EKS clusters should run a Kubernetes version that supports Pod Security Admission to minimize the admission of privileged containers

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Amazon EKS clusters should run a Kubernetes version that supports built-in Pod Security Admission so Pod Security Standards can be enforced to deny the admission of privileged containers. Privileged containers inherit all host capabilities and weaken container isolation, so workload namespaces should enforce at least the baseline (preferably restricted) profile. The available schema does not expose per-namespace Pod Security Admission labels, so this rule verifies the cluster runs Kubernetes 1.25 or later, where PSA is enabled by default and the legacy PodSecurityPolicy controller has been removed.

Remediation

Upgrade the cluster to a supported Kubernetes version using the Updating an Amazon EKS cluster Kubernetes version guide, then label each workload namespace to enforce Pod Security Standards (for example, kubectl label ns NAMESPACE pod-security.kubernetes.io/enforce=restricted --overwrite) and update workload manifests so no container, init container, or ephemeral container sets securityContext.privileged: true.

References