Enclose in backticks so <&tag> aren't processed as HTML tags - 2

docs/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md

@@ -677,8 +677,8 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e
 Follow the Kubernetes documentation and setup the TLS connection between
 the apiserver and kubelets. Then, edit the API server pod specification file
 /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
---kubelet-certificate-authority=<ca-string>
+`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
+`--kubelet-certificate-authority=<ca-string>`
 
 **Audit:**
 
@@ -1288,7 +1288,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the --service-account-key-file parameter
 to the public key file for service accounts:
---service-account-key-file=<filename>
+`--service-account-key-file=<filename>`
 
 **Audit:**
 
@@ -1317,8 +1317,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate and key file parameters.
---etcd-certfile=<path/to/client-certificate-file>
---etcd-keyfile=<path/to/client-key-file>
+`--etcd-certfile=<path/to/client-certificate-file>`
+`--etcd-keyfile=<path/to/client-key-file>`
 
 **Audit:**
 
@@ -1347,8 +1347,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the TLS certificate and private key file parameters.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 
 **Audit:**
 
@@ -1377,7 +1377,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the client certificate authority file.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 
 **Audit:**
 
@@ -1406,7 +1406,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate authority file parameter.
---etcd-cafile=<path/to/ca-file>
+`--etcd-cafile=<path/to/ca-file>`
 
 **Audit:**
 
@@ -1626,7 +1626,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.
 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
 on the master node and set the --service-account-private-key-file parameter
 to the private key file for service accounts.
---service-account-private-key-file=<filename>
+`--service-account-private-key-file=<filename>`
 
 **Audit:**
 
@@ -1654,7 +1654,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.
 **Remediation:**
 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
 on the master node and set the --root-ca-file parameter to the certificate bundle file`.
---root-ca-file=<path/to/file>
+`--root-ca-file=<path/to/file>`
 
 **Audit:**
 
@@ -1779,8 +1779,8 @@ root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernete
 Follow the etcd service documentation and configure TLS encryption.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
 on the master node and set the below parameters.
---cert-file=</path/to/ca-file>
---key-file=</path/to/key-file>
+`--cert-file=</path/to/ca-file>`
+`--key-file=</path/to/key-file>`
 
 **Audit:**
 
@@ -1866,8 +1866,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
 for your etcd cluster.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
 master node and set the below parameters.
---peer-client-file=</path/to/peer-cert-file>
---peer-key-file=</path/to/peer-key-file>
+`--peer-client-file=</path/to/peer-cert-file>`
+`--peer-key-file=</path/to/peer-key-file>`
 
 **Audit:**
 
@@ -1954,7 +1954,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
 etcd service.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
 master node and set the below parameter.
---trusted-ca-file=</path/to/ca-file>
+`--trusted-ca-file=</path/to/ca-file>`
 
 **Audit:**
 
@@ -2145,7 +2145,7 @@ root:root
 
 **Remediation:**
 Run the following command to modify the file permissions of the
---client-ca-file chmod 644 <filename>
+`--client-ca-file chmod 644 <filename>`
 
 **Audit Script:** `check_cafile_permissions.sh`
 
@@ -2305,7 +2305,7 @@ the location of the client CA file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameter in KUBELET_AUTHZ_ARGS variable.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service
@@ -2526,8 +2526,8 @@ to the location of the corresponding private key file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service

docs/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md

@@ -869,8 +869,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Follow the Kubernetes documentation and setup the TLS connection between
 the apiserver and kubelets. Then, edit the API server pod specification file
 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the
---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
---kubelet-certificate-authority=<ca-string>
+`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
+`--kubelet-certificate-authority=<ca-string>`
 
 **Audit:**
 
@@ -1468,7 +1468,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
 on the master node and set the --service-account-key-file parameter
 to the public key file for service accounts:
---service-account-key-file=<filename>
+`--service-account-key-file=<filename>`
 
 **Audit:**
 
@@ -1497,8 +1497,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate and key file parameters.
---etcd-certfile=<path/to/client-certificate-file>
---etcd-keyfile=<path/to/client-key-file>
+`--etcd-certfile=<path/to/client-certificate-file>`
+`--etcd-keyfile=<path/to/client-key-file>`
 
 **Audit:**
 
@@ -1527,8 +1527,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
 on the master node and set the TLS certificate and private key file parameters.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 
 **Audit:**
 
@@ -1557,7 +1557,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
 on the master node and set the client certificate authority file.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 
 **Audit:**
 
@@ -1586,7 +1586,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate authority file parameter.
---etcd-cafile=<path/to/ca-file>
+`--etcd-cafile=<path/to/ca-file>`
 
 **Audit:**
 
@@ -1787,7 +1787,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d
 Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
 on the master node and set the --service-account-private-key-file parameter
 to the private key file for service accounts.
---service-account-private-key-file=<filename>
+`--service-account-private-key-file=<filename>`
 
 **Audit:**
 
@@ -1815,7 +1815,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d
 **Remediation:**
 Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
 on the master node and set the --root-ca-file parameter to the certificate bundle file`.
---root-ca-file=<path/to/file>
+`--root-ca-file=<path/to/file>`
 
 **Audit:**
 
@@ -1938,8 +1938,8 @@ root 5533 5414 0 14:58 ? 00:00:02 kube-scheduler --permit-port-sharing=true --ad
 Follow the etcd service documentation and configure TLS encryption.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
 on the master node and set the below parameters.
---cert-file=</path/to/ca-file>
---key-file=</path/to/key-file>
+`--cert-file=</path/to/ca-file>`
+`--key-file=</path/to/key-file>`
 
 ### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated)
 
@@ -1989,8 +1989,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
 for your etcd cluster.
 Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
 master node and set the below parameters.
---peer-client-file=</path/to/peer-cert-file>
---peer-key-file=</path/to/peer-key-file>
+`--peer-client-file=</path/to/peer-cert-file>`
+`--peer-key-file=</path/to/peer-key-file>`
 
 ### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)
 
@@ -2041,7 +2041,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
 etcd service.
 Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
 master node and set the below parameter.
---trusted-ca-file=</path/to/ca-file>
+`--trusted-ca-file=</path/to/ca-file>`
 
 **Audit:**
 
@@ -2258,7 +2258,7 @@ root:root
 
 **Remediation:**
 Run the following command to modify the file permissions of the
---client-ca-file chmod 644 <filename>
+`--client-ca-file chmod 644 <filename>`
 
 **Audit:**
 
@@ -2438,7 +2438,7 @@ the location of the client CA file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameter in KUBELET_AUTHZ_ARGS variable.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service
@@ -2693,8 +2693,8 @@ to the location of the corresponding private key file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service
@@ -2929,7 +2929,7 @@ echo "true"
 **Audit Execution:**
 
 ```bash
-./check_for_default_sa.sh 
+./check_for_default_sa.sh
 ```
 
 **Expected Result**:
@@ -3228,7 +3228,7 @@ echo "true"
 **Audit Execution:**
 
 ```bash
-./check_for_rke2_network_policies.sh 
+./check_for_rke2_network_policies.sh
 ```
 
 **Expected Result**: