<commit_before>---
controls:
version: "gke-1.0"
id: 5
text: "Kubernetes Policies"
type: "policies"
groups:
  - id: 5.1
    text: "RBAC and Service Accounts"
    checks:
      - id: 5.1.1
        text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
        type: "manual"
        remediation: |
          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
          if they need this role or if they could use a role with fewer privileges.
          Where possible, first bind users to a lower privileged role and then remove the
          clusterrolebinding to the cluster-admin role :
          kubectl delete clusterrolebinding [name]
        scored: false

      - id: 5.1.2
        text: "Minimize access to secrets (Not Scored)"
        type: "manual"
        remediation: |
          Where possible, remove get, list and watch access to secret objects in the cluster.
        scored: false

      - id: 5.1.3
        text: "Minimize wildcard use in Roles and ClusterRoles (Not Scored)"
        type: "manual"
        remediation: |
          Where possible replace any use of wildcards in clusterroles and roles with specific
          objects or actions.
        scored: false

      - id: 5.1.4
        text: "Minimize access to create pods (Not Scored)"
        type: "manual"
        Remediation: |
          Where possible, remove create access to pod objects in the cluster.
        scored: false

      - id: 5.1.5
        text: "Ensure that default service accounts are not actively used. (Scored)"
        type: "manual"
        remediation: |
          Create explicit service accounts wherever a Kubernetes workload requires specific access
          to the Kubernetes API server.
          Modify the configuration of each default service account to include this value
          automountServiceAccountToken: false
        scored: true

      - id: 5.1.6
        text: "Ensure that Service Account Tokens are only mounted where necessary (Not Scored)"
        type: "manual"
        remediation: |
          Modify the definition of pods and service accounts which do not need to mount service
          account tokens to disable it.
        scored: false

  - id: 5.2
    text: "Pod Security Policies"
    checks:
      - id: 5.2.1
        text: "Minimize the admission of privileged containers (Not Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that
          the .spec.privileged field is omitted or set to false.
        scored: false

      - id: 5.2.2
        text: "Minimize the admission of containers wishing to share the host process ID namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostPID field is omitted or set to false.
        scored: true

      - id: 5.2.3
        text: "Minimize the admission of containers wishing to share the host IPC namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostIPC field is omitted or set to false.
        scored: true

      - id: 5.2.4
        text: "Minimize the admission of containers wishing to share the host network namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostNetwork field is omitted or set to false.
        scored: true

      - id: 5.2.5
        text: "Minimize the admission of containers with allowPrivilegeEscalation (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.allowPrivilegeEscalation field is omitted or set to false.
        scored: true

      - id: 5.2.6
        text: "Minimize the admission of root containers (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
          UIDs not including 0.
        scored: true

      - id: 5.2.7
        text: "Minimize the admission of containers with the NET_RAW capability (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
        scored: true

      - id: 5.2.8
        text: "Minimize the admission of containers with added capabilities (Scored)"
        type: "manual"
        remediation: |
          Ensure that allowedCapabilities is not present in PSPs for the cluster unless
          it is set to an empty array.
        scored: true

      - id: 5.2.9
        text: "Minimize the admission of containers with capabilities assigned (Scored) "
        type: "manual"
        remediation: |
          Review the use of capabilites in applications runnning on your cluster. Where a namespace
          contains applicaions which do not require any Linux capabities to operate consider adding
          a PSP which forbids the admission of containers which do not drop all capabilities.
        scored: true

  - id: 5.3
    text: "Network Policies and CNI"
    checks:
      - id: 5.3.1
        text: "Ensure that the CNI in use supports Network Policies (Not Scored)"
        type: "manual"
        remediation: |
          To use a CNI plugin with Network Policy, enable Network Policy in GKE, and the CNI plugin
          will be updated. See Recommendation 6.6.7.
        scored: false

