From 0b9a2bc9917517e180146fb1db20a7c2c60d68e8 Mon Sep 17 00:00:00 2001 From: Andy Pitcher Date: Tue, 22 Aug 2023 16:56:10 +0200 Subject: [PATCH] Update rke-hardening-guide based on CIS-1.24 and CIS-1.7 by removing --protect-kernel-defaults and updating notes --- docs/pages-for-subheaders/rke1-hardening-guide.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/docs/pages-for-subheaders/rke1-hardening-guide.md b/docs/pages-for-subheaders/rke1-hardening-guide.md index 6a187df3273..d842af82859 100644 --- a/docs/pages-for-subheaders/rke1-hardening-guide.md +++ b/docs/pages-for-subheaders/rke1-hardening-guide.md @@ -12,10 +12,11 @@ This hardening guide is intended to be used for RKE clusters and is associated w | Rancher Version | CIS Benchmark Version | Kubernetes Version | |-----------------|-----------------------|------------------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.23 up to v1.25 | +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.24 up to v1.25 | :::note -At the time of writing, the upstream CIS Kubernetes v1.25 benchmark is not yet available in Rancher. At this time Rancher is using the CIS v1.23 benchmark when scanning Kubernetes v1.25 clusters. Due to that, the CIS checks 5.2.3, 5.2.4, 5.2.5 and 5.2.6 might fail. +- Since Benchmark v1.24, check id `4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)` might fail, as /etc/kubernetes/ssl/kube-ca.pem is provisioned in 644 by default. +- Since Benchmark v1.7 (latest), `--protect-kernel-defaults` (check id 4.2.6) parameter is not required anymore, and was replaced. ::: For more details on how to evaluate a hardened RKE cluster against the official CIS benchmark, refer to the RKE self-assessment guides for specific Kubernetes and CIS benchmark versions. @@ -243,7 +244,6 @@ services: kubelet: extra_args: feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: "true" generate_serving_certificate: true addons: | apiVersion: networking.k8s.io/v1 @@ -293,7 +293,6 @@ services: kubelet: extra_args: feature-gates: RotateKubeletServerCertificate=true - protect-kernel-defaults: true generate_serving_certificate: true addons: | # Upstream Kubernetes restricted PSP policy