preferences
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container preferences:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- Memory requests should be set
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- CPU requests should be set
- Filesystem should be read only
- Image tag is specified
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Not running as privileged
- Host port is not configured
- Liveness probe is configured
Deployment:
dotgovnotify-sendgrid
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container sendgrid:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- CPU requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Image tag is specified
- Liveness probe is configured
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Host port is not configured
Deployment:
dotgovnotify-telegram
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container telegram:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- CPU requests should be set
- Container should not have insecure capabilities
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
Deployment:
dotgovnotify-templates
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container templates:
- The container sets potentially sensitive environment variables
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Memory requests should be set
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Host port is not configured
- Readiness probe is configured
- Image tag is specified
- Liveness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
Deployment:
dotgovnotify-twiliosms
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container twiliosms:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image tag should be specified
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- CPU requests should be set
- Should not be allowed to run as root
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Readiness probe is configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Liveness probe is configured
Deployment:
dotgovnotify-twiliowhatsapp
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container twiliowhatsapp:
- Image tag should be specified
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Memory requests should be set
- Should not be allowed to run as root
- Filesystem should be read only
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Not running as privileged
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
Deployment:
dotgovnotify-zamtel
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container zamtel:
- Image tag should be specified
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Memory requests should be set
- Should not be allowed to run as root
- CPU requests should be set
- Filesystem should be read only
- Container does not have any dangerous capabilities
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Host port is not configured
- The container does not set potentially sensitive environment variables
RoleBinding:
azdev-rb-azdev-sa-9bc333-admin-on-dotgovnotify
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-9bc333
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovnotify
Spec: no checks applied
Namespace: dotgovpass
ConfigMap:
hydra
ConfigMap:
hydra-migrate
ConfigMap:
kratos-dotgovpasskratos-config
ConfigMap:
kratos-dotgovpasskratos-migrate
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovpass-admin
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container admin:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- Filesystem should be read only
- Should not be allowed to run as root
- Image pull policy should be "Always"
- CPU requests should be set
- Container should not have insecure capabilities
- Memory requests should be set
- Host port is not configured
- Readiness probe is configured
- Image tag is specified
- Not running as privileged
- Container does not have any dangerous capabilities
- Liveness probe is configured
Deployment:
dotgovpass-api
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container api:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Memory requests should be set
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Filesystem should be read only
- Readiness probe is configured
- Image tag is specified
- The container does not set potentially sensitive environment variables
- Liveness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Host port is not configured
Deployment:
dotgovpass-claims
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container claims:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Memory requests should be set
- Image pull policy should be "Always"
- Filesystem should be read only
- Container should not have insecure capabilities
- Should not be allowed to run as root
- CPU requests should be set
- Container does not have any dangerous capabilities
- Host port is not configured
- Readiness probe is configured
- Not running as privileged
- Image tag is specified
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
Deployment:
dotgovpass-ui
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container ui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Container should not have insecure capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Memory requests should be set
- Should not be allowed to run as root
- Liveness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Readiness probe is configured
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
Deployment:
hydra
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container hydra:
- Image pull policy should be "Always"
- CPU requests should be set
- Memory requests should be set
- Liveness probe should be configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Privilege escalation not allowed
- Is not allowed to run as root
- Filesystem is read only
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Not running as privileged
- Host port is not configured
- Image tag is specified
Deployment:
hydra-hydra-maester
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container hydra-maester:
- Liveness probe should be configured
- Memory requests should be set
- Readiness probe should be configured
- CPU requests should be set
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Privilege escalation not allowed
- The container does not set potentially sensitive environment variables
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
- Not running as privileged
- Host port is not configured
- Container does not have any insecure capabilities
- Image tag is specified
- Is not allowed to run as root
Deployment:
kratos-dotgovpasskratos
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container dotgovpasskratos:
- Image pull policy should be "Always"
- Memory requests should be set
- CPU requests should be set
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Privilege escalation not allowed
- Container does not have any dangerous capabilities
- Not running as privileged
- Filesystem is read only
- Is not allowed to run as root
- Image tag is specified
- Host port is not configured
- Container does not have any insecure capabilities
Job:
hydra-automigrate
Pod Spec:
Container hydra-automigrate:
- CPU requests should be set
- Memory requests should be set
- Image pull policy should be "Always"
- Filesystem is read only
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Privilege escalation not allowed
