public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 20:48:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Enclose in backticks so <&tag> aren't processed as HTML tags - 2

Browse Source
This commit is contained in:
Billy Tat
2022-07-18 17:11:31 -07:00
parent 7e4e72da5f
commit 23d774439f
8 changed files with 199 additions and 199 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.3.x/rancher-v2.3.5/benchmark-2.3.5/benchmark-2.3.5.md
+35 -35
View File
@@ -39,7 +39,7 @@ When performing the tests, you will need access to the Docker command line on th
---
## 1 Master Node Security Configuration
### 1.1 Master Node Configuration Files
### 1.1 Master Node Configuration Files
#### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored)
@@ -155,7 +155,7 @@ Run the below command (based on the etcd data directory found above).
For example,
``` bash
chown etcd:etcd /var/lib/etcd
```
```
**Audit Script:** 1.1.12.sh
@@ -189,7 +189,7 @@ docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut
RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run.
We recommend that this `kube_config_cluster.yml` file be kept in secure store.
#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored)
#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored)
**Result:** Not Applicable
@@ -249,7 +249,7 @@ stat -c %U:%G /etc/kubernetes/ssl
'root:root' is present
```
#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored)
#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored)
**Result:** PASS
@@ -732,7 +732,7 @@ on the master node and set the below parameter.
'0' is equal to '0'
```
#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored)
#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored)
**Result:** PASS
@@ -938,7 +938,7 @@ on the master node and set the `--service-account-key-file` parameter
to the public key file for service accounts:
``` bash
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
```
**Audit:**
@@ -953,7 +953,7 @@ to the public key file for service accounts:
'--service-account-key-file' is present
```
#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored)
#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored)
**Result:** PASS
@@ -963,8 +963,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the **etcd** certificate and **key** file parameters.
``` bash
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
```
**Audit:**
@@ -989,8 +989,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the TLS certificate and private key file parameters.
``` bash
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
```
**Audit:**
@@ -1015,7 +1015,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the client certificate authority file.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
**Audit:**
@@ -1040,7 +1040,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the etcd certificate authority file parameter.
``` bash
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
```
**Audit:**
@@ -1202,7 +1202,7 @@ on the master node and set the `--service-account-private-key-file` parameter
to the private key file for service accounts.
``` bash
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
```
**Audit:**
@@ -1226,7 +1226,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku
on the master node and set the `--root-ca-file` parameter to the certificate bundle file`.
``` bash
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
```
**Audit:**
@@ -1311,7 +1311,7 @@ on the master node and set the below parameter.
'false' is equal to 'false'
```
#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored)
#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored)
**Result:** PASS
@@ -1344,8 +1344,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml`
on the master node and set the below parameters.
``` bash
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
```
**Audit:**
@@ -1418,8 +1418,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet
master node and set the below parameters.
``` bash
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
```
**Audit:**
@@ -1485,7 +1485,7 @@ node and either remove the `--peer-auto-tls` parameter or set it to `false`.
## 3 Control Plane Configuration
### 3.2 Logging
#### 3.2.1 Ensure that a minimal audit policy is created (Scored)
#### 3.2.1 Ensure that a minimal audit policy is created (Scored)
**Result:** PASS
@@ -1546,7 +1546,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected result**:
@@ -1561,7 +1561,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Remediation:**
Run the below command (based on the file location on your system) on the each worker node.
For example,
For example,
``` bash
chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
@@ -1570,7 +1570,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected result**:
@@ -1594,7 +1594,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected result**:
@@ -1618,7 +1618,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected result**:
@@ -1635,7 +1635,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
Run the following command to modify the file permissions of the
``` bash
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
```
**Audit:**
@@ -1664,7 +1664,7 @@ chown root:root <filename>
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi'
```
**Expected result**:
@@ -1703,7 +1703,7 @@ set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
``` bash
--anonymous-auth=false
```
Based on your system, restart the kubelet service. For example:
``` bash
@@ -1780,7 +1780,7 @@ If using command line arguments, edit the kubelet service file
set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
Based on your system, restart the kubelet service. For example:
@@ -1926,7 +1926,7 @@ systemctl restart kubelet.service
'true' is equal to 'true'
```
#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored)
#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored)
**Result:** PASS
@@ -1938,7 +1938,7 @@ remove the `--make-iptables-util-chains` argument from the
`KUBELET_SYSTEM_PODS_ARGS` variable.
