1 Description Configure a restrictive pod security policy (PSP) as the default and create role bindings for system level services to use the less restrictive default PSP. Rationale To address the following following controls, a restrictive default PSP needs to be applied as the default. Role bindings need to be in place to allow system services to still function. 1.7.1 - Do not admit privileged containers get role default-psp-role -n cattle-system kubectl get clusterrole psp:restricted Verify the bindings are set correctly: kubectl get rolebinding -n ingress-nginx default-psp-rolebinding kubectl get

"${default_binding}" -gt 0 ]]; then echo "fail: default service accounts have non default bindings" exit 1 fi echo "--pass" exit 0 Audit Execution: ./5.1.5.sh Expected result: '--pass'

"${default_binding}" -gt 0 ]]; then echo "fail: default service accounts have non default bindings" exit 1 fi echo "--pass" exit 0 Audit Execution: ./5.1.5.sh Expected result: '--pass'