Project: KICS (Provisioning / Security & Compliance)
File: kubernetes-queries.md

This page contains all queries from Kubernetes. | Query |Severity|Category|More info| ||--|--|--| |Authorization Mode Set To Always Allow<br/><sup><sub>f1f4d8da-1ac4-47d0-b1aa-91e69d33f7d5</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/f1f4d8da-1ac4-47d0-b1aa-91e69d33f7d5" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Basic Auth File Is Set<br/><sup><sub>5da47109-f8d6-4585-9e2b-96a8958a12f5</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/5da47109-f8d6-4585-9e2b-96a8958a12f5" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Client Certificate Authentication Not Setup Properly<br/><sup><sub>e0e00aba-5f1c-4981-a542-9a9563c0ee20</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/e0e00aba-5f1c-4981-a542-9a9563c0ee20" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">Documentation</a><br/>| |Non Kube System Pod With Host Mount<br/><sup><sub>aa8f7a35-9923-4cad-bd61-a19b7f6aac91</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/aa8f7a35-9923-4cad-bd61-a19b7f6aac91" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/storage/volumes/">Documentation</a><br/>| |RBAC Wildcard In Rule<br/><sup><sub>6b896afb-ca07-467a-b256-1a0077a1c08e</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/6b896afb-ca07-467a-b256-1a0077a1c08e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |Service Account Lookup Set To False<br/><sup><sub>a5530bd7-225a-48f9-91bb-f40b04200165</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/a5530bd7-225a-48f9-91bb-f40b04200165" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Token Auth File Is Set<br/><sup><sub>32ecd76e-7bbf-402e-bf48-8b9485749558</sub></sup>|<span style="color:#bb2124">High</span>|Access Control|<a href="../kubernetes-queries/32ecd76e-7bbf-402e-bf48-8b9485749558" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Pod Security Policy Admission Control Plugin Not Set<br/><sup><sub>afa36afb-39fe-4d94-b9b6-afb236f7a03d</sub></sup>|<span style="color:#bb2124">High</span>|Build Process|<a href="../kubernetes-queries/afa36afb-39fe-4d94-b9b6-afb236f7a03d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Cluster Allows Unsafe Sysctls<br/><sup><sub>9127f0d9-2310-42e7-866f-5fd9d20dcbad</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/9127f0d9-2310-42e7-866f-5fd9d20dcbad" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/">Documentation</a><br/>| |Container Is Privileged<br/><sup><sub>dd29336b-fe57-445b-a26e-e6aa867ae609</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/dd29336b-fe57-445b-a26e-e6aa867ae609" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/pods/#privileged-mode-for-containers">Documentation</a><br/>| |Container Runs Unmasked<br/><sup><sub>f922827f-aab6-447c-832a-e1ff63312bd3</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/f922827f-aab6-447c-832a-e1ff63312bd3" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#allowedprocmounttypes">Documentation</a><br/>| |Containers With Sys Admin Capabilities<br/><sup><sub>235236ee-ad78-4065-bd29-61b061f28ce0</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/235236ee-ad78-4065-bd29-61b061f28ce0" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |Privilege Escalation Allowed<br/><sup><sub>5572cc5e-1e4c-4113-92a6-7a8a3bd25e6d</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/5572cc5e-1e4c-4113-92a6-7a8a3bd25e6d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |PSP Allows Containers To Share The Host Network Namespace<br/><sup><sub>a33e9173-b674-4dfb-9d82-cf3754816e4b</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/a33e9173-b674-4dfb-9d82-cf3754816e4b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |PSP Allows Privilege Escalation<br/><sup><sub>87554eef-154d-411d-bdce-9dbd91e56851</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/87554eef-154d-411d-bdce-9dbd91e56851" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |PSP Allows Sharing Host IPC<br/><sup><sub>80f93444-b240-4ebb-a4c6-5c40b76c04ea</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/80f93444-b240-4ebb-a4c6-5c40b76c04ea" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |PSP Set To Privileged<br/><sup><sub>c48e57d3-d642-4e0b-90db-37f807b41b91</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/c48e57d3-d642-4e0b-90db-37f807b41b91" target="blank">Query details</a><br><a href="https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/podsecurity_policy#privileged">Documentation</a><br/>| |PSP With Added Capabilities<br/><sup><sub>7307579a-3abb-46ad-9ce5-2a915634d5c8</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/7307579a-3abb-46ad-9ce5-2a915634d5c8" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Shared Host PID Namespace<br/><sup><sub>302736f4-b16c-41b8-befe-c0baffa0bd9d</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/302736f4-b16c-41b8-befe-c0baffa0bd9d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Tiller (Helm v2) Is Deployed<br/><sup><sub>6d173be7-545a-46c6-a81d-2ae52ed1605d</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/6d173be7-545a-46c6-a81d-2ae52ed1605d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/containers/images/">Documentation</a><br/>| |Tiller Service Is Not Deleted<br/><sup><sub>8b862ca9-0fbd-4959-ad72-b6609bdaa22d</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/8b862ca9-0fbd-4959-ad72-b6609bdaa22d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/service">Documentation</a><br/>| |Workload Mounting With Sensitive OS Directory<br/><sup><sub>5308a7a8-06f8-45ac-bf10-791fe21de46e</sub></sup>|<span style="color:#bb2124">High</span>|Insecure Configurations|<a href="../kubernetes-queries/5308a7a8-06f8-45ac-bf10-791fe21de46e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Etcd Peer TLS Certificate Files Not Properly Set<br/><sup><sub>09bb9e96-8da3-4736-b89a-b36814acca60</sub></sup>|<span style="color:#bb2124">High</span>|Networking and Firewall|<a href="../kubernetes-queries/09bb9e96-8da3-4736-b89a-b36814acca60" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |Insecure Bind Address Set<br/><sup><sub>b9380fd3-5ffe-4d10-9290-13e18e71eee1</sub></sup>|<span style="color:#bb2124">High</span>|Networking and Firewall|<a href="../kubernetes-queries/b9380fd3-5ffe-4d10-9290-13e18e71eee1" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Insecure Port Not Properly Set<br/><sup><sub>fa4def8c-1898-4a35-a139-7b76b1acdef0</sub></sup>|<span style="color:#bb2124">High</span>|Networking and Firewall|<a href="../kubernetes-queries/fa4def8c-1898-4a35-a139-7b76b1acdef0" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Secure Port Set To Zero<br/><sup><sub>3d24b204-b73d-42cb-b0bf-1a5438c5f71e</sub></sup>|<span style="color:#bb2124">High</span>|Networking and Firewall|<a href="../kubernetes-queries/3d24b204-b73d-42cb-b0bf-1a5438c5f71e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Tiller Deployment Is Accessible From Within The Cluster<br/><sup><sub>e17fa86a-6222-4584-a914-56e8f6c87e06</sub></sup>|<span style="color:#bb2124">High</span>|Networking and Firewall|<a href="../kubernetes-queries/e17fa86a-6222-4584-a914-56e8f6c87e06" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/containers/images/">Documentation</a><br/>| |PSP With Unrestricted Access to Host Path<br/><sup><sub>de4421f1-4e35-43b4-9783-737dd4e4a47e</sub></sup>|<span style="color:#bb2124">High</span>|Resource Management|<a href="../kubernetes-queries/de4421f1-4e35-43b4-9783-737dd4e4a47e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems">Documentation</a><br/>| |Volume Mount With OS Directory Write Permissions<br/><sup><sub>b7652612-de4e-4466-a0bf-1cd81f0c6063</sub></sup>|<span style="color:#bb2124">High</span>|Resource Management|<a href="../kubernetes-queries/b7652612-de4e-4466-a0bf-1cd81f0c6063" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/storage/volumes/">Documentation</a><br/>| |Always Admit Admission Control Plugin Set<br/><sup><sub>ce30e584-b33f-4c7d-b418-a3d7027f8f60</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/ce30e584-b33f-4c7d-b418-a3d7027f8f60" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Anonymous Auth Is Not Set To False<br/><sup><sub>1de5cc51-f376-4638-a940-20f2e85ae238</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/1de5cc51-f376-4638-a940-20f2e85ae238" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Authorization Mode RBAC Not Set<br/><sup><sub>1aa4a1ae-5dbb-48a1-9aa2-630ea4be208e</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/1aa4a1ae-5dbb-48a1-9aa2-630ea4be208e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Docker Daemon Socket is Exposed to Containers<br/><sup><sub>a6f34658-fdfb-4154-9536-56d516f65828</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/a6f34658-fdfb-4154-9536-56d516f65828" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/storage/volumes/">Documentation</a><br/>| |Node Restriction Admission Control Plugin Not Set<br/><sup><sub>33fc6923-6553-4fe6-9d3a-4efa51eb874b</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/33fc6923-6553-4fe6-9d3a-4efa51eb874b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Permissive Access to Create Pods<br/><sup><sub>592ad21d-ad9b-46c6-8d2d-fad09d62a942</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/592ad21d-ad9b-46c6-8d2d-fad09d62a942" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#privilege-escalation-prevention-and-bootstrapping">Documentation</a><br/>| |RBAC Roles Allow Privilege Escalation<br/><sup><sub>8320826e-7a9c-4b0b-9535-578333193432</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/8320826e-7a9c-4b0b-9535-578333193432" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#restrictions-on-role-binding-creation-or-update">Documentation</a><br/>| |RBAC Roles with Attach