diff --git a/docs/backups/docker-installs/docker-installs.md b/docs/backups/docker-installs/docker-installs.md deleted file mode 100644 index cc211cee5e0..00000000000 --- a/docs/backups/docker-installs/docker-installs.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Backup and Restore for Rancher Installed with Docker ---- - -- [Backups](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) -- [Restores](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) \ No newline at end of file diff --git a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md index bc5cc83d471..300e152bb22 100644 --- a/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md +++ b/docs/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md @@ -109,20 +109,23 @@ This reference contains variables that you can use in `questions.yml` nested und | label | string | true | Define the UI label. | | description | string | false | Specify the description of the variable.| | type | string | false | Default to `string` if not specified (current supported types are string, multiline, boolean, int, enum, password, storageclass, hostname, pvc, and secret).| -| required | bool | false | Define if the variable is required or not (true \| false)| | default | string | false | Specify the default value. Only used if there is no corresponding value in the `values.yml` file. | | group | string | false | Group questions by input value. | -| min_length | int | false | Min character length.| -| max_length | int | false | Max character length.| -| min | int | false | Min integer length. | -| max | int | false | Max integer length. | | options | []string | false | Specify the options when the variable type is `enum`, for example: options:
- "ClusterIP"
- "NodePort"
- "LoadBalancer"| -| valid_chars | string | false | Regular expression for input chars validation. | -| invalid_chars | string | false | Regular expression for invalid input chars validation.| | subquestions | []subquestion | false| Add an array of subquestions.| | show_if | string | false | Show current variable if conditional variable is true. For example `show_if: "serviceType=Nodeport"` | | show\_subquestion_if | string | false | Show subquestions if is true or equal to one of the options. for example `show_subquestion_if: "true"`| + + :::note `subquestions[]` cannot contain `subquestions` or `show_subquestions_if` keys, but all other keys in the above table are supported. diff --git a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md index b65d7aa9b4b..f176acc177b 100644 --- a/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md +++ b/docs/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md @@ -8,7 +8,6 @@ title: Creating an AKS Cluster You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Service (AKS). - ## Prerequisites in Microsoft Azure :::caution @@ -65,6 +64,14 @@ az ad sp create-for-rbac \ --role Contributor ``` +### Setting Up the Service Principal with the Azure Command Line Tool + +Create the Resource Group by running this command: + +``` +az group create --location AZURE_LOCATION_NAME --resource-group AZURE_RESOURCE_GROUP_NAME +``` + ### Setting Up the Service Principal from the Azure Portal You can also follow these instructions to set up a service principal and give it role-based access from the Azure Portal. @@ -124,6 +131,17 @@ When provisioning an AKS cluster in the Rancher UI, RBAC is not configurable bec RBAC is required for AKS clusters that are registered or imported into Rancher. +### Setting Up the Role Assignment to Service Principal with the Azure Command Line Tool + +Assign the Rancher AKSv2 role to the service principal with the Azure Command Line Tool: + +``` +az role assignment create \ +--assignee CLIENT_ID \ +--scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP_NAME" \ +--role "Rancher AKSv2" +``` + ## AKS Cluster Configuration Reference For more information about how to configure AKS clusters from the Rancher UI, see the [configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md) @@ -146,12 +164,114 @@ Please be aware that when registering an existing AKS cluster, the cluster might For more information about connecting to an AKS private cluster, see the [AKS documentation.](https://docs.microsoft.com/en-us/azure/aks/private-clusters#options-for-connecting-to-the-private-cluster) +## Setting Up the Minimum Permission Role with the Azure Command Line Tool + +1. Create the Minimum Rancher AKSv2 Permission Role by running this command: + + ``` + cat >> rancher-azure.json << EOF + + { + "Name": "Rancher AKSv2", + "IsCustom": true, + "Description": "Everything needed by Rancher AKSv2 operator", + "Actions": [ + "Microsoft.Compute/disks/delete", + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/diskEncryptionSets/read", + "Microsoft.Compute/locations/DiskOperations/read", + "Microsoft.Compute/locations/vmSizes/read", + "Microsoft.Compute/locations/operations/read", + "Microsoft.Compute/proximityPlacementGroups/write", + "Microsoft.Compute/snapshots/delete", + "Microsoft.Compute/snapshots/read", + "Microsoft.Compute/snapshots/write", + "Microsoft.Compute/virtualMachineScaleSets/manualUpgrade/action", + "Microsoft.Compute/virtualMachineScaleSets/delete", + "Microsoft.Compute/virtualMachineScaleSets/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipconfigurations/publicipaddresses/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write", + "Microsoft.Compute/virtualMachineScaleSets/write", + "Microsoft.Compute/virtualMachines/read", + "Microsoft.Compute/virtualMachines/write", + "Microsoft.ContainerService/managedClusters/read", + "Microsoft.ContainerService/managedClusters/write" + "Microsoft.ContainerService/managedClusters/delete", + "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action", + "Microsoft.ContainerService/managedClusters/agentPools/read", + "Microsoft.ContainerService/managedClusters/agentPools/write", + "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", + "Microsoft.Network/applicationGateways/read", + "Microsoft.Network/applicationGateways/write", + "Microsoft.Network/loadBalancers/write", + "Microsoft.Network/loadBalancers/backendAddressPools/join/action", + "Microsoft.Network/loadBalancers/delete", + "Microsoft.Network/loadBalancers/read", + "Microsoft.Network/networkInterfaces/join/action", + "Microsoft.Network/networkInterfaces/read", + "Microsoft.Network/networkInterfaces/write", + "Microsoft.Network/networkSecurityGroups/read", + "Microsoft.Network/networkSecurityGroups/write", + "Microsoft.Network/publicIPAddresses/delete", + "Microsoft.Network/publicIPAddresses/join/action", + "Microsoft.Network/publicIPAddresses/read", + "Microsoft.Network/publicIPAddresses/write", + "Microsoft.Network/publicIPPrefixes/join/action", + "Microsoft.Network/privatednszones/*", + "Microsoft.Network/routeTables/read", + "Microsoft.Network/routeTables/routes/delete", + "Microsoft.Network/routeTables/routes/read", + "Microsoft.Network/routeTables/routes/write", + "Microsoft.Network/routeTables/write", + "Microsoft.Network/virtualNetworks/read", + "Microsoft.Network/virtualNetworks/subnets/join/action", + "Microsoft.Network/virtualNetworks/subnets/read", + "Microsoft.Network/virtualNetworks/joinLoadBalancer/action", + "Microsoft.OperationalInsights/workspaces/sharedkeys/read", + "Microsoft.OperationalInsights/workspaces/read", + "Microsoft.OperationsManagement/solutions/write", + "Microsoft.OperationsManagement/solutions/read", + "Microsoft.Resources/subscriptions/resourcegroups/read", + "Microsoft.Resources/subscriptions/resourcegroups/write", + "Microsoft.Storage/operations/read", + "Microsoft.Storage/storageAccounts/listKeys/action", + "Microsoft.Storage/storageAccounts/delete", + "Microsoft.Storage/storageAccounts/read", + "Microsoft.Storage/storageAccounts/write" + ], + "NotActions": [], + "DataActions": [], + "NotDataActions": [], + "AssignableScopes": [ + "/subscriptions/SUBSCRIPTION_ID" + ] + } + EOF + ``` + +2. Apply the Rancher AKSv2 Role: + + ``` + az role definition create --role-definition rancher-azure.json + ``` + +3. Verify if the Rancher AKSv2 Role was created: + + ``` + az role definition list | grep "Rancher AKSv2" + ``` + ## Syncing The AKS provisioner can synchronize the state of an AKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see [Syncing.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md) For information on configuring the refresh interval, see [this section.](../../../../pages-for-subheaders/gke-cluster-configuration.md#configuring-the-refresh-interval) + ## Programmatically Creating AKS Clusters -The most common way to programmatically deploy AKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) \ No newline at end of file +The most common way to programmatically deploy AKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster). diff --git a/docs/pages-for-subheaders/rancher-hardening-guides.md b/docs/pages-for-subheaders/rancher-hardening-guides.md index a7ffa3ce2e1..5db6c192945 100644 --- a/docs/pages-for-subheaders/rancher-hardening-guides.md +++ b/docs/pages-for-subheaders/rancher-hardening-guides.md @@ -27,25 +27,25 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |--------------------|-----------------------|-----------------------|------------------| | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](rke1-hardening-guide.md) | -| Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](rke1-hardening-guide.md) | -| Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](rke1-hardening-guide.md) | +| Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](rke1-hardening-guide.md) | +| Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke1-hardening-guide.md) | ### RKE2 Guides | Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |------|--------------------|-----------------------|-----------------------|------------------| | Rancher provisioned RKE2 | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](rke2-hardening-guide.md) | -| Rancher provisioned RKE2 | Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](rke2-hardening-guide.md) | -| Rancher provisioned RKE2 | Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](rke2-hardening-guide.md) | -| Standalone RKE2 | Kubernetes v1.25 | CIS v1.23 | [Link](https://docs.rke2.io/security/cis_self_assessment123) | [Link](https://docs.rke2.io/security/hardening_guide) | +| Rancher provisioned RKE2 | Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](rke2-hardening-guide.md) | +| Rancher provisioned RKE2 | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke2-hardening-guide.md) | +| Standalone RKE2 | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](https://docs.rke2.io/security/cis_self_assessment123) | [Link](https://docs.rke2.io/security/hardening_guide) | ### K3s Guides | Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |------|--------------------|-----------------------|-----------------------|------------------| | Rancher provisioned K3s cluster | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](k3s-hardening-guide.md) | -| Rancher provisioned K3s cluster | Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](k3s-hardening-guide.md) | -| Rancher provisioned K3s cluster | Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](k3s-hardening-guide.md) | +| Rancher provisioned K3s cluster | Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](k3s-hardening-guide.md) | +| Rancher provisioned K3s cluster | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](k3s-hardening-guide.md) | | Standalone K3s | Kubernetes v1.22 up to v1.24 | CIS v1.23 | [Link](https://docs.k3s.io/security/self-assessment) | [Link](https://docs.k3s.io/security/hardening-guide) | ## Rancher with SELinux diff --git a/docs/reference-guides/about-the-api/api-tokens.md b/docs/reference-guides/about-the-api/api-tokens.md index eccd4d962b1..5fe8a0eb5a4 100644 --- a/docs/reference-guides/about-the-api/api-tokens.md +++ b/docs/reference-guides/about-the-api/api-tokens.md @@ -3,7 +3,7 @@ title: API Tokens --- - + By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password. diff --git a/docs/reference-guides/backup-restore-configuration/backup-configuration.md b/docs/reference-guides/backup-restore-configuration/backup-configuration.md index 313a3de1d83..2bb79d074b7 100644 --- a/docs/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/backup-configuration.md @@ -3,7 +3,7 @@ title: Backup Configuration --- - + The **Backup: Create** page lets you configure a schedule, enable encryption and specify the storage location for your backups. diff --git a/docs/reference-guides/backup-restore-configuration/examples.md b/docs/reference-guides/backup-restore-configuration/examples.md index 32a1eb76c6a..0afd8a359fb 100644 --- a/docs/reference-guides/backup-restore-configuration/examples.md +++ b/docs/reference-guides/backup-restore-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + This section contains examples of Backup and Restore custom resources. diff --git a/docs/reference-guides/backup-restore-configuration/restore-configuration.md b/docs/reference-guides/backup-restore-configuration/restore-configuration.md index 5e958fcd674..b162a6ef873 100644 --- a/docs/reference-guides/backup-restore-configuration/restore-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/restore-configuration.md @@ -3,7 +3,7 @@ title: Restore Configuration --- - + The Restore Create page lets you provide details of the backup to restore from diff --git a/docs/reference-guides/backup-restore-configuration/storage-configuration.md b/docs/reference-guides/backup-restore-configuration/storage-configuration.md index 3ad8b94487f..b1b8bad0896 100644 --- a/docs/reference-guides/backup-restore-configuration/storage-configuration.md +++ b/docs/reference-guides/backup-restore-configuration/storage-configuration.md @@ -3,7 +3,7 @@ title: Backup Storage Location Configuration --- - + Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store. diff --git a/docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md b/docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md index 9fc13c9ce70..dc200ae62b1 100644 --- a/docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md +++ b/docs/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md @@ -3,7 +3,7 @@ title: Logging Best Practices --- - + In this guide, we recommend best practices for cluster-level logging and application logging. diff --git a/docs/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md b/docs/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md index 9255c76a28b..a6e34b03a50 100644 --- a/docs/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md +++ b/docs/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md @@ -3,7 +3,7 @@ title: Monitoring Best Practices --- - + Configuring sensible monitoring and alerting rules is vital for running any production workloads securely and reliably. This is not different when using Kubernetes and Rancher. Fortunately the integrated monitoring and alerting functionality makes this whole process a lot easier. diff --git a/docs/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md b/docs/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md index 3012223f423..9d24fb3c5db 100644 --- a/docs/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md +++ b/docs/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md @@ -3,7 +3,7 @@ title: Best Practices for Rancher Managed vSphere Clusters --- - + This guide outlines a reference architecture for provisioning downstream Rancher clusters