Kubernetes Cluster Report: aks-0402-dev-uks
Powered by KubeBuddy Logo
Generated on: April 22, 2025 14:15:08 UTC
  • Summary
  • Nodes
  • Namespaces
  • Workloads
  • Pods
  • Jobs
  • Networking
  • Storage
  • Configuration
  • Security
  • Kubernetes Events
  • AKS Best Practices

Cluster Overview

Cluster Health Score

Score: 37 / 100

37%

This score is calculated from key checks across nodes, workloads, security, and configuration best practices. A higher score means fewer issues and better adherence to Kubernetes standards.

API Server Health

latency (p99): 5 ms

Liveness: livez check passed expand_more 
[+]ping ok
[+]log ok
[+]etcd ok
[+]poststarthook/start-apiserver-admission-initializer ok
[+]poststarthook/generic-apiserver-start-informers ok
[+]poststarthook/priority-and-fairness-config-consumer ok
[+]poststarthook/priority-and-fairness-filter ok
[+]poststarthook/storage-object-count-tracker-hook ok
[+]poststarthook/start-apiextensions-informers ok
[+]poststarthook/start-apiextensions-controllers ok
[+]poststarthook/crd-informer-synced ok
[+]poststarthook/start-service-ip-repair-controllers ok
[+]poststarthook/rbac/bootstrap-roles ok
[+]poststarthook/scheduling/bootstrap-system-priority-classes ok
[+]poststarthook/priority-and-fairness-config-producer ok
[+]poststarthook/start-system-namespaces-controller ok
[+]poststarthook/bootstrap-controller ok
[+]poststarthook/start-cluster-authentication-info-controller ok
[+]poststarthook/start-kube-apiserver-identity-lease-controller ok
[+]poststarthook/start-kube-apiserver-identity-lease-garbage-collector ok
[+]poststarthook/start-legacy-token-tracking-controller ok
[+]poststarthook/aggregator-reload-proxy-client-cert ok
[+]poststarthook/start-kube-aggregator-informers ok
[+]poststarthook/apiservice-registration-controller ok
[+]poststarthook/apiservice-status-available-controller ok
[+]poststarthook/apiservice-discovery-controller ok
[+]poststarthook/kube-apiserver-autoregistration ok
[+]autoregister-completion ok
[+]poststarthook/apiservice-openapi-controller ok
[+]poststarthook/apiservice-openapiv3-controller ok
livez check passed
Readiness: readyz check passed expand_more 
[+]ping ok
[+]log ok
[+]etcd ok
[+]etcd-readiness ok
[+]informer-sync ok
[+]poststarthook/start-apiserver-admission-initializer ok
[+]poststarthook/generic-apiserver-start-informers ok
[+]poststarthook/priority-and-fairness-config-consumer ok
[+]poststarthook/priority-and-fairness-filter ok
[+]poststarthook/storage-object-count-tracker-hook ok
[+]poststarthook/start-apiextensions-informers ok
[+]poststarthook/start-apiextensions-controllers ok
[+]poststarthook/crd-informer-synced ok
[+]poststarthook/start-service-ip-repair-controllers ok
[+]poststarthook/rbac/bootstrap-roles ok
[+]poststarthook/scheduling/bootstrap-system-priority-classes ok
[+]poststarthook/priority-and-fairness-config-producer ok
[+]poststarthook/start-system-namespaces-controller ok
[+]poststarthook/bootstrap-controller ok
[+]poststarthook/start-cluster-authentication-info-controller ok
[+]poststarthook/start-kube-apiserver-identity-lease-controller ok
[+]poststarthook/start-kube-apiserver-identity-lease-garbage-collector ok
[+]poststarthook/start-legacy-token-tracking-controller ok
[+]poststarthook/aggregator-reload-proxy-client-cert ok
[+]poststarthook/start-kube-aggregator-informers ok
[+]poststarthook/apiservice-registration-controller ok
[+]poststarthook/apiservice-status-available-controller ok
[+]poststarthook/apiservice-discovery-controller ok
[+]poststarthook/kube-apiserver-autoregistration ok
[+]autoregister-completion ok
[+]poststarthook/apiservice-openapi-controller ok
[+]poststarthook/apiservice-openapiv3-controller ok
[+]shutdown ok
readyz check passed

Passed / Failed Checks

53/90

Cluster Summary

Cluster Name: aks-0402-dev-uks

Kubernetes Version: v1.30.11

Cluster is running an outdated version: v1.30.11 (Latest: v1.32.3)

Cluster Metrics Summary iSummary of metrics including node and pod counts, warnings, and issues.

🚀 Nodes: 6🟩 Healthy: 6🟥 Issues: 0
📦 Pods: 134🟩 Running: 134🟥 Failed: 0
🔄 Restarts: 1🟨 Warnings: 0🟥 Critical: 0
⏳ Pending Pods: 0🟡 Waiting: 0
⚠️ Stuck Pods: 0❌ Stuck: 0
📉 Job Failures: 0🔴 Failed: 0

Pod Distribution iAverage, min, and max pods per node and total node count.

Avg: 22.3Max: 29Min: 14Total Nodes: 6

Resource Usage iCluster-wide CPU and memory usage.

🖥 CPU: 51.4%
🟡 Warning
💾 Memory: 4.74%
🟩 Normal

Cluster Events iSummary of recent warning and error events.

❌ Errors: 0
⚠️ Warnings: 0

Node Conditions & Resources

NODE001 - Node Readiness and Conditions iDetects nodes that are not in Ready state or reporting other warning conditions.

✅ All Nodes are healthy.

Show Findings
Recommendations
  • Use kubectl describe node to check conditions and taints.
  • Check kubelet and container runtime status.
  • Verify cluster networking and node resource pressure.
NodeStatusIssues
aks-systempool-19995743-vmss00000m✅ HealthyNone
aks-systempool-19995743-vmss00000n✅ HealthyNone
aks-systempool-19995743-vmss00000o✅ HealthyNone
aks-workloadpool-10479701-vmss00000e✅ HealthyNone
aks-workloadpool-10479701-vmss00000f✅ HealthyNone
aks-workloadpool-10479701-vmss00000g✅ HealthyNone

NODE002 - Node Resource Pressure iDetects nodes under high CPU, memory, or disk pressure.

⚠️ Total Nodes with Issues: 3

Show Findings
Recommendations
  • Review node workloads with kubectl top nodes.
  • Move resource-hungry pods to less loaded nodes.
  • Scale node pool or optimize workloads if necessary.
NodeCPU StatusCPU %CPU UsedCPU TotalMem StatusMem %Mem UsedMem TotalDisk %Disk Status
aks-systempool-19995743-vmss00000m✅ Normal8.42%160 mC1900 mC🟡 Warning53.11%3470 Mi6533 Mi53%✅ Normal
aks-systempool-19995743-vmss00000n✅ Normal8.58%163 mC1900 mC🟡 Warning53.56%3499 Mi6533 Mi53%✅ Normal
aks-systempool-19995743-vmss00000o✅ Normal7.58%144 mC1900 mC🟡 Warning52.55%3433 Mi6533 Mi52%✅ Normal
aks-workloadpool-10479701-vmss00000e✅ Normal30.93%1194 mC3860 mC✅ Normal23.35%3405 Mi14584 Mi23%✅ Normal
aks-workloadpool-10479701-vmss00000f✅ Normal30.52%1178 mC3860 mC✅ Normal17.86%2604 Mi14584 Mi17%✅ Normal
aks-workloadpool-10479701-vmss00000g✅ Normal3.91%151 mC3860 mC✅ Normal15.14%2208 Mi14584 Mi15%✅ Normal

Namespaces

NS001 - Empty Namespaces iFinds namespaces with no running pods.

⚠️ Total Namespaces with Issues: 14

Show Findings
Recommendations
  • Check if any other resources (PVCs, Secrets) exist before deleting.
  • Use kubectl get all -n to inspect.
  • Clean up empty namespaces to reduce clutter.
NamespaceStatus
1📂 Empty
10📂 Empty
2📂 Empty
3📂 Empty
4📂 Empty
5📂 Empty
6📂 Empty
7📂 Empty
8📂 Empty
9📂 Empty
aks-istio-egress📂 Empty
default📂 Empty
kube-node-lease📂 Empty
kube-public📂 Empty

NS002 - Missing or Weak ResourceQuotas iDetects namespaces with missing or incomplete ResourceQuota definitions.

⚠️ Total ResourceQuotas with Issues: 32

Show Findings
Recommendations
  • Define limits using ResourceQuota for pods, memory, and CPU.
  • Helps avoid over-provisioning and noisy neighbor issues.
  • Review quotas using kubectl describe quota -n .
IssueNamespace
❌ No ResourceQuota1
❌ No ResourceQuota10
❌ No ResourceQuota2
❌ No ResourceQuota3
❌ No ResourceQuota4
❌ No ResourceQuota5
❌ No ResourceQuota6
❌ No ResourceQuota7
❌ No ResourceQuota8
❌ No ResourceQuota9
❌ No ResourceQuotaaks-istio-egress
❌ No ResourceQuotaaks-istio-ingress
❌ No ResourceQuotaaks-istio-system
❌ No ResourceQuotaapp-routing-system
❌ No ResourceQuotaargo-rollouts
❌ No ResourceQuotaargo-workflows
❌ No ResourceQuotaargocd
❌ No ResourceQuotacert-manager
❌ No ResourceQuotadefault
❌ No ResourceQuotagatekeeper-system
❌ No ResourceQuotagrafana
❌ No ResourceQuotakiali-operator
❌ No ResourceQuotakube-node-lease
❌ No ResourceQuotakube-public
❌ No ResourceQuotakube-system
❌ No ResourceQuotakubeview
❌ No ResourceQuotalinkerd
❌ No ResourceQuotanginx
❌ No ResourceQuotapets
❌ No ResourceQuotaprometheus
❌ No ResourceQuotasealed-secrets
❌ No ResourceQuotatest

NS003 - Missing LimitRanges iDetects namespaces without a defined LimitRange.

⚠️ Total LimitRanges with Issues: 32

Show Findings
Recommendations
  • LimitRanges define default and max values for CPU/memory.
  • Prevents pods from using unlimited resources.
  • Use kubectl create limitrange ... or kubectl describe limitrange -n .
IssueNamespace
❌ No LimitRange1
❌ No LimitRange10
❌ No LimitRange2
❌ No LimitRange3
❌ No LimitRange4
❌ No LimitRange5
❌ No LimitRange6
❌ No LimitRange7
❌ No LimitRange8
❌ No LimitRange9
❌ No LimitRangeaks-istio-egress
❌ No LimitRangeaks-istio-ingress
❌ No LimitRangeaks-istio-system
❌ No LimitRangeapp-routing-system
❌ No LimitRangeargo-rollouts
❌ No LimitRangeargo-workflows
❌ No LimitRangeargocd
❌ No LimitRangecert-manager
❌ No LimitRangedefault
❌ No LimitRangegatekeeper-system
❌ No LimitRangegrafana
❌ No LimitRangekiali-operator
❌ No LimitRangekube-node-lease
❌ No LimitRangekube-public
❌ No LimitRangekube-system
❌ No LimitRangekubeview
❌ No LimitRangelinkerd
❌ No LimitRangenginx
❌ No LimitRangepets
❌ No LimitRangeprometheus
❌ No LimitRangesealed-secrets
❌ No LimitRangetest

Workloads

WRK001 - DaemonSets Not Fully Running iDetects DaemonSets that have fewer running pods than desired.

✅ All DaemonSets are healthy.

WRK002 - Deployment Missing Replicas iDetects Deployments where the number of available replicas is less than desired.

✅ All Deployments are healthy.

WRK003 - StatefulSet Incomplete Rollout iDetects StatefulSets where the number of ready replicas is less than the desired count.

✅ All StatefulSets are healthy.

WRK004 - HPA Misconfiguration or Inactivity iChecks for HPAs that have missing targets, no metrics, or inactive scaling.

✅ All HorizontalPodAutoscalers are healthy.

WRK005 - Missing Resource Requests or Limits iChecks for containers that are missing CPU or memory resource requests or limits.