- Not running as privileged
- Is not allowed to run as root
- Image tag is specified
- Container does not have any dangerous capabilities
PodDisruptionBudget:
postgres-dotgovpass-postgresql-pdb
Spec: no checks applied
RoleBinding:
azdev-rb-azdev-sa-5e1944-admin-on-dotgovpass
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference a Role with wildcard permissions
RoleBinding:
hydra-hydra-maester-role-binding
Spec:
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
RoleBinding:
postgres-pod
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-5e1944
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovpass
Spec: no checks applied
ServiceAccount:
hydra
Spec: no checks applied
ServiceAccount:
hydra-cronjob-janitor
Spec: no checks applied
ServiceAccount:
hydra-hydra-maester-account
Spec: no checks applied
ServiceAccount:
hydra-job
Spec: no checks applied
ServiceAccount:
kratos-dotgovpasskratos
Spec: no checks applied
ServiceAccount:
kratos-dotgovpasskratos-job
Spec: no checks applied
ServiceAccount:
postgres-pod
Spec: no checks applied
StatefulSet:
dotgovpass-postgresql
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container postgres:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Readiness probe should be configured
- Liveness probe should be configured
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Filesystem should be read only
- Not running as privileged
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Memory requests are set
StatefulSet:
kratos-dotgovpasskratos-courier
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container kratos-dotgovpasskratos-courier:
- Image pull policy should be "Always"
- Liveness probe should be configured
- Memory requests should be set
- Readiness probe should be configured
- CPU requests should be set
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Is not allowed to run as root
- Container does not have any insecure capabilities
- Privilege escalation not allowed
- Container does not have any dangerous capabilities
- Not running as privileged
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Filesystem is read only
Namespace: dotgovpay
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovpay-absa
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container absa:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image pull policy should be "Always"
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Container should not have insecure capabilities
- CPU requests should be set
- Host port is not configured
- Liveness probe is configured
- Readiness probe is configured
- Container does not have any dangerous capabilities
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Not running as privileged
Deployment:
dotgovpay-admin
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container admin:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- The container sets potentially sensitive environment variables
- Container should not have insecure capabilities
- Memory requests should be set
- Should not be allowed to run as root
- CPU requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
Deployment:
dotgovpay-airtel
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container airtel:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- CPU requests should be set
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Image tag is specified
Deployment:
dotgovpay-callbackhandler
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container callbackhandler:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- CPU requests should be set
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Liveness probe is configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Image tag is specified
Deployment:
dotgovpay-ecobank
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container ecobank:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Memory requests should be set
- Filesystem should be read only
- CPU requests should be set
- Liveness probe is configured
- Image tag is specified
- Readiness probe is configured
- Container does not have any dangerous capabilities
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Not running as privileged
Deployment:
dotgovpay-ifmis
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container ifmis:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Memory requests should be set
- Container should not have insecure capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Not running as privileged
- Image tag is specified
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Readiness probe is configured
Deployment:
dotgovpay-izb
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container izb:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Should not be allowed to run as root
- CPU requests should be set
- Image pull policy should be "Always"
- Memory requests should be set
- Filesystem should be read only
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
Deployment:
dotgovpay-mtn
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container mtn:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- CPU requests should be set
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- The container does not set potentially sensitive environment variables
- Readiness probe is configured
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
Deployment:
dotgovpay-payments
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container payments:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Filesystem should be read only
- Should not be allowed to run as root
- CPU requests should be set
- Memory requests should be set
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Not running as privileged
- Host port is not configured
- Readiness probe is configured
- Image tag is specified
- Container does not have any dangerous capabilities
- Liveness probe is configured
Deployment:
dotgovpay-pdf
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container pdf:
- Privilege escalation should not be allowed
- The container sets potentially sensitive environment variables
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- CPU requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- Container does not have any dangerous capabilities
- Not running as privileged
- Host port is not configured
- Readiness probe is configured
- Image tag is specified
- Liveness probe is configured
Deployment:
dotgovpay-reports
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container reports:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Should not be allowed to run as root
- CPU requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Memory requests should be set
- Container does not have any dangerous capabilities
- Readiness probe is configured
- Not running as privileged
- Host port is not configured
- Liveness probe is configured
- Image tag is specified
- The container does not set potentially sensitive environment variables
Deployment:
dotgovpay-stanbicbank
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container stanbicbank:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- CPU requests should be set
- Container does not have any dangerous capabilities
- Not running as privileged
- Host port is not configured
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Readiness probe is configured
Deployment:
dotgovpay-stanbicbankussd
