Add enterprise AKS and workload security controls

CHANGELOG.md

@@ -9,6 +9,7 @@ OpenShield uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Added
 
+- Fifteen enterprise AKS and Kubernetes workload rules covering API restrictions, network policy, Defender, secrets, workload isolation, RBAC, and image trust
 - Azure Network Layer Assurance API with 20-domain coverage, network-rule classification, and authoritative IP forwarding and direct Internet route checks
 - Azure Resource Graph inventory snapshots as the first OpenShield Evidence Graph foundation
 - Azure Data Link Layer Assurance API with LLC and MAC coverage plus ExpressRoute Direct MACsec checks

CONTRIBUTING.md

@@ -176,7 +176,7 @@ Use the format: `AZ-[CATEGORY]-[NUMBER]`
 | Database | DB | AZ-DB-001 |
 | Compute | CMP | AZ-CMP-001 |
 | Key Vault | KV | AZ-KV-001 |
-| Kubernetes (AKS) | AKS | AZ-AKS-001 |
+| Kubernetes (AKS) | AKS | AZ-AKS-001 to AZ-AKS-021 |
 
 Check existing rules before picking a number to avoid clashes.
 
@@ -201,6 +201,7 @@ Use the existing wrapper methods in `scanner/azure_client.py` rather than constr
 | `azure_client.get_sql_server_auditing_policy(resource_group, server_name)` | ServerBlobAuditingPolicy or None |
 | `azure_client.get_key_vaults()` | List of Key Vault objects |
 | `azure_client.get_managed_clusters()` | List of AKS ManagedCluster objects, or `None` on API failure |
+| `azure_client.get_aks_security_posture()` | Cached ARM, Defender, and Kubernetes evidence, or `None` on AKS inventory failure |
 | `azure_client.get_applications()` | Paginated App Registration dictionaries, or `None` on Graph failure |
 | `azure_client.get_managed_identity_service_principals()` | Managed Identity service principals, or `None` on Graph failure |
 | `azure_client.get_subscription_role_assignments()` | Subscription RBAC assignments, or `None` on API failure |

README.md

@@ -59,10 +59,10 @@ Findings map to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA
 
 | Feature | Description |
 |---|---|
-| **Misconfiguration Scanner** | Runs 80 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, post-quantum cryptography, backup, serverless, private endpoint, and supply chain posture |
+| **Misconfiguration Scanner** | Runs 95 Azure security rules across storage, network, identity, database, compute, Key Vault, AKS, Kubernetes workloads, post-quantum cryptography, backup, serverless, private endpoint, and supply chain posture |
 | **Compliance Mapper** | Maps findings to CIS Benchmarks, NIST CSF, ISO 27001, and SOC 2 framework JSON files |
 | **Scan History API** | Stores scans and findings in PostgreSQL and exposes findings, score, scan history, compliance posture, drift, and resource inventory over REST |
-| **Remediation Playbooks** | Every rule ships with a matching Azure CLI remediation script (80 playbooks) |
+| **Remediation Playbooks** | Every documented rule ships with a matching review-gated remediation script (95 playbooks) |
 | **Security Dashboard** | Full React dashboard deployed on Vercel - live monitoring, findings, compliance, drift, prioritization, and AI-layer views |
 | **Project Website** | Documentation and reference site at [openshield-website.vercel.app](https://openshield-website.vercel.app) - blog, rules gallery, docs, roadmap, releases, and interactive playground |
 | **Sentinel Integration** | Normalises findings and pushes them into Microsoft Sentinel via a Log Analytics custom table and KQL analytics rules |
@@ -104,11 +104,11 @@ Project policies and assurance evidence:
 flowchart TD
     A["React Dashboard\nVercel · Live"]
     B["Flask REST API\nJWT · CORS · Blueprints"]
-    C["Scanner Engine\n80 Python rules"]
+    C["Scanner Engine\n95 Python rules"]
     D["Azure Subscription\nScanned via Azure SDK + Graph"]
     E["Compliance Framework JSON\nCIS · NIST · ISO 27001 · SOC 2"]
     F["PostgreSQL Database\nFindings · Scans"]
-    G["Azure CLI Playbooks\n80 remediation scripts"]
+    G["Azure CLI Playbooks\n95 remediation scripts"]
     H["sentinel/ingest.py\nNormalise + HMAC upload"]
     I["Microsoft Sentinel\nOpenShieldFindings_CL · KQL rules"]
 

