Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Use https for kubelet connections.
Enable certificate based kubelet authentication.
Verify kubelet's certificate before establishing connection.
Do not always authorize all requests.
Restrict kubelet nodes to reading only objects associated with them.
Turn on Role Based Access Control.
Limit the rate at which the API server accepts requests.
Do not allow all requests.
Always pull images.
The SecurityContextDeny admission controller can be used to deny pods which make use of some SecurityContext fields which could allow for privilege escalation in the cluster. This should be used where PodSecurityPolicy is not in place within the cluster.
Automate service accounts management.
Reject creating objects in a namespace that is undergoing termination.
Limit the Node and Pod objects that a kubelet could modify.
Do not disable the secure port.
Disable profiling, if not needed.
Enable auditing on the Kubernetes API Server and set the desired audit log path.
Retain the logs for at least 30 days or as appropriate.
Retain 10 or an appropriate number of old log files.
Rotate log files on reaching 100 MB or as appropriate.
Validate service account before validating token.
Explicitly set a service account public key file for service accounts on the apiserver.
etcd should be configured to make use of TLS encryption for client connections.
Setup TLS connection on the API server.
Setup TLS connection on the API server.