Permission<br/><sup><sub>d45330fd-f58d-45fb-a682-6481477a0f84</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/d45330fd-f58d-45fb-a682-6481477a0f84" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |RBAC Roles with Exec Permission<br/><sup><sub>c589f42c-7924-4871-aee2-1cede9bc7cbc</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/c589f42c-7924-4871-aee2-1cede9bc7cbc" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |RBAC Roles with Impersonate Permission<br/><sup><sub>9f85c3f6-26fd-4007-938a-2e0cb0100980</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/9f85c3f6-26fd-4007-938a-2e0cb0100980" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation">Documentation</a><br/>| |RBAC Roles with Port-Forwarding Permission<br/><sup><sub>38fa11ef-dbcc-4da8-9680-7e1fd855b6fb</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/38fa11ef-dbcc-4da8-9680-7e1fd855b6fb" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |RBAC Roles with Read Secrets Permissions<br/><sup><sub>b7bca5c4-1dab-4c2c-8cbe-3050b9d59b14</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/b7bca5c4-1dab-4c2c-8cbe-3050b9d59b14" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |Service Account Admission Control Plugin Disabled<br/><sup><sub>9587c890-0524-40c2-9ce2-663af7c2f063</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/9587c890-0524-40c2-9ce2-663af7c2f063" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Use Service Account Credentials Not Set To True<br/><sup><sub>1acd93f1-5a37-45c0-aaac-82ece818be7d</sub></sup>|<span style="color:#ff7213">Medium</span>|Access Control|<a href="../kubernetes-queries/1acd93f1-5a37-45c0-aaac-82ece818be7d" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/">Documentation</a><br/>| |Readiness Probe Is Not Configured<br/><sup><sub>a659f3b5-9bf0-438a-bd9a-7d3a6427f1e3</sub></sup>|<span style="color:#ff7213">Medium</span>|Availability|<a href="../kubernetes-queries/a659f3b5-9bf0-438a-bd9a-7d3a6427f1e3" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-readiness-probes">Documentation</a><br/>| |Request Timeout Not Properly Set<br/><sup><sub>d89a15bb-8dba-4c71-9529-bef6729b9c09</sub></sup>|<span style="color:#ff7213">Medium</span>|Availability|<a href="../kubernetes-queries/d89a15bb-8dba-4c71-9529-bef6729b9c09" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Terminated Pod Garbage Collector Threshold Not Properly

style="color:#ff7213">Medium</span>|Availability|<a href="../kubernetes-queries/49113af4-29ca-458e-b8d4-724c01a4a24f" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/">Documentation</a><br/>| |Container Running As Root<br/><sup><sub>cf34805e-3872-4c08-bf92-6ff7bb0cfadb</sub></sup>|<span style="color:#ff7213">Medium</span>|Best Practices|<a href="../kubernetes-queries/cf34805e-3872-4c08-bf92-6ff7bb0cfadb" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |Container Running With Low UID<br/><sup><sub>02323c00-cdc3-4fdc-a310-4f2b3e7a1660</sub></sup>|<span style="color:#ff7213">Medium</span>|Best Practices|<a href="../kubernetes-queries/02323c00-cdc3-4fdc-a310-4f2b3e7a1660" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |Root Containers Admitted<br/><sup><sub>e3aa0612-4351-4a0d-983f-aefea25cf203</sub></sup>|<span style="color:#ff7213">Medium</span>|Best Practices|<a href="../kubernetes-queries/e3aa0612-4351-4a0d-983f-aefea25cf203" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Always Pull Images Admission Control Plugin Not Set<br/><sup><sub>a77f4d07-c6e0-4a48-8b35-0eeb51576f4f</sub></sup>|<span style="color:#ff7213">Medium</span>|Build Process|<a href="../kubernetes-queries/a77f4d07-c6e0-4a48-8b35-0eeb51576f4f" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Incorrect Volume Claim Access Mode ReadWriteOnce<br/><sup><sub>3878dc92-8e5d-47cf-9cdd-7590f71d21b9</sub></sup>|<span style="color:#ff7213">Medium</span>|Build Process|<a href="../kubernetes-queries/3878dc92-8e5d-47cf-9cdd-7590f71d21b9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/">Documentation</a><br/>| |Encryption Provider Config Is Not Defined<br/><sup><sub>cbd2db69-0b21-4c14-8a40-7710a50571a9</sub></sup>|<span style="color:#ff7213">Medium</span>|Encryption|<a href="../kubernetes-queries/cbd2db69-0b21-4c14-8a40-7710a50571a9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Encryption Provider Not Properly Configured<br/><sup><sub>10efce34-5af6-4d83-b414-9e096d5a06a9</sub></sup>|<span style="color:#ff7213">Medium</span>|Encryption|<a href="../kubernetes-queries/10efce34-5af6-4d83-b414-9e096d5a06a9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#understanding-the-encryption-at-rest-configuration">Documentation</a><br/>| |Root CA File Not Defined<br/><sup><sub>05fb986f-ac73-4ebb-a5b2-7faafa93d882</sub></sup>|<span style="color:#ff7213">Medium</span>|Encryption|<a href="../kubernetes-queries/05fb986f-ac73-4ebb-a5b2-7faafa93d882" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/">Documentation</a><br/>| |Service Account Private Key File Not