in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/docs/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md b/docs/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md index 1298ff18b87..0cec0a91864 100644 --- a/docs/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md +++ b/docs/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md @@ -3,7 +3,7 @@ title: Tips for Setting Up Containers --- - + Running well-built containers can greatly impact the overall performance and security of your environment. diff --git a/docs/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md b/docs/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md index c19ac243d98..74243559753 100644 --- a/docs/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md +++ b/docs/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md @@ -3,7 +3,7 @@ title: Installing Rancher in a vSphere Environment --- - + This guide outlines a reference architecture for installing Rancher on an RKE Kubernetes cluster in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/docs/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md b/docs/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md index cc8811dc77e..99583f75579 100644 --- a/docs/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md +++ b/docs/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md @@ -3,7 +3,7 @@ title: Rancher Deployment Strategy --- - + There are two recommended deployment strategies for a Rancher instance that manages downstream Kubernetes clusters. Each one has its own pros and cons. Read more about which one would fit best for your use case. diff --git a/docs/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md b/docs/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md index 1863ff82503..1ed05696fa2 100644 --- a/docs/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md +++ b/docs/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md @@ -3,7 +3,7 @@ title: Tips for Running Rancher --- - + This guide is geared toward use cases where Rancher is used to manage downstream Kubernetes clusters. The high-availability setup is intended to prevent losing access to downstream clusters if the Rancher server is not available. diff --git a/docs/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md b/docs/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md index 691ef18f576..e8e919bde9b 100644 --- a/docs/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md +++ b/docs/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md @@ -3,7 +3,7 @@ title: Tips for Scaling Rancher --- - + This guide aims to introduce the approaches that should be considered to scale Rancher setups, and associated challenges with doing so. As systems grow performance will naturally reduce, but there are steps we can take to minimize the load put on Rancher, as well as optimize Rancher's ability to handle these larger setups. diff --git a/docs/reference-guides/cli-with-rancher/kubectl-utility.md b/docs/reference-guides/cli-with-rancher/kubectl-utility.md index 45502753a08..fefa1a66b1b 100644 --- a/docs/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/docs/reference-guides/cli-with-rancher/kubectl-utility.md @@ -3,7 +3,7 @@ title: kubectl Utility --- - + ## kubectl diff --git a/docs/reference-guides/cli-with-rancher/rancher-cli.md b/docs/reference-guides/cli-with-rancher/rancher-cli.md index 44024172658..0c9a27c1694 100644 --- a/docs/reference-guides/cli-with-rancher/rancher-cli.md +++ b/docs/reference-guides/cli-with-rancher/rancher-cli.md @@ -4,7 +4,7 @@ description: Interact with Rancher using command line interface (CLI) tools from --- - + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md index 6043df8f1ba..4640d142697 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Machine Configuration Reference --- - + For more details about EC2 nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md index 98d299762b0..ba7e806295e 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Machine Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md index 1d62fe9d9d7..634c7f48561 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Machine Configuration --- - + For more details about DigitalOcean, Droplets, refer to the [official documentation](https://docs.digitalocean.com/products/compute/). diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md index ffe36cf7723..bd79dabbed5 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Node Template Configuration --- - + For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md index e8fa8b382ee..e747dbbb547 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Node Template Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md index 0e679ae7d13..87b5fccdcfb 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Node Template Configuration --- - + Account access information is stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md index cbecb1be01b..4e44d5ceca7 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md @@ -3,7 +3,7 @@ title: Nutanix Node Template Configuration --- - + ## Account Access diff --git a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md index 0e665ba93f4..135c3edf7cc 100644 --- a/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md +++ b/docs/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md @@ -3,7 +3,7 @@ title: VSphere Node Template Configuration --- - + ## Account Access diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md index 136c71a45a2..67cd280e470 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md @@ -3,7 +3,7 @@ title: AKS Cluster Configuration Reference --- - + ## Changes in Rancher v2.6 diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index b6110f8cafc..ba6b826b4f1 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -3,7 +3,7 @@ title: EKS Cluster Configuration Reference --- - + ### Account Access @@ -86,9 +86,11 @@ Amazon EKS managed node groups automate the provisioning and lifecycle managemen For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) -#### Bring your own launch template +#### User-provided Launch Templates -A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group. +You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template. + +Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group. | Option | Description | Required/Optional | | ------ | ----------- | ----------------- | @@ -97,9 +99,9 @@ A launch template ID and version can be provided in order to easily configure th | Node Volume Size | The launch template must specify an EBS volume with the desired size | Required | | SSH Key | A key to be added to the instances to provide SSH access to the nodes | Optional | | User Data | Cloud init script in [MIME multi-part format](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-data) | Optional | -| Instance Resource Tags | Tag each EC2 instance in the node group | Optional | +| Instance Resource Tags | Tag each EC2 instance and its volumes in the node group | Optional | -#### Rancher-managed launch templates +#### Rancher-managed Launch Templates If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated. diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md index 60228c3fb97..120be47a641 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md @@ -3,7 +3,7 @@ title: Private Clusters --- - + In GKE, [private clusters](https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept) are clusters whose nodes are isolated from inbound and outbound traffic by assigning them internal IP addresses only. Private clusters in GKE have the option of exposing the control plane endpoint as a publicly accessible address or as a private address. This is different from other Kubernetes providers, which may refer to clusters with private control plane endpoints as "private clusters" but still allow traffic to and from nodes. You may want to create a cluster with private nodes, with or without a public control plane endpoint, depending on your organization's networking and security requirements. A GKE cluster provisioned from Rancher can use isolated nodes by selecting "Private Cluster" in the Cluster Options (under "Show advanced options"). The control plane endpoint can optionally be made private by selecting "Enable Private Endpoint". diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 94c3b2c3442..6d260b3dd68 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -127,7 +127,7 @@ ACE is available on RKE, RKE2, and K3s clusters that are provisioned or register ::: -ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters.md) on RKE2 and K3s clusters. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. +ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) on RKE2 and K3s clusters. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md index 9ccc2cfe9f0..63fa8df3511 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md @@ -3,7 +3,7 @@ title: Syncing --- - + Syncing allows Rancher to update cluster values so that they're up to date with the corresponding cluster object hosted in AKS, EKS or GKE. This enables sources other than Rancher to own a hosted cluster’s state. diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md index a0e092fee87..3c363d053cf 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md @@ -3,7 +3,7 @@ title: Rancher Agent Options --- - + Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes](../../../../pages-for-subheaders/use-existing-nodes.md) and add the options to the generated `docker run` command when adding a node. diff --git a/docs/reference-guides/monitoring-v2-configuration/examples.md b/docs/reference-guides/monitoring-v2-configuration/examples.md index 7c586657eb2..c65722cfa97 100644 --- a/docs/reference-guides/monitoring-v2-configuration/examples.md +++ b/docs/reference-guides/monitoring-v2-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + ### ServiceMonitor diff --git a/docs/reference-guides/monitoring-v2-configuration/helm-chart-options.md b/docs/reference-guides/monitoring-v2-configuration/helm-chart-options.md index fabd9fc222f..112c41c9ea0 100644 --- a/docs/reference-guides/monitoring-v2-configuration/helm-chart-options.md +++ b/docs/reference-guides/monitoring-v2-configuration/helm-chart-options.md @@ -3,7 +3,7 @@ title: Helm Chart Options --- - + ## Configuring Resource Limits and Requests diff --git a/docs/reference-guides/monitoring-v2-configuration/receivers.md b/docs/reference-guides/monitoring-v2-configuration/receivers.md index eb3a029b45b..dc459f34378 100644 --- a/docs/reference-guides/monitoring-v2-configuration/receivers.md +++ b/docs/reference-guides/monitoring-v2-configuration/receivers.md @@ -3,7 +3,7 @@ title: Receiver Configuration --- - + The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configuration/#configuration-file) Secret contains the configuration of an Alertmanager instance that sends out notifications based on alerts it receives from Prometheus. diff --git a/docs/reference-guides/monitoring-v2-configuration/routes.md b/docs/reference-guides/monitoring-v2-configuration/routes.md index 339dd2a606a..f79d1e190c6 100644 --- a/docs/reference-guides/monitoring-v2-configuration/routes.md +++ b/docs/reference-guides/monitoring-v2-configuration/routes.md @@ -3,7 +3,7 @@ title: Route Configuration --- - + The route configuration is the section of the Alertmanager custom resource that controls how the alerts fired by Prometheus are grouped and filtered before they reach the receiver. diff --git a/docs/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md b/docs/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md index 780d13c2673..30fccb634c8 100644 --- a/docs/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md +++ b/docs/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md @@ -3,7 +3,7 @@ title: ServiceMonitor and PodMonitor Configuration --- - + ServiceMonitors and PodMonitors are both pseudo-CRDs that map the scrape configuration of the Prometheus custom resource. diff --git a/docs/reference-guides/prometheus-federator/rbac.md b/docs/reference-guides/prometheus-federator/rbac.md index 47887415d85..8b54ce9559f 100644 --- a/docs/reference-guides/prometheus-federator/rbac.md +++ b/docs/reference-guides/prometheus-federator/rbac.md @@ -2,6 +2,10 @@ title: Role-Based Access Control --- + + + + This section describes the expectations for Role-Based Access Control (RBAC) for Prometheus Federator. As described in the section on [namespaces](../../pages-for-subheaders/prometheus-federator.md#namespaces), Prometheus Federator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: diff --git a/docs/reference-guides/rancher-manager-architecture/architecture-recommendations.md b/docs/reference-guides/rancher-manager-architecture/architecture-recommendations.md index d68f5b9320c..1ece990ff8c 100644 --- a/docs/reference-guides/rancher-manager-architecture/architecture-recommendations.md +++ b/docs/reference-guides/rancher-manager-architecture/architecture-recommendations.md @@ -2,6 +2,10 @@ title: Architecture Recommendations --- + + + + If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) ## Separation of Rancher and User Clusters diff --git a/docs/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md b/docs/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md index cc266462e91..586b55b0db8 100644 --- a/docs/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md +++ b/docs/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md @@ -2,6 +2,10 @@ title: Communicating with Downstream User Clusters --- + + + + This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services. The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters. @@ -24,7 +28,7 @@ the pods. Bob is authenticated through Rancher's authentication proxy. The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters. -Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod. +Rancher communicates with Kubernetes clusters using a [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/). Each user account in Rancher correlates with an equivalent service account in the downstream cluster. Rancher uses the service account to [impersonate](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) the user, which provides all the permissions the user is intended to have. By default, Rancher generates a [kubeconfig file](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster. @@ -76,6 +80,87 @@ With this endpoint enabled for the downstream cluster, Rancher generates an extr You will need to use a context defined in this kubeconfig file to access the cluster if Rancher goes down. Therefore, we recommend exporting the kubeconfig file so that if Rancher goes down, you can still use the credentials in the file to access your cluster. For more information, refer to the section on accessing your cluster with [kubectl and the kubeconfig file.](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) +## Impersonation + +Users technically exist only on the upstream cluster. Rancher creates [RoleBindings and ClusterRoleBindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) that refer to Rancher users, even though there is [no actual User resource](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes) on the downstream cluster. + +When users interact with a downstream cluster through the authentication proxy, there needs to be some entity downstream to serve as the actor for those requests. Rancher creates service accounts to be that entity. Each service account is only granted one permission, which is to **impersonate** the user they belong to. If there was only one service account that could impersonate any user, then it would