AzPolicyAdvertizer

last sync: 2020-Oct-20 13:29:33 UTC

Azure Policy

Kubernetes cluster containers should not share host process ID or host IPC namespace

Name Kubernetes cluster containers should not share host process ID or host IPC namespace
Id 47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8
Version 1.0.1
details on versioning
Category Kubernetes
Description This policy blocks pod containers from sharing the host process ID namespace and host IPC namespace in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/.
Mode Microsoft.Kubernetes.Data
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: audit
Allowed: (audit,deny,disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2020-09-15 14:06:41 change Previous DisplayName: [Preview]: Kubernetes cluster containers should not share host process ID or host IPC namespace
2020-07-08 14:28:08 add 47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8
Used in Initiatives
Initiative DisplayName Initiative Id
Enable Monitoring in Azure Security Center 1f3afdf9-d0c9-4c3d-847f-89da613e70a8
Kubernetes cluster pod security baseline standards for Linux-based workloads a8640138-9b0a-4a28-b8cb-1666c838647d
Kubernetes cluster pod security restricted standards for Linux-based workloads 42b8ef37-b724-4e24-bbc8-7a7708edfe00
Json 
{
  "properties": {
    "displayName": "Kubernetes cluster containers should not share host process ID or host IPC namespace",
    "policyType": "BuiltIn",
    "mode": "Microsoft.Kubernetes.Data",
    "description": "This policy blocks pod containers from sharing the host process ID namespace and host IPC namespace in a Kubernetes cluster. This policy is generally available for Kubernetes Service (AKS), and preview for AKS Engine and Azure Arc enabled Kubernetes. For instructions on using this policy, visit https://aka.ms/kubepolicydoc/.",
    "metadata": {
      "version": "1.0.1",
      "category": "Kubernetes"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "'Audit' allows a non-compliant resource to be created or updated, but flags it as non-compliant. 'Deny' blocks the non-compliant resource creation or update. 'Disabled' turns off the policy."
        },
        "allowedValues": [
          "audit",
          "deny",
          "disabled"
        ],
        "defaultValue": "audit"
      },
      "excludedNamespaces": {
        "type": "Array",
        "metadata": {
          "displayName": "Namespace exclusions",
          "description": "List of Kubernetes namespaces to exclude from policy evaluation."
        },
        "defaultValue": [
          "kube-system",
          "gatekeeper-system",
          "azure-arc"
        ]
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "in": [
          "AKS Engine",
          "Microsoft.Kubernetes/connectedClusters",
          "Microsoft.ContainerService/managedClusters"
        ]
      },
      "then": {
      "effect": "[parameters('effect')]",
        "details": {
          "constraintTemplate": "https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/Kubernetes/block-host-namespace/template.yaml",
          "constraint": "https://raw.githubusercontent.com/Azure/azure-policy/master/built-in-references/Kubernetes/block-host-namespace/constraint.yaml",
          "values": {
          "excludedNamespaces": "[parameters('excludedNamespaces')]"
          }
        }
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8"
}