Based on your system, restart the kubelet service. For example:
```bash
```bash
systemctl daemon-reload
systemctl restart kubelet.service
```
@@ -2091,7 +2091,7 @@ exit 0
**Audit Execution:**
```
./5.1.5.sh
./5.1.5.sh
```
**Expected result**:
@@ -2218,7 +2218,7 @@ echo "pass"
**Audit Execution:**
```
./5.3.2.sh
./5.3.2.sh
```
**Expected result**:
@@ -2258,7 +2258,7 @@ echo "--count=${default_resources}"
**Audit Execution:**
```
./5.6.4.sh
./5.6.4.sh
```
**Expected result**:
versioned_docs/version-2.0-2.4/v2.0-v2.4/en/security/rancher-2.4/benchmark-2.4/benchmark-2.4.md
+35 -35
View File
@@ -39,7 +39,7 @@ When performing the tests, you will need access to the Docker command line on th
---
## 1 Master Node Security Configuration
### 1.1 Master Node Configuration Files
### 1.1 Master Node Configuration Files
#### 1.1.1 Ensure that the API server pod specification file permissions are set to `644` or more restrictive (Scored)
@@ -155,7 +155,7 @@ Run the below command (based on the etcd data directory found above).
For example,
``` bash
chown etcd:etcd /var/lib/etcd
```
```
**Audit Script:** 1.1.12.sh
@@ -189,7 +189,7 @@ docker inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "${test_dir}" | cut
RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It’s presented to user where RKE is run.
We recommend that this `kube_config_cluster.yml` file be kept in secure store.
#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored)
#### 1.1.14 Ensure that the admin.conf file ownership is set to `root:root` (Scored)
**Result:** Not Applicable
@@ -249,7 +249,7 @@ stat -c %U:%G /etc/kubernetes/ssl
'root:root' is present
```
#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored)
#### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to `644` or more restrictive (Scored)
**Result:** PASS
@@ -732,7 +732,7 @@ on the master node and set the below parameter.
'0' is equal to '0'
```
#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored)
#### 1.2.20 Ensure that the `--secure-port` argument is not set to `0` (Scored)
**Result:** PASS
@@ -938,7 +938,7 @@ on the master node and set the `--service-account-key-file` parameter
to the public key file for service accounts:
``` bash
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
```
**Audit:**
@@ -953,7 +953,7 @@ to the public key file for service accounts:
'--service-account-key-file' is present
```
#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored)
#### 1.2.29 Ensure that the `--etcd-certfile` and `--etcd-keyfile` arguments are set as appropriate (Scored)
**Result:** PASS
@@ -963,8 +963,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the **etcd** certificate and **key** file parameters.
``` bash
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
```
**Audit:**
@@ -989,8 +989,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the TLS certificate and private key file parameters.
``` bash
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
```
**Audit:**
@@ -1015,7 +1015,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the client certificate authority file.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
**Audit:**
@@ -1040,7 +1040,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the etcd certificate authority file parameter.
``` bash
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
```
**Audit:**
@@ -1202,7 +1202,7 @@ on the master node and set the `--service-account-private-key-file` parameter
to the private key file for service accounts.
``` bash
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
```
**Audit:**
@@ -1226,7 +1226,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku
on the master node and set the `--root-ca-file` parameter to the certificate bundle file`.
``` bash
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
```
**Audit:**
@@ -1311,7 +1311,7 @@ on the master node and set the below parameter.
'false' is equal to 'false'
```
#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored)
#### 1.4.2 Ensure that the `--bind-address` argument is set to `127.0.0.1` (Scored)
**Result:** PASS
@@ -1344,8 +1344,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml`
on the master node and set the below parameters.
``` bash
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
```
**Audit:**
@@ -1418,8 +1418,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet
master node and set the below parameters.