be possible for a malicious user to corrupt that account and escalate their privileges by impersonating another user. This issue was the basis for a [CVE](https://github.com/rancher/rancher/security/advisories/GHSA-pvxj-25m6-7vqr). + +### Impersonation Troubleshooting + +On the downstream cluster, five resources handle impersonation: + +- namespace: `cattle-impersonation-system` +- service account: `cattle-impersonation-system/cattle-impersonation-` +- account token secret: `cattle-impersonation-system/cattle-impersonation--token-` +- cluster role: `cattle-impersonation-` +- cluster role binding: `cattle-impersonation-` + +In this example of a typical impersonation cluster role, the system is configured to use `github` as the auth provider: + +```yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: "2021-10-06T18:20:13Z" + labels: + authz.cluster.cattle.io/impersonator: "true" + cattle.io/creator: norman + name: cattle-impersonation-user-abcde + resourceVersion: "3528" + uid: a7478731-72a0-4343-b09f-c3bf12552d77 +rules: +# allowed to impersonate user user-abcde +- apiGroups: + - "" + resourceNames: + - user-abcde + resources: + - users + verbs: + - impersonate +# allowed to impersonate listed groups +- apiGroups: + - "" + resourceNames: + - github_team://123 # group from GitHub auth provider + - system:authenticated # automatic group from Kubernetes + - system:cattle:authenticated # automatic group from Rancher + resources: + - groups + verbs: + - impersonate +# allowed to impersonate principal ID github_user://098 +- apiGroups: + - authentication.k8s.io + resourceNames: + - github_user://098 # principal ID from GitHub auth provider + resources: + - userextras/principalid + verbs: + - impersonate +# allowed to impersonate username example +- apiGroups: + - authentication.k8s.io + resourceNames: + - example # username from GitHub auth provider + resources: + - userextras/username + verbs: + - impersonate +``` + +When you troubleshoot impersonation issues, check whether these resources exist for the user, and whether the rules in the cluster role look similar to the above. For example: + +```bash +kubectl --namespace cattle-impersonation-system get serviceaccount cattle-impersonation- +kubectl --namespace cattle-impersonation-system get secret cattle-impersonation--token- +kubectl get clusterrole cattle-impersonation- --output yaml +kubectl get clusterrolebinding cattle-impersonation- +``` + +If you see an error related to "impersonation" in the UI, pay close attention to the *end* of the error message, which should indicate the real reason that the request failed. + ## Important Files The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster: diff --git a/docs/reference-guides/rancher-manager-architecture/rancher-server-and-components.md b/docs/reference-guides/rancher-manager-architecture/rancher-server-and-components.md index bb1cf170e7a..e9fec332622 100644 --- a/docs/reference-guides/rancher-manager-architecture/rancher-server-and-components.md +++ b/docs/reference-guides/rancher-manager-architecture/rancher-server-and-components.md @@ -2,6 +2,10 @@ title: Rancher Server and Components --- + + + + The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment. The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service). diff --git a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index ddf9809440a..d0ddba7d1e7 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: K3s Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index 8944de04c27..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3148 +0,0 @@ ---- -title: K3s Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. - -Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. - -These are the possible results for each control: - -- **Pass** - The K3s cluster passes the audit outlined in the benchmark. -- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. -- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. - -This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /etc/kubernetes/manifests/etcd.yaml - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /etc/kubernetes/manifests/etcd.yaml - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.1.11 -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root controllermanager - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit:** - -```bash -find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/pki/*.key - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep containerd | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 521 1 0 22:09 ? 00:00:00 /usr/bin/containerd root 802 1 0 22:09 ? 00:00:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 3970 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 836d5508918bf22689e12f2885aeb9de5c2420beb956f6dc587d11b049e4edf4 -address /run/k3s/containerd/containerd.sock root 4088 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 6148f976b57db791da86119c599700f683df838df56b1382d428ec38402caa64 -address /run/k3s/containerd/containerd.sock root 4109 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id b0e22b39e80606c4ad5d7fdafe21a771a27a5dce8f06155af579a9fad8158219 -address /run/k3s/containerd/containerd.sock root 5321 1 0 22:14 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id f60b96ef6beaf1b7903aba944af101a7d401082969ad8b5aea633bda1043b165 -address /run/k3s/containerd/containerd.sock root 5395 1 0 22:14 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id df001d7d85239f1cfdd8e041db801a6383bc18e5e10d0cd8e8e4e6ca9b7ce036 -address /run/k3s/containerd/containerd.sock root 6366 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id a900df9f736ca35b5dbd603034588a461d706ae6c83529136a81ec13e0ecedc0 -address /run/k3s/containerd/containerd.sock root 7859 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id b3c1510cafad33b31758db1b7c771efe98f0d395d5d52caf90db7bd379966299 -address /run/k3s/containerd/containerd.sock root 7896 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id e5720fc8f9e95f2fd8b8e87c93f25213315d78b630fc889b2a5cb8b18f2a1442 -address /run/k3s/containerd/containerd.sock root 9773 9761 4 22:22 ? 00:00:16 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 10275 1 0 22:22 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 8b29d2205c5f7d47d0ecd4f95b7b96062454233e66450f9163058647e7b5c390 -address /run/k3s/containerd/containerd.sock root 11185 1 0 22:23 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9581871a145dd1c0bbff06cddea0030a30de2760e90c5fa9154cccb250f05faa -address /run/k3s/containerd/containerd.sock root 13605 1 0 22:27 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id e05825dc2a33d576c35cc1b56610d3e4459d209524645f95f163c100f6e5df46 -address /run/k3s/containerd/containerd.sock root 13770 1 0 22:27 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 74d10151f05f78b0d38deb2b1ee045bf7b72e7b879e6a15112c8495f98d230b8 -address /run/k3s/containerd/containerd.sock -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, --request-timeout=300s - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.2.29 -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -grep aescbc /path/to/encryption-config.json -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** warn - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.1 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.2 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.3 -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.4 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.5 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.6 -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.7 -``` - -**Expected Result**: - -```console -'trusted-ca-file' is present -``` - -**Returned Value**: - -```console -trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Manual) - - -**Result:** warn - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt -``` - -**Expected Result**: - -```console -'644' is equal to '644' OR '640' is present OR '600' is present OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Manual) - - -**Result:** warn - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..1d348069a2a --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3208 @@ +--- +title: K3s Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. + +Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. + +These are the possible results for each control: + +- **Pass** - The K3s cluster passes the audit outlined in the benchmark. +- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. + +This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.1.11 +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit:** + +```bash +find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.crt + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.key + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 539 1 0 Sep11 ? 00:00:09 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 45213 45195 3 Sep11 ? 00:45:14 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 47188 1 0 Sep11 ? 00:01:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 02b8fdd94b7628d575ace92f337dcc93202151d07f33858341cfcb0178fea586 -address /run/k3s/containerd/containerd.sock root 47235 1 0 Sep11 ? 00:00:33 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id eb0f03c4bc1125ae34e5de77c7eaeb9c2c1e46bec0bb106b99281df7353f9ded -address /run/k3s/containerd/containerd.sock root 47948 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5eece7110bd3876414f890ed1b7158eb91f60d1f14450a9f8c77a0fc62b73c4a -address /run/k3s/containerd/containerd.sock root 48047 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4ef831f4bb8830a0a7b46a1e8be58197be00846ea0caa094014ea7ce3adf008e -address /run/k3s/containerd/containerd.sock root 48220 1 0 Sep11 ? 00:00:33 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id f8d5d3791ad2b1a8534476aa2fbdf8da1e4f0b9fdcdd26b1ae161142458a5336 -address /run/k3s/containerd/containerd.sock root 48878 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 41b93a6581e272b0852257b3d7c44ab4cadcdf465a3579a8b29b493ea75feaf7 -address /run/k3s/containerd/containerd.sock root 49870 1 0 Sep11 ? 00:00:30 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id be329cdccda4049f048c759a2b1915cd72526473ff7768e895bcfc153a66c125 -address /run/k3s/containerd/containerd.sock root 50271 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id cceb5d26eba7d7d3c474a2dc842b72495689f4e40055505ea2598e4ac6849d40 -address /run/k3s/containerd/containerd.sock root 50571 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3a26e691e0d0186165d523bef22b0af71f175c39df82845b32ce7b4e3d652d4a -address /run/k3s/containerd/containerd.sock root 96693 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9ed77e6e58410f1295f730ba4a8f8daf7aff8f4e896e24219a8fa710729c2287 -address /run/k3s/containerd/containerd.sock root 97726 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1be4fe50e6bb29d4549f8b03102b5dc15b7669fe56b32beae3f701cf6d2e58cc -address /run/k3s/containerd/containerd.sock root 97923 1 1 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 7c65c47376f36a8980a5bebad7ffdc1abe1853821cf6c4a1d45f1b6be3452062 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.2.29 +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +grep aescbc /path/to/encryption-config.json +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.1 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.2 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.3 +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.4 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.5 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.6 +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.7 +``` + +**Expected Result**: + +```console +'trusted-ca-file' is present +``` + +**Returned Value**: + +```console +trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Manual) + + +**Result:** warn + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'600' is equal to '600' +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--event-qps' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** warn + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..e7373288b35 --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,3215 @@ +--- +title: K3s Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. + +Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. + +These are the possible results for each control: + +- **Pass** - The K3s cluster passes the audit outlined in the benchmark. +- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. + +This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml +Not Applicable. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml +Not Applicable. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 +Not Applicable. + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root +Not Applicable. + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.1.11 +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd +Not Applicable. + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /var/lib/rancher/k3s/server/tls + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.crt + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.key + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= +Permissive - When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... +Permissive - Enabling Pod Security Policy can cause applications to unexpectedly fail. + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log +Permissive. + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 +Permissive. + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 +Permissive. + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 +Permissive. + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s +Permissive. + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.2.29 +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= +Permissive - Enabling encryption changes how data can be recovered as data is encrypted. + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. +Permissive - Enabling encryption changes how data can be recovered as data is encrypted. + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true +Not Applicable. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.1 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.2 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.3 +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.4 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.5 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.6 +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.7 +``` + +**Expected Result**: + +```console +'trusted-ca-file' is present +``` + +**Returned Value**: + +```console +trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Manual) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable. + All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml +Not Applicable. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:15 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:15Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-12-34 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=af02ecbc-1e4e-422e-8b4d-4b2aa24a9d46 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:15 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:15Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-12-34 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=af02ecbc-1e4e-422e-8b4d-4b2aa24a9d46 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is present OR '--event-qps' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Permissive - When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--pod-max-pids' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md deleted file mode 100644 index 16614a7e520..