Cis K8S V200 5.5.1

Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)

cyberstrikeus Updated

File contents

5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)

Profile Applicability

  • Level 2 - Master Node

Description

Configure Image Provenance for your deployment.

Rationale

Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster.

Impact

You need to regularly maintain your provenance configuration based on container image updates.

Audit

Review the pod definitions in your cluster and verify that image provenance is configured as appropriate.

Remediation

Follow the Kubernetes documentation and setup image provenance.

Default Value

By default, image provenance is not set.

References

  1. https://kubernetes.io/docs/admin/admission-controllers/#imagepolicywebhook
  2. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/image-provenance.md
  3. https://hub.docker.com/r/dnurmi/anchore-toolbox/
  4. https://github.com/kubernetes/kubernetes/issues/22888

cyberstrikeus/cyberstrike/tree/main/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Kubernetes_Benchmark_v2.0.0/cis-k8s-v200-5.5.1 commit 2d3d4e51de

Frequently asked questions

npx skillmds@latest add cyberstrikeus/cis-k8s-v200-5-5-1