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container stanbicbankussd:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Filesystem should be read only
- CPU requests should be set
- Memory requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Not running as privileged
- Host port is not configured
- Liveness probe is configured
- Image tag is specified
- Readiness probe is configured
- Container does not have any dangerous capabilities
Deployment:
dotgovpay-tengamobilewallet
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container tengamobilewallet:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Memory requests should be set
- Should not be allowed to run as root
- Filesystem should be read only
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Liveness probe is configured
- Host port is not configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
Deployment:
dotgovpay-transactionjunction
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container transactionjunction:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Memory requests should be set
- Image pull policy should be "Always"
- CPU requests should be set
- Container should not have insecure capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- Readiness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Image tag is specified
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
- Host port is not configured
Deployment:
dotgovpay-ui
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container ui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- CPU requests should be set
- Should not be allowed to run as root
- Memory requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Filesystem should be read only
- Not running as privileged
- Image tag is specified
- Liveness probe is configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
Deployment:
dotgovpay-zamtel
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container zamtel:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Filesystem should be read only
- CPU requests should be set
- Container should not have insecure capabilities
- Memory requests should be set
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Host port is not configured
- Readiness probe is configured
- Not running as privileged
Deployment:
dotgovpay-zanaco
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container zanaco:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Should not be allowed to run as root
- Filesystem should be read only
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Memory requests should be set
- CPU requests should be set
- Host port is not configured
- Liveness probe is configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Not running as privileged
- Image tag is specified
- Container does not have any dangerous capabilities
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovpay
Spec: no checks applied
Namespace: dotgovpki
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovpki-admin
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container admin:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Memory requests should be set
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Should not be allowed to run as root
- CPU requests should be set
- Filesystem should be read only
- Not running as privileged
- Liveness probe is configured
- Container does not have any dangerous capabilities
- Readiness probe is configured
- Host port is not configured
- Image tag is specified
Deployment:
dotgovpki-api
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container api:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- CPU requests should be set
- Filesystem should be read only
- Readiness probe is configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- Liveness probe is configured
Deployment:
dotgovpki-mobile
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container mobile:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- The container sets potentially sensitive environment variables
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- CPU requests should be set
- Filesystem should be read only
- Memory requests should be set
- Host port is not configured
- Container does not have any dangerous capabilities
- Image tag is specified
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
Deployment:
dotgovpki-systemsmanager
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container systemsmanager:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- CPU requests should be set
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
- Image tag is specified
- Readiness probe is configured
Deployment:
dotgovpki-systemsmanageradmin
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container systemsmanageradmin:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- The container sets potentially sensitive environment variables
- Image pull policy should be "Always"
- Memory requests should be set
- Container should not have insecure capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- CPU requests should be set
- Not running as privileged
- Readiness probe is configured
- Host port is not configured
- Image tag is specified
- Container does not have any dangerous capabilities
- Liveness probe is configured
RoleBinding:
azdev-rb-azdev-sa-ae2d84-admin-on-dotgovpki
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-ae2d84
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovpki
Spec: no checks applied
Namespace: dotgovshortener
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovshortener-api
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container api:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Memory requests should be set
- Filesystem should be read only
- CPU requests should be set
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Container does not have any dangerous capabilities
- Readiness probe is configured
- Image tag is specified
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
RoleBinding:
azdev-rb-azdev-sa-929f4b-admin-on-dotgovshortener
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-929f4b
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovshortener
Spec: no checks applied
Namespace: dotgovsign
ConfigMap:
kube-root-ca.crt
Deployment:
dotgovsign-api
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container api:
- The container sets potentially sensitive environment variables
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Container should not have insecure capabilities
- CPU requests should be set
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Host port is not configured
- Image tag is specified
- Readiness probe is configured
- Liveness probe is configured
- Container does not have any dangerous capabilities
- Not running as privileged
Deployment:
dotgovsign-ui
Spec:
Pod Spec:
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container ui:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- The container sets potentially sensitive environment variables
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Memory requests should be set
- Image pull policy should be "Always"
- CPU requests should be set
- Filesystem should be read only
- Image tag is specified
- Container does not have any dangerous capabilities
- Liveness probe is configured
- Not running as privileged
- Host port is not configured