Defined<br/><sup><sub>ccc98ff7-68a7-436e-9218-185cb0b0b780</sub></sup>|<span style="color:#ff7213">Medium</span>|Encryption|<a href="../kubernetes-queries/ccc98ff7-68a7-436e-9218-185cb0b0b780" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/">Documentation</a><br/>| |Weak TLS Cipher Suites<br/><sup><sub>510d5810-9a30-443a-817d-5c1fa527b110</sub></sup>|<span style="color:#ff7213">Medium</span>|Encryption|<a href="../kubernetes-queries/510d5810-9a30-443a-817d-5c1fa527b110" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">Documentation</a><br/>| |Authorization Mode Node Not Set<br/><sup><sub>4d7ee40f-fc5d-427d-8cac-dffbe22d42d1</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/4d7ee40f-fc5d-427d-8cac-dffbe22d42d1" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Containers With Added Capabilities<br/><sup><sub>19ebaa28-fc86-4a58-bcfa-015c9e22fe40</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/19ebaa28-fc86-4a58-bcfa-015c9e22fe40" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |Ingress Controller Exposes Workload<br/><sup><sub>69bbc5e3-0818-4150-89cc-1e989b48f23b</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/69bbc5e3-0818-4150-89cc-1e989b48f23b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/">Documentation</a><br/>| |Kubelet Protect Kernel Defaults Set To False<br/><sup><sub>6cf42c97-facd-4fda-b8af-ea4529123355</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/6cf42c97-facd-4fda-b8af-ea4529123355" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">Documentation</a><br/>| |NETRAW Capabilities Disabled for PSP<br/><sup><sub>2270987f-bb51-479f-b8be-3ca73e5ad648</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/2270987f-bb51-479f-b8be-3ca73e5ad648" target="blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |NETRAW Capabilities Not Being Dropped<br/><sup><sub>dbbc6705-d541-43b0-b166-dd4be8208b54</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/dbbc6705-d541-43b0-b166-dd4be8208b54" target="blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |PSP Allows Sharing Host PID<br/><sup><sub>91dacd0e-d189-4a9c-8272-5999a3cc32d9</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/91dacd0e-d189-4a9c-8272-5999a3cc32d9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Seccomp Profile Is Not Configured<br/><sup><sub>f377b83e-bd07-4f48-a591-60c82b14a78b</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/f377b83e-bd07-4f48-a591-60c82b14a78b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tutorials/security/seccomp/#create-pod-that-uses-the-container-runtime-default-seccomp-profile">Documentation</a><br/>| |Security Context Deny Admission Control Plugin Not Set<br/><sup><sub>6a68bebe-c021-492e-8ddb-55b0567fb768</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/6a68bebe-c021-492e-8ddb-55b0567fb768" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Using Unrecommended Namespace<br/><sup><sub>611ab018-c4aa-4ba2-b0f6-a448337509a6</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Configurations|<a href="../kubernetes-queries/611ab018-c4aa-4ba2-b0f6-a448337509a6" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/kubernetes-objects/">Documentation</a><br/>| |Role Binding To Default Service Account<br/><sup><sub>1e749bc9-fde8-471c-af0c-8254efd2dee5</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Defaults|<a href="../kubernetes-queries/1e749bc9-fde8-471c-af0c-8254efd2dee5" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Documentation</a><br/>| |Service Account Name Undefined Or Empty<br/><sup><sub>591ade62-d6b0-4580-b1ae-209f80ba1cd9</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Defaults|<a href="../kubernetes-queries/591ade62-d6b0-4580-b1ae-209f80ba1cd9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Documentation</a><br/>| |Service Account Token Automount Not Disabled<br/><sup><sub>48471392-d4d0-47c0-b135-cdec95eb3eef</sub></sup>|<span style="color:#ff7213">Medium</span>|Insecure Defaults|<a href="../kubernetes-queries/48471392-d4d0-47c0-b135-cdec95eb3eef" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server">Documentation</a><br/>| |Auto TLS Set To True<br/><sup><sub>98ce8b81-7707-4734-aa39-627c6db3d84b</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/98ce8b81-7707-4734-aa39-627c6db3d84b" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |CNI Plugin Does Not Support Network Policies<br/><sup><sub>03aabc8c-35d6-481e-9c85-20139cf72d23</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/03aabc8c-35d6-481e-9c85-20139cf72d23" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/">Documentation</a><br/>| |Etcd TLS Certificate Files Not Properly Set<br/><sup><sub>075ca296-6768-4322-aea2-ba5063b969a9</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/075ca296-6768-4322-aea2-ba5063b969a9" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |Etcd TLS Certificate Not Properly