Worker nodes created from untrusted or altered images, or started without boot integrity verification, may execute modified software beneath the container runtime. Modified node components can observe workload data and credentials or alter workload execution. Workload confidentiality and integrity may be lost, and node or cluster availability may be reduced.
Worker Node Integrity Is Not Verified
CCC.K8S.TH18
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP03 | Abstracted Worker Infrastructure | The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user. |
| CCC.K8S.CP22 | Worker Node Integrity Protection | The service may be configured with trusted worker-node images and platform mechanisms that verify node boot integrity before workloads are executed. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN18 | Protect Worker Node Integrity | Prevent untrusted or altered worker-node software from operating beneath Kubernetes workloads. |