Imported from node011/Bounty-Reaper (.bountyreper/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_GKE_Autopilot_Benchmark_v1.0.0/cis-gke-autopilot-v100-4.5.1/SKILL.md). Install upstream with npx skills add node011/Bounty-Reaper --skill cis-gke-autopilot-v100-4.5.1. Copyright stays with the author (CC-BY-NC-SA-4.0).

4.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)

Name: cis-gke-autopilot-v100-4.5.1
Author: node011

Profile Applicability

Level 2

Description

Configure Image Provenance for the deployment.

Rationale

Kubernetes supports plugging in provenance rules to accept or reject the images in deployments. Rules can be configured to ensure that only approved images are deployed in the cluster.

Impact

Regular maintenance for the provenance configuration should be carried out, based on container image updates.

Audit

Review the pod definitions in the cluster and verify that image provenance is configured as appropriate.

Remediation

Follow the Kubernetes documentation and setup image provenance.

Default Value

By default, image provenance is not set.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.6 Securely Manage Enterprise Assets and Software	*	*	*
v7	18 Application Software Security

{ "ocm": "1", "id": "node011-bounty-reaper-cis-gke-autopilot-v100-4-5-1", "kind": "skill", "name": "cis-gke-autopilot-v100-4.5.1", "description": "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)", "publisher": "node011", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "cis", "gke-autopilot", "kubernetes", "gcp", "admission-control", "webhooks", "image-provenance", "image-policy", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)" ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/node011/Bounty-Reaper", "path": ".bountyreper/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_GKE_Autopilot_Benchmark_v1.0.0/cis-gke-autopilot-v100-4.5.1/SKILL.md", "ref": "4c98784194514df06cd25ff18978d103f7485fb6", "url": "https://github.com/node011/Bounty-Reaper/blob/4c98784194514df06cd25ff18978d103f7485fb6/.bountyreper/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_GKE_Autopilot_Benchmark_v1.0.0/cis-gke-autopilot-v100-4.5.1/SKILL.md", "key": "node011/Bounty-Reaper/.bountyreper/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_GKE_Autopilot_Benchmark_v1.0.0/cis-gke-autopilot-v100-4.5.1/SKILL.md" }, "license": "CC-BY-NC-SA-4.0" }, "instructions": "# 4.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)\n\n## Profile Applicability\n\n- Level 2\n\n## Description\n\nConfigure Image Provenance for the deployment.\n\n## Rationale\n\nKubernetes supports plugging in provenance rules to accept or reject the images in deployments. Rules can be configured to ensure that only approved images are deployed in the cluster.\n\n## Impact\n\nRegular maintenance for the provenance configuration should be carried out, based on container image updates.\n\n## Audit\n\nReview the pod definitions in the cluster and verify that image provenance i", "cost": { "context_tokens": 330 } }

cis-gke-autopilot-v100-4.5.1

About