compliance/frameworks/cis_azure_benchmark.json

@@ -263,6 +263,81 @@
       "control_name": "AKS node OS upgrade baseline (not mapped in CIS Azure Foundations 2.0.0)",
       "description": "Microsoft recommends a managed node OS upgrade channel for timely security patches. This check has no direct control in the repository's CIS Azure Foundations 2.0.0 benchmark."
     },
+    "AZ-AKS-007": {
+      "control_id": "N/A-AKS-007",
+      "control_name": "AKS API authorized IP baseline (not mapped in CIS Azure Foundations 2.0.0)",
+      "description": "Restricting a public AKS API server to approved administrator networks has no direct control in the repository's CIS Azure Foundations 2.0.0 benchmark."
+    },
+    "AZ-AKS-008": {
+      "control_id": "N/A-AKS-008",
+      "control_name": "AKS network policy engine baseline (not mapped in CIS Azure Foundations 2.0.0)",
+      "description": "Enabling a Kubernetes network policy engine has no direct control in the repository's CIS Azure Foundations 2.0.0 benchmark."
+    },
+    "AZ-AKS-009": {
+      "control_id": "N/A-AKS-009",
+      "control_name": "Kubernetes namespace NetworkPolicy baseline (not mapped in CIS Azure Foundations 2.0.0)",
+      "description": "Requiring NetworkPolicy objects for application namespaces is a Kubernetes data-plane control outside the Azure Foundations benchmark."
+    },
+    "AZ-AKS-010": {
+      "control_id": "2.1.8",
+      "control_name": "Ensure that Microsoft Defender for Containers is set to On",
+      "description": "The Containers pricing plan must use the Standard tier to provide Microsoft Defender for Containers protection."
+    },
+    "AZ-AKS-011": {
+      "control_id": "N/A-AKS-011",
+      "control_name": "AKS Key Vault or KMS secret protection baseline (not directly mapped)",
+      "description": "Key Vault CSI and KMS-backed Kubernetes secret protection have no single direct control in CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-012": {
+      "control_id": "N/A-AKS-012",
+      "control_name": "Secrets Store CSI rotation baseline (not directly mapped)",
+      "description": "Automatic rotation of CSI-mounted secrets has no direct control in CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-013": {
+      "control_id": "N/A-AKS-013",
+      "control_name": "Privileged container baseline (Kubernetes data-plane control)",
+      "description": "Privileged container restrictions are Kubernetes data-plane controls outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-014": {
+      "control_id": "N/A-AKS-014",
+      "control_name": "Host network baseline (Kubernetes data-plane control)",
+      "description": "Host network restrictions are Kubernetes data-plane controls outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-015": {
+      "control_id": "N/A-AKS-015",
+      "control_name": "Host PID baseline (Kubernetes data-plane control)",
+      "description": "Host PID namespace restrictions are Kubernetes data-plane controls outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-016": {
+      "control_id": "N/A-AKS-016",
+      "control_name": "Host IPC baseline (Kubernetes data-plane control)",
+      "description": "Host IPC namespace restrictions are Kubernetes data-plane controls outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-017": {
+      "control_id": "N/A-AKS-017",
+      "control_name": "HostPath volume baseline (Kubernetes data-plane control)",
+      "description": "HostPath volume restrictions are Kubernetes data-plane controls outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-018": {
+      "control_id": "N/A-AKS-018",
+      "control_name": "Kubernetes cluster-admin assignment baseline (not directly mapped)",
+      "description": "Kubernetes ClusterRoleBinding scope is outside CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-019": {
+      "control_id": "N/A-AKS-019",
+      "control_name": "Trusted container registry baseline (not directly mapped)",
+      "description": "Kubernetes workload registry trust policy has no direct control in CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-020": {
+      "control_id": "N/A-AKS-020",
+      "control_name": "Latest image tag baseline (not directly mapped)",
+      "description": "Kubernetes image tag immutability has no direct control in CIS Azure Foundations 2.0.0."
+    },
+    "AZ-AKS-021": {
+      "control_id": "N/A-AKS-021",
+      "control_name": "Digest-pinned image baseline (not directly mapped)",
+      "description": "Kubernetes image digest pinning has no direct control in CIS Azure Foundations 2.0.0."
+    },
     "AZ-IDN-010": {
       "control_id": "N/A-IDN-010",
       "control_name": "App Registration ownership (not mapped in CIS Azure Foundations 2.0.0)",