⚠️ Total Pods with Issues: 90

Show Findings
Recommendations
  • Add resources.requests.cpu and resources.requests.memory to every container.
  • Also specify resources.limits.cpu and resources.limits.memory.
  • Review workloads using kubectl get deploy,statefulset,daemonset -A -o yaml.
  • Apply missing limits to avoid resource starvation and enforce scheduling constraints.
MessageNamespaceResourceValue
CPU and Memory Requests and CPU and Memory Limits missingaks-istio-ingressDeployment/aks-istio-ingressgateway-external-asm-1-23istio-proxy
CPU and Memory Requests and CPU and Memory Limits missingaks-istio-systemDeployment/istiod-asm-1-23discovery
CPU and Memory Requests and CPU and Memory Limits missingapp-routing-systemDeployment/nginxcontroller
CPU and Memory Requests and CPU and Memory Limits missingargo-rolloutsDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingargo-workflowsDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-applicationset-controllerargocd-applicationset-controller
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-dex-serverdex
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-dex-servercopyutil
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-notifications-controllerargocd-notifications-controller
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-redis-ha-haproxyhaproxy
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-redis-ha-haproxysecret-init
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-redis-ha-haproxyconfig-init
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-repo-serverargocd-repo-server
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-repo-servercopyutil
CPU and Memory Requests and CPU and Memory Limits missingargocdDeployment/argocd-serverargocd-server
CPU and Memory Requests and CPU and Memory Limits missingcert-managerDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missinggatekeeper-systemDeployment/gatekeeper-auditgatekeeper-audit-container
CPU and Memory Requests and CPU and Memory Limits missinggatekeeper-systemDeployment/gatekeeper-controllergatekeeper-controller-container
CPU and Memory Requests and CPU and Memory Limits missinggrafanaDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingkiali-operatorDeployment/kialikiali
CPU and Memory Requests and CPU and Memory Limits missingkiali-operatorDeployment/kiali-operatoroperator
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-logs-rsama-logs
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-metricsprometheus-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-metricsaddon-token-adapter
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-metrics-ksmama-metrics-ksm
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-metrics-operator-targetstargetallocator
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/ama-metrics-operator-targetsconfig-reader
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/azure-policyazure-policy
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/azure-policy-webhookazure-policy-webhook
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/azure-wi-webhook-controller-managermanager
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/corednscoredns
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/coredns-autoscalerautoscaler
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/eraser-controller-managermanager
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/keda-admission-webhookskeda-admission-webhooks
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/keda-operatorkeda-operator
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/keda-operator-metrics-apiserverkeda-operator-metrics-apiserver
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/konnectivity-agentkonnectivity-agent
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/konnectivity-agent-autoscalerautoscaler
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/metrics-servermetrics-server-vpa
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/metrics-servermetrics-server
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/microsoft-defender-collector-miscmicrosoft-defender-pod-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/vpa-admission-controlleradmission-controller
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/vpa-recommenderrecommender
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDeployment/vpa-updaterupdater
CPU and Memory Requests and CPU and Memory Limits missingkubeviewDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missinglinkerdDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingnginxDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingpetsDeployment/order-serviceorder-service
CPU and Memory Requests and CPU and Memory Limits missingpetsDeployment/order-servicewait-for-rabbitmq
CPU and Memory Requests and CPU and Memory Limits missingpetsDeployment/product-serviceproduct-service
CPU and Memory Requests and CPU and Memory Limits missingpetsDeployment/store-frontstore-front
CPU and Memory Requests and CPU and Memory Limits missingprometheusDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingsealed-secretsDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingtestDeployment/simple-deploymentwebserver-simple
CPU and Memory Requests and CPU and Memory Limits missingargocdStatefulSet/argocd-application-controllerargocd-application-controller
CPU and Memory Requests and CPU and Memory Limits missingargocdStatefulSet/argocd-redis-ha-serverredis
CPU and Memory Requests and CPU and Memory Limits missingargocdStatefulSet/argocd-redis-ha-serversentinel
CPU and Memory Requests and CPU and Memory Limits missingargocdStatefulSet/argocd-redis-ha-serversplit-brain-fix
CPU and Memory Requests and CPU and Memory Limits missingargocdStatefulSet/argocd-redis-ha-serverconfig-init
CPU and Memory Requests and CPU and Memory Limits missingpetsStatefulSet/rabbitmqrabbitmq
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-drivernode-driver-registrar
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-driversecrets-store
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-driverliveness-probe
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-driver-windowsnode-driver-registrar
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-driver-windowssecrets-store
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-csi-driver-windowsliveness-probe
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-provider-azureprovider-azure-installer
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/aks-secrets-store-provider-azure-windowsprovider-azure-installer
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-logsama-logs
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-logsama-logs-prometheus
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-logs-windowsama-logs-windows
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-metrics-nodeprometheus-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-metrics-nodeaddon-token-adapter
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-metrics-win-nodeprometheus-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/ama-metrics-win-nodeaddon-token-adapter-win
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/azure-ip-masq-agentazure-ip-masq-agent
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/azure-npmazure-npm
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/azure-npmblock-wireserver
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/cloud-node-managercloud-node-manager
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/cloud-node-manager-windowscloud-node-manager
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/kube-proxykube-proxy
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/kube-proxykube-proxy-bootstrap
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/microsoft-defender-collector-dsmicrosoft-defender-pod-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/microsoft-defender-collector-dsmicrosoft-defender-low-level-collector
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/microsoft-defender-publisher-dsmicrosoft-defender-publisher
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/microsoft-defender-publisher-dsold-file-cleaner
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/retina-agentretina
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/retina-agentretina-agent-init
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/retina-agent-winretinawin
CPU and Memory Requests and CPU and Memory Limits missingkube-systemDaemonSet/windows-kube-proxy-initializerpause

WRK006 - PDB Coverage and Effectiveness iDetects missing or weak PDBs for workloads

⚠️ Total PodDisruptionBudgets with Issues: 25

Show Findings
Recommendations
  • Set minAvailable to a safe minimum (not 0).
  • Avoid setting maxUnavailable to 1 or 100%.
  • Make sure PDBs match actual workloads via label selectors.
IssueKindNameNamespace
⚠️ maxUnavailable = 100%PDBnginxapp-routing-system
❌ No matching PDBDeploymentsimple-deploymentargo-rollouts
❌ No matching PDBDeploymentsimple-deploymentargo-workflows
❌ No matching PDBDeploymentargocd-applicationset-controllerargocd
❌ No matching PDBDeploymentargocd-dex-serverargocd
❌ No matching PDBDeploymentargocd-notifications-controllerargocd
❌ No matching PDBDeploymentargocd-redis-ha-haproxyargocd
❌ No matching PDBDeploymentargocd-repo-serverargocd
❌ No matching PDBDeploymentargocd-serverargocd
❌ No matching PDBDeploymentsimple-deploymentcert-manager
❌ No matching PDBDeploymentsimple-deploymentgrafana
❌ No matching PDBDeploymentkialikiali-operator
❌ No matching PDBDeploymentkiali-operatorkiali-operator
❌ No matching PDBDeploymentsimple-deploymentkubeview
❌ No matching PDBDeploymentsimple-deploymentlinkerd
❌ No matching PDBDeploymentsimple-deploymentnginx
❌ No matching PDBDeploymentorder-servicepets
❌ No matching PDBDeploymentproduct-servicepets
❌ No matching PDBDeploymentstore-frontpets
❌ No matching PDBDeploymentsimple-deploymentprometheus
❌ No matching PDBDeploymentsimple-deploymentsealed-secrets
❌ No matching PDBDeploymentsimple-deploymenttest
❌ No matching PDBStatefulSetargocd-application-controllerargocd
❌ No matching PDBStatefulSetargocd-redis-ha-serverargocd
❌ No matching PDBStatefulSetrabbitmqpets

WRK007 - Missing Readiness and Liveness Probes iDetects containers without health probes (readiness/liveness).

⚠️ Total Deployments with Issues: 56

Show Findings
Recommendations
  • Readiness probes indicate when a container is ready to receive traffic.
  • Liveness probes detect if a container is stuck or dead.
  • Use httpGet, tcpSocket, or exec probes for most apps.
  • Docs: Health probes in Kubernetes
ContainerKindMissingNamespaceWorkload
istio-proxyDeploymentreadiness, livenessaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23
discoveryDeploymentlivenessaks-istio-systemistiod-asm-1-23
webserver-simpleDeploymentreadiness, livenessargo-rolloutssimple-deployment
webserver-simpleDeploymentreadiness, livenessargo-workflowssimple-deployment
argocd-applicationset-controllerDeploymentreadiness, livenessargocdargocd-applicationset-controller
dexDeploymentreadiness, livenessargocdargocd-dex-server
argocd-notifications-controllerDeploymentreadinessargocdargocd-notifications-controller
webserver-simpleDeploymentreadiness, livenesscert-managersimple-deployment
webserver-simpleDeploymentreadiness, livenessgrafanasimple-deployment
ama-logsDeploymentreadinesskube-systemama-logs-rs
prometheus-collectorDeploymentreadinesskube-systemama-metrics
addon-token-adapterDeploymentreadinesskube-systemama-metrics
targetallocatorDeploymentreadinesskube-systemama-metrics-operator-targets
config-readerDeploymentreadinesskube-systemama-metrics-operator-targets
autoscalerDeploymentreadinesskube-systemcoredns-autoscaler
autoscalerDeploymentreadinesskube-systemkonnectivity-agent-autoscaler
metrics-server-vpaDeploymentreadiness, livenesskube-systemmetrics-server
microsoft-defender-pod-collectorDeploymentreadiness, livenesskube-systemmicrosoft-defender-collector-misc
admission-controllerDeploymentreadiness, livenesskube-systemvpa-admission-controller
recommenderDeploymentreadiness, livenesskube-systemvpa-recommender
updaterDeploymentreadiness, livenesskube-systemvpa-updater
webserver-simpleDeploymentreadiness, livenesskubeviewsimple-deployment
webserver-simpleDeploymentreadiness, livenesslinkerdsimple-deployment
webserver-simpleDeploymentreadiness, livenessnginxsimple-deployment
webserver-simpleDeploymentreadiness, livenessprometheussimple-deployment
webserver-simpleDeploymentreadiness, livenesssealed-secretssimple-deployment
webserver-simpleDeploymentreadiness, livenesstestsimple-deployment
argocd-application-controllerStatefulSetlivenessargocdargocd-application-controller
split-brain-fixStatefulSetreadiness, livenessargocdargocd-redis-ha-server
rabbitmqStatefulSetreadiness, livenesspetsrabbitmq
node-driver-registrarDaemonSetreadinesskube-systemaks-secrets-store-csi-driver
secrets-storeDaemonSetreadinesskube-systemaks-secrets-store-csi-driver
liveness-probeDaemonSetreadiness, livenesskube-systemaks-secrets-store-csi-driver
node-driver-registrarDaemonSetreadinesskube-systemaks-secrets-store-csi-driver-windows
secrets-storeDaemonSetreadinesskube-systemaks-secrets-store-csi-driver-windows
liveness-probeDaemonSetreadiness, livenesskube-systemaks-secrets-store-csi-driver-windows
provider-azure-installerDaemonSetreadinesskube-systemaks-secrets-store-provider-azure
provider-azure-installerDaemonSetreadinesskube-systemaks-secrets-store-provider-azure-windows
ama-logsDaemonSetreadinesskube-systemama-logs
ama-logs-prometheusDaemonSetreadinesskube-systemama-logs
ama-logs-windowsDaemonSetreadinesskube-systemama-logs-windows
prometheus-collectorDaemonSetreadinesskube-systemama-metrics-node
addon-token-adapterDaemonSetreadinesskube-systemama-metrics-node
prometheus-collectorDaemonSetreadinesskube-systemama-metrics-win-node
addon-token-adapter-winDaemonSetreadinesskube-systemama-metrics-win-node
azure-ip-masq-agentDaemonSetreadiness, livenesskube-systemazure-ip-masq-agent
azure-npmDaemonSetreadiness, livenesskube-systemazure-npm
cloud-node-managerDaemonSetreadiness, livenesskube-systemcloud-node-manager
cloud-node-managerDaemonSetreadiness, livenesskube-systemcloud-node-manager-windows
kube-proxyDaemonSetreadiness, livenesskube-systemkube-proxy
microsoft-defender-pod-collectorDaemonSetreadiness, livenesskube-systemmicrosoft-defender-collector-ds
microsoft-defender-low-level-collectorDaemonSetreadiness, livenesskube-systemmicrosoft-defender-collector-ds
microsoft-defender-publisherDaemonSetreadiness, livenesskube-systemmicrosoft-defender-publisher-ds
retinaDaemonSetlivenesskube-systemretina-agent
retinawinDaemonSetreadiness, livenesskube-systemretina-agent-win
pauseDaemonSetreadiness, livenesskube-systemwindows-kube-proxy-initializer

WRK008 - Deployment Selector Without Matching Pods iDetects Deployments whose spec.selector does not match any existing Pods. This results in 0 replicas running.

✅ All Deployments are healthy.

Pods

POD001 - Pods with High Restarts iDetects pods that have restarted more than the defined threshold.

✅ All Pods are healthy.

POD002 - Long Running Pods iFlags pods that have been running longer than configured thresholds.

✅ All Pods are healthy.

POD003 - Failed Pods iDetects pods in a failed phase, typically due to startup errors, crashes, or misconfiguration.

✅ All Pods are healthy.

POD004 - Pending Pods iDetects pods stuck in a 'Pending' state due to scheduling or resource issues.

✅ All Pods are healthy.

POD005 - CrashLoopBackOff Pods iIdentifies pods stuck in a CrashLoopBackOff state due to repeated container crashes.

✅ All Pods are healthy.

POD006 - Leftover Debug Pods iDetects pods created by 'kubectl debug' that haven't been cleaned up.

✅ All Pods are healthy.

POD007 - Container images do not use latest tag iFlags containers using the 'latest' tag in their image, which can cause unpredictable upgrades.

⚠️ Total Pods with Issues: 3

Show Findings
Recommendations

🛠️ Use Specific Image Tags

  • Don't use the :latest tag in container images.
  • Why: It can pull different images on each deploy, leading to drift.
  • Fix: Tag images explicitly (e.g., :v1.2.3) and update the pod spec.
  • Docs: Kubernetes Image Tagging
MessageNamespaceResourceValue
Container image uses the 'latest' tag, which can lead to unpredictable deployments.petspod/order-service-6c5bfb6946-b58xqghcr.io/azure-samples/aks-store-demo/order-service:latest, mcr.microsoft.com/oss/istio/proxyv2:1.23.5-distroless
Container image uses the 'latest' tag, which can lead to unpredictable deployments.petspod/product-service-5dd87dfb8-ssfxcghcr.io/azure-samples/aks-store-demo/product-service:latest, mcr.microsoft.com/oss/istio/proxyv2:1.23.5-distroless
Container image uses the 'latest' tag, which can lead to unpredictable deployments.petspod/store-front-658994fd95-pk9qnghcr.io/azure-samples/aks-store-demo/store-front:latest, mcr.microsoft.com/oss/istio/proxyv2:1.23.5-distroless

Jobs

JOB001 - Stuck Kubernetes Jobs iFinds Jobs that have started but not completed within a threshold.

✅ All Jobs are healthy.

JOB002 - Failed Kubernetes Jobs iDetects jobs with failures and no successful completions.

✅ All Jobs are healthy.

Networking

NET001 - Services Without Endpoints iIdentifies services that have no backing endpoints, which means no pods are matched.

⚠️ Total Services with Issues: 1

Show Findings
Recommendations

🔍 Services Without Endpoints

  • Verify that your service has a valid selector.
  • Check if pods exist and are ready in the same namespace.
  • Use kubectl describe svc and kubectl get endpoints .
  • Restart affected pods or fix labels as needed.
MessageNamespaceResourceValue
No endpoints availablekube-systemservice/network-observabilitynetwork-observability

NET002 - Publicly Accessible Services iDetects services of type LoadBalancer or NodePort that are potentially exposed to the internet.

⚠️ Total Services with Issues: 4

Show Findings
Recommendations

🌐 Secure Exposed Services

  • Use internal IP ranges or private LoadBalancers where possible.
  • Restrict NodePort usage or protect with firewall rules.
  • Disable external exposure for internal-only services.
  • Consider network policies or service mesh for access control.
MessageNamespaceResourceValue
Exposed via external IP: 131.145.32.126aks-istio-ingressservice/aks-istio-ingressgateway-externalLoadBalancer
Exposed via external IP: 4.250.59.60app-routing-systemservice/nginxLoadBalancer
Exposed via external IP: 85.210.102.171petsservice/store-frontLoadBalancer
Exposed via NodePorttestservice/simple-serviceNodePort

NET003 - Ingress Health Validation iValidates ingress definitions for missing classes, invalid backends, missing TLS secrets, duplicate host/path entries, and incorrect path types.

✅ All Ingresses are healthy.

NET004 - Namespace Missing Network Policy iDetects namespaces that have running pods but no associated NetworkPolicy resources. This could allow unrestricted pod-to-pod communication.

⚠️ Total Namespaces with Issues: 16

Show Findings
Recommendations
  • Apply a default deny-all NetworkPolicy for ingress and egress.
  • Use additional policies to allow traffic between required pods/services.
IssueNamespacePods
No NetworkPolicy in active namespaceaks-istio-ingress2
No NetworkPolicy in active namespaceaks-istio-system2
No NetworkPolicy in active namespaceapp-routing-system2
No NetworkPolicy in active namespaceargo-rollouts1
No NetworkPolicy in active namespaceargo-workflows1
No NetworkPolicy in active namespacecert-manager1
No NetworkPolicy in active namespacegatekeeper-system3
No NetworkPolicy in active namespacegrafana1
No NetworkPolicy in active namespacekiali-operator2
No NetworkPolicy in active namespacekubeview1
No NetworkPolicy in active namespacelinkerd1
No NetworkPolicy in active namespacenginx1
No NetworkPolicy in active namespacepets4
No NetworkPolicy in active namespaceprometheus1
No NetworkPolicy in active namespacesealed-secrets1
No NetworkPolicy in active namespacetest1

Storage

PVC001 - Unused Persistent Volume Claims iDetects PVCs not attached to any pod.

✅ All PersistentVolumeClaims are healthy.

Configuration Hygiene

CFG001 - Orphaned ConfigMaps iDetects ConfigMaps that are not referenced by any pod, workload, service, or ingress.

⚠️ Total ConfigMaps with Issues: 19

Show Findings
Recommendations

🛠️ Clean Up Orphaned ConfigMaps

  • Verify: Check usage (kubectl describe cm ).
  • Delete: kubectl delete cm if unused.
  • Automation: Schedule periodic scans.
MessageNamespaceResource
ConfigMap is not used by any workloads or services.aks-istio-systemconfigmap/istio-asm-1-23
ConfigMap is not used by any workloads or services.aks-istio-systemconfigmap/istio-gateway-status-leader
ConfigMap is not used by any workloads or services.aks-istio-systemconfigmap/istio-leader
ConfigMap is not used by any workloads or services.aks-istio-systemconfigmap/istio-namespace-controller-election
ConfigMap is not used by any workloads or services.aks-istio-systemconfigmap/istio-sidecar-injector-asm-1-23
ConfigMap is not used by any workloads or services.app-routing-systemconfigmap/nginx
ConfigMap is not used by any workloads or services.argocdconfigmap/argocd-notifications-cm
ConfigMap is not used by any workloads or services.argocdconfigmap/argocd-rbac-cm
ConfigMap is not used by any workloads or services.kube-systemconfigmap/azure-ip-masq-agent-config-reconciled
ConfigMap is not used by any workloads or services.kube-systemconfigmap/cluster-autoscaler-status
ConfigMap is not used by any workloads or services.kube-systemconfigmap/container-azm-ms-aks-k8scluster
ConfigMap is not used by any workloads or services.kube-systemconfigmap/coredns-autoscaler
ConfigMap is not used by any workloads or services.kube-systemconfigmap/eraser-system-exclusion
ConfigMap is not used by any workloads or services.kube-systemconfigmap/extension-apiserver-authentication
ConfigMap is not used by any workloads or services.kube-systemconfigmap/extension-immutable-values
ConfigMap is not used by any workloads or services.kube-systemconfigmap/konnectivity-agent-autoscaler
ConfigMap is not used by any workloads or services.kube-systemconfigmap/kube-apiserver-legacy-service-account-token-tracking
ConfigMap is not used by any workloads or services.kube-systemconfigmap/overlay-upgrade-data
ConfigMap is not used by any workloads or services.kube-systemconfigmap/retina-config-win

CFG002 - Duplicate ConfigMap Names iDetects ConfigMaps with identical names across different namespaces.

⚠️ Total ConfigMaps with Issues: 2

Show Findings
Recommendations

🛠️ Fix Duplicate ConfigMap Names

  • Standardize: Use unique names or a naming convention that includes the environment or team name.
  • Audit: Periodically review ConfigMaps across namespaces for duplication.
  • Automation: Use policies or linting tools to catch duplicates pre-deploy.
MessageResource
Found in namespaces: 1, 10, 2, 3, 4, 5, 6, 7, 8, 9, aks-istio-egress, aks-istio-ingress, aks-istio-system, app-routing-system, argo-rollouts, argo-workflows, argocd, cert-manager, default, gatekeeper-system, grafana, kiali-operator, kube-system, kubeview, linkerd, nginx, pets, prometheus, sealed-secrets, testistio-ca-root-cert
Found in namespaces: 1, 10, 2, 3, 4, 5, 6, 7, 8, 9, aks-istio-egress, aks-istio-ingress, aks-istio-system, app-routing-system, argo-rollouts, argo-workflows, argocd, cert-manager, default, gatekeeper-system, grafana, kiali-operator, kube-node-lease, kube-public, kube-system, kubeview, linkerd, nginx, pets, prometheus, sealed-secrets, testkube-root-ca.crt

CFG003 - Large ConfigMaps iFinds ConfigMaps larger than 1 MiB, which may impact performance or exceed platform limits.

✅ All ConfigMaps are healthy.

Security

RBAC001 - RBAC Misconfigurations iDetects invalid roleRefs, missing roles, orphaned service accounts, and incorrect subject namespaces in RoleBindings and ClusterRoleBindings.

⚠️ Total ClusterRoleBindings with Issues: 10

Show Findings
Recommendations

🔐 RBAC Misconfiguration Fixes

  • Don't leave roleRef blank in bindings.
  • Use valid Roles/ClusterRoles that exist in the correct namespace.
  • Verify ServiceAccounts exist in the namespace specified.
  • Remove or correct subjects pointing to non-existent namespaces.
MessageNamespaceResourceValue
ServiceAccount not foundkube-systemRoleBinding/system::leader-locking-kube-controller-managerServiceAccount/kube-controller-manager
ServiceAccount not foundkube-systemRoleBinding/system::leader-locking-kube-schedulerServiceAccount/kube-scheduler
ServiceAccount not foundkube-systemRoleBinding/system:controller:cloud-providerServiceAccount/cloud-provider
ServiceAccount not foundaks-istio-systemClusterRoleBinding/istio-reader-clusterrole-asm-1-23-aks-istio-systemServiceAccount/istio-reader-service-account
ServiceAccount not foundkube-systemClusterRoleBinding/secretproviderrotation-rolebindingServiceAccount/secrets-store-csi-driver
ServiceAccount not foundkube-systemClusterRoleBinding/system:azure-cloud-providerServiceAccount/azure-cloud-provider
ServiceAccount not foundkube-systemClusterRoleBinding/system:azure-cloud-provider-secret-getterServiceAccount/azure-cloud-provider
ServiceAccount not foundkube-systemClusterRoleBinding/system:controller:route-controllerServiceAccount/route-controller
ServiceAccount not foundkube-systemClusterRoleBinding/system:controller:service-controllerServiceAccount/service-controller
ServiceAccount not foundkube-systemClusterRoleBinding/system:kube-dnsServiceAccount/kube-dns

RBAC002 - RBAC Overexposure iIdentifies dangerous RBAC grants such as cluster-admin, wildcard permissions, and sensitive resource access in roles and bindings.

⚠️ Total ClusterRoleBindings with Issues: 21

Show Findings
Recommendations

🔐 RBAC Hardening Tips

  • Avoid using cluster-admin directly in bindings.
  • Don’t assign Roles or ClusterRoles with wildcard verbs/resources/apiGroups.
  • Restrict access to sensitive resources like secrets or pods/exec.
  • Minimize privileges for default ServiceAccounts.
  • Document use of any built-in roles used in production.
MessageNamespaceResourceValue
cluster-admin binding (built-in)🌍 Cluster-WideClusterRoleBinding/aks-cluster-admin-bindingUser/clusterAdmin
cluster-admin binding (built-in)🌍 Cluster-WideClusterRoleBinding/aks-cluster-admin-bindingUser/clusterUser
cluster-admin binding (built-in)🌍 Cluster-WideClusterRoleBinding/aks-cluster-admin-binding-aadGroup/e591c663-c79c-47a4-94b8-f646b8647046
Access to sensitive resources🌍 Cluster-WideClusterRoleBinding/aks-secretprovidersyncing-rolebindingServiceAccount/aks-secrets-store-csi-driver
Access to sensitive resources🌍 Cluster-WideClusterRoleBinding/aks-service-rolebindingUser/aks-support
Wildcard permission role🌍 Cluster-WideClusterRoleBinding/argocd-application-controllerServiceAccount/argocd-application-controller
cluster-admin binding (built-in)🌍 Cluster-WideClusterRoleBinding/cluster-adminGroup/system:masters
cluster-admin binding (built-in)🌍 Cluster-WideClusterRoleBinding/extension-operatorServiceAccount/extension-operatorsa
Access to sensitive resources🌍 Cluster-WideClusterRoleBinding/kiali-operatorServiceAccount/kiali-operator
Access to sensitive resources (built-in)🌍 Cluster-WideClusterRoleBinding/system:controller:clusterrole-aggregation-controllerServiceAccount/clusterrole-aggregation-controller
Access to sensitive resources (built-in)🌍 Cluster-WideClusterRoleBinding/system:controller:legacy-service-account-token-cleanerServiceAccount/legacy-service-account-token-cleaner
Access to sensitive resources (built-in)🌍 Cluster-WideClusterRoleBinding/system:kube-controller-managerUser/system:kube-controller-manager
Access to sensitive resources (built-in)🌍 Cluster-WideClusterRoleBinding/system:kube-schedulerUser/system:kube-scheduler
Access to sensitive resources (built-in)🌍 Cluster-WideClusterRoleBinding/system:persistent-volume-bindingServiceAccount/persistent-volume-binder
Access to sensitive resourcesaks-istio-systemRoleBinding/istiod-asm-1-23ServiceAccount/istiod-asm-1-23
Access to sensitive resourcesargocdRoleBinding/argocd-redis-ha-haproxyServiceAccount/argocd-redis-ha-haproxy
Access to sensitive resourcesargocdRoleBinding/argocd-serverServiceAccount/argocd-server
Access to sensitive resourcesgatekeeper-systemRoleBinding/gatekeeper-manager-rolebindingServiceAccount/gatekeeper-admin
Access to sensitive resourceskube-systemRoleBinding/azure-policy-webhook-rolebindingServiceAccount/azure-policy-webhook-account
Access to sensitive resourceskube-systemRoleBinding/keda-operator-certsServiceAccount/keda-operator
Access to sensitive resourceskube-systemRoleBinding/system:controller:token-cleanerServiceAccount/token-cleaner

RBAC003 - Orphaned ServiceAccounts iFinds ServiceAccounts not used by any pods or referenced in RoleBindings or ClusterRoleBindings.

⚠️ Total ServiceAccounts with Issues: 20

Show Findings
Recommendations

🧾 Remove Orphaned ServiceAccounts

  • Audit ServiceAccounts not referenced in RoleBindings, ClusterRoleBindings, or used by Pods.
  • Delete those not actively used to reduce attack surface.
  • Consider automating SA cleanup with CI/CD or policy enforcement.
MessageNamespaceResourceValue
ServiceAccount not used by pods or RBAC bindings1serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings10serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings2serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings3serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings4serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings5serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings6serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings7serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings8serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindings9serviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsaks-istio-egressserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsaks-istio-ingressserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsaks-istio-systemserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsapp-routing-systemserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsargocdserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsdefaultserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingsgatekeeper-systemserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingskiali-operatorserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingskube-node-leaseserviceaccount/defaultdefault
ServiceAccount not used by pods or RBAC bindingskube-publicserviceaccount/defaultdefault

RBAC004 - Orphaned and Ineffective Roles iFlags Roles and ClusterRoles that are unused, lack subjects, or define no rules.

⚠️ Total Roles/ClusterRoles with Issues: 4

Show Findings
Recommendations

🗂️ Clean up Unused or Ineffective RBAC

  • Remove RoleBindings or ClusterRoleBindings without subjects.
  • Prune Roles and ClusterRoles not referenced by any bindings.
  • Remove roles with no defined rules unless planned for future use.
MessageNamespaceResourceValue
ClusterRoleBinding has no subjectscluster-wideclusterrolebinding/system:nodesystem:node
Unused ClusterRolecluster-wideclusterrole/aks-secretproviderclasses-admin-roleaks-secretproviderclasses-admin-role
Unused ClusterRolecluster-wideclusterrole/aks-secretproviderclasses-viewer-roleaks-secretproviderclasses-viewer-role
ClusterRole has no rulescluster-wideclusterrole/eraser-imagejob-pods-cluster-roleeraser-imagejob-pods-cluster-role

SEC001 - Orphaned Secrets iDetects Secrets not used by any workloads, ingresses, service accounts, or known custom resources.

⚠️ Total Secrets with Issues: 10

Show Findings
Recommendations

🔐 Orphaned Secrets Cleanup

  • Remove Secrets not referenced in Pods, Deployments, StatefulSets, or Ingresses.
  • Audit Secret content before deletion to avoid removing active credentials.
  • Validate Custom Resources don’t indirectly depend on these Secrets.
  • Regularly prune Secrets as part of security hygiene.
MessageNamespaceResourceValue
Secret appears unused across workloads, ingresses, service accounts, or CRsaks-istio-systemsecret/istio-ca-secretistio-ca-secret
Secret appears unused across workloads, ingresses, service accounts, or CRsargocdsecret/argocd-initial-admin-secretargocd-initial-admin-secret
Secret appears unused across workloads, ingresses, service accounts, or CRsargocdsecret/argocd-notifications-secretargocd-notifications-secret
Secret appears unused across workloads, ingresses, service accounts, or CRsargocdsecret/argocd-secretargocd-secret
Secret appears unused across workloads, ingresses, service accounts, or CRsargocdsecret/repo-1114886772repo-1114886772
Secret appears unused across workloads, ingresses, service accounts, or CRsargocdsecret/repo-1952242182repo-1952242182
Secret appears unused across workloads, ingresses, service accounts, or CRskube-systemsecret/aad-msi-auth-tokenaad-msi-auth-token
Secret appears unused across workloads, ingresses, service accounts, or CRskube-systemsecret/azure-policy-webhook-certazure-policy-webhook-cert
Secret appears unused across workloads, ingresses, service accounts, or CRskube-systemsecret/extensions-aad-msi-tokenextensions-aad-msi-token
Secret appears unused across workloads, ingresses, service accounts, or CRskube-systemsecret/omsagent-aad-msi-tokenomsagent-aad-msi-token

SEC002 - Pods using hostPID or hostNetwork iFlags pods that share the host's PID or network namespace, which can compromise isolation and node security.