- Readiness probe is configured
RoleBinding:
azdev-rb-azdev-sa-843310-admin-on-dotgovsign
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-843310
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
dotgovsign
Spec: no checks applied
Namespace: dotgovstyle
ConfigMap:
kube-root-ca.crt
RoleBinding:
azdev-rb-azdev-sa-710e30-admin-on-dotgovstyle
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-710e30
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
Namespace: ingress-nginx
ConfigMap:
ingress-nginx-controller
ConfigMap:
kube-root-ca.crt
Deployment:
ingress-nginx-controller
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container controller:
- Image pull policy should be "Always"
- Filesystem should be read only
- Memory requests are set
- Privilege escalation not allowed
- Is not allowed to run as root
- Image tag is specified
- CPU requests are set
- Readiness probe is configured
- Container does not have any dangerous capabilities
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
RoleBinding:
ingress-nginx
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
ingress-nginx
Spec: no checks applied
Namespace: kube-node-lease
Namespace: kube-public
ConfigMap:
aks-cluster-metadata
ConfigMap:
kube-root-ca.crt
RoleBinding:
system:controller:bootstrap-signer
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
default
Spec: no checks applied
Namespace: kube-system
ConfigMap:
azure-ip-masq-agent-config-reconciled
ConfigMap:
cilium-config
ConfigMap:
cns-config
ConfigMap:
cns-win-config
ConfigMap:
coredns
ConfigMap:
coredns-autoscaler
ConfigMap:
coredns-custom
ConfigMap:
extension-apiserver-authentication
ConfigMap:
konnectivity-agent-autoscaler
ConfigMap:
kube-apiserver-legacy-service-account-token-tracking
ConfigMap:
kube-root-ca.crt
ConfigMap:
overlay-upgrade-data
DaemonSet:
azure-cns
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- Priority class has been set
- Host IPC is not configured
- Host PID is not configured
Container cni-installer:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Container should not have insecure capabilities
- Should not be allowed to run as root
- Filesystem should be read only
- Image pull policy should be "Always"
- Image tag is specified
- Host port is not configured
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
Container cns-container:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Filesystem should be read only
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Host port is not configured
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Readiness probe is configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Image tag is specified
- Liveness probe is configured
- Memory requests are set
DaemonSet:
azure-cns-win
Pod Spec:
- Host network should not be configured
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Priority class has been set
- Host IPC is not configured
- Host PID is not configured
Container cni-installer:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Container does not have any insecure capabilities
- Image tag is specified
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Container cns-container:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be running as privileged
- Should not be allowed to run as root
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- CPU requests should be set
- Container should not have insecure capabilities
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
- Readiness probe is configured
- Liveness probe is configured
- Image tag is specified
DaemonSet:
azure-ip-masq-agent
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- Host network should not be configured
- Host IPC is not configured
- Host PID is not configured
- Priority class has been set
- The ServiceAccount will not be automounted
Container azure-ip-masq-agent:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Readiness probe should be configured
- Liveness probe should be configured
- Should not be allowed to run as root
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
- Memory requests are set
- Host port is not configured
- Container does not have any insecure capabilities
- The container does not set potentially sensitive environment variables
- CPU requests are set
DaemonSet:
cilium
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- Priority class has been set
- Host IPC is not configured
- Host PID is not configured
Container install-cni-binaries:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- The container does not set potentially sensitive environment variables
- Image tag is specified
Container mount-cgroup:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Host port is not configured
- Container does not have any insecure capabilities
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Container apply-sysctl-overwrites:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Filesystem should be read only
- Host port is not configured
- Container does not have any insecure capabilities
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Container mount-bpf-fs:
- Should not be running as privileged
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Image tag is specified
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
Container clean-cilium-state:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Image pull policy should be "Always"
- Filesystem should be read only
- Should not be allowed to run as root
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Host port is not configured
Container block-wireserver:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Should not be allowed to run as root
- Filesystem should be read only
- Image pull policy should be "Always"
- The container does not set potentially sensitive environment variables
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
- Host port is not configured
- Container does not have any insecure capabilities
Container cilium-agent:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- Memory requests should be set
- Image pull policy should be "Always"
- CPU requests should be set
- Host port should not be configured
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
- Liveness probe is configured
DaemonSet:
cloud-node-manager
Pod Spec:
- The ServiceAccount will be automounted
- Host network should not be configured
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- Priority class has been set
- Host IPC is not configured
Container cloud-node-manager:
- Privilege escalation should not be allowed
- Liveness probe should be configured
- Image pull policy should be "Always"
- Readiness probe should be configured
- Filesystem should be read only
- Should not be allowed to run as root
- Host port is not configured
- Container does not have any insecure capabilities
- Memory requests are set
- Not running as privileged
- The container does not set potentially sensitive environment variables
- CPU requests are set
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Container does not have any dangerous capabilities
- Image tag is specified
DaemonSet:
cloud-node-manager-windows
Pod Spec:
- The ServiceAccount will be automounted
- Host network should not be configured
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host PID is not configured
- Priority class has been set
Container cloud-node-manager:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Readiness probe should be configured
