Project: Checkov (Provisioning / Security & Compliance)
File: Kubernetes.md

layout: default published: true title: Kubernetes configuration scanning nav_order: 20 Checkov supports the evaluation of policies on your Kubernetes files. When using checkov to scan a directory that contains a Kubernetes manifests it will validate if the file is compliant with K8 best practices such as not admitting root containers, making sure there are CPU limits, and more. Full list of Kubernetes policies checks can be found . ```yaml apiVersion: v1 kind: Pod metadata: name: pod1 spec: containers: name: main image: alpine command: ["/bin/sleep", "999999"] ``` ```bash checkov -d . --framework kubernetes ``` ```bash _| | _ | | / | '_ \ / _ \/ | |/ / _ \ \ / / | (| | | | / (| < (_) \ V / \_|_| |_|\|\|_|\_\/ \/ By Prisma Cloud | version: x.x.x Passed checks: 70, Failed checks: 19, Skipped checks: 0 Check: CKVK8S37: "Minimize the admission of containers with capabilities assigned" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-34 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S31: "Ensure that the seccomp profile is set to docker/default or runtime/default" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-29 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S8: "Liveness Probe Should be Configured" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-7 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S12: "Memory requests should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-11 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S20: "Containers should not run with allowPrivilegeEscalation" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-19 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S13: "Memory limits should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-12 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S40: "Containers should run as a high UID to avoid host conflict" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bc-k8s-37 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S10: "CPU requests should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide:

2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S22: "Use read-only filesystem for containers where possible" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s21 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S9: "Readiness Probe Should be Configured" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s8 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S28: "Minimize the admission of containers with the NET_RAW capability" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s27 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S29: "Apply security context to your pods and containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s28 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S30: "Apply security context to your pods and containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s28 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S14: "Image Tag should be fixed - not latest or blank" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s13 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S38: "Ensure that Service Account Tokens are only mounted where necessary" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s35 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S21: "The default namespace should not be used" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s20 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S23: "Minimize the admission of root containers" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s22 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S43: "Image should use digest" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s39 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main 9 | image: alpine 10 | command: ["/bin/sleep", "999999"] Check: CKVK8S11: "CPU limits should be set" FAILED for resource: Pod.default.pod1 File: /rootContainersFAILED.yaml:2-10 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/bck8s10 2 | apiVersion: v1 3 | kind: Pod 4 | metadata: 5 | name: pod1 6 | spec: 7 | containers: 8 | - name: main