AKS 1.5.0 CIS benchmark

[deboshree-b]

Adding AKS 1.5.0 benchmark
CIS_Azure_Kubernetes_Service_(AKS)_Benchmark_V1.5.0_PDF.pdf

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 2 committers have signed the CLA.

❌ deboshree-b
❌ rootxrishabh
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Magier]

This was renamed to Pod Security Standards: https://workbench.cisecurity.org/benchmarks/15692/sections/2312375

[Magier]

New (full) remediation text:

Add policies to each namespace in the cluster which has user workloads to restrict the admission of privileged containers.
To enable PSA for a namespace in your cluster, set the pod-security.kubernetes.io/enforce label with the policy value you want to enforce.

`kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted`

The above command enforces the restricted policy for the NAMESPACE namespace.
You can also enable Pod Security Admission for all your namespaces. For example:

`kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline`

Pod Security Policies and Assignments can be found by searching for Policies in the Azure Portal. A detailed step-by-step guide can be found here:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

[Magier]

New (full) remediation text:

Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostPID` containers.

Pod Security Policies and Assignments can be found by searching for Policies in the Azure Portal. A detailed step-by-step guide can be found here:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

[Magier]

New (full) remediation text:

Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers.

Pod Security Policies and Assignments can be found by searching for Policies in the Azure Portal. A detailed step-by-step guide can be found here:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

[Magier]

New (full) remediation text:

Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostNetwork` containers.

Pod Security Policies and Assignments can be found by searching for Policies in the Azure Portal. A detailed step-by-step guide can be found here:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

[Magier]

New (full) remediation text:

Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.

Pod Security Policies and Assignments can be found by searching for Policies in the Azure Portal. A detailed step-by-step guide can be found here:

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes

[saikumar0412]

Can you please update when we can expected thi PR to be merged?

[afdesk]

Hi guys! thanks for your efforts!
This branch has conflicts that must be resolved
could you fix it?