tion: false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes:

tion: false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes:

tion: false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir tion: false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir

defaultAllowPrivilegeEscalation: false fsGroup: rule: RunAsAny runAsUser: rule: MustRunAsNonRoot seLinux: rule: RunAsAny supplementalGroups: rule: RunAsAny volumes: - emptyDir - secret - persistentVolumeClaim

servicePort: 90 ## service_port In the above example, we have defined a single rule with a host, path and corresponding backend service and port. We can define multiple host and path backend: serviceName: nginx-service servicePort: 90 Once you have created the ingress rule, you will notice that Rancher automatically creates a corresponding load balancer. To view the load

multi-dimensional alerting policies required to customize alerting rules alerting rules available; alerting rule configurations on web pages supported Notification Slack, email, and webhook supported Notification

available to all ServiceAccounts. Audit kubectl get psp restricted -o jsonpath='{.spec.runAsUser.rule}' | grep "RunAsAny" Returned Value: null Result: Pass 1.7.7 - Do not admit containers with dangerous

Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0. Audit: 5