VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

Each AKS cluster should be covered by an enforced Azure Policy assignment that restricts privileged container admission, so pods cannot run containers, init containers, or ephemeral containers with securityContext.privileged=true. Privileged containers gain access to all Linux kernel capabilities and host devices, letting a compromised workload act with near host-level control.

This rule evaluates each azure_aks_cluster and passes only when an azure_policy_assignment for the built-in “Kubernetes cluster should not allow privileged containers” definition both covers the cluster’s scope (the cluster resource, its resource group, or its subscription) and has its enforcement mode set to Default. A cluster with no covering enforced assignment fails. Management-group-scoped assignments are not evaluated.

Remediation

Assign the built-in “Kubernetes cluster should not allow privileged containers” policy to each subscription or resource group hosting AKS workloads, and set the enforcement mode to Default so the deny effect is applied. See Azure Policy for Kubernetes clusters for step-by-step guidance.

References

• Azure Policy built-in definitions for AKS
• Kubernetes Pod Security Admission
• CIS Kubernetes Benchmark