The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

The following exceptions must be fixed prior to maturity review:

1. test ID AUTH-9328 (Default umask values)

Reason: <Oleg Berzin> Cannot fix AUTH-9328 because changing unmask value to 027 caused lynis test suite to fail (does not run)

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

the security issues observed seem to be specific to microk8s cluster. We ran the sonobuoy tests & kube-hunter against k3s and there are no issues in the master setup. We are working with Canonical to review our configuration.

The following exceptions must be fixed prior to maturity review:

1. Information Disclosure:  Exposed pods.   An attacker could view sensitive information about pods that are bound to a Node using the /pods endpoint.
2. KHV043 (Information Disclosure):  Cluster Health Disclosure.  By accessing the open /healthz handler, an attacker could get the cluster health state without authenticating.
3. KHV044  (Access Risk):  Pivileged Container.  A privileged container exists on a node, could expose the node /cluster to unwanted root operations.