Enclose in backticks so <&tag> aren't processed as HTML tags - 2

versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.5-benchmark-2.5/1.5-benchmark-2.5.md

@@ -937,7 +937,7 @@ on the master node and set the `--service-account-key-file` parameter
 to the public key file for service accounts:
 
 ``` bash
---service-account-key-file=<filename>
+`--service-account-key-file=<filename>`
 ```
 
 **Audit:**
@@ -962,8 +962,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
 on the master node and set the **etcd** certificate and **key** file parameters.
 
 ``` bash
---etcd-certfile=<path/to/client-certificate-file>
---etcd-keyfile=<path/to/client-key-file>
+`--etcd-certfile=<path/to/client-certificate-file>`
+`--etcd-keyfile=<path/to/client-key-file>`
 ```
 
 **Audit:**
@@ -988,8 +988,8 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
 on the master node and set the TLS certificate and private key file parameters.
 
 ``` bash
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 ```
 
 **Audit:**
@@ -1014,7 +1014,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
 on the master node and set the client certificate authority file.
 
 ``` bash
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 ```
 
 **Audit:**
@@ -1039,7 +1039,7 @@ Then, edit the API server pod specification file `/etc/kubernetes/manifests/kube
 on the master node and set the etcd certificate authority file parameter.
 
 ``` bash
---etcd-cafile=<path/to/ca-file>
+`--etcd-cafile=<path/to/ca-file>`
 ```
 
 **Audit:**
@@ -1201,7 +1201,7 @@ on the master node and set the `--service-account-private-key-file` parameter
 to the private key file for service accounts.
 
 ``` bash
---service-account-private-key-file=<filename>
+`--service-account-private-key-file=<filename>`
 ```
 
 **Audit:**
@@ -1225,7 +1225,7 @@ Edit the Controller Manager pod specification file `/etc/kubernetes/manifests/ku
 on the master node and set the `--root-ca-file` parameter to the certificate bundle file`.
 
 ``` bash
---root-ca-file=<path/to/file>
+`--root-ca-file=<path/to/file>`
 ```
 
 **Audit:**
@@ -1343,8 +1343,8 @@ Then, edit the etcd pod specification file `/etc/kubernetes/manifests/etcd.yaml`
 on the master node and set the below parameters.
 
 ``` bash
---cert-file=</path/to/ca-file>
---key-file=</path/to/key-file>
+`--cert-file=</path/to/ca-file>`
+`--key-file=</path/to/key-file>`
 ```
 
 **Audit:**
@@ -1417,8 +1417,8 @@ for your etcd cluster. Then, edit the etcd pod specification file `/etc/kubernet
 master node and set the below parameters.
 
 ``` bash
---peer-client-file=</path/to/peer-cert-file>
---peer-key-file=</path/to/peer-key-file>
+`--peer-client-file=</path/to/peer-cert-file>`
+`--peer-key-file=</path/to/peer-key-file>`
 ```
 
 **Audit:**
@@ -1634,7 +1634,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
 Run the following command to modify the file permissions of the
 
 ``` bash
---client-ca-file chmod 644 <filename>
+`--client-ca-file chmod 644 <filename>`
 ```
 
 **Audit:**
@@ -1779,7 +1779,7 @@ If using command line arguments, edit the kubelet service file
 set the below parameter in `KUBELET_AUTHZ_ARGS` variable.
 
 ``` bash
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 ```
 
 Based on your system, restart the kubelet service. For example:

versioned_docs/version-2.5/v2.5/en/security/rancher-2.5/1.6-benchmark-2.5/1.6-benchmark-2.5.md

@@ -173,7 +173,7 @@ exit
 true
 
 ```
-### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) 
+### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)
 
 **Result:** pass
 
@@ -766,8 +766,8 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Follow the Kubernetes documentation and setup the TLS connection between
 the apiserver and kubelets. Then, edit the API server pod specification file
 /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
---kubelet-certificate-authority=<ca-string>
+`--kubelet-certificate-authority` parameter to the path to the cert file for the certificate authority.
+`--kubelet-certificate-authority=<ca-string>`
 
 
 **Audit:**
@@ -1379,7 +1379,7 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the --service-account-key-file parameter
 to the public key file for service accounts:
---service-account-key-file=<filename>
+`--service-account-key-file=<filename>`
 
 
 **Audit:**
@@ -1408,8 +1408,8 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate and key file parameters.
---etcd-certfile=<path/to/client-certificate-file>
---etcd-keyfile=<path/to/client-key-file>
+`--etcd-certfile=<path/to/client-certificate-file>`
+`--etcd-keyfile=<path/to/client-key-file>`
 
 
 **Audit:**
@@ -1438,8 +1438,8 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the TLS certificate and private key file parameters.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 
 
