public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-27 13:38:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

hardening guide updates

Browse Source
This commit is contained in:
Nelson Roberts
2021-01-05 12:04:50 -07:00
parent 4ad13474f5
commit 35ee481565
1 changed files with 165 additions and 347 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/security/rancher-2.5/1.6-hardening-2.5/_index.md
+165 -347
View File
@@ -1,9 +1,9 @@
--- ---
title: Hardening Guide with CIS 1.5 Benchmark title: Hardening Guide with CIS 1.6 Benchmark
weight: 99 weight: 100
--- ---
This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.5. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS). This document provides prescriptive guidance for hardening a production installation of a RKE cluster to be used with Rancher v2.5.4. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
> This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes. > This hardening guide describes how to secure the nodes in your cluster, and it is recommended to follow this guide before installing Kubernetes.
@@ -11,26 +11,26 @@ This hardening guide is intended to be used for RKE clusters and associated with
Rancher Version | CIS Benchmark Version | Kubernetes Version Rancher Version | CIS Benchmark Version | Kubernetes Version
----------------|-----------------------|------------------ ----------------|-----------------------|------------------
Rancher v2.5 | Benchmark v1.5 | Kubernetes 1.15 Rancher v2.5.4 | Benchmark 1.6 | Kubernetes v1.18
[Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.5.pdf) [Click here to download a PDF version of this document](https://releases.rancher.com/documents/security/2.5/Rancher_Hardening_Guide_CIS_1.6.pdf)
### Overview ### Overview
This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.5 with Kubernetes v1.15 or provisioning a RKE cluster with Kubernetes 1.15 to be used within Rancher v2.5. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS). This document provides prescriptive guidance for hardening a RKE cluster to be used for installing Rancher v2.5.4 with Kubernetes v1.18 or provisioning a RKE cluster with Kubernetes v1.18 to be used within Rancher v2.5.4. It outlines the configurations required to address Kubernetes benchmark controls from the Center for Information Security (CIS).
For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5]({{< baseurl >}}/rancher/v2.x/en/security/rancher-2.5/1.5-benchmark-2.5/). For more detail about evaluating a hardened cluster against the official CIS benchmark, refer to the [CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4]({{< baseurl >}}/rancher/v2.x/en/security/rancher-2.5/1.6-benchmark-2.5/).
#### Known Issues #### Known Issues
- Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes. - Rancher **exec shell** and **view logs** for pods are **not** functional in a CIS 1.6 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private IP to be provided when registering the custom nodes.
- When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.5 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments. - When setting the `default_pod_security_policy_template_id:` to `restricted` Rancher creates **RoleBindings** and **ClusterRoleBindings** on the default service accounts. The CIS 1.6 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts should be configured such that it does not provide a service account token and does not have any explicit rights assignments.
### Configure Kernel Runtime Parameters ### Configure Kernel Runtime Parameters
The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`: The following `sysctl` configuration is recommended for all nodes type in the cluster. Set the following parameters in `/etc/sysctl.d/90-kubelet.conf`:
``` ```ini
vm.overcommit_memory=1 vm.overcommit_memory=1
vm.panic_on_oom=0 vm.panic_on_oom=0
kernel.panic=10 kernel.panic=10
@@ -48,14 +48,14 @@ To create the **etcd** group run the following console commands.
The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`. The commands below use `52034` for **uid** and **gid** are for example purposes. Any valid unused **uid** or **gid** could also be used in lieu of `52034`.
``` ```bash
groupadd --gid 52034 etcd groupadd --gid 52034 etcd
useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
``` ```
Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user: Update the RKE **config.yml** with the **uid** and **gid** of the **etcd** user:
``` yaml ```yaml
services: services:
etcd: etcd:
gid: 52034 gid: 52034
@@ -67,13 +67,13 @@ Kubernetes provides a default service account which is used by cluster workloads
For each namespace including **default** and **kube-system** on a standard RKE install the **default** service account must include this value: For each namespace including **default** and **kube-system** on a standard RKE install the **default** service account must include this value:
``` ```yaml
automountServiceAccountToken: false automountServiceAccountToken: false
``` ```
Save the following yaml to a file called `account_update.yaml` Save the following yaml to a file called `account_update.yaml`
``` yaml ```yaml
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
@@ -83,7 +83,7 @@ automountServiceAccountToken: false
Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions. Create a bash script file called `account_update.sh`. Be sure to `chmod +x account_update.sh` so the script has execute permissions.
