工作负载配置审核根据 Pod 安全标准中的部分政策检查每个已部署的工作负载。工作负载配置审核在 Google 的基础架构上进行，并且不使用节点上的计算资源。
工作负载配置审核的优势
自动检测所有工作负载中的已知配置问题。
获取切实可行的建议来改善安全状况。
使用 Google Cloud 控制台大致了解配置问题。
使用 Logging 可获取问题可审核的跟踪记录，有助于提高报告功能和可观测性。
工作负载配置审核的工作原理
对于每个符合条件的已部署工作负载，GKE 都会不断扫描工作负载的规范，并将字段和值与底层安全政策中定义的控件进行比较。例如，具有 spec.containers.securityContext.privileged=true 的 Pod 违反了基准 Pod 安全标准，spec.securityContext.runAsNonRoot 字段设置为 false 的 Pod 违反了受限标准。如需查看 GKE 检查的安全政策列表，请参阅工作负载配置审核检查的内容。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-03。"],[],[],null,["# About Kubernetes security posture scanning\n\n[Autopilot](/kubernetes-engine/docs/concepts/autopilot-overview) [Standard](/kubernetes-engine/docs/concepts/choose-cluster-mode)\n\n*** ** * ** ***\n\nThis page describes *Kubernetes security posture scanning* , a feature\nof the [security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard)\nthat helps you proactively identify and address security vulnerabilities in your\nGoogle Kubernetes Engine (GKE) clusters. This page explains workload configuration\nauditing and security bulletin surfacing for finding and mitigating security\nrisks in GKE.\n\nThis page is for Security specialists who monitor clusters for security issues.\nTo learn more about common roles and example tasks that we reference in\nGoogle Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nTo enable and use Kubernetes security posture scanning, see\n[Automatically audit workloads for configuration issues](/kubernetes-engine/docs/how-to/protect-workload-configuration#overview)\n\nKubernetes security posture scanning provides the following features:\n\n- [Workload configuration auditing](#why-use-configuration-scanning)\n- [Actionable security bulletin surfacing](#security-bulletins)\n\nPricing\n-------\n\nOffered at no extra charge in GKE.\n\nEntries added to Cloud Logging are subject to\n[Cloud Logging pricing](/stackdriver/pricing#logging-costs).\n\nAbout workload configuration auditing\n-------------------------------------\n\nThe workloads that you deploy on GKE should have a\nhardened configuration that limits their attack surface. Checking workloads\nacross clusters for configuration issues can be difficult to do manually at\nscale. You can use the security posture dashboard to automatically audit the\nconfiguration of all your running workloads across multiple clusters and return\nactionable, scored results and opinionated recommendations to improve your\nsecurity posture.\n\nWorkload configuration auditing checks each deployed workload against a subset\nof policies in the\n[Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/).\nWorkload configuration auditing happens on Google's infrastructure and\ndoesn't use compute resources on your nodes.\n\n### Benefits of workload configuration auditing\n\n- Automate detection of known configuration concerns across all workloads.\n- Get actionable recommendations to improve security posture.\n- Use the Google Cloud console to get a high-level view of configuration concerns.\n- Use Logging to get an auditable trail of concerns for better reporting and observability.\n\n### How workload configuration auditing works\n\nFor each eligible deployed workload, GKE continuously scans the\nworkload's specification and compares the fields and values to the controls\ndefined in the underlying security policy. For example, a Pod with\n`spec.containers.securityContext.privileged=true` violates the Baseline Pod\nSecurity Standard, and a Pod with the `spec.securityContext.runAsNonRoot` field\nset to `false` violates the Restricted standard. For a list of the security\npolicies that GKE checks, refer to\n[What does workload configuration auditing check?](#what-checks).\n\nAfter scanning and discovering concerns, GKE rates the severity\nof discovered configuration issues based on the built-in security hardening\nmeasures. GKE assigns a\n[severity rating](/kubernetes-engine/docs/concepts/about-security-posture-dashboard#severity-ratings)\nthat can inform the speed with which you respond to the concern. The\nGoogle Cloud console displays the results and recommended actions you can take to\nfix the concerns. GKE also adds entries to Cloud Logging for\ntracing and auditing.\n\n### What does workload configuration auditing check?\n\nAdditionally, GKE checks for any RBAC RoleBindings or\nClusterRoleBindings that reference one of the following users or groups:\n\n- `system:anonymous`\n- `system:authenticated`\n- `system:unauthenticated`\n\nIf any RBAC bindings that reference these users or groups exist, a finding\nnamed **Effectively Anonymous Users Granted GKE Cluster Access** with a severity\nof **Medium** appears in the security posture dashboard. These users and\ngroups are effectively anonymous and shouldn't be used in RoleBindings or\nClusterRoleBindings. For more information, see\n[Avoid default roles and groups](/kubernetes-engine/docs/best-practices/rbac#default-roles-groups).\n\nAbout security bulletin surfacing\n---------------------------------\n\nWhen a vulnerability is discovered in GKE, we\npatch the vulnerability and publish a security bulletin for the\nvulnerability. For information about identification, patching, and\ntimelines, refer to\n[GKE security patching](/kubernetes-engine/docs/resources/security-patching).\n\nThe security posture dashboard displays security bulletins that affect your\nclusters, workloads, and Standard mode node pools. This feature is a\npart of the *Kubernetes security posture* capability of the security posture dashboard\nand is automatically enabled when you create an Autopilot or Standard\ncluster. To enable Kubernetes security posture scanning, use\nthe instructions in\n[Automatically audit workloads for configuration issues](/kubernetes-engine/docs/how-to/protect-workload-configuration).\n\nThe Google Cloud console displays details such as affected clusters,\nversions, and recommended patch versions for upgrades to mitigate the\nvulnerability. You only see bulletins for which a mitigation is available in\nyour cluster's Google Cloud region or zone.\n\nTo view bulletins for clusters that you enrolled in Kubernetes security posture\nscanning, go to the security posture dashboard:\n\n[Go to Security Posture](https://console.cloud.google.com/kubernetes/security)\n\nAny available bulletins that affect your environment appear in the\n**Security bulletins** section.\n\nWhat's next\n-----------\n\n- [Learn about the security posture dashboard](/kubernetes-engine/docs/concepts/about-security-posture-dashboard).\n- [Learn how to implement workload configuration auditing](/kubernetes-engine/docs/how-to/protect-workload-configuration)."]]
