Example Constraints Violating CIS Benchmark
redcatsec opened this issue · comments
Overview:
create an example set of constraints that violate the CIS (Center for Internet Security) benchmark for Kubernetes. The purpose is to leverage these constraints within the fuzzing tool to generate resources that simulate non-compliant Pods.
Objective:
define a set of constraints that are considered "very bad" according to the CIS benchmark. These constraints will be used by the fuzzing tool to generate resources that test the resiliency and security of the Kubernetes admission controller.
Proposed Constraints:
To initiate the discussion, I propose the following example constraints that are expected to violate the CIS benchmark:
- AllowPrivilegeEscalation: true
- HostIPC: true
- HostNetwork: true
- HostPID: true
- AllowPrivileged: true
- Privileged: true
or more ..
Hi @aasyria,
We are currently working on adding constrain files for sample Benchmarks, like CIS. I will ping you once we added these constrains.
We will use CIS Kubernetes V1.24 for the first Implementation.
Hello @aasyria,
That's a great idea :) I've added a sample pod CIS 1.24 constraints on the main branch directly. Feel free to open a pull request to add some of your own!
thanx