> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Misconfig for GCP

### Checks Performed

* [An Admission Policy Engine Should Enforce Workload Policy](gcpkubernetesmisconfig/rules/gcp_admission_policy_engine_enforced)
* [Apply Security Context To Pods And Containers](gcpkubernetesmisconfig/rules/gcp_apply_security_context)
* [Audit Logging Should Be Enabled And Shipped Off-Cluster](gcpkubernetesmisconfig/rules/gcp_audit_logging_shipped_offcluster)
* [Automate GKE Version Management Using Release Channels](gcpkubernetesmisconfig/rules/gcp_release_channel_version_management)
* [Avoid Bindings To System:anonymous](gcpkubernetesmisconfig/rules/gcp_avoid_system_anonymous_bindings)
* [Avoid Non-Default Bindings To System:authenticated](gcpkubernetesmisconfig/rules/gcp_avoid_system_authenticated_bindings)
* [Avoid Non-Default Bindings To System:unauthenticated](gcpkubernetesmisconfig/rules/gcp_avoid_system_unauthenticated_bindings)
* [Avoid Use Of System:masters Group](gcpkubernetesmisconfig/rules/gcp_avoid_system_masters_group)
* [Configure Image Provenance Using ImagePolicyWebhook Admission Controller](gcpkubernetesmisconfig/rules/gcp_configure_image_provenance_imagepolicywebhook)
* [Consider External Secret Storage](gcpkubernetesmisconfig/rules/gcp_consider_external_secret_storage)
* [Consider Firewalling GKE Worker Nodes](gcpkubernetesmisconfig/rules/gcp_firewall_gke_worker_nodes)
* [Consider GKE Sandbox For Running Untrusted Workloads](gcpkubernetesmisconfig/rules/gcp_gke_sandbox_for_untrusted_workloads)
* [Container Images Should Not Use The latest Or Untagged Tag](gcpkubernetesmisconfig/rules/gcp_no_latest_image_tag)
* [Containers Should Define Liveness And Readiness Probes](gcpkubernetesmisconfig/rules/gcp_define_liveness_readiness_probes)
* [Containers Should Disallow Privilege Escalation](gcpkubernetesmisconfig/rules/gcp_disallow_privilege_escalation)
* [Containers Should Drop All Linux Capabilities](gcpkubernetesmisconfig/rules/gcp_drop_all_capabilities)
* [Containers Should Not Run In Privileged Mode](gcpkubernetesmisconfig/rules/gcp_no_privileged_container)
* [Containers Should Run As Non-Root](gcpkubernetesmisconfig/rules/gcp_container_run_as_nonroot)
* [Containers Should Set CPU And Memory Limits](gcpkubernetesmisconfig/rules/gcp_set_resource_limits)
* [Containers Should Set CPU And Memory Requests](gcpkubernetesmisconfig/rules/gcp_set_resource_requests)
* [Containers Should Use A Read-Only Root Filesystem](gcpkubernetesmisconfig/rules/gcp_readonly_root_filesystem)
* [Create Administrative Boundaries Between Resources Using Namespaces](gcpkubernetesmisconfig/rules/gcp_namespaces_administrative_boundaries)
* [Enable Customer-Managed Encryption Keys (CMEK) For Boot Disks](gcpkubernetesmisconfig/rules/gcp_cmek_for_boot_disks)
* [Enable Customer-Managed Encryption Keys (CMEK) For GKE Persistent Disks](gcpkubernetesmisconfig/rules/gcp_cmek_for_persistent_disks)
* [Enable Linux Auditd Logging](gcpkubernetesmisconfig/rules/gcp_linux_auditd_logging_enabled)
* [Enable Security Posture](gcpkubernetesmisconfig/rules/gcp_security_posture_enabled)
* [Enable VPC Flow Logs And Intranode Visibility](gcpkubernetesmisconfig/rules/gcp_vpc_flow_logs_and_intranode_visibility)
* [Enforce Pod Security Standard Baseline Profile Or Stricter For All Namespaces](gcpkubernetesmisconfig/rules/gcp_enforce_pod_security_baseline)
* [Ensure All Namespaces Have Network Policies Defined](gcpkubernetesmisconfig/rules/gcp_namespaces_have_network_policies)
