public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove leading backslash

Browse Source
This commit is contained in:
Andy Pitcher
2023-09-18 11:40:59 -04:00
parent 380f7e8972
commit 5ea918e217
1 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md
+25 -25
View File
@@ -111,7 +111,7 @@ All configuration is passed in as arguments at container run time.
**Remediation:**
Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 <path/to/cni/files>
For example, chmod 600 <path/to/cni/files\>
**Audit:**
@@ -139,7 +139,7 @@ permissions=600 permissions=644
**Remediation:**
Run the below command (based on the file location on your system) on the control plane node.
For example,
chown root:root <path/to/cni/files>
chown root:root <path/to/cni/files\>
**Audit:**
@@ -489,7 +489,7 @@ root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.4
**Remediation:**
Follow the documentation and configure alternate mechanisms for authentication. Then,
edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and remove the --token-auth-file=<filename> parameter.
on the control plane node and remove the --token-auth-file=<filename\> parameter.
**Audit:**
@@ -574,8 +574,8 @@ Follow the Kubernetes documentation and set up the TLS connection between the
apiserver and kubelets. Then, edit API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
kubelet client certificate and key parameters as below.
--kubelet-client-certificate=<path/to/client-certificate-file>
--kubelet-client-key=<path/to/client-key-file>
--kubelet-client-certificate=<path/to/client-certificate-file\>
--kubelet-client-key=<path/to/client-key-file\>
**Audit:**
@@ -605,7 +605,7 @@ Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
--kubelet-certificate-authority=<ca-string\>
**Audit:**
@@ -720,7 +720,7 @@ Follow the Kubernetes documentation and set the desired limits in a configuratio
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
and set the below parameters.
--enable-admission-plugins=...,EventRateLimit,...
--admission-control-config-file=<path/to/configuration/file>
--admission-control-config-file=<path/to/configuration/file\>
**Audit:**
@@ -1111,7 +1111,7 @@ root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.4
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --service-account-key-file parameter
to the public key file for service accounts. For example,
--service-account-key-file=<filename>
--service-account-key-file=<filename\>
**Audit:**
@@ -1140,8 +1140,8 @@ root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.4
Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the etcd certificate and key file parameters.
--etcd-certfile=<path/to/client-certificate-file>
--etcd-keyfile=<path/to/client-key-file>
--etcd-certfile=<path/to/client-certificate-file\>
--etcd-keyfile=<path/to/client-key-file\>
**Audit:**
@@ -1170,8 +1170,8 @@ root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.4
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the TLS certificate and private key file parameters.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
--tls-cert-file=<path/to/tls-certificate-file\>
--tls-private-key-file=<path/to/tls-key-file\>
**Audit:**
@@ -1200,7 +1200,7 @@ root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.4
Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the client certificate authority file.
--client-ca-file=<path/to/client-ca-file>
--client-ca-file=<path/to/client-ca-file\>
**Audit:**
@@ -1465,7 +1465,7 @@ root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-r
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the control plane node and set the --service-account-private-key-file parameter
to the private key file for service accounts.
--service-account-private-key-file=<filename>
--service-account-private-key-file=<filename\>
**Audit:**
@@ -1493,7 +1493,7 @@ root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-r
**Remediation:**
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
--root-ca-file=<path/to/file>
--root-ca-file=<path/to/file\>
**Audit:**
@@ -1618,8 +1618,8 @@ root 3859 3838 0 Sep11 ? 00:03:44 kube-scheduler --kubeconfig=/etc/kubernetes/ss
Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters.
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
--cert-file=</path/to/ca-file\>
--key-file=</path/to/key-file\>
**Audit:**
@@ -1705,8 +1705,8 @@ Follow the etcd service documentation and configure peer TLS encryption as appro
for your etcd cluster.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
--peer-client-file=</path/to/peer-cert-file\>
--peer-key-file=</path/to/peer-key-file\>
**Audit:**
@@ -1793,7 +1793,7 @@ Follow the etcd documentation and create a dedicated certificate authority setup
etcd service.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file>
--trusted-ca-file=</path/to/ca-file\>
**Audit:**
@@ -2003,7 +2003,7 @@ root:root
**Remediation:**
Run the following command to modify the file permissions of the
--client-ca-file chmod 600 <filename>
--client-ca-file chmod 600 <filename\>
**Audit:**
@@ -2030,7 +2030,7 @@ permissions=644
**Remediation:**
Run the following command to modify the ownership of the --client-ca-file.
chown root:root <filename>
chown root:root <filename\>
**Audit:**
@@ -2165,7 +2165,7 @@ the location of the client CA file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file>
--client-ca-file=<path/to/client-ca-file\>
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service
@@ -2416,8 +2416,8 @@ to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
--tls-cert-file=<path/to/tls-certificate-file\>
--tls-private-key-file=<path/to/tls-key-file\>
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service