compliance/frameworks/iso27001.json

@@ -263,6 +263,81 @@
       "control_name": "Management of technical vulnerabilities",
       "description": "Automatic AKS node OS upgrades help deploy tested security patches within a managed maintenance process."
     },
+    "AZ-AKS-007": {
+      "control_id": "A.13.1.1",
+      "control_name": "Network controls",
+      "description": "Authorized IP ranges constrain public AKS API access to approved networks."
+    },
+    "AZ-AKS-008": {
+      "control_id": "A.13.1.3",
+      "control_name": "Segregation in networks",
+      "description": "A Kubernetes network policy engine enables workload network segregation."
+    },
+    "AZ-AKS-009": {
+      "control_id": "A.13.1.3",
+      "control_name": "Segregation in networks",
+      "description": "Namespace NetworkPolicy objects enforce workload communication boundaries."
+    },
+    "AZ-AKS-010": {
+      "control_id": "A.12.6.1",
+      "control_name": "Management of technical vulnerabilities",
+      "description": "Defender for Containers monitors workload threats and vulnerabilities."
+    },
+    "AZ-AKS-011": {
+      "control_id": "A.10.1.1",
+      "control_name": "Policy on cryptographic controls",
+      "description": "Key Vault or KMS-backed protection applies approved cryptographic controls to secrets."
+    },
+    "AZ-AKS-012": {
+      "control_id": "A.9.4.3",
+      "control_name": "Password management system",
+      "description": "CSI secret rotation maintains mounted credentials through an approved lifecycle."
+    },
+    "AZ-AKS-013": {
+      "control_id": "A.9.4.1",
+      "control_name": "Information access restriction",
+      "description": "Privileged container restrictions preserve the workload and node access boundary."
+    },
+    "AZ-AKS-014": {
+      "control_id": "A.13.1.3",
+      "control_name": "Segregation in networks",
+      "description": "Host network restrictions preserve workload network segregation."
+    },
+    "AZ-AKS-015": {
+      "control_id": "A.9.4.1",
+      "control_name": "Information access restriction",
+      "description": "Host PID restrictions prevent access to node process information."
+    },
+    "AZ-AKS-016": {
+      "control_id": "A.9.4.1",
+      "control_name": "Information access restriction",
+      "description": "Host IPC restrictions prevent access to node communication resources."
+    },
+    "AZ-AKS-017": {
+      "control_id": "A.9.4.1",
+      "control_name": "Information access restriction",
+      "description": "HostPath restrictions prevent direct access to node filesystems."
+    },
+    "AZ-AKS-018": {
+      "control_id": "A.9.2.3",
+      "control_name": "Management of privileged access rights",
+      "description": "A cluster-admin allowlist limits Kubernetes privileged access."
+    },
+    "AZ-AKS-019": {
+      "control_id": "A.14.2.5",
+      "control_name": "Secure system engineering principles",
+      "description": "Trusted image sources preserve the approved software supply boundary."
+    },
+    "AZ-AKS-020": {
+      "control_id": "A.12.1.2",
+      "control_name": "Change management",
+      "description": "Explicit image versions make deployment changes reviewable."
+    },
+    "AZ-AKS-021": {
+      "control_id": "A.14.2.5",
+      "control_name": "Secure system engineering principles",
+      "description": "Digest-pinned images provide immutable deployment inputs."
+    },
     "AZ-IDN-010": {
       "control_id": "A.9.2.1",
       "control_name": "User registration and de-registration",

compliance/frameworks/nist_csf.json

@@ -263,6 +263,81 @@
       "control_name": "A vulnerability management plan is developed and implemented",
       "description": "Managed node OS upgrade channels apply tested security updates to reduce exposure to known operating-system vulnerabilities."
     },
+    "AZ-AKS-007": {
+      "control_id": "PR.AC-3",
+      "control_name": "Remote access is managed",
+      "description": "Approved API server IP ranges constrain remote AKS administration paths."
+    },
+    "AZ-AKS-008": {
+      "control_id": "PR.AC-5",
+      "control_name": "Network integrity is protected",
+      "description": "A network policy engine provides enforcement for Kubernetes workload traffic boundaries."
+    },
+    "AZ-AKS-009": {
+      "control_id": "PR.AC-5",
+      "control_name": "Network integrity is protected",
+      "description": "Namespace NetworkPolicy objects define and enforce allowed workload communication."
+    },
+    "AZ-AKS-010": {
+      "control_id": "DE.CM-8",
+      "control_name": "Vulnerability scans are performed",
+      "description": "Defender for Containers supplies managed workload vulnerability and threat monitoring."
+    },
+    "AZ-AKS-011": {
+      "control_id": "PR.DS-1",
+      "control_name": "Data at rest is protected",
+      "description": "Key Vault CSI or KMS-backed protection reduces exposure of Kubernetes secret material."
+    },
+    "AZ-AKS-012": {
+      "control_id": "PR.AC-1",
+      "control_name": "Identities and credentials are managed",
+      "description": "Automatic CSI rotation keeps mounted workload credentials within their approved lifecycle."
+    },
+    "AZ-AKS-013": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions are managed",
+      "description": "Blocking privileged containers prevents workloads from receiving unrestricted node capabilities."
+    },
+    "AZ-AKS-014": {
+      "control_id": "PR.AC-5",
+      "control_name": "Network integrity is protected",
+      "description": "Blocking hostNetwork keeps workload networking inside Kubernetes isolation boundaries."
+    },
+    "AZ-AKS-015": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions are managed",
+      "description": "Blocking hostPID prevents workloads from observing or controlling node processes."
+    },
+    "AZ-AKS-016": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions are managed",
+      "description": "Blocking hostIPC prevents workloads from sharing node inter-process communication resources."
+    },
+    "AZ-AKS-017": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions are managed",
+      "description": "Blocking hostPath prevents direct workload access to the node filesystem."
+    },
+    "AZ-AKS-018": {
+      "control_id": "PR.AC-4",
+      "control_name": "Access permissions are managed",
+      "description": "Restricting cluster-admin bindings enforces least privilege for Kubernetes subjects."
+    },
+    "AZ-AKS-019": {
+      "control_id": "PR.DS-6",
+      "control_name": "Integrity checking mechanisms are used",
+      "description": "Trusted registries provide an approved source boundary for workload images."
+    },
+    "AZ-AKS-020": {
+      "control_id": "PR.IP-1",
+      "control_name": "A baseline configuration is maintained",
+      "description": "Avoiding latest tags makes deployed image versions explicit and reviewable."
+    },
+    "AZ-AKS-021": {
+      "control_id": "PR.DS-6",
+      "control_name": "Integrity checking mechanisms are used",
+      "description": "Digest pinning binds a workload to verified immutable image content."
+    },
     "AZ-IDN-010": {
       "control_id": "PR.AC-4",
       "control_name": "Access permissions and authorizations are managed",

compliance/frameworks/soc2.json

@@ -263,6 +263,81 @@
       "control_name": "Detects and Monitors Configuration Changes",
       "description": "Managed node OS upgrade channels maintain worker-node security patches through an observable Azure-controlled process."
     },
+    "AZ-AKS-007": {
+      "control_id": "CC6.6",
+      "control_name": "Restricts Access to Information Assets",
+      "description": "Authorized IP ranges restrict AKS API access to approved administration networks."
+    },
+    "AZ-AKS-008": {
+      "control_id": "CC6.6",
+      "control_name": "Restricts Access from Outside Boundaries",
+      "description": "A network policy engine enables workload boundary enforcement."
+    },
+    "AZ-AKS-009": {
+      "control_id": "CC6.6",
+      "control_name": "Restricts Access from Outside Boundaries",
+      "description": "Namespace NetworkPolicy objects enforce workload traffic boundaries."
+    },
+    "AZ-AKS-010": {
+      "control_id": "CC7.1",
+      "control_name": "Detection and Monitoring",
+      "description": "Defender for Containers detects workload threats and vulnerabilities."
+    },
+    "AZ-AKS-011": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "Key Vault or KMS-backed secret protection reduces credential exposure."
+    },
+    "AZ-AKS-012": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "Automatic CSI rotation maintains workload credential controls."
+    },
+    "AZ-AKS-013": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "Privileged container restrictions preserve node isolation."
+    },
+    "AZ-AKS-014": {
+      "control_id": "CC6.6",
+      "control_name": "Restricts Access from Outside Boundaries",
+      "description": "Host network restrictions preserve network isolation."
+    },
+    "AZ-AKS-015": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "Host PID restrictions prevent node process access."
+    },
+    "AZ-AKS-016": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "Host IPC restrictions prevent node communication access."
+    },
+    "AZ-AKS-017": {
+      "control_id": "CC6.1",
+      "control_name": "Logical Access Security",
+      "description": "HostPath restrictions prevent direct node filesystem access."
+    },
+    "AZ-AKS-018": {
+      "control_id": "CC6.3",
+      "control_name": "Role-Based Access",
+      "description": "A cluster-admin allowlist enforces least privilege."
+    },
+    "AZ-AKS-019": {
+      "control_id": "CC8.1",
+      "control_name": "Change Management",
+      "description": "Trusted registries constrain approved deployment sources."
+    },
+    "AZ-AKS-020": {
+      "control_id": "CC8.1",
+      "control_name": "Change Management",
+      "description": "Explicit image versions make workload changes traceable."
+    },
+    "AZ-AKS-021": {
+      "control_id": "CC8.1",
+      "control_name": "Change Management",
+      "description": "Digest pinning makes deployed image content immutable."
+    },
     "AZ-IDN-010": {
       "control_id": "CC6.2",
       "control_name": "Registers and Authorizes Users",

config/aks-kubeconfig-contexts.example.json

@@ -0,0 +1,3 @@
+{
+  "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/platform-prod/providers/Microsoft.ContainerService/managedClusters/aks-prod": "aks-prod-platform-context"
+}

config/aks-security-policy.example.json

@@ -0,0 +1,7 @@
+{
+  "approved_authorized_ip_ranges": ["203.0.113.0/24"],
+  "trusted_registry_prefixes": ["contoso.azurecr.io/"],
+  "allowed_cluster_admin_subjects": ["Group:aks-platform-admins"],
+  "excluded_namespaces": ["kube-system", "gatekeeper-system"],
+  "require_image_digests": true
+}