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ /dev/null @@ -1,3148 +0,0 @@ ---- -title: K3s Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 ---- - -This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. - -Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. - -These are the possible results for each control: - -- **Pass** - The K3s cluster passes the audit outlined in the benchmark. -- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. -- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. - -This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /etc/kubernetes/manifests/etcd.yaml - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /etc/kubernetes/manifests/etcd.yaml - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.1.11 -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root controllermanager - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit:** - -```bash -find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/pki/*.key - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep containerd | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 519 1 0 22:09 ? 00:00:00 /usr/bin/containerd root 801 1 0 22:09 ? 00:00:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 3864 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id d00174abbc275f6bb85c7f0be1d3154b9c91982a10b9dba6b5cb280f4d4c531d -address /run/k3s/containerd/containerd.sock root 4105 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 7c2b546b4d2380bcb51278661f34cff94fad2ba06978e13f8f1b92dafcc89d43 -address /run/k3s/containerd/containerd.sock root 4206 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 68d8a55ff4663985be004608dbf78b0362f5522e18490c81d4c8dc9963de1556 -address /run/k3s/containerd/containerd.sock root 5374 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id ca0ae9e0b37dfd7b1ce05f72e1bc5a1be8f5cb08f2b4543081536de3bdbc925d -address /run/k3s/containerd/containerd.sock root 5443 1 0 22:31 ? 00:00:01 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3ea3c1cdbbd5adb8efd5c67a46aadd0fca9918dc0ad1f7cafe38b83171e3dc1b -address /run/k3s/containerd/containerd.sock root 7130 1 0 22:32 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4d838297d35a31003106ac5989c3547433985bb2964b47baad12cee6e375645e -address /run/k3s/containerd/containerd.sock root 7639 1 0 22:32 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 341cb9bcd8486aa2f1acb8e1ae51baebd630ac6ed266643266c34d677f61c7d0 -address /run/k3s/containerd/containerd.sock root 10308 1 0 23:17 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id c534fbee8e0d06fd9b29bf8fc70a138975c6b18db25f1faf2615677dfdb4199e -address /run/k3s/containerd/containerd.sock root 11370 1 0 23:18 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4ff4b8776dac7a35b83616d341dbe4d5a689ac7fb9b8eee8db5978e3968380ea -address /run/k3s/containerd/containerd.sock root 13736 13723 2 23:21 ? 00:00:10 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 16022 1 0 23:29 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9027256349086e458119478e5e00384b1b76fbf5e6dbee23699f596a88d9f2bc -address /run/k3s/containerd/containerd.sock root 16159 1 0 23:29 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 929bf369fc5881654f4c1925624151ddb7cea51073267b8d213d966ba45406f3 -address /run/k3s/containerd/containerd.sock -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, --request-timeout=300s - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.2.29 -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -grep aescbc /path/to/encryption-config.json -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** warn - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.1 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.2 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.3 -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.4 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.5 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.6 -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.7 -``` - -**Expected Result**: - -```console -'trusted-ca-file' is present -``` - -**Returned Value**: - -```console -trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Manual) - - -**Result:** warn - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt -``` - -**Expected Result**: - -```console -'644' is equal to '644' OR '640' is present OR '600' is present OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Manual) - - -**Result:** warn - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 34bb63f89f0..9c6d1369a90 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index 25108b848b5..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3084 +0,0 @@ ---- -title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=600 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit Script:** `check_files_owner_in_dir.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/!(*key).pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit Script:** `check_encryption_provider_config.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` - -**Audit Execution:** - -```bash -./check_encryption_provider_config.sh aescbc -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -- aescbc: true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5209 5190 0 18:53 ? 00:00:01 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5209 5190 0 18:53 ? 00:00:01 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 4 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-26-105 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem ETCDCTL_ENDPOINTS=https://172.31.26.105:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/root -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 3 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-26-105 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem ETCDCTL_ENDPOINTS=https://172.31.26.105:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/root -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:43 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--event-qps' is equal to '0' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Automated) - - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** `check_for_default_ns.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` - -**Audit Execution:** - -```bash -./check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): replicationcontrollers is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicationcontrollers" in API group "" in the namespace "default" Error from server (Forbidden): services is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "services" in API group "" in the namespace "default" Error from server (Forbidden): daemonsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "daemonsets" in API group "apps" in the namespace "default" Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "deployments" in API group "apps" in the namespace "default" Error from server (Forbidden): replicasets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicasets" in API group "apps" in the namespace "default" Error from server (Forbidden): statefulsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "statefulsets" in API group "apps" in the namespace "default" Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "default" Error from server (Forbidden): cronjobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "cronjobs" in API group "batch" in the namespace "default" Error from server (Forbidden): jobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "jobs" in API group "batch" in the namespace "default" true -``` - diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..5f3c20fb37f --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3047 @@ +--- +title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=644 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/ssl/*key.pem + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit Script:** `check_encryption_provider_config.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to check the encrption provider config is set to aesbc +# +# outputs: +# true/false + +# TODO: Figure out the file location from the kube-apiserver commandline args +ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" + +if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then + echo "false" + exit +fi + +for provider in "$@" +do + if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then + echo "true" + exit + fi +done + +echo "false" +exit + +``` + +**Audit Execution:** + +```bash +./check_encryption_provider_config.sh aescbc +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +- aescbc: true +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3859 3838 0 Sep11 ? 00:03:44 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 3859 3838 0 Sep11 ? 00:03:44 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:08 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 5 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:08 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 4 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-7-100 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-7-100 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:10 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is equal to '0' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do + policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') + if [[ ${policy_count} -eq 0 ]]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Automated) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + +**Audit Script:** `check_for_default_ns.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) +if [[ ${count} -gt 0 ]]; then + echo "false" + exit +fi + +echo "true" + + +``` + +**Audit Execution:** + +```bash +./check_for_default_ns.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..9fe9ca2045f --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,2863 @@ +--- +title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf +Not Applicable - Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf +Not Applicable - Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=644 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= +When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi +``` + +**Expected Result**: + +```console +'provider' is present +``` + +### 1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4339 4318 0 Sep11 ? 00:03:28 kube-scheduler --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --profiling=false --v=2 --leader-elect=true +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 4339 4318 0 Sep11 ? 00:03:28 kube-scheduler --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --profiling=false --v=2 --leader-elect=true +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 2 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-4-224 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 2 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-4-224 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. + All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml +Not Applicable - Clusters provisioned by RKE do not require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable - Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is greater or equal to 0 OR '--event-qps' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable - Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--pod-max-pids' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md deleted file mode 100644 index 084568cc402..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ /dev/null @@ -1,3085 +0,0 @@ ---- -title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 ---- - -This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=600 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit Script:** `check_files_owner_in_dir.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/!(*key).pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit Script:** `check_encryption_provider_config.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` - -**Audit Execution:** - -```bash -./check_encryption_provider_config.sh aescbc -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -- aescbc: true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5671 5649 0 22:01 ? 00:00:01 kube-scheduler --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5671 5649 0 22:01 ? 00:00:01 kube-scheduler --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 5 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 4 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-51 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem ETCDCTL_ENDPOINTS=https://172.31.31.51:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 2 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 3 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-51 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem ETCDCTL_ENDPOINTS=https://172.31.31.51:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 2 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:34 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--event-qps' is equal to '0' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Automated) - - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** `check_for_default_ns.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` - -**Audit Execution:** - -```bash -./check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): replicationcontrollers is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicationcontrollers" in API group "" in the namespace "default" Error from server (Forbidden): services is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "services" in API group "" in the namespace "default" Error from server (Forbidden): daemonsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "daemonsets" in API group "apps" in the namespace "default" Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "deployments" in API group "apps" in the namespace "default" Error from server (Forbidden): replicasets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicasets" in API group "apps" in the namespace "default" Error from server (Forbidden): statefulsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "statefulsets" in API group "apps" in the namespace "default" Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "default" Error from server (Forbidden): cronjobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "cronjobs" in API group "batch" in the namespace "default" Error from server (Forbidden): jobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "jobs" in API group "batch" in the namespace "default" true -``` - diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 83cac7d6e59..3099612cacb 100644 --- a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: RKE2 Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index ffb7755d7ad..