* [Ensure Authentication Using Client Certificates Is Disabled](gcpkubernetesmisconfig/rules/gcp_client_certificate_authentication_disabled)
* [Ensure Cluster-Admin Role Is Only Used Where Required](gcpkubernetesmisconfig/rules/gcp_cluster_admin_role_restricted)
* [Ensure Clusters Are Created With Private Endpoint Enabled And Public Access Disabled](gcpkubernetesmisconfig/rules/gcp_private_endpoint_enabled_public_access_disabled)
* [Ensure Clusters Are Created With Private Nodes](gcpkubernetesmisconfig/rules/gcp_private_nodes_enabled)
* [Ensure Container-Optimized OS Is Used For GKE Node Images](gcpkubernetesmisconfig/rules/gcp_container_optimized_os_node_images)
* [Ensure Control Plane Authorized Networks Is Enabled](gcpkubernetesmisconfig/rules/gcp_control_plane_authorized_networks_enabled)
* [Ensure Default Service Accounts Are Not Actively Used](gcpkubernetesmisconfig/rules/gcp_default_service_accounts_not_used)
* [Ensure GKE Clusters Are Not Running Using The Compute Engine Default Service Account](gcpkubernetesmisconfig/rules/gcp_clusters_not_using_default_compute_service_account)
* [Ensure Image Vulnerability Scanning Is Enabled](gcpkubernetesmisconfig/rules/gcp_image_vulnerability_scanning_enabled)
* [Ensure Integrity Monitoring For Shielded GKE Nodes Is Enabled](gcpkubernetesmisconfig/rules/gcp_shielded_node_integrity_monitoring_enabled)
* [Ensure Kube-Proxy Kubeconfig File Ownership Is Set To root:root](gcpkubernetesmisconfig/rules/gcp_proxy_kubeconfig_file_ownership_root)
* [Ensure Kube-Proxy Kubeconfig File Permissions Are 644 Or More Restrictive](gcpkubernetesmisconfig/rules/gcp_proxy_kubeconfig_file_permissions_644)
* [Ensure Kubelet Configuration File Ownership Is Set To root:root](gcpkubernetesmisconfig/rules/gcp_kubelet_config_file_ownership_root)
* [Ensure Kubelet Configuration File Permissions Are Set To 644](gcpkubernetesmisconfig/rules/gcp_kubelet_config_file_permissions_644)
* [Ensure Kubernetes Secrets Are Encrypted Using Keys Managed In Cloud KMS](gcpkubernetesmisconfig/rules/gcp_secrets_encrypted_with_cloud_kms)
* [Ensure Kubernetes Web UI Is Disabled](gcpkubernetesmisconfig/rules/gcp_kubernetes_web_ui_disabled)
* [Ensure Legacy Authorization (ABAC) Is Disabled](gcpkubernetesmisconfig/rules/gcp_legacy_authorization_abac_disabled)
* [Ensure Logging And Cloud Monitoring Is Enabled](gcpkubernetesmisconfig/rules/gcp_logging_and_cloud_monitoring_enabled)
* [Ensure Node Auto-Repair Is Enabled For GKE Nodes](gcpkubernetesmisconfig/rules/gcp_node_auto_repair_enabled)
* [Ensure Node Auto-Upgrade Is Enabled For GKE Nodes](gcpkubernetesmisconfig/rules/gcp_node_auto_upgrade_enabled)
* [Ensure Only Trusted Container Images Are Used](gcpkubernetesmisconfig/rules/gcp_only_trusted_container_images_used)
* [Ensure Secure Boot For Shielded GKE Nodes Is Enabled](gcpkubernetesmisconfig/rules/gcp_shielded_node_secure_boot_enabled)
* [Ensure Service Account Tokens Are Only Mounted Where Necessary](gcpkubernetesmisconfig/rules/gcp_sa_tokens_mounted_only_when_needed)
* [Ensure Shielded GKE Nodes Are Enabled](gcpkubernetesmisconfig/rules/gcp_shielded_gke_nodes_enabled)
* [Ensure That Alpha Clusters Are Not Used For Production Workloads](gcpkubernetesmisconfig/rules/gcp_alpha_clusters_not_used_in_production)
* [Ensure The CNI In Use Supports Network Policies](gcpkubernetesmisconfig/rules/gcp_cni_supports_network_policies)