``` bash
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
```
**Audit:**
@@ -1485,7 +1485,7 @@ node and either remove the `--peer-auto-tls` parameter or set it to `false`.
## 3 Control Plane Configuration
### 3.2 Logging
#### 3.2.1 Ensure that a minimal audit policy is created (Scored)
#### 3.2.1 Ensure that a minimal audit policy is created (Scored)
**Result:** PASS
@@ -1546,7 +1546,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected result**:
@@ -1561,7 +1561,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Remediation:**
Run the below command (based on the file location on your system) on the each worker node.
For example,
For example,
``` bash
chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
@@ -1570,7 +1570,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected result**:
@@ -1594,7 +1594,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected result**:
@@ -1618,7 +1618,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected result**:
@@ -1635,7 +1635,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
Run the following command to modify the file permissions of the
``` bash
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
```
**Audit:**
@@ -1664,7 +1664,7 @@ chown root:root <filename>
**Audit:**
```
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kube-ca.pem; then stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem; fi'
```
**Expected result**:
@@ -1703,7 +1703,7 @@ set the below parameter in `KUBELET_SYSTEM_PODS_ARGS` variable.
``` bash
--anonymous-auth=false
```
Based on your system, restart the kubelet service. For example:
``` bash
@@ -1780,7 +1780,7 @@ If using command line arguments, edit the kubelet service file
set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
Based on your system, restart the kubelet service. For example:
@@ -1926,7 +1926,7 @@ systemctl restart kubelet.service
'true' is equal to 'true'
```
#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored)
#### 4.2.7 Ensure that the `--make-iptables-util-chains` argument is set to `true` (Scored)
**Result:** PASS
@@ -1938,7 +1938,7 @@ remove the `--make-iptables-util-chains` argument from the
`KUBELET_SYSTEM_PODS_ARGS` variable.
Based on your system, restart the kubelet service. For example:
```bash
```bash
systemctl daemon-reload
systemctl restart kubelet.service
```
@@ -2091,7 +2091,7 @@ exit 0
**Audit Execution:**
```
./5.1.5.sh
./5.1.5.sh
```
**Expected result**:
@@ -2218,7 +2218,7 @@ echo "pass"
**Audit Execution:**
```
./5.3.2.sh
./5.3.2.sh
```
**Expected result**:
@@ -2258,7 +2258,7 @@ echo "--count=${default_resources}"
**Audit Execution:**
```
./5.6.4.sh
./5.6.4.sh
```
**Expected result**:
versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md
+15 -15
View File
@@ -937,7 +937,7 @@ on the master node and set the `--service-account-key-file` parameter
to the public key file for service accounts:
``` bash
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
```
**Audit:**
@@ -962,8 +962,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the **etcd** certificate and **key** file parameters.
``` bash
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
```
**Audit:**
@@ -988,8 +988,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the TLS certificate and private key file parameters.
``` bash
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
```
**Audit:**
@@ -1014,7 +1014,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the client certificate authority file.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
**Audit:**
@@ -1039,7 +1039,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
on the master node and set the etcd certificate authority file parameter.
``` bash
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
```
**Audit:**
@@ -1201,7 +1201,7 @@ on the master node and set the `--service-account-private-key-file` parameter
to the private key file for service accounts.
``` bash
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
```
**Audit:**
@@ -1225,7 +1225,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku
on the master node and set the `--root-ca-file` parameter to the certificate bundle file`.
``` bash
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
```
**Audit:**
@@ -1343,8 +1343,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml`
on the master node and set the below parameters.
``` bash
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
```
**Audit:**
@@ -1417,8 +1417,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet
master node and set the below parameters.
``` bash
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
```
**Audit:**
@@ -1634,7 +1634,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
Run the following command to modify the file permissions of the
``` bash
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
```
**Audit:**
@@ -1779,7 +1779,7 @@ If using command line arguments, edit the kubelet service file
set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
``` bash
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
```
Based on your system, restart the kubelet service. For example:
versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md
+30 -30
View File
@@ -173,7 +173,7 @@ exit
true
```
### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)
### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)
**Result:** pass
@@ -766,8 +766,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
`--kubelet-certificate-authority=<ca-string>`
**Audit:**
@@ -1379,7 +1379,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the --service-account-key-file parameter
to the public key file for service accounts:
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
**Audit:**
@@ -1408,8 +1408,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the etcd certificate and key file parameters.
