ben.carrasco/prowler
1
0 Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-10-30 23:34:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(kubernetes): clarify the multi-cluster rejection rule

Browse Source
This commit is contained in:
pedrooot committed 2026-10-07 16:38:59 +02:00
1 parent ba08985336
commit ac6c0d0e42
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
docs/user-guide/providers/kubernetes/misc.mdx
+1 -1
View File
@@ -53,7 +53,7 @@ export PROWLER_ALLOWED_PRIVATE_NETWORKS="10.20.0.0/16,192.168.65.254/32"
prowler kubernetes ...
```
The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (`169.254.169.254`), loopback, and the rest of the internal network remain protected. A kubeconfig declaring several clusters is rejected when any one of them resolves outside the allowlist. Malformed entries are rejected, and a non-empty allowlist is logged as a relaxed security control. When unset, only public addresses are reachable.
The value is a comma-separated list of IPs and CIDRs. A resolved address inside an allowlisted range is permitted; every other non-public address stays blocked, so link-local (`169.254.169.254`), loopback, and the rest of the internal network remain protected. A kubeconfig declaring several clusters is rejected when any one of them resolves to a non-public address outside the allowlist. Malformed entries are rejected, and a non-empty allowlist is logged as a relaxed security control. When unset, only public addresses are reachable.
The variable is read by the process that runs the scan: