Apply mandatory cluster security policy to every workload path and prevent its scope or enforcement configuration from being bypassed or modified without authorization.
Protect Admission Control Enforcement
CCC.K8S.CN11 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP18 | Admission Policy Enforcement | The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence. |
| CCC.K8S.CP06 | Declarative Workload Orchestration | The service automatically reconciles Kubernetes workload resources toward their user-declared state by scheduling, restarting, and replacing containers as needed. |
| CCC.K8S.CP14 | Managed Cluster Extensions | The service can manage the installation and lifecycle of supported extensions for networking, storage, policy, observability, and workload management. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH12 | Admission Controls are Bypassed | Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption. |
| CCC.K8S.TH13 | Controllers Reconcile Unauthorized Cluster State | A controller or scheduled workload granted excessive scope may repeatedly create or restore unauthorized resources and configuration through its reconciliation loop. Manual remediation can then be overwritten, restoring unsafe cluster state that exposes workload data or interferes with service availability. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN11.AR01 | When security admission policies are enabled, every namespace and relevant create or update operation MUST be governed by an explicitly defined policy, including separate policies for system namespaces that require different constraints. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN11.AR02 | When admission policy configuration is modified, the change MUST require a dedicated administrative role AND produce an externally retained audit record. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN11.AR03 | When an external admission component enforces a mandatory control, unavailable or untrusted webhook responses MUST cause the request to be denied. | tlp-green, tlp-amber, tlp-red |