Prevent untrusted or altered worker-node software from operating beneath Kubernetes workloads.
Protect Worker Node Integrity
CCC.K8S.CN18 · Compute
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP03 | Abstracted Worker Infrastructure | The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user. |
| CCC.K8S.CP18 | Admission Policy Enforcement | The service may be configured with policies, admission controllers, and webhooks that validate, mutate, or reject Kubernetes API requests before persistence. |
| CCC.K8S.CP19 | Workload Isolation Controls | The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings. |
| CCC.K8S.CP15 | Cluster Version Management | The service may be configured with upgrade channels and maintenance settings that keep control-plane and worker components within provider-defined compatibility and support periods. |
| CCC.K8S.CP22 | Worker Node Integrity Protection | The service may be configured with trusted worker-node images and platform mechanisms that verify node boot integrity before workloads are executed. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH05 | Privileged Workloads Escape Isolation | Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure. |
| CCC.K8S.TH09 | Unsupported Cluster Components Remain in Use | Control-plane, worker, runtime, or extension versions outside their supported lifecycles may retain known vulnerabilities and compatibility defects. Exposed components can then be exploited or may fail during service changes, leading to data exposure, loss of cluster-state integrity, or workload interruption. |
| CCC.K8S.TH18 | Worker Node Integrity Is Not Verified | Worker nodes created from untrusted or altered images, or started without boot integrity verification, may execute modified software beneath the container runtime. Modified node components can observe workload data and credentials or alter workload execution. Workload confidentiality and integrity may be lost, and node or cluster availability may be reduced. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN18.AR01 | Worker nodes MUST use supported images obtained from the service or an authenticated publisher. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN18.AR02 | Worker nodes MUST use service-supported boot-integrity verification before accepting workloads. | tlp-clear, tlp-green, tlp-amber, tlp-red |