Minimize workload privilege and block unnecessary access to host-level resources that could defeat container isolation.
Enforce Restricted Workload Security
CCC.K8S.CN05 · Compute
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP03 | Abstracted Worker Infrastructure | The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user. |
| CCC.K8S.CP18 | Admission Policy Enforcement | The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence. |
| CCC.K8S.CP19 | Workload Isolation Controls | The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH05 | Privileged Workloads Escape Isolation | Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure. |
| CCC.K8S.TH12 | Admission Controls are Bypassed | Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN05.AR01 | When a workload is admitted, it MUST NOT request privileged execution, privilege escalation, host PID, host IPC, host networking, unrestricted host paths, or additional Linux capabilities. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN05.AR02 | When a Linux workload is admitted, each container MUST run as a non-root user, use the runtime-default seccomp profile, disable privilege escalation, and drop all Linux capabilities without adding capabilities back to the container. | tlp-green, tlp-amber, tlp-red |