⚠️ Total Pods with Issues: 36

Show Findings
Recommendations

⚠️ Avoid Host-Level Sharing

  • Set hostPID: false and hostNetwork: false unless needed for special workloads.
  • Review security implications of namespace sharing with the host.
  • Restrict use of these settings to trusted namespaces and workloads.
  • Consider using PSPs or OPA/Gatekeeper policies to prevent usage cluster-wide.
MessageNamespaceResourceValue
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-68nhwhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-7bqmnhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-7r458hostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-k9tdchostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-n952ghostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/aks-secrets-store-provider-azure-njpqhhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-4522jhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-4c7crhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-78rnwhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-84ltnhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-t4c2whostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-ip-masq-agent-vbdd8hostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-jsbbhhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-lp6sfhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-nv6xxhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-p6fpwhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-vsrfphostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/azure-npm-z8mczhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-57rk2hostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-gl5xlhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-l7v5jhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-lr49dhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-n5qdrhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/cloud-node-manager-xwrrdhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-26xkdhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-6mrqlhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-9rbxfhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-njzgkhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-rvmxlhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/kube-proxy-vp7xjhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-9g44dhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-d6wf4hostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-gj4r5hostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-rndzhhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-szgglhostPID=False, hostNetwork=True
Pod uses hostNetworkkube-systempod/retina-agent-t68m8hostPID=False, hostNetwork=True

SEC003 - Pods Running as Root iDetects pods running with UID 0 or no explicit runAsUser setting (defaults to root).

⚠️ Total Pods with Issues: 372

Show Findings
Recommendations

🔐 RunAsUser Hardening

  • Set runAsUser: non-zero UID at pod or container level.
  • Avoid relying on container defaults — define securityContext explicitly.
  • Use Pod Security Policies (PSPs) or Gatekeeper policies to enforce non-root UID usage.
  • Validate any custom base images that may default to root.
MessageNamespaceResourceValue
Container runs as root or has no runAsUser setaks-istio-ingresspod/aks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4Not Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-ingresspod/aks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4Not Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-ingresspod/aks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbNot Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-ingresspod/aks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbNot Set (Defaults to root)
Container discovery runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-9572mNot Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-9572mNot Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-9572mNot Set (Defaults to root)
Container discovery runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-rqzvtNot Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-rqzvtNot Set (Defaults to root)
Container runs as root or has no runAsUser setaks-istio-systempod/istiod-asm-1-23-7744d5fbf4-rqzvtNot Set (Defaults to root)
Container runs as root or has no runAsUser setapp-routing-systempod/nginx-69fcb489fd-4wgk9Not Set (Defaults to root)
Container runs as root or has no runAsUser setapp-routing-systempod/nginx-69fcb489fd-4wgk9Not Set (Defaults to root)
Container runs as root or has no runAsUser setapp-routing-systempod/nginx-69fcb489fd-64v6kNot Set (Defaults to root)
Container runs as root or has no runAsUser setapp-routing-systempod/nginx-69fcb489fd-64v6kNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setargo-rolloutspod/simple-deployment-74fd649f8d-996vtNot Set (Defaults to root)
Container runs as root or has no runAsUser setargo-rolloutspod/simple-deployment-74fd649f8d-996vtNot Set (Defaults to root)
Container runs as root or has no runAsUser setargo-rolloutspod/simple-deployment-74fd649f8d-996vtNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setargo-workflowspod/simple-deployment-74fd649f8d-24t56Not Set (Defaults to root)
Container runs as root or has no runAsUser setargo-workflowspod/simple-deployment-74fd649f8d-24t56Not Set (Defaults to root)
Container runs as root or has no runAsUser setargo-workflowspod/simple-deployment-74fd649f8d-24t56Not Set (Defaults to root)
Container argocd-application-controller runs as root or has no runAsUser setargocdpod/argocd-application-controller-0Not Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-application-controller-0Not Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-application-controller-0Not Set (Defaults to root)
Container argocd-applicationset-controller runs as root or has no runAsUser setargocdpod/argocd-applicationset-controller-6fdf84dbb6-msffzNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-applicationset-controller-6fdf84dbb6-msffzNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-applicationset-controller-6fdf84dbb6-msffzNot Set (Defaults to root)
Container dex runs as root or has no runAsUser setargocdpod/argocd-dex-server-556c76889-h4kxjNot Set (Defaults to root)
Container copyutil runs as root or has no runAsUser setargocdpod/argocd-dex-server-556c76889-h4kxjNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-dex-server-556c76889-h4kxjNot Set (Defaults to root)
Container argocd-notifications-controller runs as root or has no runAsUser setargocdpod/argocd-notifications-controller-6ff6bf8dd6-nbktrNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-notifications-controller-6ff6bf8dd6-nbktrNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-notifications-controller-6ff6bf8dd6-nbktrNot Set (Defaults to root)
Container argocd-repo-server runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-sx6ksNot Set (Defaults to root)
Container copyutil runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-sx6ksNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-sx6ksNot Set (Defaults to root)
Container argocd-repo-server runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-xrzznNot Set (Defaults to root)
Container copyutil runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-xrzznNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-repo-server-8568fc89b5-xrzznNot Set (Defaults to root)
Container argocd-server runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-2zqmxNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-2zqmxNot Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-2zqmxNot Set (Defaults to root)
Container argocd-server runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-zlzd5Not Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-zlzd5Not Set (Defaults to root)
Container runs as root or has no runAsUser setargocdpod/argocd-server-c5b86c885-zlzd5Not Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setcert-managerpod/simple-deployment-74fd649f8d-7cht8Not Set (Defaults to root)
Container runs as root or has no runAsUser setcert-managerpod/simple-deployment-74fd649f8d-7cht8Not Set (Defaults to root)
Container runs as root or has no runAsUser setcert-managerpod/simple-deployment-74fd649f8d-7cht8Not Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-audit-77858c8f69-7k782Not Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-audit-77858c8f69-7k782Not Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-controller-6f97954b4b-7tbnrNot Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-controller-6f97954b4b-7tbnrNot Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-controller-6f97954b4b-gwrggNot Set (Defaults to root)
Container runs as root or has no runAsUser setgatekeeper-systempod/gatekeeper-controller-6f97954b4b-gwrggNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setgrafanapod/simple-deployment-74fd649f8d-l7wrdNot Set (Defaults to root)
Container runs as root or has no runAsUser setgrafanapod/simple-deployment-74fd649f8d-l7wrdNot Set (Defaults to root)
Container runs as root or has no runAsUser setgrafanapod/simple-deployment-74fd649f8d-l7wrdNot Set (Defaults to root)
Container kiali runs as root or has no runAsUser setkiali-operatorpod/kiali-5b88cfb6f8-cm8dzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkiali-operatorpod/kiali-5b88cfb6f8-cm8dzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkiali-operatorpod/kiali-5b88cfb6f8-cm8dzNot Set (Defaults to root)
Container operator runs as root or has no runAsUser setkiali-operatorpod/kiali-operator-696bd54db-mr8mdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkiali-operatorpod/kiali-operator-696bd54db-mr8mdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkiali-operatorpod/kiali-operator-696bd54db-mr8mdNot Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-2l2wlNot Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-2l2wlNot Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-2l2wlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-2l2wlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-2l2wlNot Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-6w2vpNot Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-6w2vpNot Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-6w2vpNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-6w2vpNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-6w2vpNot Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-7879cNot Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-7879cNot Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-7879cNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-7879cNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-7879cNot Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-m8m29Not Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-m8m29Not Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-m8m29Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-m8m29Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-m8m29Not Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-vnmcdNot Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-vnmcdNot Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-vnmcdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-vnmcdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-vnmcdNot Set (Defaults to root)
Container node-driver-registrar runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-zrfbzNot Set (Defaults to root)
Container secrets-store runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-zrfbzNot Set (Defaults to root)
Container liveness-probe runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-zrfbzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-zrfbzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-csi-driver-zrfbzNot Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-68nhwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-68nhwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-68nhwNot Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7bqmnNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7bqmnNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7bqmnNot Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7r458Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7r458Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-7r458Not Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-k9tdcNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-k9tdcNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-k9tdcNot Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-n952gNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-n952gNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-n952gNot Set (Defaults to root)
Container provider-azure-installer runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-njpqhNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-njpqhNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/aks-secrets-store-provider-azure-njpqhNot Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-4v8mzNot Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-4v8mzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-4v8mzNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-4v8mzNot Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-5vr2wNot Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-5vr2wNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-5vr2wNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-5vr2wNot Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-fmd7bNot Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-fmd7bNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-fmd7bNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-fmd7bNot Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-fpkw6Not Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-fpkw6Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-fpkw6Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-fpkw6Not Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-gqs28Not Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-gqs28Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-gqs28Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-gqs28Not Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-ndxrwNot Set (Defaults to root)
Container ama-logs-prometheus runs as root or has no runAsUser setkube-systempod/ama-logs-ndxrwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-ndxrwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-ndxrwNot Set (Defaults to root)
Container ama-logs runs as root or has no runAsUser setkube-systempod/ama-logs-rs-64765bd4b9-ldxwlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-rs-64765bd4b9-ldxwlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-logs-rs-64765bd4b9-ldxwlNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-hlggbNot Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-hlggbNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-hlggbNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-hlggbNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-q2mlgNot Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-q2mlgNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-q2mlgNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-7f878d975f-q2mlgNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-2ssrwNot Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-2ssrwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-2ssrwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-2ssrwNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-6kkz8Not Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-6kkz8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-6kkz8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-6kkz8Not Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-9h44hNot Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-9h44hNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-9h44hNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-9h44hNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-lhk42Not Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-lhk42Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-lhk42Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-lhk42Not Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-nm5bfNot Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-nm5bfNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-nm5bfNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-nm5bfNot Set (Defaults to root)
Container prometheus-collector runs as root or has no runAsUser setkube-systempod/ama-metrics-node-pqcz5Not Set (Defaults to root)
Container addon-token-adapter runs as root or has no runAsUser setkube-systempod/ama-metrics-node-pqcz5Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-pqcz5Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-node-pqcz5Not Set (Defaults to root)
Container targetallocator runs as root or has no runAsUser setkube-systempod/ama-metrics-operator-targets-66fb46c8d6-vskdgNot Set (Defaults to root)
Container config-reader runs as root or has no runAsUser setkube-systempod/ama-metrics-operator-targets-66fb46c8d6-vskdgNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-operator-targets-66fb46c8d6-vskdgNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/ama-metrics-operator-targets-66fb46c8d6-vskdgNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4522jNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4522jNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4522jNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4c7crNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4c7crNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-4c7crNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-78rnwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-78rnwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-78rnwNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-84ltnNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-84ltnNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-84ltnNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-t4c2wNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-t4c2wNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-t4c2wNot Set (Defaults to root)
Container azure-ip-masq-agent runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-vbdd8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-vbdd8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-ip-masq-agent-vbdd8Not Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-jsbbhNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-jsbbhNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-jsbbhNot Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-lp6sfNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-lp6sfNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-lp6sfNot Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-nv6xxNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-nv6xxNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-nv6xxNot Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-p6fpwNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-p6fpwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-p6fpwNot Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-vsrfpNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-vsrfpNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-vsrfpNot Set (Defaults to root)
Container azure-npm runs as root or has no runAsUser setkube-systempod/azure-npm-z8mczNot Set (Defaults to root)
Container block-wireserver runs as root or has no runAsUser setkube-systempod/azure-npm-z8mczNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-npm-z8mczNot Set (Defaults to root)
Container azure-policy runs as root or has no runAsUser setkube-systempod/azure-policy-698f7c86b4-nnff2Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-policy-698f7c86b4-nnff2Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-policy-698f7c86b4-nnff2Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-policy-webhook-764fdf5cd5-6vrc5Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-policy-webhook-764fdf5cd5-6vrc5Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-wi-webhook-controller-manager-7f95f666d4-7r44bNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-wi-webhook-controller-manager-7f95f666d4-7r44bNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-wi-webhook-controller-manager-7f95f666d4-xfh2pNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/azure-wi-webhook-controller-manager-7f95f666d4-xfh2pNot Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-57rk2Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-57rk2Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-57rk2Not Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-gl5xlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-gl5xlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-gl5xlNot Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-l7v5jNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-l7v5jNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-l7v5jNot Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-lr49dNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-lr49dNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-lr49dNot Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-n5qdrNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-n5qdrNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-n5qdrNot Set (Defaults to root)
Container cloud-node-manager runs as root or has no runAsUser setkube-systempod/cloud-node-manager-xwrrdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-xwrrdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/cloud-node-manager-xwrrdNot Set (Defaults to root)
Container coredns runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-757xpNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-757xpNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-757xpNot Set (Defaults to root)
Container coredns runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-pt6l6Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-pt6l6Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-658d6d767d-pt6l6Not Set (Defaults to root)
Container autoscaler runs as root or has no runAsUser setkube-systempod/coredns-autoscaler-5955d6bbdb-mz9knNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-autoscaler-5955d6bbdb-mz9knNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/coredns-autoscaler-5955d6bbdb-mz9knNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/eraser-controller-manager-864f9476c8-lhdfcNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/eraser-controller-manager-864f9476c8-lhdfcNot Set (Defaults to root)
Container konnectivity-agent runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-fzm5qNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-fzm5qNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-fzm5qNot Set (Defaults to root)
Container konnectivity-agent runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-t9qdjNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-t9qdjNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-9f65c5cd8-t9qdjNot Set (Defaults to root)
Container autoscaler runs as root or has no runAsUser setkube-systempod/konnectivity-agent-autoscaler-cdfc7c46-vct7pNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-autoscaler-cdfc7c46-vct7pNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/konnectivity-agent-autoscaler-cdfc7c46-vct7pNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-26xkdNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-26xkdNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-26xkdNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-6mrqlNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-6mrqlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-6mrqlNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-9rbxfNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-9rbxfNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-9rbxfNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-njzgkNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-njzgkNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-njzgkNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-rvmxlNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-rvmxlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-rvmxlNot Set (Defaults to root)
Container kube-proxy runs as root or has no runAsUser setkube-systempod/kube-proxy-vp7xjNot Set (Defaults to root)
Container kube-proxy-bootstrap runs as root or has no runAsUser setkube-systempod/kube-proxy-vp7xjNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/kube-proxy-vp7xjNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/metrics-server-5f9ccffcc4-jsrjlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/metrics-server-5f9ccffcc4-jsrjlNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/metrics-server-5f9ccffcc4-v88pwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/metrics-server-5f9ccffcc4-v88pwNot Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-6xdfqNot Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-6xdfqNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-6xdfqNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-6xdfqNot Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-89l74Not Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-89l74Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-89l74Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-89l74Not Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-d7gwkNot Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-d7gwkNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-d7gwkNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-d7gwkNot Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-mdcs8Not Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-mdcs8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-mdcs8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-mdcs8Not Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-q6d6cNot Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-q6d6cNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-q6d6cNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-q6d6cNot Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-wb5dmNot Set (Defaults to root)
Container microsoft-defender-low-level-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-wb5dmNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-wb5dmNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-ds-wb5dmNot Set (Defaults to root)
Container microsoft-defender-pod-collector runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-misc-7df6776447-bcbphNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-misc-7df6776447-bcbphNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-collector-misc-7df6776447-bcbphNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2ql5bNot Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2ql5bNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2ql5bNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2rsrwNot Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2rsrwNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-2rsrwNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-jj6dhNot Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-jj6dhNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-jj6dhNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-l5crsNot Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-l5crsNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-l5crsNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-lfk8hNot Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-lfk8hNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-lfk8hNot Set (Defaults to root)
Container microsoft-defender-publisher runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-vz2c6Not Set (Defaults to root)
Container old-file-cleaner runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-vz2c6Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/microsoft-defender-publisher-ds-vz2c6Not Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-9g44dNot Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-9g44dNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-9g44dNot Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-d6wf4Not Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-d6wf4Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-d6wf4Not Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-gj4r5Not Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-gj4r5Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-gj4r5Not Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-rndzhNot Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-rndzhNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-rndzhNot Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-szgglNot Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-szgglNot Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-szgglNot Set (Defaults to root)
Container retina runs as root or has no runAsUser setkube-systempod/retina-agent-t68m8Not Set (Defaults to root)
Container retina-agent-init runs as root or has no runAsUser setkube-systempod/retina-agent-t68m8Not Set (Defaults to root)
Container runs as root or has no runAsUser setkube-systempod/retina-agent-t68m8Not Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setkubeviewpod/simple-deployment-74fd649f8d-qxp2rNot Set (Defaults to root)
Container runs as root or has no runAsUser setkubeviewpod/simple-deployment-74fd649f8d-qxp2rNot Set (Defaults to root)
Container runs as root or has no runAsUser setkubeviewpod/simple-deployment-74fd649f8d-qxp2rNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setlinkerdpod/simple-deployment-74fd649f8d-mkmstNot Set (Defaults to root)
Container runs as root or has no runAsUser setlinkerdpod/simple-deployment-74fd649f8d-mkmstNot Set (Defaults to root)
Container runs as root or has no runAsUser setlinkerdpod/simple-deployment-74fd649f8d-mkmstNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setnginxpod/simple-deployment-74fd649f8d-hlcdkNot Set (Defaults to root)
Container runs as root or has no runAsUser setnginxpod/simple-deployment-74fd649f8d-hlcdkNot Set (Defaults to root)
Container runs as root or has no runAsUser setnginxpod/simple-deployment-74fd649f8d-hlcdkNot Set (Defaults to root)
Container order-service runs as root or has no runAsUser setpetspod/order-service-6c5bfb6946-b58xqNot Set (Defaults to root)
Container wait-for-rabbitmq runs as root or has no runAsUser setpetspod/order-service-6c5bfb6946-b58xqNot Set (Defaults to root)
Container istio-init runs as root or has no runAsUser setpetspod/order-service-6c5bfb6946-b58xqNot Set (Defaults to root)
Container runs as root or has no runAsUser setpetspod/order-service-6c5bfb6946-b58xqNot Set (Defaults to root)
Container product-service runs as root or has no runAsUser setpetspod/product-service-5dd87dfb8-ssfxcNot Set (Defaults to root)
Container istio-init runs as root or has no runAsUser setpetspod/product-service-5dd87dfb8-ssfxcNot Set (Defaults to root)
Container runs as root or has no runAsUser setpetspod/product-service-5dd87dfb8-ssfxcNot Set (Defaults to root)
Container rabbitmq runs as root or has no runAsUser setpetspod/rabbitmq-0Not Set (Defaults to root)
Container istio-init runs as root or has no runAsUser setpetspod/rabbitmq-0Not Set (Defaults to root)
Container runs as root or has no runAsUser setpetspod/rabbitmq-0Not Set (Defaults to root)
Container store-front runs as root or has no runAsUser setpetspod/store-front-658994fd95-pk9qnNot Set (Defaults to root)
Container istio-init runs as root or has no runAsUser setpetspod/store-front-658994fd95-pk9qnNot Set (Defaults to root)
Container runs as root or has no runAsUser setpetspod/store-front-658994fd95-pk9qnNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setprometheuspod/simple-deployment-74fd649f8d-2x6w5Not Set (Defaults to root)
Container runs as root or has no runAsUser setprometheuspod/simple-deployment-74fd649f8d-2x6w5Not Set (Defaults to root)
Container runs as root or has no runAsUser setprometheuspod/simple-deployment-74fd649f8d-2x6w5Not Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser setsealed-secretspod/simple-deployment-74fd649f8d-stktpNot Set (Defaults to root)
Container runs as root or has no runAsUser setsealed-secretspod/simple-deployment-74fd649f8d-stktpNot Set (Defaults to root)
Container runs as root or has no runAsUser setsealed-secretspod/simple-deployment-74fd649f8d-stktpNot Set (Defaults to root)
Container webserver-simple runs as root or has no runAsUser settestpod/simple-deployment-74fd649f8d-lhlkxNot Set (Defaults to root)
Container runs as root or has no runAsUser settestpod/simple-deployment-74fd649f8d-lhlkxNot Set (Defaults to root)
Container runs as root or has no runAsUser settestpod/simple-deployment-74fd649f8d-lhlkxNot Set (Defaults to root)

