> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Misconfig for AZURE

### Checks Performed

* [An Admission Policy Engine Should Enforce Workload Policy](azurekubernetesmisconfig/rules/azure_admission_policy_engine_enforced)
* [Apply Security Context To Your Pods And Containers](azurekubernetesmisconfig/rules/azure_apply_pod_security_context)
* [Audit Logging Should Be Enabled And Shipped Off-Cluster](azurekubernetesmisconfig/rules/azure_audit_logging_shipped_offcluster)
* [Azure Json File Ownership Set To Root Root](azurekubernetesmisconfig/rules/azure_azure_json_file_ownership_root)
* [Azure Json File Permissions Set To 644 Or More Restrictive](azurekubernetesmisconfig/rules/azure_azure_json_file_permissions_644)
* [Consider External Secret Storage](azurekubernetesmisconfig/rules/azure_external_secret_storage)
* [Container Images Should Not Use The latest Or Untagged Tag](azurekubernetesmisconfig/rules/azure_no_latest_image_tag)
* [Containers Should Define Liveness And Readiness Probes](azurekubernetesmisconfig/rules/azure_define_liveness_readiness_probes)
* [Containers Should Disallow Privilege Escalation](azurekubernetesmisconfig/rules/azure_disallow_privilege_escalation)
* [Containers Should Drop All Linux Capabilities](azurekubernetesmisconfig/rules/azure_drop_all_capabilities)
* [Containers Should Not Run In Privileged Mode](azurekubernetesmisconfig/rules/azure_no_privileged_container)
* [Containers Should Run As Non-Root](azurekubernetesmisconfig/rules/azure_container_run_as_nonroot)
* [Containers Should Set CPU And Memory Limits](azurekubernetesmisconfig/rules/azure_set_resource_limits)
* [Containers Should Set CPU And Memory Requests](azurekubernetesmisconfig/rules/azure_set_resource_requests)
* [Containers Should Use A Read-Only Root Filesystem](azurekubernetesmisconfig/rules/azure_readonly_root_filesystem)
* [Create Administrative Boundaries Between Resources Using Namespaces](azurekubernetesmisconfig/rules/azure_create_namespace_boundaries)
* [Enable Audit Logs](azurekubernetesmisconfig/rules/azure_aks_enable_audit_logs)
* [Enable Image Vulnerability Scanning With Microsoft Defender](azurekubernetesmisconfig/rules/azure_acr_image_vulnerability_scanning_defender)
* [Encrypt Traffic To HTTPS Load Balancers With TLS Certificates](azurekubernetesmisconfig/rules/azure_encrypt_traffic_https_load_balancers_tls)
* [Ensure Clusters Are Created With Private Nodes](azurekubernetesmisconfig/rules/azure_clusters_created_with_private_nodes)
* [Ensure Clusters Use Private Endpoint With Public Access Disabled](azurekubernetesmisconfig/rules/azure_private_endpoint_enabled_public_access_disabled)
* [Ensure Default Service Accounts Are Not Actively Used](azurekubernetesmisconfig/rules/azure_default_service_accounts_not_used)
* [Ensure Kubernetes Secrets Are Encrypted](azurekubernetesmisconfig/rules/azure_kubernetes_secrets_encrypted_key_vault)
* [Ensure Latest CNI Version Is Used](azurekubernetesmisconfig/rules/azure_latest_cni_version)
* [Ensure Network Policy Is Enabled And Set Appropriately](azurekubernetesmisconfig/rules/azure_network_policy_enabled)
* [Ensure Service Account Tokens Are Only Mounted Where Necessary](azurekubernetesmisconfig/rules/azure_minimize_service_account_token_mount)
* [Ensure That All Namespaces Have Network Policies Defined](azurekubernetesmisconfig/rules/azure_namespaces_have_network_policies)
* [Ensure The Cluster-Admin Role Is Only Used Where Required](azurekubernetesmisconfig/rules/azure_restrict_cluster_admin_role)
* [Every Non-System Namespace Should Have A Default-Deny NetworkPolicy](azurekubernetesmisconfig/rules/azure_default_deny_networkpolicy)
* [Kubelet Anonymous Auth Set To False](azurekubernetesmisconfig/rules/azure_kubelet_anonymous_auth_disabled)
* [Kubelet Authorization Mode Not Set To AlwaysAllow](azurekubernetesmisconfig/rules/azure_kubelet_authorization_mode_not_alwaysallow)
* [Kubelet Client CA File Set As Appropriate](azurekubernetesmisconfig/rules/azure_kubelet_client_ca_file_set)
* [Kubelet Event Record QPS Set For Appropriate Event Capture](azurekubernetesmisconfig/rules/azure_kubelet_event_qps_appropriate)
* [Kubelet Kubeconfig File Ownership Set To Root Root](azurekubernetesmisconfig/rules/azure_kubelet_kubeconfig_file_ownership_root)
* [Kubelet Kubeconfig File Permissions Set To 644 Or More Restrictive](azurekubernetesmisconfig/rules/azure_kubelet_kubeconfig_file_permissions_644)
* [Kubelet Make IPTables Util Chains Set To True](azurekubernetesmisconfig/rules/azure_kubelet_make_iptables_util_chains_enabled)
* [Kubelet Read Only Port Secured](azurekubernetesmisconfig/rules/azure_kubelet_read_only_port_secured)
* [Kubelet Rotate Certificates Not Set To False](azurekubernetesmisconfig/rules/azure_kubelet_rotate_certificates_not_false)
* [Kubelet RotateKubeletServerCertificate Set To True](azurekubernetesmisconfig/rules/azure_kubelet_rotate_server_certificate_enabled)
