public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update rke-hardening-guide based on CIS-1.24 and CIS-1.7 by removing --protect-kernel-defaults and updating notes

Browse Source
This commit is contained in:
Andy Pitcher
2023-08-22 16:56:10 +02:00
parent aed5f8fbbe
commit 0b9a2bc991
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pages-for-subheaders/rke1-hardening-guide.md
+3 -4
View File
@@ -12,10 +12,11 @@ This hardening guide is intended to be used for RKE clusters and is associated w
| Rancher Version | CIS Benchmark Version | Kubernetes Version |
|-----------------|-----------------------|------------------------------|
| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.23 up to v1.25 |
| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.24 up to v1.25 |
:::note
At the time of writing, the upstream CIS Kubernetes v1.25 benchmark is not yet available in Rancher. At this time Rancher is using the CIS v1.23 benchmark when scanning Kubernetes v1.25 clusters. Due to that, the CIS checks 5.2.3, 5.2.4, 5.2.5 and 5.2.6 might fail.
- Since Benchmark v1.24, check id `4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)` might fail, as /etc/kubernetes/ssl/kube-ca.pem is provisioned in 644 by default.
- Since Benchmark v1.7 (latest), `--protect-kernel-defaults` (check id 4.2.6) parameter is not required anymore, and was replaced.
:::
For more details on how to evaluate a hardened RKE cluster against the official CIS benchmark, refer to the RKE self-assessment guides for specific Kubernetes and CIS benchmark versions.
@@ -243,7 +244,6 @@ services:
kubelet:
extra_args:
feature-gates: RotateKubeletServerCertificate=true
protect-kernel-defaults: "true"
generate_serving_certificate: true
addons: |
apiVersion: networking.k8s.io/v1
@@ -293,7 +293,6 @@ services:
kubelet:
extra_args:
feature-gates: RotateKubeletServerCertificate=true
protect-kernel-defaults: true
generate_serving_certificate: true
addons: |
# Upstream Kubernetes restricted PSP policy