public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-30 23:14:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Escape <txt> values with backslash

Browse Source 
Avoids markdown compilation issues
This commit is contained in:
Andy Pitcher
2023-09-20 23:37:08 -03:00
committed by Guilherme Macedo
parent 40cd732265
commit 15606d6db1
1 changed files with 26 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md
+26 -26
View File
@@ -257,7 +257,7 @@ root:root
**Remediation:** **Remediation:**
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 <path/to/cni/files> For example, chmod 600 \<path/to/cni/files\>
**Audit:** **Audit:**
@@ -285,7 +285,7 @@ permissions=600 permissions=644
**Remediation:** **Remediation:**
Run the below command (based on the file location on your system) on the control plane node. Run the below command (based on the file location on your system) on the control plane node.
For example, For example,
chown root:root <path/to/cni/files> chown root:root \<path/to/cni/files\>
**Audit:** **Audit:**
@@ -678,8 +678,8 @@ Follow the Kubernetes documentation and set up the TLS connection between the
apiserver and kubelets. Then, edit API server pod specification file apiserver and kubelets. Then, edit API server pod specification file
/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the
kubelet client certificate and key parameters as below. kubelet client certificate and key parameters as below.
--kubelet-client-certificate=<path/to/client-certificate-file> --kubelet-client-certificate=\<path/to/client-certificate-file\>
--kubelet-client-key=<path/to/client-key-file> --kubelet-client-key=\<path/to/client-key-file\>
**Audit:** **Audit:**
@@ -709,7 +709,7 @@ Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file the apiserver and kubelets. Then, edit the API server pod specification file
/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=/<ca-string/> --kubelet-certificate-authority=\<ca-string\>
**Audit:** **Audit:**
@@ -824,7 +824,7 @@ Follow the Kubernetes documentation and set the desired limits in a configuratio
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
and set the below parameters. and set the below parameters.
--enable-admission-plugins=...,EventRateLimit,... --enable-admission-plugins=...,EventRateLimit,...
--admission-control-config-file=<path/to/configuration/file> --admission-control-config-file=\<path/to/configuration/file\>
**Audit:** **Audit:**
@@ -1237,7 +1237,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the --service-account-key-file parameter on the control plane node and set the --service-account-key-file parameter
to the public key file for service accounts. For example, to the public key file for service accounts. For example,
--service-account-key-file=<filename> --service-account-key-file=\<filename\>
**Audit:** **Audit:**
@@ -1266,8 +1266,8 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the etcd certificate and key file parameters. on the control plane node and set the etcd certificate and key file parameters.
--etcd-certfile=<path/to/client-certificate-file> --etcd-certfile=\<path/to/client-certificate-file\>
--etcd-keyfile=<path/to/client-key-file> --etcd-keyfile=\<path/to/client-key-file\>
**Audit:** **Audit:**
@@ -1296,8 +1296,8 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the TLS certificate and private key file parameters. on the control plane node and set the TLS certificate and private key file parameters.
--tls-cert-file=<path/to/tls-certificate-file> --tls-cert-file=\<path/to/tls-certificate-file\>
--tls-private-key-file=<path/to/tls-key-file> --tls-private-key-file=\<path/to/tls-key-file\>
**Audit:** **Audit:**
@@ -1326,7 +1326,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the client certificate authority file. on the control plane node and set the client certificate authority file.
--client-ca-file=<path/to/client-ca-file> --client-ca-file=\<path/to/client-ca-file\>
**Audit:** **Audit:**
@@ -1355,7 +1355,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the etcd certificate authority file parameter. on the control plane node and set the etcd certificate authority file parameter.
--etcd-cafile=<path/to/ca-file> --etcd-cafile=\<path/to/ca-file\>
**Audit:** **Audit:**
@@ -1384,7 +1384,7 @@ root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file
Follow the Kubernetes documentation and configure a EncryptionConfig file. Follow the Kubernetes documentation and configure a EncryptionConfig file.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the control plane node and set the --encryption-provider-config parameter to the path of that file. on the control plane node and set the --encryption-provider-config parameter to the path of that file.
For example, --encryption-provider-config=</path/to/EncryptionConfig/File> For example, --encryption-provider-config=\</path/to/EncryptionConfig/File\>
**Audit:** **Audit:**
@@ -1537,7 +1537,7 @@ root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-d
Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
on the control plane node and set the --service-account-private-key-file parameter on the control plane node and set the --service-account-private-key-file parameter
to the private key file for service accounts. to the private key file for service accounts.
--service-account-private-key-file=<filename> --service-account-private-key-file=\<filename\>
**Audit:** **Audit:**
@@ -1565,7 +1565,7 @@ root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-d
**Remediation:** **Remediation:**
Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
--root-ca-file=<path/to/file> --root-ca-file=\<path/to/file\>
**Audit:** **Audit:**
@@ -1688,8 +1688,8 @@ root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --au
Follow the etcd service documentation and configure TLS encryption. Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters. on the master node and set the below parameters.
--cert-file=</path/to/ca-file> --cert-file=\</path/to/ca-file\>
--key-file=</path/to/key-file> --key-file=\</path/to/key-file\>
Not Applicable. Not Applicable.
### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated)
@@ -1741,8 +1741,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
for your etcd cluster. for your etcd cluster.
Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
master node and set the below parameters. master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file> --peer-client-file=\</path/to/peer-cert-file\>
--peer-key-file=</path/to/peer-key-file> --peer-key-file=\</path/to/peer-key-file\>
Not Applicable. Not Applicable.
### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)
@@ -1795,7 +1795,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
etcd service. etcd service.
Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
master node and set the below parameter. master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file> --trusted-ca-file=\</path/to/ca-file\>
**Audit:** **Audit:**
@@ -2032,7 +2032,7 @@ root:root
**Remediation:** **Remediation:**
Run the following command to modify the file permissions of the Run the following command to modify the file permissions of the
--client-ca-file chmod 600 <filename> --client-ca-file chmod 600 \<filename\>
**Audit Script:** `check_cafile_permissions.sh` **Audit Script:** `check_cafile_permissions.sh`
@@ -2071,7 +2071,7 @@ permissions=600
**Remediation:** **Remediation:**
Run the following command to modify the ownership of the --client-ca-file. Run the following command to modify the ownership of the --client-ca-file.
chown root:root <filename> chown root:root \<filename\>
**Audit Script:** `check_cafile_ownership.sh` **Audit Script:** `check_cafile_ownership.sh`
@@ -2248,7 +2248,7 @@ the location of the client CA file.
If using command line arguments, edit the kubelet service file If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable. set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file> --client-ca-file=\<path/to/client-ca-file\>
Based on your system, restart the kubelet service. For example, Based on your system, restart the kubelet service. For example,
systemctl daemon-reload systemctl daemon-reload
systemctl restart kubelet.service systemctl restart kubelet.service
@@ -2459,8 +2459,8 @@ to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable. set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file> --tls-cert-file=\<path/to/tls-certificate-file\>
--tls-private-key-file=<path/to/tls-key-file> --tls-private-key-file=\<path/to/tls-key-file\>
Based on your system, restart the kubelet service. For example, Based on your system, restart the kubelet service. For example,
systemctl daemon-reload systemctl daemon-reload
systemctl restart kubelet.service systemctl restart kubelet.service