Confine persistent storage provisioning and mounts to their approved namespace, workload, access mode, and ownership boundary.
Restrict Persistent Volume Access
CCC.K8S.CN10 · Data
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP13 | Kubernetes Storage Provisioning | The service can dynamically provision ephemeral and persistent workload storage through Kubernetes container storage interface integrations. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH11 | Persistent Volumes are Bound to Unauthorized Workloads | Misconfigured persistent-volume claims, storage classes, or workload authorization may allow a volume to be mounted outside its intended ownership boundary. Data stored on the volume can then be read, modified, or deleted through the unauthorized workload, directly reducing its confidentiality, integrity, and availability. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN10.AR01 | When a persistent volume claim is created, its namespace, storage class, access mode, and requesting service account MUST match an approved workload storage policy. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN10.AR02 | When a persistent volume is statically provisioned or rebound, its underlying storage identity and prior ownership MUST be verified before it is mounted by a different workload. | tlp-green, tlp-amber, tlp-red |