* [Kubelet Streaming Connection Idle Timeout Not Set To Zero](azurekubernetesmisconfig/rules/azure_kubelet_streaming_connection_idle_timeout_not_zero)
* [Limit Use Of The Bind, Impersonate And Escalate Permissions](azurekubernetesmisconfig/rules/azure_limit_bind_impersonate_escalate)
* [Manage Kubernetes RBAC Users With Azure AD](azurekubernetesmisconfig/rules/azure_manage_kubernetes_rbac_users_with_azure_ad)
* [Minimize Access To Create Persistent Volumes](azurekubernetesmisconfig/rules/azure_minimize_create_persistent_volumes)
* [Minimize Access To Create Pods](azurekubernetesmisconfig/rules/azure_minimize_create_pods_access)
* [Minimize Access To Secrets](azurekubernetesmisconfig/rules/azure_minimize_secret_access)
* [Minimize Access To The Approval Sub-Resource Of CertificateSigningRequests](azurekubernetesmisconfig/rules/azure_minimize_csr_approval_access)
* [Minimize Access To The Proxy Sub-Resource Of Nodes](azurekubernetesmisconfig/rules/azure_minimize_node_proxy_access)
* [Minimize Access To The Service Account Token Creation](azurekubernetesmisconfig/rules/azure_minimize_service_account_token_creation)
* [Minimize Access To Webhook Configuration Objects](azurekubernetesmisconfig/rules/azure_minimize_webhook_config_access)
* [Minimize Cluster Access To Read-Only For Azure Container Registry](azurekubernetesmisconfig/rules/azure_minimize_cluster_access_read_only_acr)
* [Minimize Container Registries To Only Those Approved](azurekubernetesmisconfig/rules/azure_minimize_container_registries_to_approved)
* [Minimize The Admission Of Containers Sharing The Host IPC Namespace](azurekubernetesmisconfig/rules/azure_restrict_host_ipc_containers)
* [Minimize The Admission Of Containers Sharing The Host Network Namespace](azurekubernetesmisconfig/rules/azure_restrict_host_network_containers)
* [Minimize The Admission Of Containers Sharing The Host Process ID Namespace](azurekubernetesmisconfig/rules/azure_restrict_host_pid_containers)
* [Minimize The Admission Of Containers With allowPrivilegeEscalation](azurekubernetesmisconfig/rules/azure_restrict_allow_privilege_escalation)
* [Minimize The Admission Of Privileged Containers](azurekubernetesmisconfig/rules/azure_restrict_privileged_containers)
* [Minimize User Access To Azure Container Registry](azurekubernetesmisconfig/rules/azure_minimize_user_access_to_acr)
* [Minimize Wildcard Use In Roles And ClusterRoles](azurekubernetesmisconfig/rules/azure_minimize_wildcard_use_rbac)
* [Multi-Replica Deployments Should Have A PodDisruptionBudget](azurekubernetesmisconfig/rules/azure_multireplica_poddisruptionbudget)
* [Mutable Image Tags Should Use imagePullPolicy Always](azurekubernetesmisconfig/rules/azure_mutable_tag_pullpolicy_always)
* [Namespaces Should Enforce Pod Security Admission Baseline Or Stricter](azurekubernetesmisconfig/rules/azure_enforce_pod_security_admission)
* [No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users](azurekubernetesmisconfig/rules/azure_no_anonymous_rolebindings)
* [No ServiceAccount Should Be Bound To cluster-admin](azurekubernetesmisconfig/rules/azure_no_serviceaccount_cluster_admin)
* [No Workloads Should Run In The default Namespace](azurekubernetesmisconfig/rules/azure_no_workloads_default_namespace)
* [Pods Should Be Managed By A Controller](azurekubernetesmisconfig/rules/azure_pods_managed_by_controller)
* [Pods Should Not Mount HostPath Volumes](azurekubernetesmisconfig/rules/azure_no_hostpath_volumes)
* [Pods Should Not Share Host Namespaces](azurekubernetesmisconfig/rules/azure_no_host_namespace_sharing)
* [Pods That Do Not Use The API Should Disable Token Automount](azurekubernetesmisconfig/rules/azure_disable_token_automount)
* [pods/exec Should Not Be Granted To Broad Subjects](azurekubernetesmisconfig/rules/azure_restrict_pods_exec)
* [Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens](azurekubernetesmisconfig/rules/azure_prefer_projected_sa_tokens)
* [Prefer Using Dedicated AKS Service Accounts](azurekubernetesmisconfig/rules/azure_prefer_dedicated_aks_service_accounts)
* [Prefer Using Secrets As Files Over Secrets As Environment Variables](azurekubernetesmisconfig/rules/azure_prefer_secrets_as_files)
* [Restrict Access To The Control Plane Endpoint](azurekubernetesmisconfig/rules/azure_restrict_access_control_plane_endpoint)
* [Secrets Should Be Encrypted At Rest](azurekubernetesmisconfig/rules/azure_secrets_encrypted_at_rest)
* [Sensitive Values Should Not Be Passed As Literal Env Vars](azurekubernetesmisconfig/rules/azure_no_literal_secret_env)
* [Tenant Namespaces Should Have A ResourceQuota](azurekubernetesmisconfig/rules/azure_namespace_resourcequota)
* [The Default Namespace Should Not Be Used](azurekubernetesmisconfig/rules/azure_default_namespace_not_used)
* [Use Azure RBAC For Kubernetes Authorization](azurekubernetesmisconfig/rules/azure_use_azure_rbac_for_kubernetes_authorization)