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Liveness probe should be configured
- Filesystem should be read only
- Container should not have insecure capabilities
- CPU requests are set
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
- Image tag is specified
- Memory requests are set
DaemonSet:
csi-azuredisk-node
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- Host IPC is not configured
- Host PID is not configured
- Priority class has been set
Container liveness-probe:
- Privilege escalation should not be allowed
- Readiness probe should be configured
- Should not be allowed to run as root
- Liveness probe should be configured
- Filesystem should be read only
- Image pull policy should be "Always"
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Memory requests are set
- Container does not have any insecure capabilities
- Not running as privileged
- Image tag is specified
- Host port is not configured
Container node-driver-registrar:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Readiness probe should be configured
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Liveness probe is configured
- Not running as privileged
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Memory requests are set
- CPU requests are set
Container azuredisk:
- Should not be running as privileged
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Readiness probe should be configured
- CPU requests are set
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Host port is not configured
- Liveness probe is configured
- Memory requests are set
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
DaemonSet:
csi-azuredisk-node-win
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- Priority class has been set
- Host IPC is not configured
- Host PID is not configured
Container init:
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Filesystem should be read only
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
- Host port is not configured
- Container does not have any insecure capabilities
- The container does not set potentially sensitive environment variables
Container node-driver-registrar:
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Readiness probe should be configured
- Should not be allowed to run as root
- Liveness probe should be configured
- Filesystem should be read only
- Not running as privileged
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any insecure capabilities
- Container does not have any dangerous capabilities
- Host port is not configured
- Memory requests are set
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Container azuredisk:
- Privilege escalation should not be allowed
- Liveness probe should be configured
- Readiness probe should be configured
- Should not be allowed to run as root
- CPU requests should be set
- Image pull policy should be "Always"
- Memory requests should be set
- Filesystem should be read only
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Container does not have any insecure capabilities
DaemonSet:
csi-azurefile-node
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host PID is not configured
- Priority class has been set
Container liveness-probe:
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Liveness probe should be configured
- Filesystem should be read only
- Image pull policy should be "Always"
- Readiness probe should be configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Image tag is specified
- Memory requests are set
- Not running as privileged
- CPU requests are set
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
- Container does not have any insecure capabilities
Container node-driver-registrar:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Readiness probe should be configured
- CPU requests are set
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Liveness probe is configured
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Memory requests are set
- Image tag is specified
Container azurefile:
- Privilege escalation should not be allowed
- Should not be running as privileged
- Readiness probe should be configured
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Filesystem should be read only
- Host port is not configured
- Memory requests are set
- Image tag is specified
- Liveness probe is configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
DaemonSet:
csi-azurefile-node-win
Pod Spec:
- Host network should not be configured
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Priority class has been set
- Host IPC is not configured
Container init:
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Filesystem should be read only
- Image pull policy should be "Always"
- Container does not have any insecure capabilities
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Not running as privileged
- Image tag is specified
Container node-driver-registrar:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Should not be allowed to run as root
- Liveness probe should be configured
- Image pull policy should be "Always"
- Readiness probe should be configured
- Not running as privileged
- Container does not have any dangerous capabilities
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- The container does not set potentially sensitive environment variables
- Image tag is specified
- CPU requests are set
- Container does not have any insecure capabilities
- Memory requests are set
Container azurefile:
- Privilege escalation should not be allowed
- CPU requests should be set
- Image pull policy should be "Always"
- Readiness probe should be configured
- Liveness probe should be configured
- Memory requests should be set
- Filesystem should be read only
- Should not be allowed to run as root
- Container does not have any dangerous capabilities
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Not running as privileged
- Container does not have any insecure capabilities
DaemonSet:
windows-kube-proxy-initializer
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
- Priority class has been set
Container pause:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Liveness probe should be configured
- Memory requests should be set
- Readiness probe should be configured
- CPU requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Image tag is specified
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Host port is not configured
- Not running as privileged
Deployment:
cilium-operator
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network should not be configured
- Priority class has been set
- Host IPC is not configured
- Host PID is not configured
Container cilium-operator:
- Privilege escalation should not be allowed
- Container should not have dangerous capabilities
- CPU requests should be set
- Image pull policy should be "Always"
- Memory requests should be set
- Should not be allowed to run as root
- Host port should not be configured
- Filesystem should be read only
- The container does not set potentially sensitive environment variables
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Readiness probe is configured
- Image tag is specified
- Container does not have any insecure capabilities
- Not running as privileged
Deployment:
coredns
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
- Priority class has been set
Container coredns:
- Image pull policy should be "Always"