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
**Audit:**
@@ -1438,8 +1438,8 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the TLS certificate and private key file parameters.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
**Audit:**
@@ -1468,7 +1468,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the client certificate authority file.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
**Audit:**
@@ -1497,7 +1497,7 @@ root 4643 4626 22 16:15 ? 00:00:46 kube-apiserver --etcd-keyfil
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the etcd certificate authority file parameter.
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
**Audit:**
@@ -1717,7 +1717,7 @@ root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --co
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the master node and set the --service-account-private-key-file parameter
to the private key file for service accounts.
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
**Audit:**
@@ -1745,7 +1745,7 @@ root 4788 4773 4 16:16 ? 00:00:09 kube-controller-manager --co
**Remediation:**
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the master node and set the --root-ca-file parameter to the certificate bundle file`.
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
**Audit:**
@@ -1877,8 +1877,8 @@ root 4947 4930 1 16:16 ? 00:00:02 kube-scheduler --kubeconfig=
Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters.
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
**Audit:**
@@ -1973,8 +1973,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
for your etcd cluster.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
**Audit:**
@@ -2070,7 +2070,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
etcd service.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file>
`--trusted-ca-file=</path/to/ca-file>`
**Audit:**
@@ -2167,7 +2167,7 @@ All configuration is passed in as arguments at container run time.
**Audit:**
```bash
/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
```
@@ -2183,7 +2183,7 @@ All configuration is passed in as arguments at container run time.
**Audit:**
```bash
/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
```
@@ -2200,7 +2200,7 @@ chmod 644 $proykubeconfig
**Audit:**
```bash
/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected Result**:
@@ -2227,7 +2227,7 @@ For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
**Audit:**
```bash
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
```
**Expected Result**:
@@ -2249,7 +2249,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```bash
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected Result**:
@@ -2271,7 +2271,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
**Audit:**
```bash
/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
```
**Expected Result**:
@@ -2292,7 +2292,7 @@ root:root
**Remediation:**
Run the following command to modify the file permissions of the
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
**Audit:**
@@ -2361,7 +2361,7 @@ All configuration is passed in as arguments at container run time.
**Audit:**
```bash
/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
```
@@ -2380,7 +2380,7 @@ All configuration is passed in as arguments at container run time.
**Audit:**
```bash
/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'
/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'
```
@@ -2450,7 +2450,7 @@ the location of the client CA file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
@@ -2602,7 +2602,7 @@ Clusters provisioned by RKE set the --hostname-override to avoid any hostname co
**Audit:**
```bash
/bin/ps -fC kubelet
/bin/ps -fC kubelet
```
@@ -2643,8 +2643,8 @@ to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke-1.6-benchmark-2.6/rke-1.6-benchmark-2.6.md
+20 -20
View File
@@ -673,8 +673,8 @@ root 121142 121120 7 12:27 ? 00:06:27 kube-apiserver --audit-log-maxsize=100 --e
Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
`--kubelet-certificate-authority=<ca-string>`
**Audit:**
@@ -1284,7 +1284,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the --service-account-key-file parameter
to the public key file for service accounts:
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
**Audit:**
@@ -1313,8 +1313,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the etcd certificate and key file parameters.
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
**Audit:**
@@ -1343,8 +1343,8 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the TLS certificate and private key file parameters.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
**Audit:**
@@ -1373,7 +1373,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the client certificate authority file.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
**Audit:**
@@ -1402,7 +1402,7 @@ root 121142 121120 7 12:27 ? 00:06:28 kube-apiserver --audit-log-maxsize=100 --e
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the etcd certificate authority file parameter.
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
**Audit:**
@@ -1622,7 +1622,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the master node and set the --service-account-private-key-file parameter
to the private key file for service accounts.
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
**Audit:**
@@ -1650,7 +1650,7 @@ root 121366 121346 1 12:27 ? 00:01:13 kube-controller-manager --cluster-cidr=10.
**Remediation:**
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the master node and set the --root-ca-file parameter to the certificate bundle file`.