SEC004 - Privileged Containers iDetects containers running with privileged mode enabled.

⚠️ Total Pods with Issues: 37

Show Findings
Recommendations

🚫 Disable Privileged Containers

  • Remove securityContext.privileged: true from container specs.
  • Refactor workloads to avoid needing host-level access.
  • Enforce restrictions using Pod Security Policies or OPA/Gatekeeper.
  • Limit use to dedicated namespaces with strict controls.
MessageNamespaceResourceValue
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-2l2wlprivileged=true
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-6w2vpprivileged=true
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-7879cprivileged=true
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-m8m29privileged=true
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-vnmcdprivileged=true
Container 'secrets-store' is running in privileged modekube-systempod/aks-secrets-store-csi-driver-zrfbzprivileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-4v8mzprivileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-4v8mzprivileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-5vr2wprivileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-5vr2wprivileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-fmd7bprivileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-fmd7bprivileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-fpkw6privileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-fpkw6privileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-gqs28privileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-gqs28privileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-ndxrwprivileged=true
Container 'ama-logs-prometheus' is running in privileged modekube-systempod/ama-logs-ndxrwprivileged=true
Container 'ama-logs' is running in privileged modekube-systempod/ama-logs-rs-64765bd4b9-ldxwlprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-26xkdprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-26xkdprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-6mrqlprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-6mrqlprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-9rbxfprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-9rbxfprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-njzgkprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-njzgkprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-rvmxlprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-rvmxlprivileged=true
Container 'kube-proxy' is running in privileged modekube-systempod/kube-proxy-vp7xjprivileged=true
Container 'kube-proxy-bootstrap' is running in privileged modekube-systempod/kube-proxy-vp7xjprivileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-9g44dprivileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-d6wf4privileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-gj4r5privileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-rndzhprivileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-szgglprivileged=true
Container 'retina-agent-init' is running in privileged modekube-systempod/retina-agent-t68m8privileged=true

SEC005 - Pods Using hostIPC iDetects pods that use hostIPC, which can compromise pod isolation and allow access to shared memory on the host.

✅ All Pods are healthy.

SEC006 - Pods Missing Secure Defaults iChecks if pods are missing recommended securityContext fields such as runAsNonRoot, readOnlyRootFilesystem, or allowPrivilegeEscalation.

⚠️ Total Pods with Issues: 151

Show Findings
Recommendations
  • Set securityContext.runAsNonRoot: true
  • Set securityContext.readOnlyRootFilesystem: true
  • Set securityContext.allowPrivilegeEscalation: false
ContainerFlagsIssueNamespacePod
controllerrunAsNonRoot: True, readOnlyRootFilesystem: , allowPrivilegeEscalation: FalseMissing one or more secure defaultsapp-routing-systemnginx-69fcb489fd-4wgk9
controllerrunAsNonRoot: True, readOnlyRootFilesystem: , allowPrivilegeEscalation: FalseMissing one or more secure defaultsapp-routing-systemnginx-69fcb489fd-64v6k
webserver-simpleMissing securityContextNo securityContext definedargo-rolloutssimple-deployment-74fd649f8d-996vt
webserver-simpleMissing securityContextNo securityContext definedargo-workflowssimple-deployment-74fd649f8d-24t56
argocd-notifications-controllerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-notifications-controller-6ff6bf8dd6-nbktr
haproxyrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-haproxy-fb657456c-kjbkq
haproxyrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-haproxy-fb657456c-kjlpf
haproxyrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-haproxy-fb657456c-tnjmb
redisrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-0
sentinelrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-0
split-brain-fixrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-0
redisrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-1
sentinelrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-1
split-brain-fixrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-1
redisrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-2
sentinelrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-2
split-brain-fixrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultsargocdargocd-redis-ha-server-2
webserver-simpleMissing securityContextNo securityContext definedcert-managersimple-deployment-74fd649f8d-7cht8
webserver-simpleMissing securityContextNo securityContext definedgrafanasimple-deployment-74fd649f8d-l7wrd
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-2l2wl
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-2l2wl
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-2l2wl
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-6w2vp
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-6w2vp
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-6w2vp
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-7879c
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-7879c
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-7879c
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-m8m29
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-m8m29
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-m8m29
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-vnmcd
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-vnmcd
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-vnmcd
node-driver-registrarMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-zrfbz
secrets-storerunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-csi-driver-zrfbz
liveness-probeMissing securityContextNo securityContext definedkube-systemaks-secrets-store-csi-driver-zrfbz
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-68nhw
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-7bqmn
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-7r458
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-k9tdc
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-n952g
provider-azure-installerrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemaks-secrets-store-provider-azure-njpqh
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-4v8mz
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-4v8mz
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-5vr2w
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-5vr2w
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-fmd7b
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-fmd7b
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-fpkw6
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-fpkw6
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-gqs28
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-gqs28
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-ndxrw
ama-logs-prometheusrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-ndxrw
ama-logsrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-logs-rs-64765bd4b9-ldxwl
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-7f878d975f-hlggb
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-7f878d975f-hlggb
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-7f878d975f-q2mlg
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-7f878d975f-q2mlg
ama-metrics-ksmrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-ksm-5bd68b9c-8l9lp
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-2ssrw
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-2ssrw
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-6kkz8
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-6kkz8
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-9h44h
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-9h44h
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-lhk42
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-lhk42
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-nm5bf
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-nm5bf
prometheus-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-pqcz5
addon-token-adapterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-node-pqcz5
targetallocatorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-operator-targets-66fb46c8d6-vskdg
config-readerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemama-metrics-operator-targets-66fb46c8d6-vskdg
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-4522j
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-4c7cr
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-78rnw
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-84ltn
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-t4c2w
azure-ip-masq-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-ip-masq-agent-vbdd8
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-jsbbh
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-lp6sf
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-nv6xx
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-p6fpw
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-vsrfp
azure-npmrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: Missing one or more secure defaultskube-systemazure-npm-z8mcz
azure-policyrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemazure-policy-698f7c86b4-nnff2
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-57rk2
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-gl5xl
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-l7v5j
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-lr49d
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-n5qdr
cloud-node-managerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcloud-node-manager-xwrrd
corednsrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemcoredns-658d6d767d-757xp
corednsrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemcoredns-658d6d767d-pt6l6
autoscalerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemcoredns-autoscaler-5955d6bbdb-mz9kn
keda-admission-webhooksrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-admission-webhooks-787f866c7c-4b64k
keda-admission-webhooksrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-admission-webhooks-787f866c7c-dw2sg
keda-operatorrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-operator-6b85944bfb-4zpbp
keda-operatorrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-operator-6b85944bfb-sx9sj
keda-operator-metrics-apiserverrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-operator-metrics-apiserver-8468875db7-86c5h
keda-operator-metrics-apiserverrunAsNonRoot: , readOnlyRootFilesystem: True, allowPrivilegeEscalation: FalseMissing one or more secure defaultskube-systemkeda-operator-metrics-apiserver-8468875db7-ngp4h
konnectivity-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkonnectivity-agent-9f65c5cd8-fzm5q
konnectivity-agentrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkonnectivity-agent-9f65c5cd8-t9qdj
autoscalerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkonnectivity-agent-autoscaler-cdfc7c46-vct7p
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-26xkd
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-6mrql
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-9rbxf
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-njzgk
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-rvmxl
kube-proxyrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemkube-proxy-vp7xj
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-6xdfq
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-6xdfq
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-89l74
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-89l74
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-d7gwk
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-d7gwk
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-mdcs8
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-mdcs8
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-q6d6c
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-q6d6c
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-wb5dm
microsoft-defender-low-level-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-ds-wb5dm
microsoft-defender-pod-collectorrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-collector-misc-7df6776447-bcbph
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-2ql5b
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-2rsrw
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-jj6dh
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-l5crs
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-lfk8h
microsoft-defender-publisherrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemmicrosoft-defender-publisher-ds-vz2c6
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-9g44d
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-d6wf4
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-gj4r5
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-rndzh
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-szggl
retinarunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemretina-agent-t68m8
admission-controllerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemvpa-admission-controller-7d9f8d57bd-lrcch
admission-controllerrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemvpa-admission-controller-7d9f8d57bd-tnqvx
recommenderrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemvpa-recommender-74bfff7f75-sspdc
updaterrunAsNonRoot: , readOnlyRootFilesystem: , allowPrivilegeEscalation: Missing one or more secure defaultskube-systemvpa-updater-5d6d49f8b6-pxkz8
webserver-simpleMissing securityContextNo securityContext definedkubeviewsimple-deployment-74fd649f8d-qxp2r
webserver-simpleMissing securityContextNo securityContext definedlinkerdsimple-deployment-74fd649f8d-mkmst
webserver-simpleMissing securityContextNo securityContext definednginxsimple-deployment-74fd649f8d-hlcdk
order-serviceMissing securityContextNo securityContext definedpetsorder-service-6c5bfb6946-b58xq
product-serviceMissing securityContextNo securityContext definedpetsproduct-service-5dd87dfb8-ssfxc
rabbitmqMissing securityContextNo securityContext definedpetsrabbitmq-0
store-frontMissing securityContextNo securityContext definedpetsstore-front-658994fd95-pk9qn
webserver-simpleMissing securityContextNo securityContext definedprometheussimple-deployment-74fd649f8d-2x6w5
webserver-simpleMissing securityContextNo securityContext definedsealed-secretssimple-deployment-74fd649f8d-stktp
webserver-simpleMissing securityContextNo securityContext definedtestsimple-deployment-74fd649f8d-lhlkx

SEC007 - Missing Pod Security Admission Labels iChecks if namespaces are missing the 'pod-security.kubernetes.io/enforce' label required for Pod Security Admission enforcement.

