Checks
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
Browse individual security checks available in the Prowler Registry. Filter by cloud provider, severity, or search by check ID.
etcd should be configured to make use of TLS encryption for client connections.
Encrypt etcd key-value store.
Activate garbage collector on pod termination, as appropriate.
Disable profiling, if not needed.
Use individual service account credentials for each controller.
Explicitly set a service account private key file for service accounts on the controller manager.
Allow pods to verify the API server's serving certificate before establishing connections.
Enable kubelet server certificate rotation on controller-manager.
Do not bind the scheduler service to non-loopback insecure addresses.
Disable profiling, if not needed.
Do not bind the scheduler service to non-loopback insecure addresses.
Configure TLS encryption for the etcd service.
Enable client authentication on etcd service.
Do not use self-signed certificates for TLS.
etcd should be configured to make use of TLS encryption for peer connections.
etcd should be configured for peer authentication.
Do not use self-signed certificates for TLS.
Ensure that the API server pod specification file has permissions of 600 or more restrictive.
Ensure that the API server pod specification file ownership is set to root:root.
Ensure that the controller manager pod specification file has permissions of 600 or more restrictive.
Ensure that the controller manager pod specification file ownership is set to root:root.
Ensure that the scheduler pod specification file has permissions of 600 or more restrictive.
Ensure that the scheduler pod specification file ownership is set to root:root.
Ensure that the etcd pod specification file has permissions of 600 or more restrictive.