Configured<br/><sup><sub>895a5a95-3756-4b04-9924-2f3bc93181bd</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/895a5a95-3756-4b04-9924-2f3bc93181bd" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Kubelet HTTPS Set To False<br/><sup><sub>cdc8b54e-6b16-4538-a1b0-35849dbe29cf</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/cdc8b54e-6b16-4538-a1b0-35849dbe29cf" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Kubelet Not Managing Ip Tables<br/><sup><sub>5f89001f-6dd9-49ff-9b15-d8cd71b617f4</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/5f89001f-6dd9-49ff-9b15-d8cd71b617f4" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Kubelet Read Only Port Is Not Set To Zero<br/><sup><sub>2940d48a-dc5e-4178-a3f8-bfbd80720b41</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/2940d48a-dc5e-4178-a3f8-bfbd80720b41" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Kubelet Streaming Connection Timeout Disabled<br/><sup><sub>ed89b97d-04e9-4fd4-919f-ee5b27e555e9</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/ed89b97d-04e9-4fd4-919f-ee5b27e555e9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Peer Auto TLS Set To True<br/><sup><sub>ae8827e2-4af9-4baa-9998-87539ae0d6f0</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/ae8827e2-4af9-4baa-9998-87539ae0d6f0" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |Pod Misconfigured Network Policy<br/><sup><sub>0401f71b-9c1e-4821-ab15-a955caa621be</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/0401f71b-9c1e-4821-ab15-a955caa621be" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/">Documentation</a><br/>| |Service With External Load Balancer<br/><sup><sub>26763a1c-5dda-4772-b507-5fca7fb5f165</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/26763a1c-5dda-4772-b507-5fca7fb5f165" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/">Documentation</a><br/>| |TSL Connection Certificate Not Setup<br/><sup><sub>fa750c81-93c2-4fab-9c6d-d3fd3ce3b89f</sub></sup>|<span style="color:#ff7213">Medium</span>|Networking and Firewall|<a href="../kubernetes-queries/fa750c81-93c2-4fab-9c6d-d3fd3ce3b89f" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Audit Log Path Not Set<br/><sup><sub>73e251f0-363d-4e53-86e2-0a93592437eb</sub></sup>|<span style="color:#ff7213">Medium</span>|Observability|<a href="../kubernetes-queries/73e251f0-363d-4e53-86e2-0a93592437eb" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Audit Policy File Not Defined<br/><sup><sub>13a49a2e-488e-4309-a7c0-d6b05577a5fb</sub></sup>|<span style="color:#ff7213">Medium</span>|Observability|<a href="../kubernetes-queries/13a49a2e-488e-4309-a7c0-d6b05577a5fb" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Memory Limits Not Defined<br/><sup><sub>b14d1bc4-a208-45db-92f0-e21f8e2588e9</sub></sup>|<span style="color:#ff7213">Medium</span>|Resource Management|<a href="../kubernetes-queries/b14d1bc4-a208-45db-92f0-e21f8e2588e9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/">Documentation</a><br/>| |Memory Requests Not Defined<br/><sup><sub>229588ef-8fde-40c8-8756-f4f2b5825ded</sub></sup>|<span style="color:#ff7213">Medium</span>|Resource Management|<a href="../kubernetes-queries/229588ef-8fde-40c8-8756-f4f2b5825ded" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/">Documentation</a><br/>| |Shared Host IPC Namespace<br/><sup><sub>cd290efd-6c82-4e9d-a698-be12ae31d536</sub></sup>|<span style="color:#ff7213">Medium</span>|Resource Management|<a href="../kubernetes-queries/cd290efd-6c82-4e9d-a698-be12ae31d536" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Shared Host Network Namespace<br/><sup><sub>6b6bdfb3-c3ae-44cb-88e4-7405c1ba2c8a</sub></sup>|<span style="color:#ff7213">Medium</span>|Resource Management|<a href="../kubernetes-queries/6b6bdfb3-c3ae-44cb-88e4-7405c1ba2c8a" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Etcd Client Certificate Authentication Set To False<br/><sup><sub>9391103a-d8d7-4671-ac5d-606ba7ccb0ac</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/9391103a-d8d7-4671-ac5d-606ba7ccb0ac" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |Etcd Client Certificate File Not Defined<br/><sup><sub>3f5ff8a7-5ad6-4d02-86f5-666307da1b20</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/3f5ff8a7-5ad6-4d02-86f5-666307da1b20" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Etcd Peer Client Certificate Authentication Set To False<br/><sup><sub>b7d0181d-0a9b-4611-9d1c-1ad4f0b620ff</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/b7d0181d-0a9b-4611-9d1c-1ad4f0b620ff" target="_blank">Query details</a><br><a href="https://etcd.io/docs/v3.4/op-guide/security/">Documentation</a><br/>| |Kubelet Certificate Authority Not Set<br/><sup><sub>ec18a0d3-0069-4a58-a7fb-fbfe0b4bbbe0</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/ec18a0d3-0069-4a58-a7fb-fbfe0b4bbbe0" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Kubelet Client Certificate Or Key Not Set<br/><sup><sub>36a27826-1bf5-49da-aeb0-a60a30c0e834</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/36a27826-1bf5-49da-aeb0-a60a30c0e834" target="_blank">Query details</a><br><a