``` ```bash
#!/bin/bash -e #!/bin/bash -e
for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
@@ -116,7 +116,7 @@ about network policies can be found on the Kubernetes site.
> This `NetworkPolicy` is not recommended for production use > This `NetworkPolicy` is not recommended for production use
``` yaml ```yaml
--- ---
apiVersion: networking.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: NetworkPolicy kind: NetworkPolicy
@@ -136,13 +136,14 @@ spec:
Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to Create a bash script file called `apply_networkPolicy_to_all_ns.sh`. Be sure to
`chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions. `chmod +x apply_networkPolicy_to_all_ns.sh` so the script has execute permissions.
``` ```bash
#!/bin/bash -e #!/bin/bash -e
for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do
kubectl apply -f default-allow-all.yaml -n ${namespace} kubectl apply -f default-allow-all.yaml -n ${namespace}
done done
``` ```
Execute this script to apply the `default-allow-all.yaml` the **permissive** `NetworkPolicy` to all namespaces. Execute this script to apply the `default-allow-all.yaml` the **permissive** `NetworkPolicy` to all namespaces.
### Reference Hardened RKE `cluster.yml` configuration ### Reference Hardened RKE `cluster.yml` configuration
@@ -152,139 +153,111 @@ of Rancher Kubernetes Engine (RKE). Install [documentation](https://rancher.com/
provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration can be found here: https://rancher.com/docs/rke/latest/en/config-options/nodes provided with additional details about the configuration items. This reference `cluster.yml` does not include the required **nodes** directive which will vary depending on your environment. Documentation for node configuration can be found here: https://rancher.com/docs/rke/latest/en/config-options/nodes
``` yaml ```yaml
# If you intend to deploy Kubernetes in an air-gapped environment, # If you intend to deploy Kubernetes in an air-gapped environment,
# please consult the documentation on how to configure custom RKE images. # please consult the documentation on how to configure custom RKE images.
kubernetes_version: "v1.15.9-rancher1-1" # https://rancher.com/docs/rke/latest/en/installation/
enable_network_policy: true
default_pod_security_policy_template_id: "restricted"
# the nodes directive is required and will vary depending on your environment # the nodes directive is required and will vary depending on your environment
# documentation for node configuration can be found here: # documentation for node configuration can be found here:
# https://rancher.com/docs/rke/latest/en/config-options/nodes # https://rancher.com/docs/rke/latest/en/config-options/nodes
nodes: nodes: []
services: services:
etcd: etcd:
image: ""
extra_args: {}
extra_binds: []
extra_env: []
win_extra_args: {}
win_extra_binds: []
win_extra_env: []
external_urls: []
ca_cert: ""
cert: ""
key: ""
path: ""
uid: 52034 uid: 52034
gid: 52034 gid: 52034
snapshot: true
retention: ""
creation: ""
backup_config: null
kube-api: kube-api:
image: ""
extra_args: {}
extra_binds: []
extra_env: []
win_extra_args: {}
win_extra_binds: []
win_extra_env: []
service_cluster_ip_range: ""
service_node_port_range: ""
pod_security_policy: true pod_security_policy: true
always_pull_images: false
secrets_encryption_config: secrets_encryption_config:
enabled: true enabled: true
custom_config: null
audit_log: audit_log:
enabled: true enabled: true
admission_configuration: configuration: null
admission_configuration: null
event_rate_limit: event_rate_limit:
enabled: true enabled: true
configuration: null
kube-controller: kube-controller:
image: ""
extra_args: extra_args:
feature-gates: "RotateKubeletServerCertificate=true" feature-gates: RotateKubeletServerCertificate=true
extra_binds: []
extra_env: []
win_extra_args: {}
win_extra_binds: []
win_extra_env: []
cluster_cidr: ""
service_cluster_ip_range: ""
scheduler: scheduler:
image: "" image: ""
extra_args: {} extra_args: {}
extra_binds: [] extra_binds: []
