Skip to content

Latest commit

 

History

History

cis-gke-v1.5.0

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
.krmignore
.krmignore
 
 
Kptfile
Kptfile
 
 
README.md
README.md
 
 
apparmor.yaml
apparmor.yaml
 
 
capabilities.yaml
capabilities.yaml
 
 
host-namespace.yaml
host-namespace.yaml
 
 
host-port.yaml
host-port.yaml
 
 
host_namespaces_hostnetwork.yaml
host_namespaces_hostnetwork.yaml
 
 
hostpath-volumes.yaml
hostpath-volumes.yaml
 
 
hostprocess.yaml
hostprocess.yaml
 
 
kustomization.yaml
kustomization.yaml
 
 
privileged-containers.yaml
privileged-containers.yaml
 
 
proc_mount_type.yaml
proc_mount_type.yaml
 
 
require-binauthz.yaml
require-binauthz.yaml
 
 
require-cos-node-image.yaml
require-cos-node-image.yaml
 
 
require-gke-metadata-server-enabled.yaml
require-gke-metadata-server-enabled.yaml
 
 
require-ingress.class-gce.yaml
require-ingress.class-gce.yaml
 
 
require-managed-certificates.yaml
require-managed-certificates.yaml
 
 
require-namespace-networkpolicy.yaml
require-namespace-networkpolicy.yaml
 
 
require-seccomp-default.yaml
require-seccomp-default.yaml
 
 
require-securitycontext.yaml
require-securitycontext.yaml
 
 
restrict-automountserviceaccounttoken.yaml
restrict-automountserviceaccounttoken.yaml
 
 
restrict-bind-escalate-impersonate.yaml
restrict-bind-escalate-impersonate.yaml
 
 
restrict-certificatesigningrequests-approval.yaml
restrict-certificatesigningrequests-approval.yaml
 
 
restrict-cluster-admin-role.yaml
restrict-cluster-admin-role.yaml
 
 
restrict-creation-with-default-serviceaccount.yaml
restrict-creation-with-default-serviceaccount.yaml
 
 
restrict-default-namespace.yaml
restrict-default-namespace.yaml
 
 
restrict-env-var-secrets.yaml
restrict-env-var-secrets.yaml
 
 
restrict-loadbalancer.yaml
restrict-loadbalancer.yaml
 
 
restrict-nodes-proxy.yaml
restrict-nodes-proxy.yaml
 
 
restrict-persistent-volume.yaml
restrict-persistent-volume.yaml
 
 
restrict-pods-create.yaml
restrict-pods-create.yaml
 
 
restrict-rbac-subjects.yaml
restrict-rbac-subjects.yaml
 
 
restrict-role-secrets.yaml
restrict-role-secrets.yaml
 
 
restrict-role-wildcards.yaml
restrict-role-wildcards.yaml
 
 
restrict-secrets-of-type-basic-auth.yaml
restrict-secrets-of-type-basic-auth.yaml
 
 
restrict-serviceaccounts-token.yaml
restrict-serviceaccounts-token.yaml
 
 
restrict-system-masters-group.yaml
restrict-system-masters-group.yaml
 
 
restrict-webhook-config.yaml
restrict-webhook-config.yaml
 
 
seccomp.yaml
seccomp.yaml
 
 
selinux.yaml
selinux.yaml
 
 
sysctls.yaml
sysctls.yaml
 
 

README.md

CIS GKE Benchmark v1.5.0

Description

Use the CIS GKE Benchmark 1.5.0 policy bundle with Policy Controller to evaluate the compliance of your cluster resources against the CIS GKE Benchmark v1.5.0, which is a set of recommended security controls for configuring GKE.

The accompanying CIS GKE Benchmark v1.5.0 policy bundle documentation provides additional details.

Disclaimer

These constraints are not certified by CIS.

Compatibility

This bundle requires Policy Controller v1.16.2 or higher, and is intended for use only with GKE on Google Cloud.

Sample Usage

(Optional) Preview the policy constraints with kubectl:

kubectl kustomize https://github.com/GoogleCloudPlatform/gke-policy-library.git/anthos-bundles/cis-gke-v1.5.0

Apply the policy constraints with kubectl:

kubectl apply -k https://github.com/GoogleCloudPlatform/gke-policy-library.git/anthos-bundles/cis-gke-v1.5.0