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3196 +0,0 @@ ---- -title: RKE2 Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Master Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'permissions' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 permissions=644 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -permissions has permissions 700, expected 700 or more restrictive -``` - -**Returned Value**: - -```console -permissions=700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd -``` - -### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /var/lib/rancher/rke2/server/tls/ - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key -``` - -**Expected Result**: - -```console -'permissions' is equal to '600' -``` - -**Returned Value**: - -```console -permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -### 1.2.33 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -/bin/sh -c 'if grep aescbc /var/lib/rancher/rke2/server/cred/encryption-config.json; then echo 0; fi' -``` - -**Expected Result**: - -```console -'0' is present -``` - -**Returned Value**: - -```console -{"kind":"EncryptionConfiguration","apiVersion":"apiserver.config.k8s.io/v1","resources":[{"resources":["secrets"],"providers":[{"aescbc":{"keys":[{"name":"aescbckey","secret":"LdLeqCPN/HfmgnUBXVPkDtUfeOPHwcQzDiLYG3nzFI4="}]}},{"identity":{}}]}]} 0 -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3652 3523 0 23:45 ? 00:00:03 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 3652 3523 0 23:45 ? 00:00:03 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Audit Config:** - -```bash -cat /var/lib/rancher/rke2/server/db/etcd/config -``` - -**Expected Result**: - -```console -'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -o audit-policy-file -``` - -**Expected Result**: - -```console -'audit-policy-file' is equal to 'audit-policy-file' -``` - -**Returned Value**: - -```console -audit-policy-file -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit Script:** `check_cafile_permissions.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_permissions.sh -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit Script:** `check_cafile_ownership.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_ownership.sh -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c permissions=%a /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c %U:%G /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.eventRecordQPS}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** pass - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{range .tlsCipherSuites[:]}{}{','}{end}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "calico-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "tigera-operator" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r '.spec.runAsUser.rule' -``` - -**Expected Result**: - -```console -'MustRunAsNonRoot' is present -``` - -**Returned Value**: - -```console -MustRunAsNonRoot -``` - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=5 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=5 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=2 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=4 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** pass - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=4 -``` - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r .spec.requiredDropCapabilities[] -``` - -**Expected Result**: - -```console -'ALL' is present -``` - -**Returned Value**: - -```console -ALL -``` - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports Network Policies (Automated) - - -**Result:** pass - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -**Audit:** - -```bash -kubectl get pods --all-namespaces --selector='k8s-app in (calico-node, canal, cilium)' -o name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_rke2_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in kube-system kube-public default; do - policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') - if [ ${policy_count} -eq 0 ]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_rke2_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..ba80c0a516a --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3202 @@ +--- +title: RKE2 Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 644 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'permissions' is equal to '600' +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'644' is equal to '644' +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +permissions has permissions 700, expected 700 or more restrictive +``` + +**Returned Value**: + +```console +permissions=700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /var/lib/rancher/rke2/server/tls/ + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Automated) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key +``` + +**Expected Result**: + +```console +'permissions' is equal to '600' +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true root 1017917 2489 83 16:16 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz root 1017945 2489 75 16:16 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/livez +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +### 1.2.33 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +/bin/sh -c 'if grep aescbc /var/lib/rancher/rke2/server/cred/encryption-config.json; then echo 0; fi' +``` + +**Expected Result**: + +```console +'0' is present +``` + +**Returned Value**: + +```console +{"kind":"EncryptionConfiguration","apiVersion":"apiserver.config.k8s.io/v1","resources":[{"resources":["secrets"],"providers":[{"aescbc":{"keys":[{"name":"aescbckey","secret":"akmMjUAq94YvsUftJpiA3b+9SClu0ESPBeckAI7KZBY="}]}},{"identity":{}}]}]} 0 +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2707 2593 0 Sep11 ? 00:06:20 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2707 2593 0 Sep11 ? 00:06:20 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Audit Config:** + +```bash +cat /var/lib/rancher/rke2/server/db/etcd/config +``` + +**Expected Result**: + +```console +'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -o audit-policy-file +``` + +**Expected Result**: + +```console +'audit-policy-file' is equal to 'audit-policy-file' +``` + +**Returned Value**: + +```console +audit-policy-file +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Automated) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.eventRecordQPS}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{range .tlsCipherSuites[:]}{}{','}{end}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +**Audit:** + +```bash +kubectl get psp global-restricted-psp && kubectl get psp global-restricted-psp -o json | jq -r ".spec.runAsUser.rule" || kubectl get psp restricted-noroot-psp && kubectl get psp restricted-noroot-psp -o json | jq -r ".spec.runAsUser.rule" +``` + +**Expected Result**: + +```console +'MustRunAsNonRoot' is equal to 'MustRunAsNonRoot' +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ Error from server (NotFound): podsecuritypolicies.policy "global-restricted-psp" not found Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES restricted-noroot-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,csi,persistentVolumeClaim Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ MustRunAsNonRoot +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=5 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=5 +``` + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=2 +``` + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=4 +``` + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** pass + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=4 +``` + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +**Audit:** + +```bash +kubectl get psp global-restricted-psp && kubectl get psp global-restricted-psp -o json | jq -r .spec.requiredDropCapabilities[] || kubectl get psp restricted-noroot-psp && kubectl get psp restricted-noroot-psp -o json | jq -r .spec.requiredDropCapabilities[] +``` + +**Expected Result**: + +```console +'ALL' is equal to 'ALL' +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ Error from server (NotFound): podsecuritypolicies.policy "global-restricted-psp" not found Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES restricted-noroot-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,csi,persistentVolumeClaim Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ ALL +``` + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Automated) + + +**Result:** pass + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +**Audit:** + +```bash +kubectl get pods --all-namespaces --selector='k8s-app in (calico-node, canal, cilium)' -o name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_rke2_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in kube-system kube-public default; do + policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') + if [ ${policy_count} -eq 0 ]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_rke2_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..b7d4a36ea4b --- /dev/null +++ b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,2967 @@ +--- +title: RKE2 Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then find /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml -name '*etcd*' | xargs stat -c permissions=%a; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +permissions has permissions 700, expected 700 or more restrictive +``` + +**Returned Value**: + +```console +permissions=700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true root 1018768 2419 99 16:17 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi +``` + +**Expected Result**: + +```console +'provider' is present +``` + +### 1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 +Not Applicable. + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= +Not Applicable. + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" +Not Applicable. + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= +Not Applicable. + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true +Not Applicable. + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Audit Config:** + +```bash +cat /var/lib/rancher/rke2/server/db/etcd/config +``` + +**Expected Result**: + +```console +'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not applicable. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.eventRecordQPS}' is present OR '{.eventRecordQPS}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{range .tlsCipherSuites[:]}{}{','}{end}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.podPidsLimit}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** warn + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md deleted file mode 100644 index 252accbb79d..00000000000 --- a/docs/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ /dev/null @@ -1,3196 +0,0 @@ ---- -title: RKE2 Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 ---- - -This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Master Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'permissions' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 permissions=644 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -permissions has permissions 700, expected 700 or more restrictive -``` - -**Returned Value**: - -```console -permissions=700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd -``` - -### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /var/lib/rancher/rke2/server/tls/ - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key -``` - -**Expected Result**: - -```console -'permissions' is equal to '600' -``` - -**Returned Value**: - -```console -permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:05 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true root 15378 3910 99 23:32 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 3980 3910 19 23:26 ? 00:01:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -### 1.2.33 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -/bin/sh -c 'if grep aescbc /var/lib/rancher/rke2/server/cred/encryption-config.json; then echo 0; fi' -``` - -**Expected Result**: - -```console -'0' is present -``` - -**Returned Value**: - -```console -{"kind":"EncryptionConfiguration","apiVersion":"apiserver.config.k8s.io/v1","resources":[{"resources":["secrets"],"providers":[{"aescbc":{"keys":[{"name":"aescbckey","secret":"TSpBkJhIU0sRx+84IZuBZ1qO+eaRdW31C7QCnF3+n8s="}]}},{"identity":{}}]}]} 0 -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 4128 4029 2 23:27 ? 00:00:06 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4126 4014 0 23:27 ? 00:00:02 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 4126 4014 0 23:27 ? 00:00:02 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-25-112 ETCD_UNSUPPORTED_ARCH= POD_HASH=ab0b8a2ee7711940d3d951edece075f3 FILE_HASH=068666c5f959fc1023cb1761daaaed212727c04120747d825c78fd7683122e6d NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 HOME=/ -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-25-112 ETCD_UNSUPPORTED_ARCH= POD_HASH=ab0b8a2ee7711940d3d951edece075f3 FILE_HASH=068666c5f959fc1023cb1761daaaed212727c04120747d825c78fd7683122e6d NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 HOME=/ -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Audit Config:** - -```bash -cat /var/lib/rancher/rke2/server/db/etcd/config -``` - -**Expected Result**: - -```console -'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-25-112 ETCD_UNSUPPORTED_ARCH= POD_HASH=ab0b8a2ee7711940d3d951edece075f3 FILE_HASH=068666c5f959fc1023cb1761daaaed212727c04120747d825c78fd7683122e6d NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 HOME=/ -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -o audit-policy-file -``` - -**Expected Result**: - -```console -'audit-policy-file' is equal to 'audit-policy-file' -``` - -**Returned Value**: - -```console -audit-policy-file -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit Script:** `check_cafile_permissions.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_permissions.sh -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit Script:** `check_cafile_ownership.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_ownership.sh -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c permissions=%a /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c %U:%G /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.eventRecordQPS}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3727 3667 3 23:26 ? 