Implement enterprise AKS and container workload security rules

Objective

Implement Azure Kubernetes Service and container workload security controls across Azure control-plane, Defender, and Kubernetes evidence sources.

Scope

Implement these controls:

1. The AKS API server lacks approved IP restrictions.
2. An AKS cluster has no Kubernetes network policy.
3. Defender for Containers protection is disabled for an in-scope cluster.
4. AKS secrets lack required Key Vault or KMS-backed protection.
5. Secrets Store CSI secret rotation is disabled.
6. A workload permits privileged containers.
7. A workload permits unrestricted host network, host PID, or host IPC access.
8. A workload permits unrestricted hostPath volumes.
9. Kubernetes cluster-admin access is assigned too broadly.
10. A workload uses untrusted registries, mutable tags, or the latest image tag.

Collection architecture

• Azure Resource Manager and AKS management APIs.
• Defender for Cloud plans and recommendations.
• Kubernetes API for namespaces, workloads, pod security context, RBAC, network policies, CSI configuration, and images.
• Key Vault/KMS integration metadata and cluster identity configuration.

Required implementation behavior

• Handle private, stopped, unreachable, unsupported, and unauthorized clusters explicitly.
• Return NOT_APPLICABLE when no eligible cluster or workload exists.
• Return UNKNOWN for unavailable credentials, API errors, incomplete namespace discovery, or insufficient permissions.
• Return FAIL only from positive evidence of an unsafe setting.
• Include cluster, namespace, workload, container, image, subject, role, evidence, remediation, permissions, severity, confidence, and UNKNOWN reason.
• Do not treat an unavailable optional add-on as a failure without confirming scope.

Delivery order

1. AKS API restrictions, network policy, Defender, and secret integration.
2. CSI rotation and pod security context rules.
3. HostPath, RBAC, registry trust, and image-tag rules.

Acceptance criteria

• Every rule has collector, evaluator, remediation, documentation, and verified mappings.
• Tests cover secure and violating manifests, RBAC, network policies, CSI, Defender state, empty clusters, unreachable clusters, malformed data, and partial permissions.
• Unsupported or inaccessible clusters never produce false findings.
• No TBD framework mappings remain.
• Scanner, serialization, compliance, and CI-equivalent tests pass.
• An origin-branch PR references this issue.