Cis Aks V180 4.1.8
DevOps & Securitycis-aks-v180-4.1.8Cis Aks V180 4.1.8 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.
Minimize access to create persistent volumes (Manual)
How to use this skill
Bring this guide into your coding agent with a prompt tailored to the tool you use.
- Open your project in Codex.
- Copy and paste the prompt below.
- Review files and risks before approving any action.
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Kubernetes/CIS_Azure_Kubernetes_Service_AKS_Benchmark_v1.8.0/cis-aks-v180-4.1.8/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aks-v180-4-1-8, but wait for my approval before writing files or running scripts.
Copying this prompt does not install or run the skill. Review third-party files before use.
4.1.8 Minimize access to create persistent volumes (Manual)
Profile Applicability
- Level 1
Description
The ability to create persistent volumes in a cluster can provide an opportunity for privilege escalation, via the creation of hostPath volumes. As persistent volumes are not covered by Pod Security Admission, a user with access to create persistent volumes may be able to get access to sensitive files from the underlying host even where restrictive Pod Security Admission policies are in place.
Rationale
The ability to create persistent volumes in a cluster opens up possibilities for privilege escalation and should be restricted, where possible.
Audit
Review the users who have create access to PersistentVolume objects in the Kubernetes API.
Remediation
Where possible, remove create access to PersistentVolume objects in the cluster.
References
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 6.8 Define and Maintain Role-Based Access Control | x |