AzInitiativeAdvertizer

last sync: 2025-Oct-31 18:22:44 UTC

[Preview]: Nexus Compute Cluster Security Baseline

Azure BuiltIn Policy Initiative (PolicySet)

Source

Azure Portal

Display name

[Preview]: Nexus Compute Cluster Security Baseline

336cb876-5cb8-4795-b9d1-bd9323d3487e

Version

1.2.0-preview
Details on versioning

Versioning

Versions supported for Versioning: 3
1.2.0-preview
1.1.0-preview
1.0.0-preview
Built-in Versioning [Preview]

Category

Nexus
Microsoft Learn

Description

This initiative includes policies designed to reflect the security baseline expectations of Nexus Compute Clusters. It ensures that the cluster configurations adhere to specific security controls that are critical for maintaining a secure environment.

Cloud environments

AzureCloud = true
AzureChinaCloud = unknown
AzureUSGovernment = unknown

Available in AzUSGov

Unknown, no evidence if PolicySet definition is/not available in AzureUSGovernment

Type

BuiltIn

Deprecated

False

Preview

True

Policy-used summary

Policy types	Policy states	Policy categories
Total Policies: 13 Builtin Policies: 13 Static Policies: 0	GA: 13	1 categories: Kubernetes: 13

Policy-used

Policy DisplayName	Policy Id	Category	Version	Versioning	Effect	State	policy in AzUSGov
Kubernetes cluster containers should only use allowed capabilities	c26596ff-4d70-4e6a-9a30-c2506bd2f80c	Kubernetes	6.2.0	2x 6.2.0, 6.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster containers should only use allowed images	febd0533-8e55-448f-b837-bd0e06f16469	Kubernetes	9.3.0	4x 9.3.0, 9.2.0, 9.1.1, 9.1.0	Default Deny Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster containers should only use allowed pull policy	50c83470-d2f0-4dda-a716-1938a4825f62	Kubernetes	3.2.0	2x 3.2.0, 3.1.0	Default Audit Allowed Audit, Deny, Disabled	GA	true
Kubernetes cluster containers should run with a read only root file system	df49d893-a74c-421d-bc95-c663042e5b80	Kubernetes	6.3.0	3x 6.3.0, 6.2.0, 6.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster pod hostPath volumes should only use allowed host paths	098fc59e-46c7-4d99-9b16-64990e543d75	Kubernetes	6.3.0	3x 6.3.0, 6.2.0, 6.1.1	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster pods should only use allowed volume types	16697877-1118-4fb1-9b65-9898ec2509ec	Kubernetes	5.2.0	2x 5.2.0, 5.1.1	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster pods should only use approved host network and port list	82985f06-dc18-4a48-bc1c-b9f4f0098cfe	Kubernetes	7.0.0	3x 7.0.0, 6.2.0, 6.1.0	Default Audit Allowed Audit, Deny, Disabled	GA	true
Kubernetes cluster services should listen only on allowed ports	233a2a17-77ca-4fb1-9b6b-69223d272a44	Kubernetes	8.2.0	2x 8.2.0, 8.1.0	Default Deny Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster services should only use allowed external IPs	d46c275d-1680-448d-b2ec-e495a3b6cc89	Kubernetes	5.2.0	2x 5.2.0, 5.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster should not allow privileged containers	95edb821-ddaf-4404-9732-666045e056b4	Kubernetes	9.2.0	2x 9.2.0, 9.1.0	Default Deny Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true
Kubernetes cluster should not use naked pods	65280eef-c8b4-425e-9aec-af55e55bf581	Kubernetes	2.3.1	4x 2.3.1, 2.3.0, 2.2.0, 2.1.0	Default Audit Allowed Audit, Deny, Disabled	GA	true
Kubernetes clusters should not allow container privilege escalation	1c6e92c9-99f0-4e55-9cf2-0c234dc48f99	Kubernetes	8.0.0	3x 8.0.0, 7.2.0, 7.1.0	Default Audit Allowed Audit, Deny, Disabled	GA	true
Kubernetes clusters should not use the default namespace	9f061a12-e40d-4183-a00e-171812443373	Kubernetes	4.2.0	2x 4.2.0, 4.1.0	Default Audit Allowed audit, Audit, deny, Deny, disabled, Disabled	GA	true

Roles used

No Roles used

History

Date/Time (UTC ymd) (i)	Changes
2025-10-30 18:22:48	Version change: '1.1.0-preview' to '1.2.0-preview'
2025-07-16 17:22:33	Version change: '1.0.0-preview' to '1.1.0-preview'
2024-09-26 17:50:01	add Initiative 336cb876-5cb8-4795-b9d1-bd9323d3487e

JSON compare

compare mode: version left: version right:

JSON

api-version=2023-04-01
EPAC