public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-05-17 10:25:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

EIO-4: corrections needed to address issues found in 5.1.5 tests

Browse Source
This commit is contained in:
Nelson Roberts
2020-06-05 16:20:43 -07:00
committed by Catherine Luse
parent 32b98275b1
commit 178f2cf3af
4 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/security/benchmark-2.3.5/_index.md
+1 -1
View File
@@ -1975,7 +1975,7 @@ systemctl restart kubelet.service
#### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
**Result:** PASS
**Result:** FAIL
**Remediation:**
Create explicit service accounts wherever a Kubernetes workload requires specific access
content/rancher/v2.x/en/security/benchmark-2.4/_index.md
+2 -2
View File
@@ -1975,7 +1975,7 @@ systemctl restart kubelet.service
#### 5.1.5 Ensure that default service accounts are not actively used. (Scored)
**Result:** PASS
**Result:** FAIL
**Remediation:**
Create explicit service accounts wherever a Kubernetes workload requires specific access
@@ -2006,7 +2006,7 @@ if [[ "${accounts}" != "" ]]; then
exit 1
fi
default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name=="default").metadata.uid' | wc -l)"
default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" and .metadata.name!="default").metadata.uid' | wc -l)"
if [[ "${default_binding}" -gt 0 ]]; then
echo "fail: default service accounts have non default bindings"
content/rancher/v2.x/en/security/hardening-2.3.5/_index.md
+2 -1
View File
@@ -24,7 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
#### Known Issues
Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
### Configure Kernel Runtime Parameters
content/rancher/v2.x/en/security/hardening-2.4/_index.md
+2 -1
View File
@@ -24,7 +24,8 @@ For more detail about evaluating a hardened cluster against the official CIS ben
#### Known Issues
Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
- Rancher **exec shell** and **view logs** for pods are **not** functional in a cis 1.5 hardened setup when only public ip is provided when registering custom nodes.
- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
### Configure Kernel Runtime Parameters