extra_env: [] extra_env: []
win_extra_args: {}
win_extra_binds: []
win_extra_env: []
kubelet: kubelet:
generate_serving_certificate: true image: ""
extra_args: extra_args:
feature-gates: "RotateKubeletServerCertificate=true" feature-gates: RotateKubeletServerCertificate=true
protect-kernel-defaults: "true" protect-kernel-defaults: "true"
tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256" tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
extra_binds: [] extra_binds: []
extra_env: [] extra_env: []
cluster_domain: "" win_extra_args: {}
win_extra_binds: []
win_extra_env: []
cluster_domain: cluster.local
infra_container_image: "" infra_container_image: ""
cluster_dns_server: "" cluster_dns_server: ""
fail_swap_on: false fail_swap_on: false
generate_serving_certificate: true
kubeproxy: kubeproxy:
image: "" image: ""
extra_args: {} extra_args: {}
extra_binds: [] extra_binds: []
extra_env: [] extra_env: []
win_extra_args: {}
win_extra_binds: []
win_extra_env: []
network: network:
plugin: "" plugin: ""
options: {} options: {}
mtu: 0 mtu: 0
node_selector: {} node_selector: {}
update_strategy: null
authentication: authentication:
strategy: "" strategy: ""
sans: [] sans: []
webhook: null webhook: null
addons: | addons: |
---
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: default-psp-role
namespace: ingress-nginx
rules:
- apiGroups:
- extensions
resourceNames:
- default-psp
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: default-psp-rolebinding
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: default-psp-role
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
---
apiVersion: v1
kind: Namespace
metadata:
name: cattle-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: default-psp-role
namespace: cattle-system
rules:
- apiGroups:
- extensions
resourceNames:
- default-psp
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: default-psp-rolebinding
namespace: cattle-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: default-psp-role
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
---
apiVersion: policy/v1beta1 apiVersion: policy/v1beta1
kind: PodSecurityPolicy kind: PodSecurityPolicy
metadata: metadata:
@@ -311,55 +284,25 @@ addons: |
- configMap - configMap
- projected - projected
--- ---
apiVersion: rbac.authorization.k8s.io/v1 apiVersion: networking.k8s.io/v1
kind: ClusterRole kind: NetworkPolicy
metadata: metadata:
name: psp:restricted name: default-allow-all
rules: spec:
- apiGroups: podSelector: {}
- extensions ingress:
resourceNames: - {}
- restricted egress:
resources: - {}
- podsecuritypolicies policyTypes:
verbs: - Ingress
- use - Egress
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: psp:restricted
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: psp:restricted
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
--- ---
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
name: tiller name: default
namespace: kube-system automountServiceAccountToken: false
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tiller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: tiller
namespace: kube-system
addons_include: [] addons_include: []
system_images: system_images:
etcd: "" etcd: ""
@@ -373,6 +316,7 @@ system_images:
kubedns_autoscaler: "" kubedns_autoscaler: ""
coredns: "" coredns: ""
coredns_autoscaler: "" coredns_autoscaler: ""
nodelocal: ""
kubernetes: "" kubernetes: ""
flannel: "" flannel: ""
flannel_cni: "" flannel_cni: ""
@@ -383,6 +327,7 @@ system_images:
calico_flexvol: "" calico_flexvol: ""
canal_node: "" canal_node: ""
canal_cni: "" canal_cni: ""
canal_controllers: ""
canal_flannel: "" canal_flannel: ""
canal_flexvol: "" canal_flexvol: ""
weave_node: "" weave_node: ""
@@ -399,6 +344,7 @@ authorization:
mode: "" mode: ""
options: {} options: {}
ignore_docker_version: false ignore_docker_version: false
kubernetes_version: v1.18.12-rancher1-1
private_registries: [] private_registries: []
ingress: ingress:
provider: "" provider: ""
@@ -409,8 +355,15 @@ ingress:
extra_envs: [] extra_envs: []
extra_volumes: [] extra_volumes: []