 **Audit:**
@@ -1468,7 +1468,7 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the client certificate authority file.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 
 
 **Audit:**
@@ -1497,7 +1497,7 @@ root        4643    4626 22 16:15 ?        00:00:46 kube-apiserver --etcd-keyfil
 Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
 Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
 on the master node and set the etcd certificate authority file parameter.
---etcd-cafile=<path/to/ca-file>
+`--etcd-cafile=<path/to/ca-file>`
 
 
 **Audit:**
@@ -1717,7 +1717,7 @@ root        4788    4773  4 16:16 ?        00:00:09 kube-controller-manager --co
 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
 on the master node and set the --service-account-private-key-file parameter
 to the private key file for service accounts.
---service-account-private-key-file=<filename>
+`--service-account-private-key-file=<filename>`
 
 
 **Audit:**
@@ -1745,7 +1745,7 @@ root        4788    4773  4 16:16 ?        00:00:09 kube-controller-manager --co
 **Remediation:**
 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
 on the master node and set the --root-ca-file parameter to the certificate bundle file`.
---root-ca-file=<path/to/file>
+`--root-ca-file=<path/to/file>`
 
 
 **Audit:**
@@ -1877,8 +1877,8 @@ root        4947    4930  1 16:16 ?        00:00:02 kube-scheduler --kubeconfig=
 Follow the etcd service documentation and configure TLS encryption.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
 on the master node and set the below parameters.
---cert-file=</path/to/ca-file>
---key-file=</path/to/key-file>
+`--cert-file=</path/to/ca-file>`
+`--key-file=</path/to/key-file>`
 
 
 **Audit:**
@@ -1973,8 +1973,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
 for your etcd cluster.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
 master node and set the below parameters.
---peer-client-file=</path/to/peer-cert-file>
---peer-key-file=</path/to/peer-key-file>
+`--peer-client-file=</path/to/peer-cert-file>`
+`--peer-key-file=</path/to/peer-key-file>`
 
 
 **Audit:**
@@ -2070,7 +2070,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
 etcd service.
 Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
 master node and set the below parameter.
---trusted-ca-file=</path/to/ca-file>
+`--trusted-ca-file=</path/to/ca-file>`
 
 
 **Audit:**
@@ -2167,7 +2167,7 @@ All configuration is passed in as arguments at container run time.
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' 
+/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c permissions=%a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
 ```
 
 
@@ -2183,7 +2183,7 @@ All configuration is passed in as arguments at container run time.
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi' 
+/bin/sh -c 'if test -e /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; then stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf; fi'
 ```
 
 
@@ -2200,7 +2200,7 @@ chmod 644 $proykubeconfig
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
 ```
 
 **Expected Result**:
@@ -2227,7 +2227,7 @@ For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' 
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi'
 ```
 
 **Expected Result**:
@@ -2249,7 +2249,7 @@ chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
 ```
 
 **Expected Result**:
@@ -2271,7 +2271,7 @@ chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' 
+/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi'
 ```
 
 **Expected Result**:
@@ -2292,7 +2292,7 @@ root:root
 
 **Remediation:**
 Run the following command to modify the file permissions of the
---client-ca-file chmod 644 <filename>
+`--client-ca-file chmod 644 <filename>`
 
 
 **Audit:**
@@ -2361,7 +2361,7 @@ All configuration is passed in as arguments at container run time.
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi' 
+/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c permissions=%a /var/lib/kubelet/config.yaml; fi'
 ```
 
 
@@ -2380,7 +2380,7 @@ All configuration is passed in as arguments at container run time.
 **Audit:**
 
 ```bash
-/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi' 
+/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'
 ```
 
 
@@ -2450,7 +2450,7 @@ the location of the client CA file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameter in KUBELET_AUTHZ_ARGS variable.
---client-ca-file=<path/to/client-ca-file>
+`--client-ca-file=<path/to/client-ca-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service
@@ -2602,7 +2602,7 @@ Clusters provisioned by RKE set the --hostname-override to avoid any hostname co
 **Audit:**
 
 ```bash
-/bin/ps -fC kubelet 
+/bin/ps -fC kubelet
 ```
 
 
@@ -2643,8 +2643,8 @@ to the location of the corresponding private key file.
 If using command line arguments, edit the kubelet service file
 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
 set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
---tls-cert-file=<path/to/tls-certificate-file>
---tls-private-key-file=<path/to/tls-key-file>
+`--tls-cert-file=<path/to/tls-certificate-file>`
+`--tls-private-key-file=<path/to/tls-key-file>`
 Based on your system, restart the kubelet service. For example:
 systemctl daemon-reload
 systemctl restart kubelet.service