⚠️ Total Namespaces with Issues: 32

Show Findings
Recommendations
  • Set pod-security.kubernetes.io/enforce=restricted on sensitive namespaces.
  • Optionally use enforce-version and audit labels.
AuditIssueNamespaceWarn
N/ANo pod security labels1N/A
N/ANo pod security labels10N/A
N/ANo pod security labels2N/A
N/ANo pod security labels3N/A
N/ANo pod security labels4N/A
N/ANo pod security labels5N/A
N/ANo pod security labels6N/A
N/ANo pod security labels7N/A
N/ANo pod security labels8N/A
N/ANo pod security labels9N/A
N/ANo pod security labelsaks-istio-egressN/A
N/ANo pod security labelsaks-istio-ingressN/A
N/ANo pod security labelsaks-istio-systemN/A
N/ANo pod security labelsapp-routing-systemN/A
N/ANo pod security labelsargo-rolloutsN/A
N/ANo pod security labelsargo-workflowsN/A
N/ANo pod security labelsargocdN/A
N/ANo pod security labelscert-managerN/A
N/ANo pod security labelsdefaultN/A
N/ANo pod security labelsgatekeeper-systemN/A
N/ANo pod security labelsgrafanaN/A
N/ANo pod security labelskiali-operatorN/A
N/ANo pod security labelskube-node-leaseN/A
N/ANo pod security labelskube-publicN/A
N/ANo pod security labelskube-systemN/A
N/ANo pod security labelskubeviewN/A
N/ANo pod security labelslinkerdN/A
N/ANo pod security labelsnginxN/A
N/ANo pod security labelspetsN/A
N/ANo pod security labelsprometheusN/A
N/ANo pod security labelssealed-secretsN/A
N/ANo pod security labelstestN/A

SEC008 - Secrets in Environment Variables iDetects secrets injected into pods via environment variables using env.valueFrom.secretKeyRef. `n This makes secrets easier to leak through logs or /proc inspection.

⚠️ Total Pods with Issues: 20

Show Findings
Recommendations
  • Use secret volumes instead of env vars to reduce accidental exposure.
  • Avoid using valueFrom.secretKeyRef in env.
  • Limit permissions to read secrets.
EnvVarIssueNamespacePod
env: REDIS_PASSWORDSecret argocd-redis exposed via env var in container argocd-application-controllerargocdpod/argocd-application-controller-0
env: AUTHSecret argocd-redis exposed via env var in container haproxyargocdpod/argocd-redis-ha-haproxy-fb657456c-kjbkq
env: AUTHSecret argocd-redis exposed via env var in container haproxyargocdpod/argocd-redis-ha-haproxy-fb657456c-kjlpf
env: AUTHSecret argocd-redis exposed via env var in container haproxyargocdpod/argocd-redis-ha-haproxy-fb657456c-tnjmb
env: AUTHSecret argocd-redis exposed via env var in container redisargocdpod/argocd-redis-ha-server-0
env: AUTHSecret argocd-redis exposed via env var in container sentinelargocdpod/argocd-redis-ha-server-0
env: AUTHSecret argocd-redis exposed via env var in container split-brain-fixargocdpod/argocd-redis-ha-server-0
env: AUTHSecret argocd-redis exposed via env var in container config-initargocdpod/argocd-redis-ha-server-0
env: AUTHSecret argocd-redis exposed via env var in container redisargocdpod/argocd-redis-ha-server-1
env: AUTHSecret argocd-redis exposed via env var in container sentinelargocdpod/argocd-redis-ha-server-1
env: AUTHSecret argocd-redis exposed via env var in container split-brain-fixargocdpod/argocd-redis-ha-server-1
env: AUTHSecret argocd-redis exposed via env var in container config-initargocdpod/argocd-redis-ha-server-1
env: AUTHSecret argocd-redis exposed via env var in container redisargocdpod/argocd-redis-ha-server-2
env: AUTHSecret argocd-redis exposed via env var in container sentinelargocdpod/argocd-redis-ha-server-2
env: AUTHSecret argocd-redis exposed via env var in container split-brain-fixargocdpod/argocd-redis-ha-server-2
env: AUTHSecret argocd-redis exposed via env var in container config-initargocdpod/argocd-redis-ha-server-2
env: REDIS_PASSWORDSecret argocd-redis exposed via env var in container argocd-repo-serverargocdpod/argocd-repo-server-8568fc89b5-sx6ks
env: REDIS_PASSWORDSecret argocd-redis exposed via env var in container argocd-repo-serverargocdpod/argocd-repo-server-8568fc89b5-xrzzn
env: REDIS_PASSWORDSecret argocd-redis exposed via env var in container argocd-serverargocdpod/argocd-server-c5b86c885-2zqmx
env: REDIS_PASSWORDSecret argocd-redis exposed via env var in container argocd-serverargocdpod/argocd-server-c5b86c885-zlzd5

SEC009 - Missing Capabilities Drop iChecks containers that don't drop all Linux capabilities via securityContext.capabilities.drop = ['ALL'].

⚠️ Total Pods with Issues: 38

Show Findings
Recommendations
  • Set securityContext.capabilities.drop: ['ALL'] in container spec.
  • Allow only required capabilities via add list, if any.
ContainerIssueNamespacePod
webserver-simpleDoes not drop ALL capabilitiesargo-rolloutssimple-deployment-74fd649f8d-996vt
webserver-simpleDoes not drop ALL capabilitiesargo-workflowssimple-deployment-74fd649f8d-24t56
webserver-simpleDoes not drop ALL capabilitiescert-managersimple-deployment-74fd649f8d-7cht8
webserver-simpleDoes not drop ALL capabilitiesgrafanasimple-deployment-74fd649f8d-l7wrd
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-2l2wl
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-2l2wl
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-2l2wl
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-6w2vp
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-6w2vp
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-6w2vp
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-7879c
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-7879c
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-7879c
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-m8m29
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-m8m29
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-m8m29
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-vnmcd
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-vnmcd
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-vnmcd
node-driver-registrarDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-zrfbz
secrets-storeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-zrfbz
liveness-probeDoes not drop ALL capabilitieskube-systemaks-secrets-store-csi-driver-zrfbz
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-26xkd
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-6mrql
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-9rbxf
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-njzgk
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-rvmxl
kube-proxyDoes not drop ALL capabilitieskube-systemkube-proxy-vp7xj
webserver-simpleDoes not drop ALL capabilitieskubeviewsimple-deployment-74fd649f8d-qxp2r
webserver-simpleDoes not drop ALL capabilitieslinkerdsimple-deployment-74fd649f8d-mkmst
webserver-simpleDoes not drop ALL capabilitiesnginxsimple-deployment-74fd649f8d-hlcdk
order-serviceDoes not drop ALL capabilitiespetsorder-service-6c5bfb6946-b58xq
product-serviceDoes not drop ALL capabilitiespetsproduct-service-5dd87dfb8-ssfxc
rabbitmqDoes not drop ALL capabilitiespetsrabbitmq-0
store-frontDoes not drop ALL capabilitiespetsstore-front-658994fd95-pk9qn
webserver-simpleDoes not drop ALL capabilitiesprometheussimple-deployment-74fd649f8d-2x6w5
webserver-simpleDoes not drop ALL capabilitiessealed-secretssimple-deployment-74fd649f8d-stktp
webserver-simpleDoes not drop ALL capabilitiestestsimple-deployment-74fd649f8d-lhlkx

SEC010 - HostPath Volume Usage iFlags pods that use hostPath volumes, which mount parts of the host filesystem. This bypasses isolation and can be dangerous if misused.

⚠️ Total Pods with Issues: 303

Show Findings
Recommendations
  • Remove hostPath volumes unless needed for host-level access.
  • Consider alternatives like persistent volume claims or configMaps.
IssueNamespacePathPodVolume
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-2l2wlmountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-2l2wlregistration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-2l2wlplugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-2l2wlproviders-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-2l2wlproviders-dir-0
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-6w2vpmountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-6w2vpregistration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-6w2vpplugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-6w2vpproviders-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-6w2vpproviders-dir-0
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-7879cmountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-7879cregistration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-7879cplugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-7879cproviders-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-7879cproviders-dir-0
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-m8m29mountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-m8m29registration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-m8m29plugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-m8m29providers-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-m8m29providers-dir-0
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-vnmcdmountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-vnmcdregistration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-vnmcdplugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-vnmcdproviders-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-vnmcdproviders-dir-0
hostPath volume usedkube-system/var/lib/kubelet/podsaks-secrets-store-csi-driver-zrfbzmountpoint-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins_registry/aks-secrets-store-csi-driver-zrfbzregistration-dir
hostPath volume usedkube-system/var/lib/kubelet/plugins/csi-secrets-store/aks-secrets-store-csi-driver-zrfbzplugin-dir
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-csi-driver-zrfbzproviders-dir
hostPath volume usedkube-system/etc/kubernetes/secrets-store-csi-providersaks-secrets-store-csi-driver-zrfbzproviders-dir-0
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-68nhwprovider-vol
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-7bqmnprovider-vol
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-7r458provider-vol
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-k9tdcprovider-vol
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-n952gprovider-vol
hostPath volume usedkube-system/var/run/secrets-store-csi-providersaks-secrets-store-provider-azure-njpqhprovider-vol
hostPath volume usedkube-system/ama-logs-4v8mzhost-root
hostPath volume usedkube-system/etc/hostnameama-logs-4v8mzcontainer-hostname
hostPath volume usedkube-system/var/logama-logs-4v8mzhost-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-4v8mzmdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-4v8mzcontainerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-4v8mzcontainerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-4v8mzcontainerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-4v8mzazure-json-path
hostPath volume usedkube-system/ama-logs-5vr2whost-root
hostPath volume usedkube-system/etc/hostnameama-logs-5vr2wcontainer-hostname
hostPath volume usedkube-system/var/logama-logs-5vr2whost-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-5vr2wmdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-5vr2wcontainerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-5vr2wcontainerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-5vr2wcontainerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-5vr2wazure-json-path
hostPath volume usedkube-system/ama-logs-fmd7bhost-root
hostPath volume usedkube-system/etc/hostnameama-logs-fmd7bcontainer-hostname
hostPath volume usedkube-system/var/logama-logs-fmd7bhost-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-fmd7bmdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-fmd7bcontainerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-fmd7bcontainerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-fmd7bcontainerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-fmd7bazure-json-path
hostPath volume usedkube-system/ama-logs-fpkw6host-root
hostPath volume usedkube-system/etc/hostnameama-logs-fpkw6container-hostname
hostPath volume usedkube-system/var/logama-logs-fpkw6host-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-fpkw6mdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-fpkw6containerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-fpkw6containerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-fpkw6containerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-fpkw6azure-json-path
hostPath volume usedkube-system/ama-logs-gqs28host-root
hostPath volume usedkube-system/etc/hostnameama-logs-gqs28container-hostname
hostPath volume usedkube-system/var/logama-logs-gqs28host-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-gqs28mdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-gqs28containerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-gqs28containerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-gqs28containerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-gqs28azure-json-path
hostPath volume usedkube-system/ama-logs-ndxrwhost-root
hostPath volume usedkube-system/etc/hostnameama-logs-ndxrwcontainer-hostname
hostPath volume usedkube-system/var/logama-logs-ndxrwhost-log
hostPath volume usedkube-system/var/run/mdsd-ciama-logs-ndxrwmdsd-sock
hostPath volume usedkube-system/var/lib/docker/containersama-logs-ndxrwcontainerlog-path
hostPath volume usedkube-system/mnt/dockerama-logs-ndxrwcontainerlog-path-2
hostPath volume usedkube-system/mnt/containersama-logs-ndxrwcontainerlog-path-3
hostPath volume usedkube-system/etc/kubernetesama-logs-ndxrwazure-json-path
hostPath volume usedkube-system/etc/hostnameama-logs-rs-64765bd4b9-ldxwlcontainer-hostname
hostPath volume usedkube-system/var/logama-logs-rs-64765bd4b9-ldxwlhost-log
hostPath volume usedkube-system/etc/kubernetesama-logs-rs-64765bd4b9-ldxwlazure-json-path
hostPath volume usedkube-system/var/log/containersama-metrics-7f878d975f-hlggbhost-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-7f878d975f-hlggbhost-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-7f878d975f-hlggbanchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-7f878d975f-hlggbanchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-7f878d975f-q2mlghost-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-7f878d975f-q2mlghost-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-7f878d975f-q2mlganchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-7f878d975f-q2mlganchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-2ssrwhost-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-2ssrwhost-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-2ssrwanchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-2ssrwanchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-6kkz8host-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-6kkz8host-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-6kkz8anchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-6kkz8anchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-9h44hhost-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-9h44hhost-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-9h44hanchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-9h44hanchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-lhk42host-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-lhk42host-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-lhk42anchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-lhk42anchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-nm5bfhost-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-nm5bfhost-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-nm5bfanchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-nm5bfanchors-ubuntu
hostPath volume usedkube-system/var/log/containersama-metrics-node-pqcz5host-log-containers
hostPath volume usedkube-system/var/log/podsama-metrics-node-pqcz5host-log-pods
hostPath volume usedkube-system/etc/pki/ca-trust/anchors/ama-metrics-node-pqcz5anchors-mariner
hostPath volume usedkube-system/usr/local/share/ca-certificates/ama-metrics-node-pqcz5anchors-ubuntu
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-4522jiptableslock
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-4c7criptableslock
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-78rnwiptableslock
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-84ltniptableslock
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-t4c2wiptableslock
hostPath volume usedkube-system/run/xtables.lockazure-ip-masq-agent-vbdd8iptableslock
hostPath volume usedkube-system/var/logazure-npm-jsbbhlog
hostPath volume usedkube-system/run/xtables.lockazure-npm-jsbbhxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-jsbbhprotocols
hostPath volume usedkube-system/var/logazure-npm-lp6sflog
hostPath volume usedkube-system/run/xtables.lockazure-npm-lp6sfxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-lp6sfprotocols
hostPath volume usedkube-system/var/logazure-npm-nv6xxlog
hostPath volume usedkube-system/run/xtables.lockazure-npm-nv6xxxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-nv6xxprotocols
hostPath volume usedkube-system/var/logazure-npm-p6fpwlog
hostPath volume usedkube-system/run/xtables.lockazure-npm-p6fpwxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-p6fpwprotocols
hostPath volume usedkube-system/var/logazure-npm-vsrfplog
hostPath volume usedkube-system/run/xtables.lockazure-npm-vsrfpxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-vsrfpprotocols
hostPath volume usedkube-system/var/logazure-npm-z8mczlog
hostPath volume usedkube-system/run/xtables.lockazure-npm-z8mczxtables-lock
hostPath volume usedkube-system/etc/protocolsazure-npm-z8mczprotocols
hostPath volume usedkube-system/etc/kubernetes/azure.jsonazure-policy-698f7c86b4-nnff2acs-credential
hostPath volume usedkube-system/etc/ssl/certsazure-policy-698f7c86b4-nnff2ca-certs
hostPath volume usedkube-system/etc/pki/ca-trust/extractedazure-policy-698f7c86b4-nnff2etc-pki-ca-certs
hostPath volume usedkube-system/run/xtables.lockkube-proxy-26xkdiptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-26xkdsysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-26xkdmodules
hostPath volume usedkube-system/run/xtables.lockkube-proxy-6mrqliptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-6mrqlsysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-6mrqlmodules
hostPath volume usedkube-system/run/xtables.lockkube-proxy-9rbxfiptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-9rbxfsysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-9rbxfmodules
hostPath volume usedkube-system/run/xtables.lockkube-proxy-njzgkiptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-njzgksysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-njzgkmodules
hostPath volume usedkube-system/run/xtables.lockkube-proxy-rvmxliptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-rvmxlsysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-rvmxlmodules
hostPath volume usedkube-system/run/xtables.lockkube-proxy-vp7xjiptableslock
hostPath volume usedkube-system/etc/sysctl.dkube-proxy-vp7xjsysctls
hostPath volume usedkube-system/lib/moduleskube-proxy-vp7xjmodules
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-6xdfqhost-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-6xdfqdebugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-6xdfqmodules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-6xdfqusr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-6xdfqcontainerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-6xdfqproc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-6xdfqbin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-6xdfqetc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-6xdfqopt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-6xdfqusr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-6xdfqrun
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-6xdfqbpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-89l74host-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-89l74debugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-89l74modules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-89l74usr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-89l74containerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-89l74proc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-89l74bin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-89l74etc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-89l74opt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-89l74usr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-89l74run
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-89l74bpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-d7gwkhost-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-d7gwkdebugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-d7gwkmodules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-d7gwkusr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-d7gwkcontainerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-d7gwkproc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-d7gwkbin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-d7gwketc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-d7gwkopt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-d7gwkusr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-d7gwkrun
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-d7gwkbpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-mdcs8host-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-mdcs8debugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-mdcs8modules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-mdcs8usr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-mdcs8containerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-mdcs8proc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-mdcs8bin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-mdcs8etc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-mdcs8opt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-mdcs8usr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-mdcs8run
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-mdcs8bpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-q6d6chost-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-q6d6cdebugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-q6d6cmodules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-q6d6cusr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-q6d6ccontainerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-q6d6cproc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-q6d6cbin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-q6d6cetc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-q6d6copt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-q6d6cusr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-q6d6crun
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-q6d6cbpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-ds-wb5dmhost-log
hostPath volume usedkube-system/sys/kernelmicrosoft-defender-collector-ds-wb5dmdebugfs
hostPath volume usedkube-system/lib/modulesmicrosoft-defender-collector-ds-wb5dmmodules
hostPath volume usedkube-system/usr/srcmicrosoft-defender-collector-ds-wb5dmusr-src
hostPath volume usedkube-system/run/containerd/containerd.sockmicrosoft-defender-collector-ds-wb5dmcontainerd-file-sock
hostPath volume usedkube-system/procmicrosoft-defender-collector-ds-wb5dmproc
hostPath volume usedkube-system/binmicrosoft-defender-collector-ds-wb5dmbin
hostPath volume usedkube-system/etcmicrosoft-defender-collector-ds-wb5dmetc
hostPath volume usedkube-system/optmicrosoft-defender-collector-ds-wb5dmopt
hostPath volume usedkube-system/usrmicrosoft-defender-collector-ds-wb5dmusr
hostPath volume usedkube-system/runmicrosoft-defender-collector-ds-wb5dmrun
hostPath volume usedkube-system/sys/fs/bpfmicrosoft-defender-collector-ds-wb5dmbpffs
hostPath volume usedkube-system/var/logmicrosoft-defender-collector-misc-7df6776447-bcbphhost-log
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-2ql5bcert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-2ql5bhost-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-2ql5bdocker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-2ql5bcontainer-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-2ql5bhost-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-2ql5bazure-json-path
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-2rsrwcert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-2rsrwhost-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-2rsrwdocker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-2rsrwcontainer-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-2rsrwhost-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-2rsrwazure-json-path
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-jj6dhcert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-jj6dhhost-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-jj6dhdocker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-jj6dhcontainer-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-jj6dhhost-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-jj6dhazure-json-path
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-l5crscert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-l5crshost-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-l5crsdocker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-l5crscontainer-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-l5crshost-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-l5crsazure-json-path
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-lfk8hcert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-lfk8hhost-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-lfk8hdocker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-lfk8hcontainer-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-lfk8hhost-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-lfk8hazure-json-path
hostPath volume usedkube-system/var/microsoft/microsoft-defender-for-cloudmicrosoft-defender-publisher-ds-vz2c6cert-onboarding
hostPath volume usedkube-system/microsoft-defender-publisher-ds-vz2c6host-root
hostPath volume usedkube-system/var/runmicrosoft-defender-publisher-ds-vz2c6docker-sock
hostPath volume usedkube-system/etc/hostnamemicrosoft-defender-publisher-ds-vz2c6container-hostname
hostPath volume usedkube-system/var/logmicrosoft-defender-publisher-ds-vz2c6host-log
hostPath volume usedkube-system/etc/kubernetesmicrosoft-defender-publisher-ds-vz2c6azure-json-path
hostPath volume usedkube-system/sys/kernel/debugretina-agent-9g44ddebug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-9g44dtrace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-9g44dbpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-9g44dcgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-9g44dcilium
hostPath volume usedkube-system/sys/kernel/debugretina-agent-d6wf4debug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-d6wf4trace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-d6wf4bpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-d6wf4cgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-d6wf4cilium
hostPath volume usedkube-system/sys/kernel/debugretina-agent-gj4r5debug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-gj4r5trace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-gj4r5bpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-gj4r5cgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-gj4r5cilium
hostPath volume usedkube-system/sys/kernel/debugretina-agent-rndzhdebug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-rndzhtrace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-rndzhbpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-rndzhcgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-rndzhcilium
hostPath volume usedkube-system/sys/kernel/debugretina-agent-szggldebug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-szggltrace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-szgglbpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-szgglcgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-szgglcilium
hostPath volume usedkube-system/sys/kernel/debugretina-agent-t68m8debug
hostPath volume usedkube-system/sys/kernel/tracingretina-agent-t68m8trace
hostPath volume usedkube-system/sys/fs/bpfretina-agent-t68m8bpf
hostPath volume usedkube-system/sys/fs/cgroupretina-agent-t68m8cgroup
hostPath volume usedkube-system/var/run/ciliumretina-agent-t68m8cilium