- Should not be allowed to run as root
- The container does not set potentially sensitive environment variables
- Memory requests are set
- Not running as privileged
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Filesystem is read only
- Privilege escalation not allowed
- Image tag is specified
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Readiness probe is configured
- CPU requests are set
- Liveness probe is configured
Deployment:
coredns-autoscaler
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Host PID is not configured
- Priority class has been set
- Host IPC is not configured
- Host network is not configured
Container autoscaler:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Readiness probe should be configured
- Should not be allowed to run as root
- Liveness probe is configured
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Memory requests are set
- Not running as privileged
- Image tag is specified
- Host port is not configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Deployment:
konnectivity-agent
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
- Priority class has been set
- The ServiceAccount will not be automounted
Container konnectivity-agent:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Image pull policy should be "Always"
- Should not be allowed to run as root
- Host port is not configured
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Image tag is specified
- CPU requests are set
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
Deployment:
konnectivity-agent-autoscaler
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
- Priority class has been set
Container autoscaler:
- Privilege escalation should not be allowed
- Filesystem should be read only
- Should not be allowed to run as root
- Image pull policy should be "Always"
- Readiness probe should be configured
- Host port is not configured
- Liveness probe is configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Image tag is specified
- CPU requests are set
- Memory requests are set
- Not running as privileged
Deployment:
metrics-server
Spec:
Pod Spec:
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class has been set
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container metrics-server-vpa:
- Image pull policy should be "Always"
- Readiness probe should be configured
- Liveness probe should be configured
- Container does not have any insecure capabilities
- Privilege escalation not allowed
- Is not allowed to run as root
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Memory requests are set
- CPU requests are set
- Filesystem is read only
- Not running as privileged
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
Container metrics-server:
- Image pull policy should be "Always"
- Not running as privileged
- Image tag is specified
- CPU requests are set
- Container does not have any dangerous capabilities
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Is not allowed to run as root
- Host port is not configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Filesystem is read only
- Privilege escalation not allowed
- Readiness probe is configured
NetworkPolicy:
konnectivity-agent
Spec: no checks applied
PodDisruptionBudget:
coredns-pdb
Spec: no checks applied
PodDisruptionBudget:
konnectivity-agent
Spec: no checks applied
PodDisruptionBudget:
metrics-server-pdb
Spec: no checks applied
Role:
extension-apiserver-authentication-reader
Role:
system::leader-locking-kube-controller-manager
RoleBinding:
cert-manager-cainjector:leaderelection
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
cert-manager:leaderelection
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
metrics-server-auth-reader
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
metrics-server-binding
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
nodeNetConfigEditorRoleBinding
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
RoleBinding:
system::extension-apiserver-authentication-reader
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
system::leader-locking-kube-controller-manager
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
system::leader-locking-kube-scheduler
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
RoleBinding:
system:controller:bootstrap-signer
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
RoleBinding:
system:controller:cloud-provider
Spec:
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
RoleBinding:
system:controller:token-cleaner
Spec:
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
ServiceAccount:
attachdetach-controller
Spec: no checks applied
ServiceAccount:
azure-cns
Spec: no checks applied
ServiceAccount:
bootstrap-signer
Spec: no checks applied
ServiceAccount:
certificate-controller
Spec: no checks applied
ServiceAccount:
cilium
Spec: no checks applied
ServiceAccount:
cilium-operator
Spec: no checks applied
ServiceAccount:
cloud-node-manager
Spec: no checks applied
ServiceAccount:
clusterrole-aggregation-controller
Spec: no checks applied
ServiceAccount:
coredns
Spec: no checks applied
ServiceAccount:
coredns-autoscaler
Spec: no checks applied
ServiceAccount:
cronjob-controller
Spec: no checks applied
ServiceAccount:
csi-azuredisk-node-sa
Spec: no checks applied
ServiceAccount:
csi-azurefile-node-sa
Spec: no checks applied
ServiceAccount:
daemon-set-controller
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
deployment-controller
Spec: no checks applied
ServiceAccount:
disruption-controller
Spec: no checks applied
ServiceAccount:
endpoint-controller
Spec: no checks applied
ServiceAccount:
endpointslice-controller
Spec: no checks applied
ServiceAccount:
endpointslicemirroring-controller
Spec: no checks applied
ServiceAccount:
ephemeral-volume-controller
Spec: no checks applied
ServiceAccount:
expand-controller
Spec: no checks applied
ServiceAccount:
generic-garbage-collector
Spec: no checks applied
ServiceAccount:
horizontal-pod-autoscaler
Spec: no checks applied
ServiceAccount:
job-controller
Spec: no checks applied
ServiceAccount:
konnectivity-agent
Spec: no checks applied
ServiceAccount:
konnectivity-agent-autoscaler
Spec: no checks applied
ServiceAccount:
legacy-service-account-token-cleaner
Spec: no checks applied
ServiceAccount:
metrics-server
Spec: no checks applied
ServiceAccount:
namespace-controller
Spec: no checks applied
ServiceAccount:
node-controller
Spec: no checks applied
ServiceAccount:
persistent-volume-binder
Spec: no checks applied
ServiceAccount:
pod-garbage-collector
Spec: no checks applied
ServiceAccount:
pv-protection-controller
Spec: no checks applied
ServiceAccount:
pvc-protection-controller
Spec: no checks applied
ServiceAccount:
replicaset-controller
Spec: no checks applied
ServiceAccount:
replication-controller
Spec: no checks applied
ServiceAccount:
resourcequota-controller
Spec: no checks applied
ServiceAccount:
root-ca-cert-publisher
Spec: no checks applied
ServiceAccount:
service-account-controller
Spec: no checks applied
ServiceAccount:
statefulset-controller
Spec: no checks applied
ServiceAccount:
token-cleaner
Spec: no checks applied
ServiceAccount:
ttl-after-finished-controller
Spec: no checks applied
ServiceAccount:
ttl-controller
Spec: no checks applied
ServiceAccount:
validatingadmissionpolicy-status-controller
Spec: no checks applied
Namespace: kuma-uptime
ConfigMap:
kube-root-ca.crt
ConfigMap:
kuma-manager-scripts
