diff --git a/cloud/kubernetes/pods/k8s-containers-share-host-ipc.yaml b/cloud/kubernetes/pods/k8s-containers-share-host-ipc.yaml index 6384676d21..d33d13d18a 100644 --- a/cloud/kubernetes/pods/k8s-containers-share-host-ipc.yaml +++ b/cloud/kubernetes/pods/k8s-containers-share-host-ipc.yaml @@ -7,7 +7,7 @@ info: description: Checks if any containers in Kubernetes Pods are configured to share the host's IPC namespace, which can lead to security risks. impact: | Sharing the host's IPC namespace allows containers to access data across all containers on the same host, posing potential security risks. - remediation: Ensure that no container in Kubernetes Pods is set to share the host IPC namespace. Configure 'spec.hostIPC' to 'false' for all pods to isolate IPC namespaces. + remediation: Ensure that no container in Kubernetes Pods is set to share the host IPC namespace. Configure 'spec.hostIPC' to 'false' for all pods to isolate IPC namespaces. reference: - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ tags: cloud,devops,kubernetes,k8s,devsecops,pods diff --git a/cloud/kubernetes/pods/k8s-readonly-fs.yaml b/cloud/kubernetes/pods/k8s-readonly-fs.yaml index 2148601878..947aa40f31 100644 --- a/cloud/kubernetes/pods/k8s-readonly-fs.yaml +++ b/cloud/kubernetes/pods/k8s-readonly-fs.yaml @@ -7,7 +7,7 @@ info: description: Checks for containers that do not use a read-only filesystem, which can prevent malicious write operations at runtime impact: | Not using a read-only filesystem can expose containers to risks of malicious modifications at runtime, compromising the container's integrity and security. - remediation: Configure containers to use read-only filesystems where possible to enhance security and minimize risk of unauthorized data modification + remediation: Configure containers to use read-only filesystems where possible to enhance security and minimize risk of unauthorized data modification reference: - https://kubernetes.io/docs/concepts/storage/volumes/#mount-propagation tags: cloud,devops,kubernetes,k8s,devsecops,pods