V-254571

Discussion

Admission controllers intercept requests to the Kubernetes API before an object is instantiated. Enabling the admissions webhook allows for Kubernetes to apply policies against objects that are to be created, read, updated or deleted. Admissions controllers can be used for: - Prevent pod’s ability to run privileged containers - Prevent pod’s ability to use privileged escalation - Controlling pod’s access to volume types - Controlling pod’s access to host file system - Controlling pod’s usage of host networking objects and configuration Satisfies: SRG-APP-000340-CTR-000770, SRG-APP-000342-CTR-000775

Check Content

On each controlplane node, retrieve the "pod-security-admission-config-file" value from the RKE2 config file (/etc/rancher/rke2/config.yaml). For example:

pod-security-admission-config-file: /etc/rancher/rke2/rke2-pss-custom.yaml

Validate that the file referenced by "pod-security-admission-config-file" exists and the default configuration settings match the following:

    defaults:
      audit: restricted
      audit-version: latest
      enforce: restricted
      enforce-version: latest
      warn: restricted
      warn-version: latest

If "pod-security-admission-config-file" is not set, the file does not exist, or the configuration file differs from the above, this is a finding.