ConfigMap:
kuma-monitors-adminconsole-dotgov-test-aks
ConfigMap:
kuma-monitors-adminconsole-gsb-stg
ConfigMap:
kuma-monitors-adminconsole-gsb-tst
ConfigMap:
kuma-monitors-adminconsole-production
ConfigMap:
kuma-monitors-argocd-aks-dev
ConfigMap:
kuma-monitors-argocd-dotgov-test-aks
ConfigMap:
kuma-monitors-cloudadmin-aks-dev
ConfigMap:
kuma-monitors-default-aks-dev
ConfigMap:
kuma-monitors-default-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovdocs-aks-dev
ConfigMap:
kuma-monitors-dotgovdocs-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovengine-aks-dev
ConfigMap:
kuma-monitors-dotgovengine-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovframework-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovnotify-aks-dev
ConfigMap:
kuma-monitors-dotgovnotify-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovpass-aks-dev
ConfigMap:
kuma-monitors-dotgovpass-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovpay-aks-dev
ConfigMap:
kuma-monitors-dotgovpay-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovpki-aks-dev
ConfigMap:
kuma-monitors-dotgovpki-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovshortener-aks-dev
ConfigMap:
kuma-monitors-dotgovshortener-dotgov-test-aks
ConfigMap:
kuma-monitors-dotgovsign-aks-dev
ConfigMap:
kuma-monitors-dotgovsign-dotgov-test-aks
ConfigMap:
kuma-monitors-echo-gsb-tst
ConfigMap:
kuma-monitors-ecouncil-gsb-tst
ConfigMap:
kuma-monitors-elastic-aks-dev
ConfigMap:
kuma-monitors-elastic-gsb-stg
ConfigMap:
kuma-monitors-elastic-gsb-tst
ConfigMap:
kuma-monitors-elastic-production
ConfigMap:
kuma-monitors-harbor-aks-dev
ConfigMap:
kuma-monitors-harbor-gsb-stg
ConfigMap:
kuma-monitors-harbor-gsb-tst
ConfigMap:
kuma-monitors-harbor-production
ConfigMap:
kuma-monitors-ndr-gsb-stg
ConfigMap:
kuma-monitors-ndr-gsb-tst
ConfigMap:
kuma-monitors-ndr-production
ConfigMap:
kuma-monitors-opensearch-aks-dev
ConfigMap:
kuma-monitors-polaris-aks-dev
ConfigMap:
kuma-monitors-polaris-dotgov-test-aks
ConfigMap:
kuma-monitors-zamconnect-gsb-stg
ConfigMap:
kuma-monitors-zamconnect-gsb-tst
ConfigMap:
kuma-monitors-zamconnect-production
ConfigMap:
kuma-monitors-zamdocs-gsb-stg
ConfigMap:
kuma-monitors-zamdocs-gsb-tst
ConfigMap:
kuma-monitors-zamdocs-production
ConfigMap:
kuma-monitors-zamlog-production
ConfigMap:
kuma-monitors-zammobile-gsb-stg
ConfigMap:
kuma-monitors-zammobile-gsb-tst
ConfigMap:
kuma-monitors-zammobile-production
ConfigMap:
kuma-monitors-zamnotify-gsb-stg
ConfigMap:
kuma-monitors-zamnotify-gsb-tst
ConfigMap:
kuma-monitors-zamnotify-production
ConfigMap:
kuma-monitors-zamoffice-gsb-stg
ConfigMap:
kuma-monitors-zamoffice-gsb-tst
ConfigMap:
kuma-monitors-zamoffice-production
ConfigMap:
kuma-monitors-zampass-gsb-stg
ConfigMap:
kuma-monitors-zampass-gsb-tst
ConfigMap:
kuma-monitors-zampass-production
ConfigMap:
kuma-monitors-zampay-gsb-stg
ConfigMap:
kuma-monitors-zampay-gsb-tst
ConfigMap:
kuma-monitors-zampay-production
ConfigMap:
kuma-monitors-zampki-gsb-stg
ConfigMap:
kuma-monitors-zampki-gsb-tst
ConfigMap:
kuma-monitors-zampki-production
ConfigMap:
kuma-monitors-zampoint-gsb-stg
ConfigMap:
kuma-monitors-zampoint-gsb-tst
ConfigMap:
kuma-monitors-zampoint-production
ConfigMap:
kuma-monitors-zamservices-gsb-stg
ConfigMap:
kuma-monitors-zamservices-gsb-tst
ConfigMap:
kuma-monitors-zamservices-production
ConfigMap:
kuma-monitors-zamshortener-gsb-stg
ConfigMap:
kuma-monitors-zamshortener-gsb-tst
ConfigMap:
kuma-monitors-zamshortener-production
ConfigMap:
kuma-monitors-zamsign-gsb-stg
ConfigMap:
kuma-monitors-zamsign-gsb-tst
ConfigMap:
kuma-monitors-zamsign-production
Deployment:
kuma-uptime
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container kuma-uptime:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image tag should be specified
- Container should not have insecure capabilities
- Filesystem should be read only
- Should not be allowed to run as root
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Host port is not configured
- Memory requests are set
- Image pull policy is "Always"
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
Container kuma-manager:
- Privilege escalation should not be allowed
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Container should not have insecure capabilities
- Image pull policy should be "Always"
- Readiness probe should be configured
- Liveness probe should be configured
- Filesystem should be read only
- Should not be allowed to run as root
- CPU requests are set
- Container does not have any dangerous capabilities
- Memory requests are set
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Host port is not configured
- Not running as privileged
ServiceAccount:
default
Spec: no checks applied
Namespace: playwright
ConfigMap:
kube-root-ca.crt
RoleBinding:
azdev-rb-azdev-sa-836f16-admin-on-playwright
Spec:
- The RoleBinding references the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding references a Role with wildcard permissions
- The RoleBinding references a ClusterRole that allows Pods/exec, allows pods/attach, or that does not exist
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
azdev-sa-836f16
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
Namespace: polaris
ConfigMap:
kube-root-ca.crt
ConfigMap:
polaris
Deployment:
polaris-dashboard
Spec:
Pod Spec:
Container dashboard:
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Memory requests are set
- Privilege escalation not allowed
- Not running as privileged
- CPU requests are set
- Liveness probe is configured
- Filesystem is read only
- Image pull policy is "Always"
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
- Readiness probe is configured
- Image tag is specified
- Container does not have any dangerous capabilities
- Host port is not configured
- Is not allowed to run as root
PodDisruptionBudget:
polaris-dashboard
Spec: no checks applied
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
polaris
Spec: no checks applied
Namespace: postgres-operator
ConfigMap:
kube-root-ca.crt
Deployment:
postgres-operator
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container postgres-operator:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Image pull policy should be "Always"
- Liveness probe should be configured
- Container should not have insecure capabilities
- Host port is not configured
- Image tag is specified
- The container does not set potentially sensitive environment variables
- Container does not have any dangerous capabilities
- Not running as privileged
- CPU requests are set
- Memory requests are set
- Filesystem is read only
- Privilege escalation not allowed
- Readiness probe is configured
- Is not allowed to run as root
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
postgres-operator
Spec: no checks applied
Namespace: rabbitmq-ha
ConfigMap:
kube-root-ca.crt
ConfigMap:
rabbitmq-ha-plugins-conf
ConfigMap:
rabbitmq-ha-server-conf
RabbitmqCluster:
rabbitmq-ha
Spec: no checks applied
RoleBinding:
rabbitmq-ha-server
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
rabbitmq-ha-server
Spec: no checks applied
Namespace: rabbitmq-operator
ConfigMap:
kube-root-ca.crt
Deployment:
rabbitmq-operator-rabbitmq-cluster-operator
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container rabbitmq-cluster-operator:
- Image pull policy should be "Always"
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Container does not have any insecure capabilities