00:00:11 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-112 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c1cd514-db7b-4692-a1c4-cacb2656161f --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** pass - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{range .tlsCipherSuites[:]}{}{','}{end}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVXpPVE00TUI0WERUSXpNREl5TmpJek1qVXpPRm9YRFRNek1ESXlNekl6TWpVegpPRm93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFNemt6T0RCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJOUHllSlcwNE9lMUN6clo5cHplN09WWlliMlh4QmNvWUJ5Z3JRcUwKYUdpR29tN2xLNGs2ZW1uaUZQekpiOU9EQ0hDRmYyVUZaVXZDQTQxcUVmNVB3NlNqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnhUdGJTbTVMTnFrditkYXQrCmczalBWWXJjcERBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlBN08wV1NNVHo4djgwM3BZK3hFeDR2SUZaVEMraVoKUHVDc082eFRuVVVtb2dJaEFPY1NqQVdkUVJ0UmJvaUhJbTd2RHZuM1czT1JmYlUwaXU2UUhNcXdsTGs4Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrakNDQVRpZ0F3SUJBZ0lJRjc3RlZRT1l5RzR3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU16a3pPREFlRncweU16QXlNall5TXpJMU16aGFGdzB5TkRBeQpNall5TXpJMU16aGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUXg5Z1lxUzVCbndwTDIKcUdOeStjNnR0Yk15VmE3ZTdzT0J1UWdaWHBHZ1hNcGxOZHFhVy9lZjNZTjQwTk5RUnl2SWdWeTMzU0ZHSFJ0VgpqaXBpOXRZbG8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVVyNlUvYVNMcm1ONkxiaDZHS1JJa3NoM1M1bEF3Q2dZSUtvWkl6ajBFQXdJRFNBQXcKUlFJaEFPS2paZmxRVU11RnZldlFkYzg3ckxPcnhoNUtyUGhlQUtkY0Y4YWdielFJQWlCcHBmUGNMMFRoZ1g5UAptcCtOZHJqa1hvQU5SRTlEWVdIRUlRbDdubytDdWc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlCZVRDQ0FSK2dBd0lCQWdJQkFEQUtCZ2dxaGtqT1BRUURBakFrTVNJd0lBWURWUVFEREJseWEyVXlMV05zCmFXVnVkQzFqWVVBeE5qYzNORFV6T1RNNE1CNFhEVEl6TURJeU5qSXpNalV6T0ZvWERUTXpNREl5TXpJek1qVXoKT0Zvd0pERWlNQ0FHQTFVRUF3d1pjbXRsTWkxamJHbGxiblF0WTJGQU1UWTNOelExTXprek9EQlpNQk1HQnlxRwpTTTQ5QWdFR0NDcUdTTTQ5QXdFSEEwSUFCQlhFZ0x2Z3JLV09KdkZtVnJhNEhyY05YdmNwN3JMN3VFNW1IcFpkCmJmT2xkRDRkVlJ4NjRxak9DeUNpc2Vsczk4WDJLSXlieGNSNkpnbFU2VXRoOU5xalFqQkFNQTRHQTFVZER3RUIKL3dRRUF3SUNwREFQQmdOVkhSTUJBZjhFQlRBREFRSC9NQjBHQTFVZERnUVdCQlN2cFQ5cEl1dVkzb3R1SG9ZcApFaVN5SGRMbVVEQUtCZ2dxaGtqT1BRUURBZ05JQURCRkFpRUF3R2xqWXUxZkJpMHZROFczbWxueXVDNUJqMlBBCm14Sm1uS3BVSG8ydjJBZ0NJRndiblM3ajROUGtCT2hzRjJBeFhEZlZzdExoRWpqbmhPRHlQek1kT01STQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUpZblVvZ2U2bHVuNFN1WVVaN3VBQTVGYXV6blBaQzV2WHlpc1R2SVRjOXFvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTWZZR0trdVFaOEtTOXFoamN2bk9yYld6TWxXdTN1N0RnYmtJR1Y2Um9GektaVFhhbWx2MwpuOTJEZU5EVFVFY3J5SUZjdDkwaFJoMGJWWTRxWXZiV0pRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "calico-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "tigera-operator" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r '.spec.runAsUser.rule' -``` - -**Expected Result**: - -```console -'MustRunAsNonRoot' is present -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" -``` - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** fail - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r .spec.requiredDropCapabilities[] -``` - -**Expected Result**: - -```console -'ALL' is present -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" -``` - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports Network Policies (Automated) - - -**Result:** pass - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -**Audit:** - -```bash -kubectl get pods --all-namespaces --selector='k8s-app in (calico-node, canal, cilium)' -o name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** true - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_rke2_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in kube-system kube-public default; do - policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') - if [ ${policy_count} -eq 0 ]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_rke2_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md b/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md index a863dd44e52..ace8bd95fab 100644 --- a/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md +++ b/docs/reference-guides/rancher-security/kubernetes-security-best-practices.md @@ -2,6 +2,10 @@ title: Kubernetes Security Best Practices --- + + + + ### Restricting cloud metadata API access Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. diff --git a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md index 2373ec352c4..0f35551cf31 100644 --- a/docs/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/docs/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -2,6 +2,10 @@ title: Sample PodSecurityConfiguration --- + + + + The following PodSecurityConfiguration contains the required Rancher namespace exemptions for a `rancher-restricted` cluster to run properly. ```yaml diff --git a/docs/reference-guides/rancher-security/security-advisories-and-cves.md b/docs/reference-guides/rancher-security/security-advisories-and-cves.md index 872a908f633..8f3649e7a85 100644 --- a/docs/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/docs/reference-guides/rancher-security/security-advisories-and-cves.md @@ -2,6 +2,10 @@ title: Security Advisories and CVEs --- + + + + Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher's GitHub [security page](https://github.com/rancher/rancher/security/advisories). | ID | Description | Date | Resolution | diff --git a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index d7358c29b62..1d9d46c75d4 100644 --- a/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/docs/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -2,6 +2,10 @@ title: About rancher-selinux --- + + + + To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides a SELinux RPM. The `rancher-selinux` RPM only contains policies for the [rancher-logging application.](https://github.com/rancher/charts/tree/dev-v2.5/charts/rancher-logging) diff --git a/docs/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md b/docs/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md index fe124221e5f..c5edf5e0017 100644 --- a/docs/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md +++ b/docs/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md @@ -2,6 +2,10 @@ title: About rke2-selinux --- + + + + `rke2-selinux` provides policies for RKE2. It is installed automatically when the RKE2 installer script detects that it is running on an RPM-based distro. The `rke2-selinux` GitHub repository is [here.](https://github.com/rancher/rke2-selinux) diff --git a/docs/troubleshooting/other-troubleshooting-tips/logging.md b/docs/troubleshooting/other-troubleshooting-tips/logging.md index d4d6353442e..f4ba45226bc 100644 --- a/docs/troubleshooting/other-troubleshooting-tips/logging.md +++ b/docs/troubleshooting/other-troubleshooting-tips/logging.md @@ -6,7 +6,7 @@ title: Logging -## Log levels +## Log Levels The following log levels are used in Rancher: @@ -16,9 +16,9 @@ The following log levels are used in Rancher: | `debug` | Logs more detailed messages that can be used to debug. | | `trace` | Logs very detailed messages on internal functions. This is very verbose and can contain sensitive information. | -### How to configure a log level +### How to Configure a Log Level -#### Kubernetes install +#### Kubernetes Install * Configure debug log level @@ -58,7 +58,7 @@ $ docker exec -ti loglevel --set info OK ``` -## Rancher machine debug logs +## Rancher Machine Debug Logs If you need to troubleshoot the creation of objects in your infrastructure provider of choice, `rancher-machine` debug logs might be helpful to you. @@ -78,3 +78,19 @@ possible to enable debug logs in `rancher-machine` when provisioning RKE1, RKE2 Just like the `trace` log level above, `rancher-machine` debug logs can contain sensitive information. ::: + + +## Cattle-cluster-agent Debug Logs + +The `cattle-cluster-agent` log levels can be set when you initialize downstream clusters. + +When you create a cluster under **Cluster Configuration > Agent Environment Vars** you can set variables to define the log level. +- Trace-level logging: Set `CATTLE_TRACE` or `RANCHER_TRACE` to `true` + +- Debug-level logging: Set `CATTLE_DEBUG` or `RANCHER_DEBUG` to `true` + +:::caution + +The `cattle-cluster-agent` debug logs may contain sensitive information. + +::: diff --git a/docusaurus.config.js b/docusaurus.config.js index 3ab17e54bc1..0295dbea609 100644 --- a/docusaurus.config.js +++ b/docusaurus.config.js @@ -1143,28 +1143,52 @@ module.exports = { from: '/v2.6/explanations/integrations-in-rancher/opa-gatekeeper' }, // Redirects for restructure from PR #234 (end) { - to: "/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/v2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.25" }, { - to: "/v2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/v2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/v2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.25" }, { - to: "/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/v2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25" }, { - to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/v2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.25" }, { - to: "/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + from: "/v2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24" + }, + { + to: "/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.25" }, { - to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + to: "/v2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", from: "/v2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.25" } ], diff --git a/sidebars.js b/sidebars.js index 4c97c819bbc..b4e164c5130 100644 --- a/sidebars.js +++ b/sidebars.js @@ -1069,8 +1069,8 @@ const sidebars = { }, items: [ "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", ], }, { @@ -1082,8 +1082,8 @@ const sidebars = { }, items: [ "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", ], }, { @@ -1095,8 +1095,8 @@ const sidebars = { }, items: [ "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25", + "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27", ], }, ], diff --git a/src/pages/versions.md b/src/pages/versions.md index e30f1483b84..6cd8feaf4af 100644 --- a/src/pages/versions.md +++ b/src/pages/versions.md @@ -10,10 +10,10 @@ Below are the documentation and release notes for the currently released version - + - - + +
v2.7.6v2.7.7 DocumentationRelease NotesSupport MatrixRelease NotesSupport Matrix
@@ -33,6 +33,12 @@ Below are the documentation and release notes for the currently released version Below are the documentation and release notes for previous versions of Rancher 2.7.x: + + + + + + diff --git a/static/img/backup-container.png b/static/img/backup-container.png deleted file mode 100644 index e1fce01bd2c..00000000000 Binary files a/static/img/backup-container.png and /dev/null differ diff --git a/static/img/click-register-new-app.png b/static/img/click-register-new-app.png deleted file mode 100644 index ac467965d19..00000000000 Binary files a/static/img/click-register-new-app.png and /dev/null differ diff --git a/static/img/create-backup-tarball.png b/static/img/create-backup-tarball.png deleted file mode 100644 index e659d50f351..00000000000 Binary files a/static/img/create-backup-tarball.png and /dev/null differ diff --git a/static/img/default-grafana-dashboards.png b/static/img/default-grafana-dashboards.png deleted file mode 100644 index 9918dae8236..00000000000 Binary files a/static/img/default-grafana-dashboards.png and /dev/null differ diff --git a/static/img/dir-backup-tarball-clear.png b/static/img/dir-backup-tarball-clear.png deleted file mode 100644 index 35395285fdf..00000000000 Binary files a/static/img/dir-backup-tarball-clear.png and /dev/null differ diff --git a/static/img/dir-backup-tarball.png b/static/img/dir-backup-tarball.png deleted file mode 100644 index eeb2a4687e6..00000000000 Binary files a/static/img/dir-backup-tarball.png and /dev/null differ diff --git a/static/img/docker-container-ps-output.png b/static/img/docker-container-ps-output.png deleted file mode 100644 index edd911fb566..00000000000 Binary files a/static/img/docker-container-ps-output.png and /dev/null differ diff --git a/static/img/no-ingress.png b/static/img/no-ingress.png deleted file mode 100644 index fa1a0a0fdd2..00000000000 Binary files a/static/img/no-ingress.png and /dev/null differ diff --git a/static/img/persistent-volume.png b/static/img/persistent-volume.png deleted file mode 100644 index 327da071bf2..00000000000 Binary files a/static/img/persistent-volume.png and /dev/null differ diff --git a/static/img/rancher_overview_2.png b/static/img/rancher_overview_2.png deleted file mode 100644 index 00ce8eb2c27..00000000000 Binary files a/static/img/rancher_overview_2.png and /dev/null differ diff --git a/static/img/rke-etcd-backup.png b/static/img/rke-etcd-backup.png deleted file mode 100644 index b40c550618d..00000000000 Binary files a/static/img/rke-etcd-backup.png and /dev/null differ diff --git a/static/img/stop-rancher-container.gif b/static/img/stop-rancher-container.gif deleted file mode 100644 index 92468116973..00000000000 Binary files a/static/img/stop-rancher-container.gif and /dev/null differ diff --git a/versioned_docs/version-2.0-2.4/backups/backup/backup.md b/versioned_docs/version-2.0-2.4/backups/backup/backup.md deleted file mode 100644 index 065e8159532..00000000000 --- a/versioned_docs/version-2.0-2.4/backups/backup/backup.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Backup ---- - - - - - -This section contains information about how to create backups of your Rancher data and how to restore them in a disaster scenario. - - - Rancher server backups: - - [Rancher installed on a K3s Kubernetes cluster](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-k3s-installed-rancher.md) - - [Rancher installed on an RKE Kubernetes cluster](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-rancher-launched-kubernetes-clusters.md) - - [Rancher installed with Docker](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) - -For information on backing up Rancher launched Kubernetes clusters, refer to [this section.](../../how-to-guides/advanced-user-guides/manage-clusters/backing-up-etcd.md) - -If you are looking to back up your [Rancher launched Kubernetes cluster](../../pages-for-subheaders/launch-kubernetes-with-rancher.md), please refer [here](../../how-to-guides/advanced-user-guides/manage-clusters/backing-up-etcd.md). diff --git a/versioned_docs/version-2.0-2.4/backups/restore/restore.md b/versioned_docs/version-2.0-2.4/backups/restore/restore.md deleted file mode 100644 index 7467b146f48..00000000000 --- a/versioned_docs/version-2.0-2.4/backups/restore/restore.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -title: Restore ---- - -If you lose the data on your Rancher Server, you can restore it if you have backups stored in a safe location. - -- [Restoring backups for Rancher installed with Docker](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) -- [Restoring backups for Rancher installed on an RKE Kubernetes cluster](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-rancher-launched-kubernetes-clusters-from-backup.md) -- [Restoring backups for Rancher installed on a K3s Kubernetes cluster](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-k3s-installed-rancher.md) - -If you are looking to restore your [Rancher launched Kubernetes cluster](../../pages-for-subheaders/launch-kubernetes-with-rancher.md), please refer to [this section](../../how-to-guides/advanced-user-guides/manage-clusters/restoring-etcd.md). diff --git a/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/creating-apps.md b/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/creating-apps.md index 270d7674c0c..beeea68d679 100644 --- a/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/creating-apps.md +++ b/versioned_docs/version-2.0-2.4/how-to-guides/new-user-guides/helm-charts-in-rancher/creating-apps.md @@ -65,7 +65,6 @@ Before you create your own custom catalog, you should have a basic understanding A file that contains questions for a form. These form questions simplify deployment of a chart. Without it, you must configure the deployment using key value pairs, which is more difficult. The following image displays the difference between a Rancher chart (which includes `questions.yml`) and a native Helm chart (which does not). -
Rancher Chart with questions.yml (left) vs. Helm Chart without (right)