extra_volume_mounts: [] extra_volume_mounts: []
cluster_name: "" update_strategy: null
http_port: 0
https_port: 0
network_mode: ""
cluster_name:
cloud_provider:
name: ""
prefix_path: "" prefix_path: ""
win_prefix_path: ""
addon_job_timeout: 0 addon_job_timeout: 0
bastion_host: bastion_host:
address: "" address: ""
@@ -424,10 +377,17 @@ monitoring:
provider: "" provider: ""
options: {} options: {}
node_selector: {} node_selector: {}
update_strategy: null
replicas: null
restore: restore:
restore: false restore: false
snapshot_name: "" snapshot_name: ""
dns: null dns: null
upgrade_strategy:
max_unavailable_worker: ""
max_unavailable_controlplane: ""
drain: null
node_drain_input: null
``` ```
### Reference Hardened RKE Template configuration ### Reference Hardened RKE Template configuration
@@ -436,198 +396,49 @@ The reference RKE Template provides the configuration needed to achieve a harden
RKE Templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher RKE Templates are used to provision Kubernetes and define Rancher settings. Follow the Rancher
[documentaion](https://rancher.com/docs/rancher/v2.x/en/installation) for additional installation and RKE Template details. [documentaion](https://rancher.com/docs/rancher/v2.x/en/installation) for additional installation and RKE Template details.
``` yaml ```yaml
# #
# Cluster Config # Cluster Config
# #
default_pod_security_policy_template_id: restricted default_pod_security_policy_template_id: restricted
docker_root_dir: /var/lib/docker docker_root_dir: /var/lib/docker
enable_cluster_alerting: false enable_cluster_alerting: false
enable_cluster_monitoring: false enable_cluster_monitoring: false
enable_network_policy: true enable_network_policy: true
# #
# Rancher Config # Rancher Config
# #
rancher_kubernetes_engine_config: rancher_kubernetes_engine_config:
addon_job_timeout: 30 addon_job_timeout: 45
addons: |-
---
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: default-psp-role
namespace: ingress-nginx
rules:
- apiGroups:
- extensions
resourceNames:
- default-psp
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: default-psp-rolebinding
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: default-psp-role
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
---
apiVersion: v1
kind: Namespace
metadata:
name: cattle-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: default-psp-role
namespace: cattle-system
rules:
- apiGroups:
- extensions
resourceNames:
- default-psp
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: default-psp-rolebinding
namespace: cattle-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: default-psp-role
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: restricted
spec:
requiredDropCapabilities:
- NET_RAW
privileged: false
allowPrivilegeEscalation: false
defaultAllowPrivilegeEscalation: false
fsGroup:
rule: RunAsAny
runAsUser:
rule: MustRunAsNonRoot
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- emptyDir
- secret
- persistentVolumeClaim
- downwardAPI
- configMap
- projected
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: psp:restricted
rules:
- apiGroups:
- extensions
resourceNames:
- restricted
resources:
- podsecuritypolicies
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: psp:restricted
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: psp:restricted
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:authenticated
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: tiller
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: tiller
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- kind: ServiceAccount
name: tiller
namespace: kube-system
ignore_docker_version: true ignore_docker_version: true
kubernetes_version: v1.15.9-rancher1-1 kubernetes_version: v1.18.12-rancher1-1
