CIS Kubernetes Benchmark v1.9.0

kubectl get clusterrolebindings -o=custom-
columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name 

kubectl delete clusterrolebinding [name] 

CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterroleaggregation-controller ServiceAccount kube-system system:controller:expand-controller expand-controller ServiceAccount kube-system system:controller:generic-garbage-collector generic-garbagecollector ServiceAccount kube-system system:controller:namespace-controller namespace-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volumebinder ServiceAccount kube-system system:kube-controller-manager system:kube-controllermanager User  

kubectl get roles --all-namespaces -o yaml 

kubectl get clusterroles -o yaml 

CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterroleaggregation-controller ServiceAccount kube-system system:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-system system:controller:job-controller job-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volumebinder ServiceAccount kube-system system:controller:replicaset-controller replicaset-controller ServiceAccount kube-system system:controller:replication-controller replication-controller ServiceAccount kube-system system:controller:statefulset-controller statefulset-controller ServiceAccount kube-system 

automountServiceAccountToken: false 

automountServiceAccountToken: false 

Run the following command: get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: 
{@..securityContext}\n{end}' 

kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A 

kubectl get namespaces 

1. default - The default namespace for objects with no other namespace 
2. kube-system - The namespace for objects created by the Kubernetes system 
3. kube-node-lease - Namespace used for node heartbeats 
4. kube-public - Namespace used for public information in a cluster

securityContext: 
  seccompProfile: 
    type: RuntimeDefault 

securityContext: 
  seccompProfile: 
    type: RuntimeDefault 

kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default