![questions.yml](/img/questions.png) diff --git a/versioned_docs/version-2.0-2.4/reference-guides/about-the-api/api-tokens.md b/versioned_docs/version-2.0-2.4/reference-guides/about-the-api/api-tokens.md index 8e6a1a9b8c1..64e450463e2 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/about-the-api/api-tokens.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/about-the-api/api-tokens.md @@ -3,7 +3,7 @@ title: API Tokens --- - + By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password. diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/kubectl-utility.md index 003aea86dba..255b8ad4ac1 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/kubectl-utility.md @@ -3,7 +3,7 @@ title: kubectl Utility --- - + ## kubectl diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/rancher-cli.md index c0850617aff..9b50fd35f2e 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cli-with-rancher/rancher-cli.md @@ -4,7 +4,7 @@ description: Interact with Rancher using command line interface (CLI) tools from --- - + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md index 4997518b135..828c9ca1ce8 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Node Template Configuration --- - + For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md index 3c969b1d06e..d8c0f3dcdab 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Node Template Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md index 22fd6532146..24bfabe753a 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Node Template Configuration --- - + diff --git a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md index a0e092fee87..3c363d053cf 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md @@ -3,7 +3,7 @@ title: Rancher Agent Options --- - + Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes](../../../../pages-for-subheaders/use-existing-nodes.md) and add the options to the generated `docker run` command when adding a node. diff --git a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/architecture-recommendations.md b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/architecture-recommendations.md index 36794f75b40..b7fc1fc46a0 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/architecture-recommendations.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/architecture-recommendations.md @@ -2,6 +2,10 @@ title: Architecture Recommendations --- + + + + Kubernetes cluster. If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the cluster running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) ## Separation of Rancher and User Clusters diff --git a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md index fabdcd6f8b9..e45c9e17140 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md @@ -2,6 +2,10 @@ title: Communicating with Downstream User Clusters --- + + + + This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services. The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters. diff --git a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/rancher-server-and-components.md b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/rancher-server-and-components.md index 6bf86ee8d7c..7c22dba7b10 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/rancher-server-and-components.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/rancher-manager-architecture/rancher-server-and-components.md @@ -2,6 +2,10 @@ title: Rancher Server and Components --- + + + + The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment. The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service). diff --git a/versioned_docs/version-2.0-2.4/reference-guides/rancher-security/security-advisories-and-cves.md b/versioned_docs/version-2.0-2.4/reference-guides/rancher-security/security-advisories-and-cves.md index 84381237884..a9142bd4b34 100644 --- a/versioned_docs/version-2.0-2.4/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/versioned_docs/version-2.0-2.4/reference-guides/rancher-security/security-advisories-and-cves.md @@ -2,6 +2,10 @@ title: Rancher CVEs and Resolutions --- + + + + Rancher is committed to informing the community of security issues in our products. Rancher will publish CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. | ID | Description | Date | Resolution | diff --git a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.0/rancher-v2.3.0.md b/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.0/rancher-v2.3.0.md deleted file mode 100644 index a5d9ae8ec66..00000000000 --- a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.0/rancher-v2.3.0.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Rancher v2.3.0 ---- - -### Self Assessment Guide - -This [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.0-self-assessment-guide-with-cis-v1.4.1-benchmark.md) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark: - -Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version ----------------------------|----------|---------|-------|----- -Self Assessment Guide v2.3 | Rancher v2.3.0-2.3.2 | Hardening Guide v2.3 | Kubernetes 1.15 | Benchmark v1.4.1 - -### Hardening Guide - -This hardening [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.0-hardening-guide-with-cis-v1.4.1-benchmark.md) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - -Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version -------------------------|----------------|-----------------------|------------------ -Hardening Guide v2.3 | Rancher v2.3.0-v2.3.2 | Benchmark v1.4.1 | Kubernetes 1.15 \ No newline at end of file diff --git a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.3/rancher-v2.3.3.md b/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.3/rancher-v2.3.3.md deleted file mode 100644 index c353c8a9a99..00000000000 --- a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.3/rancher-v2.3.3.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Rancher v2.3.3 ---- - -### Self Assessment Guide - -This [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.3-self-assessment-guide-with-cis-v1.4.1-benchmark.md) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark: - -Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version ----------------------------|----------|---------|-------|----- -Self Assessment Guide v2.3.3 | Rancher v2.3.3 | Hardening Guide v2.3.3 | Kubernetes v1.16 | Benchmark v1.4.1 - -### Hardening Guide - -This hardening [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.3-hardening-guide-with-cis-v1.4.1-benchmark.md) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - -Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version -------------------------|----------------|-----------------------|------------------ -Hardening Guide v2.3.3 | Rancher v2.3.3 | Benchmark v1.4.1 | Kubernetes 1.14, 1.15, and 1.16 \ No newline at end of file diff --git a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.5/rancher-v2.3.5.md b/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.5/rancher-v2.3.5.md deleted file mode 100644 index cf519162c6c..00000000000 --- a/versioned_docs/version-2.0-2.4/security/rancher-2.3.x/rancher-v2.3.5/rancher-v2.3.5.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Rancher v2.3.5 ---- - -### Self Assessment Guide - -This [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.5-self-assessment-guide-with-cis-v1.5-benchmark.md) corresponds to specific versions of the hardening guide, Rancher, Kubernetes, and the CIS Benchmark: - -Self Assessment Guide Version | Rancher Version | Hardening Guide Version | Kubernetes Version | CIS Benchmark Version ----------------------------|----------|---------|-------|----- -Self Assessment Guide v2.3.5 | Rancher v2.3.5 | Hardening Guide v2.3.5 | Kubernetes v1.15 | Benchmark v1.5 - -### Hardening Guide - -This hardening [guide](../../../reference-guides/rancher-security/rancher-v2.3-hardening-guides/rancher-v2.3.5-hardening-guide-with-cis-v1.5-benchmark.md) is intended to be used with specific versions of the CIS Kubernetes Benchmark, Kubernetes, and Rancher: - -Hardening Guide Version | Rancher Version | CIS Benchmark Version | Kubernetes Version -------------------------|----------------|-----------------------|------------------ -Hardening Guide v2.3.5 | Rancher v2.3.5 | Benchmark v1.5 | Kubernetes 1.15 \ No newline at end of file diff --git a/versioned_docs/version-2.5/backups/docker-installs/docker-installs.md b/versioned_docs/version-2.5/backups/docker-installs/docker-installs.md deleted file mode 100644 index cc211cee5e0..00000000000 --- a/versioned_docs/version-2.5/backups/docker-installs/docker-installs.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Backup and Restore for Rancher Installed with Docker ---- - -- [Backups](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) -- [Restores](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) \ No newline at end of file diff --git a/versioned_docs/version-2.5/cluster-provisioning/rke-clusters/options/options.md b/versioned_docs/version-2.5/cluster-provisioning/rke-clusters/options/options.md deleted file mode 100644 index 9fc981415b2..00000000000 --- a/versioned_docs/version-2.5/cluster-provisioning/rke-clusters/options/options.md +++ /dev/null @@ -1,302 +0,0 @@ ---- -title: RKE Cluster Configuration Reference ---- - - - - - -When Rancher installs Kubernetes, it uses [RKE](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md) as the Kubernetes distribution. - -This section covers the configuration options that are available in Rancher for a new or existing RKE Kubernetes cluster. - -You can configure the Kubernetes options one of two ways: - -- [Rancher UI](#rancher-ui-options): Use the Rancher UI to select options that are commonly customized when setting up a Kubernetes cluster. -- [Cluster Config File](#cluster-config-file): Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the options available in an RKE installation, except for system_images configuration, by specifying them in YAML. - -The RKE cluster config options are nested under the `rancher_kubernetes_engine_config` directive. For more information, see the section about the [cluster config file.](#cluster-config-file) - - -## Rancher UI Options - -When creating a cluster using one of the options described in [Rancher Launched Kubernetes](../../../pages-for-subheaders/launch-kubernetes-with-rancher.md), you can configure basic Kubernetes options using the **Cluster Options** section. - -### Kubernetes Version - -The version of Kubernetes installed on your cluster nodes. Rancher packages its own version of Kubernetes based on [hyperkube](https://github.com/rancher/hyperkube). - -### Network Provider - -The [Network Provider](https://kubernetes.io/docs/concepts/cluster-administration/networking/) that the cluster uses. For more details on the different networking providers, please view our [Networking FAQ](../../../faq/container-network-interface-providers.md). - ->**Note:** After you launch the cluster, you cannot change your network provider. Therefore, choose which network provider you want to use carefully, as Kubernetes doesn't allow switching between network providers. Once a cluster is created with a network provider, changing network providers would require you tear down the entire cluster and all its applications. - -Out of the box, Rancher is compatible with the following network providers: - -- [Canal](https://github.com/projectcalico/canal) -- [Flannel](https://github.com/coreos/flannel#flannel) -- [Calico](https://docs.projectcalico.org/v3.11/introduction/) -- [Weave](https://github.com/weaveworks/weave) - - -**Notes on Weave:** - -When Weave is selected as network provider, Rancher will automatically enable encryption by generating a random password. If you want to specify the password manually, please see how to configure your cluster using a [Config File](cluster-provisioning/rke-clusters/options/#cluster-config-file) and the [Weave Network Plug-in Options](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/#weave-network-plug-in-options). - -### Project Network Isolation - -Project network isolation is used to enable or disable communication between pods in different projects. - - - - -To enable project network isolation as a cluster option, you will need to use any RKE network plugin that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin. - - - - -To enable project network isolation as a cluster option, you will need to use Canal as the CNI. - - - - -### Kubernetes Cloud Providers - -You can configure a [Kubernetes cloud provider](../../../pages-for-subheaders/set-up-cloud-providers.md). If you want to use [volumes and storage](../../../pages-for-subheaders/create-kubernetes-persistent-storage.md) in Kubernetes, typically you must select the specific cloud provider in order to use it. For example, if you want to use Amazon EBS, you would need to select the `aws` cloud provider. - ->**Note:** If the cloud provider you want to use is not listed as an option, you will need to use the [config file option](#cluster-config-file) to configure the cloud provider. Please reference the [RKE cloud provider documentation](https://rancher.com/docs/rke/latest/en/config-options/cloud-providers/) on how to configure the cloud provider. - -If you want to see all the configuration options for a cluster, please click **Show advanced options** on the bottom right. The advanced options are described below: - -### Private registries - -The cluster-level private registry configuration is only used for provisioning clusters. - -There are two main ways to set up private registries in Rancher: by setting up the [global default registry](../../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/global-default-private-registry.md) through the **Settings** tab in the global view, and by setting up a private registry in the advanced options in the cluster-level settings. The global default registry is intended to be used for air-gapped setups, for registries that do not require credentials. The cluster-level private registry is intended to be used in all setups in which the private registry requires credentials. - -If your private registry requires credentials, you need to pass the credentials to Rancher by editing the cluster options for each cluster that needs to pull images from the registry. - -The private registry configuration option tells Rancher where to pull the [system images](https://rancher.com/docs/rke/latest/en/config-options/system-images/) or [addon images](https://rancher.com/docs/rke/latest/en/config-options/add-ons/) that will be used in your cluster. - -- **System images** are components needed to maintain the Kubernetes cluster. -- **Add-ons** are used to deploy several cluster components, including network plug-ins, the ingress controller, the DNS provider, or the metrics server. - -See the [RKE documentation on private registries](https://rancher.com/docs/rke/latest/en/config-options/private-registries/) for more information on the private registry for components applied during the provisioning of the cluster. - -### Authorized Cluster Endpoint - -Authorized Cluster Endpoint can be used to directly access the Kubernetes API server, without requiring communication through Rancher. - -> The authorized cluster endpoint is available only in clusters that Rancher has provisioned [using RKE](../../../pages-for-subheaders/rancher-manager-architecture.md#tools-for-provisioning-kubernetes-clusters). It is not available for clusters in hosted Kubernetes providers, such as Amazon's EKS. Additionally, the authorized cluster endpoint cannot be enabled for RKE clusters that are registered with Rancher; it is available only on Rancher-launched Kubernetes clusters. - -This is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self signed certificates. - -For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) - -We recommend using a load balancer with the authorized cluster endpoint. For details, refer to the [recommended architecture section.](../../../reference-guides/rancher-manager-architecture/architecture-recommendations.md#architecture-for-an-authorized-cluster-endpoint) - -### Node Pools - -For information on using the Rancher UI to set up node pools in an RKE cluster, refer to [this page.](../../../pages-for-subheaders/use-new-nodes-in-an-infra-provider.md) - -## Advanced Options - -The following options are available when you create clusters in the Rancher UI. They are located under **Advanced Options.