# #
# If you are using calico on AWS # If you are using calico on AWS
# #
# network: # network:
# plugin: calico # plugin: calico
# calico_network_provider: # calico_network_provider:
# cloud_provider: aws # cloud_provider: aws
# #
# # To specify flannel interface # # To specify flannel interface
# #
# network: # network:
# plugin: flannel # plugin: flannel
# flannel_network_provider: # flannel_network_provider:
# iface: eth1 # iface: eth1
# #
# # To specify flannel interface for canal plugin # # To specify flannel interface for canal plugin
# #
# network: # network:
# plugin: canal # plugin: canal
# canal_network_provider: # canal_network_provider:
# iface: eth1 # iface: eth1
# #
network: network:
mtu: 0 mtu: 0
plugin: canal plugin: canal
# rotate_encryption_key: false
#
# services: # services:
# kube-api: # kube-api:
# service_cluster_ip_range: 10.43.0.0/16 # service_cluster_ip_range: 10.43.0.0/16
@@ -637,7 +448,7 @@ rancher_kubernetes_engine_config:
# kubelet: # kubelet:
# cluster_domain: cluster.local # cluster_domain: cluster.local
# cluster_dns_server: 10.43.0.10 # cluster_dns_server: 10.43.0.10
# #
services: services:
etcd: etcd:
backup_config: backup_config:
@@ -665,56 +476,63 @@ rancher_kubernetes_engine_config:
service_node_port_range: 30000-32767 service_node_port_range: 30000-32767
kube_controller: kube_controller:
extra_args: extra_args:
address: 127.0.0.1
feature-gates: RotateKubeletServerCertificate=true feature-gates: RotateKubeletServerCertificate=true
profiling: 'false'
terminated-pod-gc-threshold: '1000'
kubelet: kubelet:
extra_args: extra_args:
anonymous-auth: 'false'
event-qps: '0'
feature-gates: RotateKubeletServerCertificate=true feature-gates: RotateKubeletServerCertificate=true
make-iptables-util-chains: 'true'
protect-kernel-defaults: 'true' protect-kernel-defaults: 'true'
streaming-connection-idle-timeout: 1800s
tls-cipher-suites: >- tls-cipher-suites: >-
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
fail_swap_on: false fail_swap_on: false
generate_serving_certificate: true generate_serving_certificate: true
scheduler:
extra_args:
address: 127.0.0.1
profiling: 'false'
ssh_agent_auth: false ssh_agent_auth: false
upgrade_strategy:
max_unavailable_controlplane: '1'
max_unavailable_worker: 10%
windows_prefered_cluster: false windows_prefered_cluster: false
``` ```
### Hardened Reference Ubuntu 18.04 LTS **cloud-config**: ### Hardened Reference Ubuntu 20.04 LTS **cloud-config**:
The reference **cloud-config** is generally used in cloud infrastructure environments to allow for The reference **cloud-config** is generally used in cloud infrastructure environments to allow for
configuration management of compute instances. The reference config configures Ubuntu operating system level settings configuration management of compute instances. The reference config configures Ubuntu operating system level settings
needed before installing kubernetes. needed before installing kubernetes.
``` yaml ```yaml
#cloud-config #cloud-config
packages: apt:
- curl sources:
- jq docker.list:
runcmd: source: deb [arch=amd64] http://download.docker.com/linux/ubuntu $RELEASE stable
- sysctl -w vm.overcommit_memory=1 keyid: 9DC858229FC7DD38854AE2D88D81803C0EBFCD88
- sysctl -w kernel.panic=10 system_info:
- sysctl -w kernel.panic_on_oops=1 default_user:
- curl https://releases.rancher.com/install-docker/18.09.sh | sh groups:
- usermod -aG docker ubuntu - docker
- return=1; while [ $return != 0 ]; do sleep 2; docker ps; return=$?; done
- addgroup --gid 52034 etcd
- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
write_files: write_files:
- path: /etc/sysctl.d/kubelet.conf - path: "/etc/apt/preferences.d/docker"
owner: root:root owner: root:root
permissions: "0644" permissions: '0600'
content: | content: |
vm.overcommit_memory=1 Package: docker-ce
kernel.panic=10 Pin: version 5:19*
kernel.panic_on_oops=1 Pin-Priority: 800
- path: "/etc/sysctl.d/90-kubelet.conf"
owner: root:root
permissions: '0644'
content: |
vm.overcommit_memory=1
vm.panic_on_oom=0
kernel.panic=10
kernel.panic_on_oops=1
kernel.keys.root_maxbytes=25000000
package_update: true
packages:
- docker-ce
- docker-ce-cli
- containerd.io
runcmd:
- sysctl -p /etc/sysctl.d/90-kubelet.conf
- groupadd --gid 52034 etcd
- useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd
``` ```