1

I found some findings related to Azure Kubernetes Cluster in the Azure Security Center Recommendations.

Immutable (read-only) root filesystem should be enforced for containers. Services should listen on allowed ports only. Containers should listen on allowed ports only. Running containers as root user should be avoided. Container with privilege escalation should be avoided. Container CPU and memory limits should be enforced.

If anybody has an idea how to remediate these issues let me know.

Mrugesh Shah
  • 31
  • 3
  • ASC policy has some limitations like it will monitor the pod template properties alone only eventhough the pods have the options already enabled.. – Vowneee Aug 19 '21 at 07:43

1 Answers1

0

These all due to limitations of Azure Security Center policies and how they identify the vulnerabilities. FOr example, ASC will only check the security context of the pods template to understand whether it is running with root user or not. Evenn if your container running with non-root user also will reflect in the affected pod list, if the property is not set to the pods specific eventhough your image has already set a non-root user. The same limitations are there for your other mentioned alerts also.

So we have options like, disable the alerts which are not related the cluster or as they recommended in the remediation steps, just follow to add the properties just to remediate eventhough that doesnt make much sense.

Vowneee
  • 956
  • 10
  • 33