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
**Audit:**
@@ -1775,8 +1775,8 @@ root 121587 121567 0 12:27 ? 00:00:12 kube-scheduler --kubeconfig=/etc/kubernete
Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters.
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
**Audit:**
@@ -1862,8 +1862,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
for your etcd cluster.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
**Audit:**
@@ -1950,7 +1950,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
etcd service.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file>
`--trusted-ca-file=</path/to/ca-file>`
**Audit:**
@@ -2141,7 +2141,7 @@ root:root
**Remediation:**
Run the following command to modify the file permissions of the
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
**Audit Script:** `check_cafile_permissions.sh`
@@ -2301,7 +2301,7 @@ the location of the client CA file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
@@ -2522,8 +2522,8 @@ to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
versioned_docs/version-2.6/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/rke2-1.6-benchmark-2.6.md
+22 -22
View File
@@ -865,8 +865,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the master node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
`--kubelet-certificate-authority=<ca-string>`
**Audit:**
@@ -1464,7 +1464,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the master node and set the --service-account-key-file parameter
to the public key file for service accounts:
--service-account-key-file=<filename>
`--service-account-key-file=<filename>`
**Audit:**
@@ -1493,8 +1493,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the master node and set the etcd certificate and key file parameters.
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
`--etcd-certfile=<path/to/client-certificate-file>`
`--etcd-keyfile=<path/to/client-key-file>`
**Audit:**
@@ -1523,8 +1523,8 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the master node and set the TLS certificate and private key file parameters.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
**Audit:**
@@ -1553,7 +1553,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the master node and set the client certificate authority file.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
**Audit:**
@@ -1582,7 +1582,7 @@ root 5275 5222 15 14:58 ? 00:01:26 kube-apiserver --audit-policy-file=/etc/ranch
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
on the master node and set the etcd certificate authority file parameter.
--etcd-cafile=<path/to/ca-file>
`--etcd-cafile=<path/to/ca-file>`
**Audit:**
@@ -1783,7 +1783,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d
Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
on the master node and set the --service-account-private-key-file parameter
to the private key file for service accounts.
--service-account-private-key-file=<filename>
`--service-account-private-key-file=<filename>`
**Audit:**
@@ -1811,7 +1811,7 @@ root 5522 5416 3 14:58 ? 00:00:16 kube-controller-manager --flex-volume-plugin-d
**Remediation:**
Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
on the master node and set the --root-ca-file parameter to the certificate bundle file`.
--root-ca-file=<path/to/file>
`--root-ca-file=<path/to/file>`
**Audit:**
@@ -1934,8 +1934,8 @@ root 5533 5414 0 14:58 ? 00:00:02 kube-scheduler --permit-port-sharing=true --ad
Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters.
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
`--cert-file=</path/to/ca-file>`
`--key-file=</path/to/key-file>`
### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated)
@@ -1985,8 +1985,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
for your etcd cluster.
Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
`--peer-client-file=</path/to/peer-cert-file>`
`--peer-key-file=</path/to/peer-key-file>`
### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)
@@ -2037,7 +2037,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
etcd service.
Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the
master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file>
`--trusted-ca-file=</path/to/ca-file>`
**Audit:**
@@ -2254,7 +2254,7 @@ root:root
**Remediation:**
Run the following command to modify the file permissions of the
--client-ca-file chmod 644 <filename>
`--client-ca-file chmod 644 <filename>`
**Audit:**
@@ -2434,7 +2434,7 @@ the location of the client CA file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file>
`--client-ca-file=<path/to/client-ca-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
@@ -2689,8 +2689,8 @@ to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
`--tls-cert-file=<path/to/tls-certificate-file>`
`--tls-private-key-file=<path/to/tls-key-file>`
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
@@ -2925,7 +2925,7 @@ echo "true"
**Audit Execution:**
```bash
./check_for_default_sa.sh
./check_for_default_sa.sh
```
**Expected Result**:
@@ -3224,7 +3224,7 @@ echo "true"
**Audit Execution:**
```bash
./check_for_rke2_network_policies.sh
./check_for_rke2_network_policies.sh
```
**Expected Result**: