UCF STIG Viewer Logo

Kubernetes must remove old components after updated versions have been installed.


Finding ID Version Rule ID IA Controls Severity
V-242442 CNTR-K8-002700 SV-242442r878098_rule Medium
Previous versions of Kubernetes components that are not removed after updates have been installed may be exploited by adversaries by allowing the vulnerabilities to still exist within the cluster. It is important for Kubernetes to remove old pods when newer pods are created using new images to always be at the desired security state.
Kubernetes Security Technical Implementation Guide 2022-12-02


Check Text ( C-45717r863905_chk )
To view all pods and the images used to create the pods, from the Control Plane, run the following command:
kubectl get pods --all-namespaces -o jsonpath="{..image}" | \
tr -s '[[:space:]]' '\n' | \
sort | \
uniq -c

Review the images used for pods running within Kubernetes.

If there are multiple versions of the same image, this is a finding.
Fix Text (F-45675r863906_fix)
Remove any old pods that are using older images. On the Control Plane, run the command:
kubectl delete pod podname
(Note: "podname" is the name of the pod to delete.)