- Memory requests are set
- Filesystem is read only
- Privilege escalation not allowed
- Image tag is specified
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Readiness probe is configured
- Not running as privileged
- Is not allowed to run as root
- Container does not have any dangerous capabilities
- Liveness probe is configured
- CPU requests are set
Deployment:
rabbitmq-operator-rabbitmq-messaging-topology-operator
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container rabbitmq-cluster-operator:
- The container sets potentially sensitive environment variables
- Image pull policy should be "Always"
- Memory requests are set
- Readiness probe is configured
- Image tag is specified
- CPU requests are set
- Host port is not configured
- Liveness probe is configured
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Container does not have any dangerous capabilities
- Container does not have any insecure capabilities
- Filesystem is read only
- Privilege escalation not allowed
- Not running as privileged
- Is not allowed to run as root
NetworkPolicy:
rabbitmq-operator-rabbitmq-cluster-operator
Spec: no checks applied
NetworkPolicy:
rabbitmq-operator-rabbitmq-messaging-topology-operator
Spec: no checks applied
PodDisruptionBudget:
rabbitmq-operator-rabbitmq-cluster-operator
Spec: no checks applied
PodDisruptionBudget:
rabbitmq-operator-rabbitmq-messaging-topology-operator
Spec: no checks applied
Role:
rabbitmq-operator-rabbitmq-cluster-operator
Role:
rabbitmq-operator-rabbitmq-messaging-topology-operator
RoleBinding:
rabbitmq-operator-rabbitmq-cluster-operator
Spec:
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
RoleBinding:
rabbitmq-operator-rabbitmq-messaging-topology-operator
Spec:
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
rabbitmq-operator-rabbitmq-cluster-operator
Spec: no checks applied
ServiceAccount:
rabbitmq-operator-rabbitmq-messaging-topology-operator
Spec: no checks applied
Namespace: redis-ha
ConfigMap:
kube-root-ca.crt
ServiceAccount:
default
Spec: no checks applied
StatefulSet:
redis-ha
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container redis-ha:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Memory requests should be set
- Filesystem should be read only
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Should not be allowed to run as root
- CPU requests should be set
- Not running as privileged
- The container does not set potentially sensitive environment variables
- Image tag is specified
- Readiness probe is configured
- Host port is not configured
- Container does not have any dangerous capabilities
- Liveness probe is configured
Namespace: redis-operator
ConfigMap:
kube-root-ca.crt
Deployment:
redis-operator
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container redis-operator:
- Use one of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities to restrict containers using unwanted privileges
- Privilege escalation should not be allowed
- Should not be allowed to run as root
- Container should not have insecure capabilities
- Filesystem should be read only
- Liveness probe is configured
- Readiness probe is configured
- Not running as privileged
- Image tag is specified
- Host port is not configured
- Image pull policy is "Always"
- The container does not set potentially sensitive environment variables
- CPU requests are set
- Container does not have any dangerous capabilities
- Memory requests are set
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
redis-operator
Spec: no checks applied
Namespace: reloader
ConfigMap:
kube-root-ca.crt
ConfigMap:
reloader-meta-info
Deployment:
reloader-reloader
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host network is not configured
- Host PID is not configured
- Host IPC is not configured
Container reloader-reloader:
- Privilege escalation should not be allowed
- Image pull policy should be "Always"
- Container should not have insecure capabilities
- Filesystem should be read only
- Is not allowed to run as root
- Image tag is specified
- Memory requests are set
- Readiness probe is configured
- The container does not set potentially sensitive environment variables
- Host port is not configured
- Liveness probe is configured
- Not running as privileged
- CPU requests are set
- Container does not have any dangerous capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
RoleBinding:
reloader-reloader-metadata-role-binding
Spec:
- The RoleBinding does not reference a Role with wildcard permissions
- The RoleBinding does not reference a ClusterRole allowing pods/exec or pods/attach
- The RoleBinding does not reference a Role allowing Pod exec or attach
- The RoleBinding does not reference the default cluster-admin ClusterRole or one with wildcard permissions
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
reloader-reloader
Spec: no checks applied
Namespace: vpa
ConfigMap:
kube-root-ca.crt
Deployment:
vpa-admission-controller
Spec:
Pod Spec:
- The ServiceAccount will be automounted
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container vpa:
- Memory requests are set
- Not running as privileged
- Liveness probe is configured
- Filesystem is read only
- Privilege escalation not allowed
- Image tag is specified
- CPU requests are set
- Image pull policy is "Always"
- The container does not set potentially sensitive environment variables
- Is not allowed to run as root
- Container does not have any dangerous capabilities
- Host port is not configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Readiness probe is configured
Deployment:
vpa-recommender
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host PID is not configured
- Host IPC is not configured
- Host network is not configured
Container vpa:
- Container does not have any dangerous capabilities
- Host port is not configured
- The container does not set potentially sensitive environment variables
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Memory requests are set
- Readiness probe is configured
- Not running as privileged
- Is not allowed to run as root
- Image tag is specified
- Filesystem is read only
- Privilege escalation not allowed
- Image pull policy is "Always"
- CPU requests are set
Deployment:
vpa-updater
Spec:
Pod Spec:
- A NetworkPolicy should match pod labels and contain applied egress and ingress rules
- Priority class should be set
- Pod should be configured with a valid topology spread constraint
- The ServiceAccount will be automounted
- Host IPC is not configured
- Host network is not configured
- Host PID is not configured
Container vpa:
- Readiness probe is configured
- Container does not have any insecure capabilities
- One of AppArmor, Seccomp, SELinux, or dropping Linux Capabilities are used to restrict containers using unwanted privileges
- Liveness probe is configured
- Filesystem is read only
- Image pull policy is "Always"
- Image tag is specified
- CPU requests are set
- Container does not have any dangerous capabilities
- Host port is not configured
- Is not allowed to run as root
- The container does not set potentially sensitive environment variables
- Memory requests are set
- Privilege escalation not allowed
- Not running as privileged
ServiceAccount:
default
Spec: no checks applied
ServiceAccount:
vpa-admission-controller
Spec: no checks applied
ServiceAccount:
vpa-recommender
Spec: no checks applied
ServiceAccount:
vpa-updater
