Kubernetes Clusters Should Not Grant CAPSYSADMIN Security Capabilities

Description:

To reduce the attack surface of your containers, restrict CAP_SYS_ADMIN Linux capabilities.

Solution/Reference: 

Security Center lists the pods running containers that have the CAP_SYS_ADMIN Linux security capability. To remove a containers' CAP_SYS_ADMIN Linux security capabilities:
1. From the unhealthy resources tab, select the cluster.
2. Insert a capabilities section in the securityContext section of the container manifest with Drop: CAP_SYS_ADMIN.
3. After making your changes, redeploy the pod with the updated capabilities

For more information, see https://aka.ms/kubepolicydoc.