SEC011 - Containers Running as UID 0 iDetects containers explicitly set to run as user 0 (root).

⚠️ Total Pods with Issues: 13

Show Findings
Recommendations
  • Set runAsUser to a non-root user ID.
  • Use runAsNonRoot: true for validation.
ContainerIssueNamespacePod
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-68nhw
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-7bqmn
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-7r458
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-k9tdc
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-n952g
provider-azure-installerContainer runs as UID 0kube-systemaks-secrets-store-provider-azure-njpqh
azure-policyContainer runs as UID 0kube-systemazure-policy-698f7c86b4-nnff2
retinaContainer runs as UID 0kube-systemretina-agent-9g44d
retinaContainer runs as UID 0kube-systemretina-agent-d6wf4
retinaContainer runs as UID 0kube-systemretina-agent-gj4r5
retinaContainer runs as UID 0kube-systemretina-agent-rndzh
retinaContainer runs as UID 0kube-systemretina-agent-szggl
retinaContainer runs as UID 0kube-systemretina-agent-t68m8

SEC012 - Added Linux Capabilities iFlags containers that add extra Linux capabilities using securityContext.capabilities.add.

⚠️ Total Pods with Issues: 70

Show Findings
Recommendations
  • Review and remove unnecessary capabilities.
  • Default to dropping all, then selectively add only what's needed.
CapabilitiesContainerIssueNamespacePod
NET_BIND_SERVICEcontrollerAdded Linux capabilitiesapp-routing-systemnginx-69fcb489fd-4wgk9
NET_BIND_SERVICEcontrollerAdded Linux capabilitiesapp-routing-systemnginx-69fcb489fd-64v6k
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-4v8mz
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-4v8mz
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-5vr2w
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-5vr2w
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-fmd7b
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-fmd7b
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-fpkw6
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-fpkw6
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-gqs28
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-gqs28
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-ndxrw
DAC_OVERRIDEama-logs-prometheusAdded Linux capabilitieskube-systemama-logs-ndxrw
DAC_OVERRIDEama-logsAdded Linux capabilitieskube-systemama-logs-rs-64765bd4b9-ldxwl
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-7f878d975f-hlggb
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-7f878d975f-hlggb
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-7f878d975f-q2mlg
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-7f878d975f-q2mlg
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-2ssrw
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-2ssrw
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-6kkz8
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-6kkz8
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-9h44h
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-9h44h
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-lhk42
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-lhk42
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-nm5bf
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-nm5bf
DAC_OVERRIDEprometheus-collectorAdded Linux capabilitieskube-systemama-metrics-node-pqcz5
NET_ADMIN, NET_RAWaddon-token-adapterAdded Linux capabilitieskube-systemama-metrics-node-pqcz5
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-4522j
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-4c7cr
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-78rnw
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-84ltn
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-t4c2w
NET_ADMIN, NET_RAWazure-ip-masq-agentAdded Linux capabilitieskube-systemazure-ip-masq-agent-vbdd8
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-jsbbh
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-lp6sf
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-nv6xx
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-p6fpw
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-vsrfp
NET_ADMIN, NET_RAWazure-npmAdded Linux capabilitieskube-systemazure-npm-z8mcz
NET_BIND_SERVICEcorednsAdded Linux capabilitieskube-systemcoredns-658d6d767d-757xp
NET_BIND_SERVICEcorednsAdded Linux capabilitieskube-systemcoredns-658d6d767d-pt6l6
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-6xdfq
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-6xdfq
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-89l74
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-89l74
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-d7gwk
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-d7gwk
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-mdcs8
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-mdcs8
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-q6d6c
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-q6d6c
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-wb5dm
SYS_ADMIN, SYS_RESOURCE, SYS_PTRACE, SYSLOG, IPC_LOCK, NET_ADMIN, NET_RAWmicrosoft-defender-low-level-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-ds-wb5dm
NET_RAW, NET_ADMINmicrosoft-defender-pod-collectorAdded Linux capabilitieskube-systemmicrosoft-defender-collector-misc-7df6776447-bcbph
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-2ql5b
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-2rsrw
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-jj6dh
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-l5crs
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-lfk8h
NET_RAW, NET_ADMINmicrosoft-defender-publisherAdded Linux capabilitieskube-systemmicrosoft-defender-publisher-ds-vz2c6
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-9g44d
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-d6wf4
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-gj4r5
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-rndzh
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-szggl
SYS_ADMIN, SYS_RESOURCE, NET_ADMIN, NET_RAW, IPC_LOCKretinaAdded Linux capabilitieskube-systemretina-agent-t68m8

SEC013 - EmptyDir Volume Usage iEmptyDir volumes are ephemeral and cleared on pod restart. Use only if data persistence is not needed.

⚠️ Total Pods with Issues: 98

Show Findings
Recommendations
  • Audit use of EmptyDir volumes in production workloads.
  • Replace with PVCs or other managed storage if persistence is needed.
IssueNamespacePodVolume
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4workload-socket
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4credential-socket
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4workload-certs
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4istio-envoy
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-hdfn4istio-data
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbworkload-socket
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbcredential-socket
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbworkload-certs
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbistio-envoy
EmptyDir volume usedaks-istio-ingressaks-istio-ingressgateway-external-asm-1-23-59bd5fbf44-zqwtbistio-data
EmptyDir volume usedaks-istio-systemistiod-asm-1-23-7744d5fbf4-9572mlocal-certs
EmptyDir volume usedaks-istio-systemistiod-asm-1-23-7744d5fbf4-rqzvtlocal-certs
EmptyDir volume usedargocdargocd-application-controller-0argocd-home
EmptyDir volume usedargocdargocd-application-controller-0argocd-application-controller-tmp
EmptyDir volume usedargocdargocd-applicationset-controller-6fdf84dbb6-msffzgpg-keyring
EmptyDir volume usedargocdargocd-applicationset-controller-6fdf84dbb6-msffztmp
EmptyDir volume usedargocdargocd-dex-server-556c76889-h4kxjstatic-files
EmptyDir volume usedargocdargocd-dex-server-556c76889-h4kxjdexconfig
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-kjbkqshared-socket
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-kjbkqdata
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-kjlpfshared-socket
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-kjlpfdata
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-tnjmbshared-socket
EmptyDir volume usedargocdargocd-redis-ha-haproxy-fb657456c-tnjmbdata
EmptyDir volume usedargocdargocd-redis-ha-server-0data
EmptyDir volume usedargocdargocd-redis-ha-server-1data
EmptyDir volume usedargocdargocd-redis-ha-server-2data
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-sx6ksgpg-keyring
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-sx6kstmp
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-sx6kshelm-working-dir
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-sx6ksvar-files
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-sx6ksplugins
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-xrzzngpg-keyring
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-xrzzntmp
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-xrzznhelm-working-dir
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-xrzznvar-files
EmptyDir volume usedargocdargocd-repo-server-8568fc89b5-xrzznplugins
EmptyDir volume usedargocdargocd-server-c5b86c885-2zqmxplugins-home
EmptyDir volume usedargocdargocd-server-c5b86c885-2zqmxtmp
EmptyDir volume usedargocdargocd-server-c5b86c885-zlzd5plugins-home
EmptyDir volume usedargocdargocd-server-c5b86c885-zlzd5tmp
EmptyDir volume usedgatekeeper-systemgatekeeper-audit-77858c8f69-7k782tmp-volume
EmptyDir volume usedkiali-operatorkiali-operator-696bd54db-mr8mdtmp
EmptyDir volume usedkube-systemama-logs-4v8mzmdsd-prometheus-sock
EmptyDir volume usedkube-systemama-logs-5vr2wmdsd-prometheus-sock
EmptyDir volume usedkube-systemama-logs-fmd7bmdsd-prometheus-sock
EmptyDir volume usedkube-systemama-logs-fpkw6mdsd-prometheus-sock
EmptyDir volume usedkube-systemama-logs-gqs28mdsd-prometheus-sock
EmptyDir volume usedkube-systemama-logs-ndxrwmdsd-prometheus-sock
EmptyDir volume usedkube-systemama-metrics-operator-targets-66fb46c8d6-vskdgta-config-shared
EmptyDir volume usedkube-systemazure-npm-jsbbhtmp
EmptyDir volume usedkube-systemazure-npm-lp6sftmp
EmptyDir volume usedkube-systemazure-npm-nv6xxtmp
EmptyDir volume usedkube-systemazure-npm-p6fpwtmp
EmptyDir volume usedkube-systemazure-npm-vsrfptmp
EmptyDir volume usedkube-systemazure-npm-z8mcztmp
EmptyDir volume usedkube-systemcoredns-658d6d767d-757xptmp
EmptyDir volume usedkube-systemcoredns-658d6d767d-pt6l6tmp
EmptyDir volume usedkube-systemmetrics-server-5f9ccffcc4-jsrjltmp-dir
EmptyDir volume usedkube-systemmetrics-server-5f9ccffcc4-v88pwtmp-dir
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-6xdfqebpf
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-89l74ebpf
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-d7gwkebpf
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-mdcs8ebpf
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-q6d6cebpf
EmptyDir volume usedkube-systemmicrosoft-defender-collector-ds-wb5dmebpf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-2ql5bfluent-bit-conf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-2rsrwfluent-bit-conf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-jj6dhfluent-bit-conf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-l5crsfluent-bit-conf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-lfk8hfluent-bit-conf
EmptyDir volume usedkube-systemmicrosoft-defender-publisher-ds-vz2c6fluent-bit-conf
EmptyDir volume usedkube-systemretina-agent-9g44dtmp
EmptyDir volume usedkube-systemretina-agent-d6wf4tmp
EmptyDir volume usedkube-systemretina-agent-gj4r5tmp
EmptyDir volume usedkube-systemretina-agent-rndzhtmp
EmptyDir volume usedkube-systemretina-agent-szggltmp
EmptyDir volume usedkube-systemretina-agent-t68m8tmp
EmptyDir volume usedpetsorder-service-6c5bfb6946-b58xqworkload-socket
EmptyDir volume usedpetsorder-service-6c5bfb6946-b58xqcredential-socket
EmptyDir volume usedpetsorder-service-6c5bfb6946-b58xqworkload-certs
EmptyDir volume usedpetsorder-service-6c5bfb6946-b58xqistio-envoy
EmptyDir volume usedpetsorder-service-6c5bfb6946-b58xqistio-data
EmptyDir volume usedpetsproduct-service-5dd87dfb8-ssfxcworkload-socket
EmptyDir volume usedpetsproduct-service-5dd87dfb8-ssfxccredential-socket
EmptyDir volume usedpetsproduct-service-5dd87dfb8-ssfxcworkload-certs
EmptyDir volume usedpetsproduct-service-5dd87dfb8-ssfxcistio-envoy
EmptyDir volume usedpetsproduct-service-5dd87dfb8-ssfxcistio-data
EmptyDir volume usedpetsrabbitmq-0workload-socket
EmptyDir volume usedpetsrabbitmq-0credential-socket
EmptyDir volume usedpetsrabbitmq-0workload-certs
EmptyDir volume usedpetsrabbitmq-0istio-envoy
EmptyDir volume usedpetsrabbitmq-0istio-data
EmptyDir volume usedpetsstore-front-658994fd95-pk9qnworkload-socket
EmptyDir volume usedpetsstore-front-658994fd95-pk9qncredential-socket
EmptyDir volume usedpetsstore-front-658994fd95-pk9qnworkload-certs
EmptyDir volume usedpetsstore-front-658994fd95-pk9qnistio-envoy
EmptyDir volume usedpetsstore-front-658994fd95-pk9qnistio-data