|Kubelet Client Periodic Certificate Switch Disabled<br/><sup><sub>52d70f2e-3257-474c-b3dc-8ad9ba6a061a</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/52d70f2e-3257-474c-b3dc-8ad9ba6a061a" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Not Unique Certificate Authority<br/><sup><sub>cb7e695d-6a85-495c-b15f-23aed2519303</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/cb7e695d-6a85-495c-b15f-23aed2519303" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Rotate Kubelet Server Certificate Not Active<br/><sup><sub>1c621b8e-2c6a-44f5-bd6a-fb0fb7ba33e2</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/1c621b8e-2c6a-44f5-bd6a-fb0fb7ba33e2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/">Documentation</a><br/>| |Service Account Key File Not Properly Set<br/><sup><sub>dab4ec72-ce2e-4732-b7c3-1757dcce01a1</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/dab4ec72-ce2e-4732-b7c3-1757dcce01a1" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |ServiceAccount Allows Access Secrets<br/><sup><sub>056ac60e-fe07-4acc-9b34-8e1d51716ab9</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/056ac60e-fe07-4acc-9b34-8e1d51716ab9" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Documentation</a><br/>| |Shared Service Account<br/><sup><sub>c1032cf7-3628-44e2-bd53-38c17cf31b6b</sub></sup>|<span style="color:#ff7213">Medium</span>|Secret Management|<a href="../kubernetes-queries/c1032cf7-3628-44e2-bd53-38c17cf31b6b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Documentation</a><br/>| |Cluster Admin Rolebinding With Superuser Permissions<br/><sup><sub>249328b8-5f0f-409f-b1dd-029f07882e11</sub></sup>|<span style="color:#edd57e">Low</span>|Access Control|<a href="../kubernetes-queries/249328b8-5f0f-409f-b1dd-029f07882e11" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles">Documentation</a><br/>| |Missing AppArmor Profile<br/><sup><sub>8b36775e-183d-4d46-b0f7-96a6f34a723f</sub></sup>|<span style="color:#edd57e">Low</span>|Access Control|<a href="../kubernetes-queries/8b36775e-183d-4d46-b0f7-96a6f34a723f" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tutorials/clusters/apparmor/">Documentation</a><br/>| |Deployment Without PodDisruptionBudget<br/><sup><sub>b23e9b98-0cb6-4fc9-b257-1f3270442678</sub></sup>|<span style="color:#edd57e">Low</span>|Availability|<a href="../kubernetes-queries/b23e9b98-0cb6-4fc9-b257-1f3270442678" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/run-application/configure-pdb/">Documentation</a><br/>| |Event Rate Limit Admission Control Plugin Not Set<br/><sup><sub>e0099af2-fe17-411f-9991-0de28fe15f3c</sub></sup>|<span style="color:#edd57e">Low</span>|Availability|<a href="../kubernetes-queries/e0099af2-fe17-411f-9991-0de28fe15f3c" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |HPA Targets Invalid Object<br/><sup><sub>2f652c42-619d-4361-b361-9f599688f8ca</sub></sup>|<span style="color:#edd57e">Low</span>|Availability|<a href="../kubernetes-queries/2f652c42-619d-4361-b361-9f599688f8ca" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/">Documentation</a><br/>| |StatefulSet Without PodDisruptionBudget<br/><sup><sub>1db3a5a5-bf75-44e5-9e44-c56cfc8b1ac5</sub></sup>|<span style="color:#edd57e">Low</span>|Availability|<a href="../kubernetes-queries/1db3a5a5-bf75-44e5-9e44-c56cfc8b1ac5" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/run-application/configure-pdb/">Documentation</a><br/>| |StatefulSet Without Service Name<br/><sup><sub>bb241e61-77c3-4b97-9575-c0f8a1e008d0</sub></sup>|<span style="color:#edd57e">Low</span>|Availability|<a href="../kubernetes-queries/bb241e61-77c3-4b97-9575-c0f8a1e008d0" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/">Documentation</a><br/>| |Metadata Label Is Invalid<br/><sup><sub>1123031a-f921-4c5b-bd86-ef354ecfd37a</sub></sup>|<span style="color:#edd57e">Low</span>|Best Practices|<a href="../kubernetes-queries/1123031a-f921-4c5b-bd86-ef354ecfd37a" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/">Documentation</a><br/>| |No Drop Capabilities for Containers<br/><sup><sub>268ca686-7fb7-4ae9-b129-955a2a89064e</sub></sup>|<span style="color:#edd57e">Low</span>|Best Practices|<a href="../kubernetes-queries/268ca686-7fb7-4ae9-b129-955a2a89064e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/">Documentation</a><br/>| |Object Is Using A Deprecated API Version<br/><sup><sub>94b76ea5-e074-4ca2-8a03-c5a606e30645</sub></sup>|<span style="color:#edd57e">Low</span>|Best Practices|<a href="../kubernetes-queries/94b76ea5-e074-4ca2-8a03-c5a606e30645" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/using-api/deprecation-guide/">Documentation</a><br/>| |Image Policy Webhook Admission Control Plugin Not Set<br/><sup><sub>14abda69-8e91-4acb-9931-76e2bee90284</sub></sup>|<span style="color:#edd57e">Low</span>|Build