---
# Source: trivy/charts/trivy-operator/templates/specs/k8s-nsa-1.0.yaml
apiVersion: aquasecurity.github.io/v1alpha1
kind: ClusterComplianceReport
metadata:
  name: k8s-nsa-1.0
  labels:
    app.kubernetes.io/name: trivy-operator
    app.kubernetes.io/instance: trivy-operator
    app.kubernetes.io/version: 0.29.0
    app.kubernetes.io/managed-by: kubectl
spec:
  cron: "0 5 * * *"
  reportType: "summary"
  compliance:
    id: k8s-nsa-1.0
    platform: k8s
    type: nsa
    title: National Security Agency - Kubernetes Hardening Guidance v1.0
    description: National Security Agency - Kubernetes Hardening Guidance
    relatedResources:
      - https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/
    version: "1.0"
    controls:
      - name: Non-root containers
        description: Check that container is not running as root
        id: "1.0"
        checks:
          - id: AVD-KSV-0012
        severity: MEDIUM
      - name: Immutable container file systems
        description: Check that container root file system is immutable
        id: "1.1"
        checks:
          - id: AVD-KSV-0014
        severity: LOW
      - name: Preventing privileged containers
        description: Controls whether Pods can run privileged containers
        id: "1.2"
        checks:
          - id: AVD-KSV-0017
        severity: HIGH
      - name: Share containers process namespaces
        description: Controls whether containers can share process namespaces
        id: "1.3"
        checks:
          - id: AVD-KSV-0008
        severity: HIGH
      - name: Share host process namespaces
        description: Controls whether share host process namespaces
        id: "1.4"
        checks:
          - id: AVD-KSV-0009
        severity: HIGH
      - name: Use the host network
        description: Controls whether containers can use the host network
        id: "1.5"
        checks:
          - id: AVD-KSV-0010
        severity: HIGH
      - name: Run with root privileges or with root group membership
        description: Controls whether container applications can run with root privileges or with root group membership
        id: "1.6"
        checks:
          - id: AVD-KSV-0029
        severity: LOW
      - name: Restricts escalation to root privileges
        description: Control check restrictions escalation to root privileges
        id: "1.7"
        checks:
          - id: AVD-KSV-0001
        severity: MEDIUM
      - name: Sets the SELinux context of the container
        description: Control checks if pod sets the SELinux context of the container
        id: "1.8"
        checks:
          - id: AVD-KSV-0002
        severity: MEDIUM
      - name: Restrict a container's access to resources with AppArmor
        description: Control checks the restriction of containers access to resources with AppArmor
        id: "1.9"
        checks:
          - id: AVD-KSV-0030
        severity: MEDIUM
      - name: Sets the seccomp profile used to sandbox containers.
        description: Control checks the sets the seccomp profile used to sandbox containers
        id: "1.10"
        checks:
          - id: AVD-KSV-0030
        severity: LOW
      - name: Protecting Pod service account tokens
        description: "Control check whether disable secret token been mount ,automountServiceAccountToken: false"
        id: "1.11"
        checks:
          - id: AVD-KSV-0036
        severity: MEDIUM
      - name: Namespace kube-system should not be used by users
        description: Control check whether Namespace kube-system is not be used by users
        id: "1.12"
        defaultStatus: FAIL
        checks:
          - id: AVD-KSV-0037
        severity: MEDIUM
      - name: Pod and/or namespace Selectors usage
        description: Control check validate the pod and/or namespace Selectors usage
        id: "2.0"
        defaultStatus: FAIL
        checks:
          - id: AVD-KSV-0038
        severity: MEDIUM
      - name: Use CNI plugin that supports NetworkPolicy API (Manual)
        description: Control check whether check cni plugin installed
        id: "3.0"
        defaultStatus: FAIL
        severity: CRITICAL
      - name: Use ResourceQuota policies to limit resources
        description: Control check the use of ResourceQuota policy to limit aggregate resource usage within namespace
        id: "4.0"
        defaultStatus: FAIL
        checks:
          - id: AVD-KSV-0040
        severity: MEDIUM
      - name: Use LimitRange policies to limit resources
        description: Control check the use of LimitRange policy limit resource usage for namespaces or nodes
        id: "4.1"
        defaultStatus: FAIL
        checks:
          - id: AVD-KSV-0039
        severity: MEDIUM
      - name: Control plan disable insecure port (Manual)
        description: Control check whether control plan disable insecure port
        id: "5.0"
        defaultStatus: FAIL
        severity: CRITICAL
      - name: Encrypt etcd communication
        description: Control check whether etcd communication is encrypted
        id: "5.1"
        checks:
          - id: AVD-KCV-0030
        severity: CRITICAL
      - name: Ensure kube config file permission (Manual)
        description: Control check whether kube config file permissions
        id: "6.0"
        defaultStatus: FAIL
        severity: CRITICAL
      - name: Check that encryption resource has been set
        description: Control checks whether encryption resource has been set
        id: "6.1"
        checks:
          - id: AVD-KCV-0029
        severity: CRITICAL
      - name: Check encryption provider
        description: Control checks whether encryption provider has been set
        id: "6.2"
        checks:
          - id: AVD-KCV-0004
        severity: CRITICAL
      - name: Make sure anonymous-auth is unset
        description: Control checks whether anonymous-auth is unset
        id: "7.0"
        checks:
          - id: AVD-KCV-0001
        severity: CRITICAL
      - name: Make sure -authorization-mode=RBAC
        description: Control check whether RBAC permission is in use
        id: "7.1"
        checks:
          - id: AVD-KCV-0008
        severity: CRITICAL
      - name: Audit policy is configure (Manual)
        description: Control check whether audit policy is configure
        id: "8.0"
        defaultStatus: FAIL
        severity: HIGH
      - name: Audit log path is configure
        description: Control check whether audit log path is configure
        id: "8.1"
        checks:
          - id: AVD-KCV-0019
        severity: MEDIUM
      - name: Audit log aging
        description: Control check whether audit log aging is configure
        id: "8.2"
        checks:
          - id: AVD-KCV-0020
        severity: MEDIUM