Skip to main content

Bundles/infrastructure-hardening

Infrastructure Hardening Audit

infrastructure-hardening · v1.1.0 · paid

Container, Kubernetes, and network security review covering image hardening, RBAC, network policies, and supply chain integrity.

Container & Image Security

container-image-security · weight 0.3

All Dockerfile FROM statements use official base images with SHA-256 digest pinning
ab-001630
critical
Dockerfile includes USER directive with non-root UID above 1000
ab-001631
critical
Image layers are scanned for hardcoded credentials and secrets
ab-001632
critical
Image uses multi-stage builds to minimize final layer size
ab-001633
high
CI/CD pipeline runs vulnerability scanning on every image build
ab-001634
high

Network & TLS

network-tls · weight 0.25

TLS 1.2 or higher enforced at ingress for all external traffic
ab-001635
high
TLS certificates are automatically renewed before expiry
ab-001636
high
Kubernetes NetworkPolicies restrict pod-to-pod and pod-to-external traffic
ab-001637
high

Access Control & RBAC

access-control-rbac · weight 0.2

Kubernetes RBAC configured with minimal permissions; no wildcard verbs or cluster-admin
ab-001638
high
No containers run with privileged flag or securityContext.privileged: true
ab-001639
medium
Containers run with read-only root filesystem where permitted
ab-001640
medium
Secrets are stored in a dedicated secrets manager with encryption at rest
ab-001641
medium

Monitoring & Incident Response

monitoring-incident-response · weight 0.25

Kubernetes audit logging is enabled and covers authentication, API calls, and RBAC denials
ab-001642
medium
Egress traffic is restricted to approved destinations; no open egress to 0.0.0.0/0
ab-001643
medium
Images are signed using Docker Content Trust or Cosign; verification enforced at deployment
ab-001644
low
DNSSEC enabled; DNS query logging configured
ab-001645
low
Image pull credentials enforced via ImagePullSecrets or IAM-based registry authentication
ab-001646
low
Liveness and readiness probes configured for all Deployments
ab-001647
low
CPU and memory resource limits defined for all pods
ab-001648
low
Container runtime security policies (seccomp, AppArmor) are applied
ab-001649
low
Pod Security Standards enforcement at namespace level
ab-001650
low
Production containers do not expose SSH port 22 or RDP
ab-001651
low
CDN or WAF deployed with DDoS protection, geo-blocking, rate limiting, and bot detection
ab-001652
info
Centralized log aggregation configured with timestamps, severity, and trace IDs
ab-001653
info
Alerting configured for anomalous patterns (failed logins, privilege escalation, unexpected connections)
ab-001654
info
Disaster recovery procedures documented, tested quarterly, with RTO and RPO targets
ab-001655
info