      - id: 5.3.2
        text: "Ensure that all Namespaces have Network Policies defined (Scored)"<commit_msg>Correct typo (#616)<commit_after>---
controls:
version: "gke-1.0"
id: 5
text: "Kubernetes Policies"
type: "policies"
groups:
  - id: 5.1
    text: "RBAC and Service Accounts"
    checks:
      - id: 5.1.1
        text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
        type: "manual"
        remediation: |
          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
          if they need this role or if they could use a role with fewer privileges.
          Where possible, first bind users to a lower privileged role and then remove the
          clusterrolebinding to the cluster-admin role :
          kubectl delete clusterrolebinding [name]
        scored: false

      - id: 5.1.2
        text: "Minimize access to secrets (Not Scored)"
        type: "manual"
        remediation: |
          Where possible, remove get, list and watch access to secret objects in the cluster.
        scored: false

      - id: 5.1.3
        text: "Minimize wildcard use in Roles and ClusterRoles (Not Scored)"
        type: "manual"
        remediation: |
          Where possible replace any use of wildcards in clusterroles and roles with specific
          objects or actions.
        scored: false

      - id: 5.1.4
        text: "Minimize access to create pods (Not Scored)"
        type: "manual"
        Remediation: |
          Where possible, remove create access to pod objects in the cluster.
        scored: false

      - id: 5.1.5
        text: "Ensure that default service accounts are not actively used. (Scored)"
        type: "manual"
        remediation: |
          Create explicit service accounts wherever a Kubernetes workload requires specific access
          to the Kubernetes API server.
          Modify the configuration of each default service account to include this value
          automountServiceAccountToken: false
        scored: true

      - id: 5.1.6
        text: "Ensure that Service Account Tokens are only mounted where necessary (Not Scored)"
        type: "manual"
        remediation: |
          Modify the definition of pods and service accounts which do not need to mount service
          account tokens to disable it.
        scored: false

  - id: 5.2
    text: "Pod Security Policies"
    checks:
      - id: 5.2.1
        text: "Minimize the admission of privileged containers (Not Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that
          the .spec.privileged field is omitted or set to false.
        scored: false

      - id: 5.2.2
        text: "Minimize the admission of containers wishing to share the host process ID namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostPID field is omitted or set to false.
        scored: true

      - id: 5.2.3
        text: "Minimize the admission of containers wishing to share the host IPC namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostIPC field is omitted or set to false.
        scored: true

      - id: 5.2.4
        text: "Minimize the admission of containers wishing to share the host network namespace (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.hostNetwork field is omitted or set to false.
        scored: true

      - id: 5.2.5
        text: "Minimize the admission of containers with allowPrivilegeEscalation (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.allowPrivilegeEscalation field is omitted or set to false.
        scored: true

      - id: 5.2.6
        text: "Minimize the admission of root containers (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
          UIDs not including 0.
        scored: true

      - id: 5.2.7
        text: "Minimize the admission of containers with the NET_RAW capability (Scored)"
        type: "manual"
        remediation: |
          Create a PSP as described in the Kubernetes documentation, ensuring that the
          .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
        scored: true

      - id: 5.2.8
        text: "Minimize the admission of containers with added capabilities (Scored)"
        type: "manual"
        remediation: |
          Ensure that allowedCapabilities is not present in PSPs for the cluster unless
          it is set to an empty array.
        scored: true

      - id: 5.2.9
        text: "Minimize the admission of containers with capabilities assigned (Scored) "
        type: "manual"
        remediation: |
          Review the use of capabilites in applications runnning on your cluster. Where a namespace
          contains applications which do not require any Linux capabities to operate consider adding
          a PSP which forbids the admission of containers which do not drop all capabilities.
        scored: true

  - id: 5.3
    text: "Network Policies and CNI"
    checks:
      - id: 5.3.1
        text: "Ensure that the CNI in use supports Network Policies (Not Scored)"
        type: "manual"
        remediation: |
          To use a CNI plugin with Network Policy, enable Network Policy in GKE, and the CNI plugin
          will be updated. See Recommendation 6.6.7.
        scored: false

      - id: 5.3.2
        text: "Ensure that all Namespaces have Network Policies defined (Scored)"
{'fraction_non_alphanumeric': 0.05861575981835001, 'fraction_numerical': 0.011016735346060045, 'mean_word_length': 2.153540175019889, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5492084', 'n_tokens_mistral': 3238, 'n_tokens_neox': 3084, 'n_words': 1415}