SEC014 - Untrusted Image Registries iFlags images that are not pulled from approved registries.

⚠️ Total Pods with Issues: 15

Show Findings
Recommendations
  • Use approved internal or vendor-verified registries.
  • Restrict image pull policies using Gatekeeper or admission plugins.
ContainerImageIssueNamespacePod
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registryargo-rolloutssimple-deployment-74fd649f8d-996vt
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registryargo-workflowssimple-deployment-74fd649f8d-24t56
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrycert-managersimple-deployment-74fd649f8d-7cht8
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrygrafanasimple-deployment-74fd649f8d-l7wrd
kialiquay.io/kiali/kiali:v2.7.1Image from untrusted registrykiali-operatorkiali-5b88cfb6f8-cm8dz
operatorquay.io/kiali/kiali-operator:v2.7.1Image from untrusted registrykiali-operatorkiali-operator-696bd54db-mr8md
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrykubeviewsimple-deployment-74fd649f8d-qxp2r
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrylinkerdsimple-deployment-74fd649f8d-mkmst
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrynginxsimple-deployment-74fd649f8d-hlcdk
order-serviceghcr.io/azure-samples/aks-store-demo/order-service:latestImage from untrusted registrypetsorder-service-6c5bfb6946-b58xq
product-serviceghcr.io/azure-samples/aks-store-demo/product-service:latestImage from untrusted registrypetsproduct-service-5dd87dfb8-ssfxc
store-frontghcr.io/azure-samples/aks-store-demo/store-front:latestImage from untrusted registrypetsstore-front-658994fd95-pk9qn
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registryprometheussimple-deployment-74fd649f8d-2x6w5
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrysealed-secretssimple-deployment-74fd649f8d-stktp
webserver-simpledocker.io/kostiscodefresh/gitops-simple-app:v1.0Image from untrusted registrytestsimple-deployment-74fd649f8d-lhlkx

SEC015 - Pods Using Default ServiceAccount iFlags pods using the default service account, which may have broad permissions.

⚠️ Total Pods with Issues: 20

Show Findings
Recommendations
  • Create and bind a custom ServiceAccount per application.
  • Avoid using the default ServiceAccount unless absolutely necessary.
IssueNamespacePodServiceAccount
Using default ServiceAccountargo-rolloutssimple-deployment-74fd649f8d-996vtdefault
Using default ServiceAccountargo-workflowssimple-deployment-74fd649f8d-24t56default
Using default ServiceAccountcert-managersimple-deployment-74fd649f8d-7cht8default
Using default ServiceAccountgrafanasimple-deployment-74fd649f8d-l7wrddefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-4522jdefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-4c7crdefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-78rnwdefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-84ltndefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-t4c2wdefault
Using default ServiceAccountkube-systemazure-ip-masq-agent-vbdd8default
Using default ServiceAccountkubeviewsimple-deployment-74fd649f8d-qxp2rdefault
Using default ServiceAccountlinkerdsimple-deployment-74fd649f8d-mkmstdefault
Using default ServiceAccountnginxsimple-deployment-74fd649f8d-hlcdkdefault
Using default ServiceAccountpetsorder-service-6c5bfb6946-b58xqdefault
Using default ServiceAccountpetsproduct-service-5dd87dfb8-ssfxcdefault
Using default ServiceAccountpetsrabbitmq-0default
Using default ServiceAccountpetsstore-front-658994fd95-pk9qndefault
Using default ServiceAccountprometheussimple-deployment-74fd649f8d-2x6w5default
Using default ServiceAccountsealed-secretssimple-deployment-74fd649f8d-stktpdefault
Using default ServiceAccounttestsimple-deployment-74fd649f8d-lhlkxdefault

SEC016 - Non-Existent Secret References iFlags pods referencing Secrets that do not exist. This may cause runtime failures.

⚠️ Total Pods with Issues: 33

Show Findings
Recommendations
  • Check envFrom, secretKeyRef, and volume.secret.secretName references.
  • Create missing Secrets or remove invalid references.
IssueNamespacePodSecretVolume
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-9572mcacertscacerts
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-9572mistio-kubeconfigistio-kubeconfig
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-9572mistiod-tlsistio-csr-dns-cert
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-rqzvtcacertscacerts
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-rqzvtistio-kubeconfigistio-kubeconfig
Missing secret reference in volumeaks-istio-systemistiod-asm-1-23-7744d5fbf4-rqzvtistiod-tlsistio-csr-dns-cert
Missing secret reference in volumeargocdargocd-application-controller-0argocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-applicationset-controller-6fdf84dbb6-msffzargocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-dex-server-556c76889-h4kxjargocd-dex-server-tlsargocd-dex-server-tls
Missing secret reference in volumeargocdargocd-notifications-controller-6ff6bf8dd6-nbktrargocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-repo-server-8568fc89b5-sx6ksargocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-repo-server-8568fc89b5-xrzznargocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-server-c5b86c885-2zqmxargocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-server-c5b86c885-2zqmxargocd-dex-server-tlsargocd-dex-server-tls
Missing secret reference in volumeargocdargocd-server-c5b86c885-zlzd5argocd-repo-server-tlsargocd-repo-server-tls
Missing secret reference in volumeargocdargocd-server-c5b86c885-zlzd5argocd-dex-server-tlsargocd-dex-server-tls
Missing secret reference in volumekiali-operatorkiali-5b88cfb6f8-cm8dzkialikiali-secret
Missing secret reference in volumekube-systemama-logs-4v8mzama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-5vr2wama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-fmd7bama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-fpkw6ama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-gqs28ama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-ndxrwama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-logs-rs-64765bd4b9-ldxwlama-logs-adx-secretama-logs-adx-secret
Missing secret reference in volumekube-systemama-metrics-7f878d975f-hlggbama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-7f878d975f-q2mlgama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-2ssrwama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-6kkz8ama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-9h44hama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-lhk42ama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-nm5bfama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-node-pqcz5ama-metrics-mtls-secretama-metrics-tls-secret-volume
Missing secret reference in volumekube-systemama-metrics-operator-targets-66fb46c8d6-vskdgama-metrics-mtls-secretama-metrics-tls-secret-volume

Kubernetes Warning Events

EVENT001 - Grouped Warning Events iGroups recent Warning events by Reason and Message.

✅ All Events are healthy.

EVENT002 - Full Warning Event Log iLists all recent Warning events in the cluster.

✅ All Events are healthy.

AKS Best Practices

AKS Best Practices Summary

✅ Passed: 33
❌ Failed: 5
📊 Total Checks: 38
🎯 Score: 86.84%
⭐ Rating: B

AKS Best Practices Results

Show Findings
IDCheckSeverityCategoryStatusFail MessageRecommendationURL
AKSBP001Allowed Container Images Policy EnforcementHighBest Practices❌ FAILThe 'Only Allowed Images' policy is either missing or not enforcing deny mode, increasing the risk of running untrusted images.Deploy and enforce the 'Only Allowed Images' policy with deny mode to restrict unapproved images.Learn More
AKSBP002No Privileged Containers Policy EnforcementHighBest Practices❌ FAILThe 'No Privileged Containers' policy is either missing or not enforcing deny mode, allowing potentially insecure workloads.Deploy and enforce the 'No Privileged Containers' policy in deny mode to block privileged containers and enhance security.Learn More
AKSRES002AKS Built-in Cost Tooling EnabledMediumResource Management❌ FAILAKS built-in cost tooling (Open Costs) is not enabled, making cost allocation and optimization harder.Enable cost analysis in the AKS metrics profile to gain insights into resource spending and optimize cost management.Learn More
AKSSEC001Private ClusterHighSecurity❌ FAILCluster API server is publicly accessible, increasing security risks.Configure the cluster as a private cluster to restrict API server access to your virtual network.Learn More
AKSSEC08Pod Security Admission EnabledHighSecurity❌ FAILPod Security Admission is not enabled on this cluster. This may reduce baseline pod security.Enable Pod Security Admission by setting 'podSecurityAdmissionConfiguration' during cluster creation or via supported upgrade path.Learn More
AKSBP011System Node Pool Minimum SizeHighBest Practices✅ PASSSystem Node Pool Minimum Size is enabled.Learn More
AKSBP010Customized MC_ Resource Group NameMediumBest Practices✅ PASSCustomized MC_ Resource Group Name is enabled.Learn More
AKSBP009Node OS Upgrade Channel ConfiguredMediumBest Practices✅ PASSNode OS Upgrade Channel Configured is enabled.Learn More
AKSBP007System Node Pool TaintHighBest Practices✅ PASSSystem Node Pool Taint is enabled.Learn More
AKSBP006Non-Ephemeral Disks with Adequate SizeMediumBest Practices✅ PASSNon-Ephemeral Disks with Adequate Size is enabled.Learn More
AKSBP005Ephemeral OS Disks EnabledMediumBest Practices✅ PASSEphemeral OS Disks Enabled is enabled.Learn More
AKSBP004Azure Linux as Host OSHighBest Practices✅ PASSAzure Linux as Host OS is enabled.Learn More
AKSBP003Multiple Node PoolsMediumBest Practices✅ PASSMultiple Node Pools is enabled.Learn More
AKSBP012Node Pool Version Matches Control PlaneMediumBest Practices✅ PASSNode Pool Version Matches Control Plane is enabled.Learn More
AKSBP008Auto Upgrade Channel ConfiguredMediumBest Practices✅ PASSAuto Upgrade Channel Configured is enabled.Learn More
AKSDR001Agent Pools with Availability ZonesHighDisaster Recovery✅ PASSAgent Pools with Availability Zones is enabled.Learn More
AKSDR002Control Plane SLAMediumDisaster Recovery✅ PASSControl Plane SLA is enabled.Learn More
AKSIAM001RBAC EnabledHighIdentity & Access✅ PASSRBAC Enabled is enabled.Learn More
AKSIAM002Managed IdentityHighIdentity & Access✅ PASSManaged Identity is enabled.Learn More
AKSIAM003Workload Identity EnabledMediumIdentity & Access✅ PASSWorkload Identity Enabled is enabled.Learn More
AKSIAM004Managed Identity UsedHighIdentity & Access✅ PASSManaged Identity Used is enabled.Learn More
AKSIAM005AAD RBAC Authorization IntegratedHighIdentity & Access✅ PASSAAD RBAC Authorization Integrated is enabled.Learn More
AKSIAM006AAD Managed Authentication EnabledHighIdentity & Access✅ PASSAAD Managed Authentication Enabled is enabled.Learn More
AKSIAM007Local Accounts DisabledHighIdentity & Access✅ PASSLocal Accounts Disabled is enabled.Learn More
AKSMON001Azure MonitorHighMonitoring & Logging✅ PASSAzure Monitor is enabled.Learn More
AKSMON002Managed Prometheus EnabledHighMonitoring & Logging✅ PASSManaged Prometheus Enabled is enabled.Learn More
AKSNET002Network Policy CheckMediumNetworking✅ PASSNetwork Policy Check is enabled.Learn More
AKSNET004Azure CNI Networking RecommendedMediumNetworking✅ PASSAzure CNI Networking Recommended is enabled.Learn More
AKSNET003Web App Routing EnabledLowNetworking✅ PASSWeb App Routing Enabled is enabled.Learn More
AKSNET001Authorized IP RangesHighNetworking✅ PASSAuthorized IP Ranges is enabled.Learn More
AKSRES001Cluster AutoscalerMediumResource Management✅ PASSCluster Autoscaler is enabled.Learn More
AKSRES003Vertical Pod Autoscaler (VPA) is enabledMediumResource Management✅ PASSVertical Pod Autoscaler (VPA) is enabled is enabled.Learn More
AKSSEC007Kubernetes Dashboard DisabledHighSecurity✅ PASSKubernetes Dashboard Disabled is enabled.Learn More
AKSSEC002Azure Policy Add-onMediumSecurity✅ PASSAzure Policy Add-on is enabled.Learn More
AKSSEC003Defender for ContainersHighSecurity✅ PASSDefender for Containers is enabled.Learn More
AKSSEC004OIDC Issuer EnabledMediumSecurity✅ PASSOIDC Issuer Enabled is enabled.Learn More
AKSSEC005Azure Key Vault IntegrationHighSecurity✅ PASSAzure Key Vault Integration is enabled.Learn More
AKSSEC006Image Cleaner EnabledMediumSecurity✅ PASSImage Cleaner Enabled is enabled.Learn More