* [Ensure The GKE Metadata Server Is Enabled](gcpkubernetesmisconfig/rules/gcp_gke_metadata_server_enabled)
* [Ensure The Seccomp Profile Is Set To RuntimeDefault In Pod Definitions](gcpkubernetesmisconfig/rules/gcp_seccomp_runtime_default)
* [Ensure Use Of Google-Managed SSL Certificates](gcpkubernetesmisconfig/rules/gcp_google_managed_ssl_certificates)
* [Ensure Use Of VPC-Native Clusters](gcpkubernetesmisconfig/rules/gcp_vpc_native_clusters)
* [Every Non-System Namespace Should Have A Default-Deny NetworkPolicy](gcpkubernetesmisconfig/rules/gcp_default_deny_networkpolicy)
* [Limit Use Of The Bind, Impersonate And Escalate Permissions](gcpkubernetesmisconfig/rules/gcp_limit_bind_impersonate_escalate)
* [Manage Kubernetes RBAC Users With Google Groups For GKE](gcpkubernetesmisconfig/rules/gcp_rbac_users_with_google_groups)
* [Minimize Access To Secrets](gcpkubernetesmisconfig/rules/gcp_minimize_secrets_access)
* [Minimize Cluster Access To Read-Only For Container Image Repositories](gcpkubernetesmisconfig/rules/gcp_cluster_access_readonly_image_repositories)
* [Minimize User Access To Container Image Repositories](gcpkubernetesmisconfig/rules/gcp_minimize_user_access_image_repositories)
* [Minimize Wildcard Use In Roles And ClusterRoles](gcpkubernetesmisconfig/rules/gcp_minimize_wildcard_rbac)
* [Multi-Replica Deployments Should Have A PodDisruptionBudget](gcpkubernetesmisconfig/rules/gcp_multireplica_poddisruptionbudget)
* [Mutable Image Tags Should Use imagePullPolicy Always](gcpkubernetesmisconfig/rules/gcp_mutable_tag_pullpolicy_always)
* [Namespaces Should Enforce Pod Security Admission Baseline Or Stricter](gcpkubernetesmisconfig/rules/gcp_enforce_pod_security_admission)
* [No RoleBinding Should Grant Access To Anonymous Or Unauthenticated Users](gcpkubernetesmisconfig/rules/gcp_no_anonymous_rolebindings)
* [No ServiceAccount Should Be Bound To cluster-admin](gcpkubernetesmisconfig/rules/gcp_no_serviceaccount_cluster_admin)
* [No Workloads Should Run In The default Namespace](gcpkubernetesmisconfig/rules/gcp_no_workloads_default_namespace)
* [Pods Should Be Managed By A Controller](gcpkubernetesmisconfig/rules/gcp_pods_managed_by_controller)
* [Pods Should Not Mount HostPath Volumes](gcpkubernetesmisconfig/rules/gcp_no_hostpath_volumes)
* [Pods Should Not Share Host Namespaces](gcpkubernetesmisconfig/rules/gcp_no_host_namespace_sharing)
* [Pods That Do Not Use The API Should Disable Token Automount](gcpkubernetesmisconfig/rules/gcp_disable_token_automount)
* [pods/exec Should Not Be Granted To Broad Subjects](gcpkubernetesmisconfig/rules/gcp_restrict_pods_exec)
* [Prefer Bound Projected ServiceAccount Tokens Over Secret Tokens](gcpkubernetesmisconfig/rules/gcp_prefer_projected_sa_tokens)
* [Prefer Using Dedicated GCP Service Accounts And Workload Identity](gcpkubernetesmisconfig/rules/gcp_dedicated_service_accounts_and_workload_identity)
* [Prefer Using Secrets As Files Over Secrets As Environment Variables](gcpkubernetesmisconfig/rules/gcp_prefer_secrets_as_files)
* [Secrets Should Be Encrypted At Rest](gcpkubernetesmisconfig/rules/gcp_secrets_encrypted_at_rest)
* [Sensitive Values Should Not Be Passed As Literal Env Vars](gcpkubernetesmisconfig/rules/gcp_no_literal_secret_env)
* [Tenant Namespaces Should Have A ResourceQuota](gcpkubernetesmisconfig/rules/gcp_namespace_resourcequota)
* [The Default Namespace Should Not Be Used](gcpkubernetesmisconfig/rules/gcp_default_namespace_not_used)