From 15606d6db100e2af0da1ee16d39cc8afa1f6cb0b Mon Sep 17 00:00:00 2001 From: Andy Pitcher Date: Fri, 15 Sep 2023 22:14:01 -0400 Subject: [PATCH] Escape values with backslash Avoids markdown compilation issues --- ...ssessment-guide-with-cis-v1.7-k8s-v1.25.md | 52 +++++++++---------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md index 0128743eabe..4937ffd1a99 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md @@ -257,7 +257,7 @@ root:root **Remediation:** Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 +For example, chmod 600 \ **Audit:** @@ -285,7 +285,7 @@ permissions=600 permissions=644 **Remediation:** Run the below command (based on the file location on your system) on the control plane node. For example, -chown root:root +chown root:root \ **Audit:** @@ -678,8 +678,8 @@ Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= +--kubelet-client-certificate=\ +--kubelet-client-key=\ **Audit:** @@ -709,7 +709,7 @@ Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority=/ +--kubelet-certificate-authority=\ **Audit:** @@ -824,7 +824,7 @@ Follow the Kubernetes documentation and set the desired limits in a configuratio Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml and set the below parameters. --enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= +--admission-control-config-file=\ **Audit:** @@ -1237,7 +1237,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the --service-account-key-file parameter to the public key file for service accounts. For example, ---service-account-key-file= +--service-account-key-file=\ **Audit:** @@ -1266,8 +1266,8 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= +--etcd-certfile=\ +--etcd-keyfile=\ **Audit:** @@ -1296,8 +1296,8 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= +--tls-cert-file=\ +--tls-private-key-file=\ **Audit:** @@ -1326,7 +1326,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the client certificate authority file. ---client-ca-file= +--client-ca-file=\ **Audit:** @@ -1355,7 +1355,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= +--etcd-cafile=\ **Audit:** @@ -1384,7 +1384,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= +For example, --encryption-provider-config=\ **Audit:** @@ -1537,7 +1537,7 @@ root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-d Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the control plane node and set the --service-account-private-key-file parameter to the private key file for service accounts. ---service-account-private-key-file= +--service-account-private-key-file=\ **Audit:** @@ -1565,7 +1565,7 @@ root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-d **Remediation:** Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= +--root-ca-file=\ **Audit:** @@ -1688,8 +1688,8 @@ root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --au Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. ---cert-file= ---key-file= +--cert-file=\ +--key-file=\ Not Applicable. ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) @@ -1741,8 +1741,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro for your etcd cluster. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameters. ---peer-client-file= ---peer-key-file= +--peer-client-file=\ +--peer-key-file=\ Not Applicable. ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) @@ -1795,7 +1795,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup etcd service. Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master node and set the below parameter. ---trusted-ca-file= +--trusted-ca-file=\ **Audit:** @@ -2032,7 +2032,7 @@ root:root **Remediation:** Run the following command to modify the file permissions of the ---client-ca-file chmod 600 +--client-ca-file chmod 600 \ **Audit Script:** `check_cafile_permissions.sh` @@ -2071,7 +2071,7 @@ permissions=600 **Remediation:** Run the following command to modify the ownership of the --client-ca-file. -chown root:root +chown root:root \ **Audit Script:** `check_cafile_ownership.sh` @@ -2248,7 +2248,7 @@ the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= +--client-ca-file=\ Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service @@ -2459,8 +2459,8 @@ to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= +--tls-cert-file=\ +--tls-private-key-file=\ Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service