Process|<a href="../kubernetes-queries/14abda69-8e91-4acb-9931-76e2bee90284" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Namespace Lifecycle Admission Control Plugin Disabled<br/><sup><sub>1ffe7bf7-563b-4b3d-a71d-ba6bd8d49b37</sub></sup>|<span style="color:#edd57e">Low</span>|Build Process|<a href="../kubernetes-queries/1ffe7bf7-563b-4b3d-a71d-ba6bd8d49b37" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Root Container Not Mounted Read-only<br/><sup><sub>a9c2f49d-0671-4fc9-9ece-f4e261e128d0</sub></sup>|<span style="color:#edd57e">Low</span>|Build Process|<a href="../kubernetes-queries/a9c2f49d-0671-4fc9-9ece-f4e261e128d0" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |StatefulSet Requests Storage<br/><sup><sub>8cf4671a-cf3d-46fc-8389-21e7405063a2</sub></sup>|<span style="color:#edd57e">Low</span>|Build Process|<a href="../kubernetes-queries/8cf4671a-cf3d-46fc-8389-21e7405063a2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/">Documentation</a><br/>| |Dashboard Is Enabled<br/><sup><sub>d2ad057f-0928-41ef-a83c-f59203bb855b</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/d2ad057f-0928-41ef-a83c-f59203bb855b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/">Documentation</a><br/>| |Image Pull Policy Of The Container Is Not Set To Always<br/><sup><sub>caa3479d-885d-4882-9aac-95e5e78ef5c2</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/caa3479d-885d-4882-9aac-95e5e78ef5c2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/containers/images/#updating-images">Documentation</a><br/>| |Image Without Digest<br/><sup><sub>7c81d34c-8e5a-402b-9798-9f442630e678</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/7c81d34c-8e5a-402b-9798-9f442630e678" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/containers/images/#updating-images">Documentation</a><br/>| |Kubelet Hostname Override Is Set<br/><sup><sub>bf36b900-b5ef-4828-adb7-70eb543b7cfb</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/bf36b900-b5ef-4828-adb7-70eb543b7cfb" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">Documentation</a><br/>| |Pod or Container Without LimitRange<br/><sup><sub>4a20ebac-1060-4c81-95d1-1f7f620e983b</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/4a20ebac-1060-4c81-95d1-1f7f620e983b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/limit-range/">Documentation</a><br/>| |Pod or Container Without ResourceQuota<br/><sup><sub>48a5beba-e4c0-4584-a2aa-e6894e4cf424</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/48a5beba-e4c0-4584-a2aa-e6894e4cf424" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/resource-quotas/">Documentation</a><br/>| |Pod or Container Without Security Context<br/><sup><sub>a97a340a-0063-418e-b3a1-3028941d0995</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/a97a340a-0063-418e-b3a1-3028941d0995" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/">Documentation</a><br/>| |Service Does Not Target Pod<br/><sup><sub>3ca03a61-3249-4c16-8427-6f8e47dda729</sub></sup>|<span style="color:#edd57e">Low</span>|Insecure Configurations|<a href="../kubernetes-queries/3ca03a61-3249-4c16-8427-6f8e47dda729" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/service/">Documentation</a><br/>| |Network Policy Is Not Targeting Any Pod<br/><sup><sub>85ab1c5b-014e-4352-b5f8-d7dea3bb4fd3</sub></sup>|<span style="color:#edd57e">Low</span>|Networking and Firewall|<a href="../kubernetes-queries/85ab1c5b-014e-4352-b5f8-d7dea3bb4fd3" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/">Documentation</a><br/>| |Service Type is NodePort<br/><sup><sub>845acfbe-3e10-4b8e-b656-3b404d36dfb2</sub></sup>|<span style="color:#edd57e">Low</span>|Networking and Firewall|<a href="../kubernetes-queries/845acfbe-3e10-4b8e-b656-3b404d36dfb2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/service/">Documentation</a><br/>| |Workload Host Port Not Specified<br/><sup><sub>2b1836f1-dcce-416e-8e16-da8c71920633</sub></sup>|<span style="color:#edd57e">Low</span>|Networking and Firewall|<a href="../kubernetes-queries/2b1836f1-dcce-416e-8e16-da8c71920633" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/services-networking/connect-applications-service/#exposing-the-service">Documentation</a><br/>| |Audit Log Maxage Not Properly Set<br/><sup><sub>da9f3aa8-fbfb-472f-b5a1-576127944218</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/da9f3aa8-fbfb-472f-b5a1-576127944218" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Audit Log Maxbackup Not Properly Set<br/><sup><sub>768aab52-2504-4a2f-a3e3-329d5a679848</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/768aab52-2504-4a2f-a3e3-329d5a679848" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Audit Log Maxsize Not Properly Set<br/><sup><sub>35c0a471-f7c8-4993-aa2c-503a3c712a66</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/35c0a471-f7c8-4993-aa2c-503a3c712a66" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |Audit Policy Not Cover Key Security Concerns<br/><sup><sub>1828a670-5957-4bc5-9974-47da228f75e2</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/1828a670-5957-4bc5-9974-47da228f75e2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/">Documentation</a><br/>| |Kubelet Event QPS Not Properly Set<br/><sup><sub>1a07a446-8e61-4e4d-bc16-b0781fcb8211</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/1a07a446-8e61-4e4d-bc16-b0781fcb8211" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/">Documentation</a><br/>| |Profiling Not Set To False<br/><sup><sub>2f491173-6375-4a84-b28e-a4e2b9a58a69</sub></sup>|<span style="color:#edd57e">Low</span>|Observability|<a href="../kubernetes-queries/2f491173-6375-4a84-b28e-a4e2b9a58a69" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">Documentation</a><br/>| |CPU Limits Not Set<br/><sup><sub>4ac0e2b7-d2d2-4af7-8799-e8de6721ccda</sub></sup>|<span style="color:#edd57e">Low</span>|Resource Management|<a href="../kubernetes-queries/4ac0e2b7-d2d2-4af7-8799-e8de6721ccda" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/">Documentation</a><br/>| |CPU Requests Not Set<br/><sup><sub>ca469dd4-c736-448f-8ac1-30a642705e0a</sub></sup>|<span style="color:#edd57e">Low</span>|Resource Management|<a href="../kubernetes-queries/ca469dd4-c736-448f-8ac1-30a642705e0a" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#">Documentation</a><br/>| |CronJob Deadline Not Configured<br/><sup><sub>192fe40b-b1c3-448a-aba2-6cc19a300fe3</sub></sup>|<span style="color:#edd57e">Low</span>|Resource Management|<a href="../kubernetes-queries/192fe40b-b1c3-448a-aba2-6cc19a300fe3" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/">Documentation</a><br/>| |Deployment Has No PodAntiAffinity<br/><sup><sub>a31b7b82-d994-48c4-bd21-3bab6c31827a</sub></sup>|<span style="color:#edd57e">Low</span>|Resource Management|<a href="../kubernetes-queries/a31b7b82-d994-48c4-bd21-3bab6c31827a" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/">Documentation</a><br/>| |StatefulSet Has No PodAntiAffinity<br/><sup><sub>d740d048-8ed3-49d3-b77b-6f072f3b669e</sub></sup>|<span style="color:#edd57e">Low</span>|Resource Management|<a href="../kubernetes-queries/d740d048-8ed3-49d3-b77b-6f072f3b669e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/">Documentation</a><br/>| |Secrets As Environment Variables<br/><sup><sub>3d658f8b-d988-41a0-a841-40043121de1e</sub></sup>|<span style="color:#edd57e">Low</span>|Secret Management|<a href="../kubernetes-queries/3d658f8b-d988-41a0-a841-40043121de1e" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-environment-variables">Documentation</a><br/>| |Invalid Image Tag<br/><sup><sub>583053b7-e632-46f0-b989-f81ff8045385</sub></sup>|<span style="color:#edd57e">Low</span>|Supply-Chain|<a href="../kubernetes-queries/583053b7-e632-46f0-b989-f81ff8045385" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/containers/images/#updating-images">Documentation</a><br/>| |Ensure Administrative Boundaries Between Resources<br/><sup><sub>e84eaf4d-2f45-47b2-abe8-e581b06deb66</sub></sup>|<span style="color:#5bc0de">Info</span>|Access Control|<a href="../kubernetes-queries/e84eaf4d-2f45-47b2-abe8-e581b06deb66" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/">Documentation</a><br/>| |HPA Targeted Deployments With Configured Replica Count<br/><sup><sub>5744cbb8-5946-4b75-a196-ade44449525b</sub></sup>|<span style="color:#5bc0de">Info</span>|Availability|<a href="../kubernetes-queries/5744cbb8-5946-4b75-a196-ade44449525b" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale-walkthrough/">Documentation</a><br/>| |Liveness Probe Is Not Defined<br/><sup><sub>ade74944-a674-4e00-859e-c6eab5bde441</sub></sup>|<span style="color:#5bc0de">Info</span>|Availability|<a href="../kubernetes-queries/ade74944-a674-4e00-859e-c6eab5bde441" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#when-should-you-use-a-liveness-probe">Documentation</a><br/>| |Not Limited Capabilities For Pod Security Policy<br/><sup><sub>caa93370-791f-4fc6-814b-ba6ce0cb4032</sub></sup>|<span style="color:#5bc0de">Info</span>|Insecure Configurations|<a href="../kubernetes-queries/caa93370-791f-4fc6-814b-ba6ce0cb4032" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/">Documentation</a><br/>| |Bind Address Not Properly Set<br/><sup><sub>46a2e9ec-6a5f-4faa-9d39-4ea44d5d87a2</sub></sup>|<span style="color:#5bc0de">Info</span>|Networking and Firewall|<a href="../kubernetes-queries/46a2e9ec-6a5f-4faa-9d39-4ea44d5d87a2" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/">Documentation</a><br/>| |Using Kubernetes Native Secret Management<br/><sup><sub>b9c83569-459b-4110-8f79-6305aa33cb37</sub></sup>|<span style="color:#5bc0de">Info</span>|Secret Management|<a href="../kubernetes-queries/b9c83569-459b-4110-8f79-6305aa33cb37" target="_blank">Query details</a><br><a href="https://kubernetes.io/docs/concepts/configuration/secret/">Documentation</a><br/>|