** - -### NGINX Ingress - -Option to enable or disable the [NGINX ingress controller](https://rancher.com/docs/rke/latest/en/config-options/add-ons/ingress-controllers/). - -### Node Port Range - -Option to change the range of ports that can be used for [NodePort services](https://kubernetes.io/docs/concepts/services-networking/service/#nodeport). Default is `30000-32767`. - -### Metrics Server Monitoring - -Option to enable or disable [Metrics Server](https://rancher.com/docs/rke/latest/en/config-options/add-ons/metrics-server/). - -### Pod Security Policy Support - -Option to enable and select a default [Pod Security Policy](../../../how-to-guides/advanced-user-guides/authentication-permissions-and-global-configuration/create-pod-security-policies.md). You must have an existing Pod Security Policy configured before you can use this option. - -### Docker Version on Nodes - -Option to require [a supported Docker version](../../../pages-for-subheaders/installation-requirements.md) installed on the cluster nodes that are added to the cluster, or to allow unsupported Docker versions installed on the cluster nodes. - -### Docker Root Directory - -If the nodes you are adding to the cluster have Docker configured with a non-default Docker Root Directory (default is `/var/lib/docker`), please specify the correct Docker Root Directory in this option. - -### Recurring etcd Snapshots - -Option to enable or disable [recurring etcd snapshots](https://rancher.com/docs/rke/latest/en/etcd-snapshots/#etcd-recurring-snapshots). - -### Agent Environment Variables - -_Available as of v2.5.6_ - -Option to set environment variables for [rancher agents](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/launch-kubernetes-with-rancher/about-rancher-agents.md). The environment variables can be set using key value pairs. If rancher agent requires use of proxy to communicate with Rancher server, `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY` environment variables can be set using agent environment variables. - - -## Cluster Config File - -Instead of using the Rancher UI to choose Kubernetes options for the cluster, advanced users can create an RKE config file. Using a config file allows you to set any of the [options available](https://rancher.com/docs/rke/latest/en/config-options/) in an RKE installation, except for `system_images` configuration. The `system_images` option is not supported when creating a cluster with the Rancher UI or API. - -- To edit an RKE config file directly from the Rancher UI, click **Edit as YAML**. -- To read from an existing RKE file, click **Read from a file**. - -![image](/img/cluster-options-yaml.png) - -### Config File Structure in Rancher v2.3.0+ - -RKE (Rancher Kubernetes Engine) is the tool that Rancher uses to provision Kubernetes clusters. Rancher's cluster config files used to have the same structure as [RKE config files,](https://rancher.com/docs/rke/latest/en/example-yamls/) but the structure changed so that in Rancher, RKE cluster config items are separated from non-RKE config items. Therefore, configuration for your cluster needs to be nested under the `rancher_kubernetes_engine_config` directive in the cluster config file. Cluster config files created with earlier versions of Rancher will need to be updated for this format. An example cluster config file is included below. - -
- Example Cluster Config File - -```yaml -# -# Cluster Config -# -docker_root_dir: /var/lib/docker -enable_cluster_alerting: false -enable_cluster_monitoring: false -enable_network_policy: false -local_cluster_auth_endpoint: - enabled: true -# -# Rancher Config -# -rancher_kubernetes_engine_config: # Your RKE template config goes here. - addon_job_timeout: 30 - authentication: - strategy: x509 - ignore_docker_version: true -# -# # Currently only nginx ingress provider is supported. -# # To disable ingress controller, set `provider: none` -# # To enable ingress on specific nodes, use the node_selector, eg: -# provider: nginx -# node_selector: -# app: ingress -# - ingress: - provider: nginx - kubernetes_version: v1.15.3-rancher3-1 - monitoring: - provider: metrics-server -# -# If you are using calico on AWS -# -# network: -# plugin: calico -# calico_network_provider: -# cloud_provider: aws -# -# # To specify flannel interface -# -# network: -# plugin: flannel -# flannel_network_provider: -# iface: eth1 -# -# # To specify flannel interface for canal plugin -# -# network: -# plugin: canal -# canal_network_provider: -# iface: eth1 -# - network: - options: - flannel_backend_type: vxlan - plugin: canal -# -# services: -# kube-api: -# service_cluster_ip_range: 10.43.0.0/16 -# kube-controller: -# cluster_cidr: 10.42.0.0/16 -# service_cluster_ip_range: 10.43.0.0/16 -# kubelet: -# cluster_domain: cluster.local -# cluster_dns_server: 10.43.0.10 -# - services: - etcd: - backup_config: - enabled: true - interval_hours: 12 - retention: 6 - safe_timestamp: false - creation: 12h - extra_args: - election-timeout: 5000 - heartbeat-interval: 500 - gid: 0 - retention: 72h - snapshot: false - uid: 0 - kube_api: - always_pull_images: false - pod_security_policy: false - service_node_port_range: 30000-32767 - ssh_agent_auth: false -windows_prefered_cluster: false -``` -
- -### Default DNS provider - -The table below indicates what DNS provider is deployed by default. See [RKE documentation on DNS provider](https://rancher.com/docs/rke/latest/en/config-options/add-ons/dns/) for more information how to configure a different DNS provider. CoreDNS can only be used on Kubernetes v1.12.0 and higher. - -| Rancher version | Kubernetes version | Default DNS provider | -|-------------|--------------------|----------------------| -| v2.2.5 and higher | v1.14.0 and higher | CoreDNS | -| v2.2.5 and higher | v1.13.x and lower | kube-dns | -| v2.2.4 and lower | any | kube-dns | - -## Rancher specific parameters - -Besides the RKE config file options, there are also Rancher specific settings that can be configured in the Config File (YAML): - -### docker_root_dir - -See [Docker Root Directory](#docker-root-directory). - -### enable_cluster_monitoring - -Option to enable or disable [Cluster Monitoring](../../../pages-for-subheaders/monitoring-and-alerting.md). - -### enable_network_policy - -Option to enable or disable Project Network Isolation. - -Before Rancher v2.5.8, project network isolation is only available if you are using the Canal network plugin for RKE. - -In v2.5.8+, project network isolation is available if you are using any RKE network plugin that supports the enforcement of Kubernetes network policies, such as Canal or the Cisco ACI plugin. - -### local_cluster_auth_endpoint - -See [Authorized Cluster Endpoint](#authorized-cluster-endpoint). - -Example: - -```yaml -local_cluster_auth_endpoint: - enabled: true - fqdn: "FQDN" - ca_certs: "BASE64_CACERT" -``` - -### Custom Network Plug-in - -You can add a custom network plug-in by using the [user-defined add-on functionality](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/) of RKE. You define any add-on that you want deployed after the Kubernetes cluster is deployed. - -There are two ways that you can specify an add-on: - -- [In-line Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#in-line-add-ons) -- [Referencing YAML Files for Add-ons](https://rancher.com/docs/rke/latest/en/config-options/add-ons/user-defined-add-ons/#referencing-yaml-files-for-add-ons) - -For an example of how to configure a custom network plug-in by editing the `cluster.yml`, refer to the [RKE documentation.](https://rancher.com/docs/rke/latest/en/config-options/add-ons/network-plugins/custom-network-plugin-example) diff --git a/versioned_docs/version-2.5/reference-guides/about-the-api/api-tokens.md b/versioned_docs/version-2.5/reference-guides/about-the-api/api-tokens.md index 2cc866cbe50..1136b4956d1 100644 --- a/versioned_docs/version-2.5/reference-guides/about-the-api/api-tokens.md +++ b/versioned_docs/version-2.5/reference-guides/about-the-api/api-tokens.md @@ -3,7 +3,7 @@ title: API Tokens --- - + By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password. diff --git a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/backup-configuration.md b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/backup-configuration.md index 6a94ae60a51..12d8c9a053e 100644 --- a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/backup-configuration.md @@ -3,7 +3,7 @@ title: Backup Configuration --- - + The Backup Create page lets you configure a schedule, enable encryption and specify the storage location for your backups. diff --git a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/examples.md b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/examples.md index 1cc04a7938d..610cfab0650 100644 --- a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/examples.md +++ b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + This section contains examples of Backup and Restore custom resources. diff --git a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/restore-configuration.md b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/restore-configuration.md index 3b2f93cc099..a6db2a37239 100644 --- a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/restore-configuration.md +++ b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/restore-configuration.md @@ -3,7 +3,7 @@ title: Restore Configuration --- - + The Restore Create page lets you provide details of the backup to restore from diff --git a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/storage-configuration.md b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/storage-configuration.md index 3f0e04d0fbb..2a99b969db0 100644 --- a/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/storage-configuration.md +++ b/versioned_docs/version-2.5/reference-guides/backup-restore-configuration/storage-configuration.md @@ -3,7 +3,7 @@ title: Backup Storage Location Configuration --- - + Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md index bd56e50d30e..dc307e21494 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md @@ -3,7 +3,7 @@ title: Logging Best Practices --- - + In this guide, we recommend best practices for cluster-level logging and application logging. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md index 20e14e6b9e0..3dbe0bd9c20 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md @@ -3,7 +3,7 @@ title: Monitoring Best Practices --- - + Configuring sensible monitoring and alerting rules is vital for running any production workloads securely and reliably. This is not different when using Kubernetes and Rancher. Fortunately the integrated monitoring and alerting functionality makes this whole process a lot easier. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md index 3012223f423..9d24fb3c5db 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md @@ -3,7 +3,7 @@ title: Best Practices for Rancher Managed vSphere Clusters --- - + This guide outlines a reference architecture for provisioning downstream Rancher clusters in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md index 628bd1c36f9..cdc2183847a 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md @@ -3,7 +3,7 @@ title: Tips for Setting Up Containers --- - + Running well-built containers can greatly impact the overall performance and security of your environment. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md index 7251e64930f..87d4f348d3a 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md @@ -3,7 +3,7 @@ title: Installing Rancher in a vSphere Environment --- - + This guide outlines a reference architecture for installing Rancher on an RKE Kubernetes cluster in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md index a158b49e238..ba971bfde8f 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md @@ -3,7 +3,7 @@ title: Rancher Deployment Strategy --- - + There are two recommended deployment strategies for a Rancher server that manages downstream Kubernetes clusters. Each one has its own pros and cons. Read more about which one would fit best for your use case. diff --git a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md index a5290120701..36a246dc735 100644 --- a/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md +++ b/versioned_docs/version-2.5/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md @@ -3,7 +3,7 @@ title: Tips for Running Rancher --- - + This guide is geared toward use cases where Rancher is used to manage downstream Kubernetes clusters. The high-availability setup is intended to prevent losing access to downstream clusters if the Rancher server is not available. diff --git a/versioned_docs/version-2.5/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.5/reference-guides/cli-with-rancher/kubectl-utility.md index ba9782062b7..3ff216dc9fa 100644 --- a/versioned_docs/version-2.5/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.5/reference-guides/cli-with-rancher/kubectl-utility.md @@ -3,7 +3,7 @@ title: kubectl Utility --- - + ## kubectl diff --git a/versioned_docs/version-2.5/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.5/reference-guides/cli-with-rancher/rancher-cli.md index cd762cd7368..fbf757d7f43 100644 --- a/versioned_docs/version-2.5/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.5/reference-guides/cli-with-rancher/rancher-cli.md @@ -4,7 +4,7 @@ description: Interact with Rancher using command line interface (CLI) tools from --- - + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md index ad127081b1a..5d6ee5eb8c8 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Node Template Configuration --- - + For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md index 5b529bb37aa..bfe53fc1835 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Node Template Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md index 584a6b14437..d4e70a8fc12 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Node Template Configuration --- - + Account access information is stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md index 015f6eda551..49afe925b82 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md @@ -3,7 +3,7 @@ title: VSphere Node Template Configuration --- - + The following node template configuration reference applies to Rancher v2.3.3+. diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index 99ec7c9d160..6861ccbee5c 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -3,7 +3,7 @@ title: EKS Cluster Configuration Reference --- - + @@ -107,9 +107,11 @@ Amazon EKS managed node groups automate the provisioning and lifecycle managemen For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) -#### Bring your own launch template +#### User-provided Launch Templates -A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group. +You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template. + +Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group. | Option | Description | Required/Optional | | ------ | ----------- | ----------------- | @@ -120,7 +122,7 @@ A launch template ID and version can be provided in order to easily configure th | User Data | Cloud init script in [MIME multi-part format](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-data) | Optional | | Instance Resource Tags | Tag each EC2 instance in the node group | Optional | -#### Rancher-managed launch templates +#### Rancher-managed Launch Templates If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated. diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md index db4cb75d76d..103cf012ccb 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md @@ -3,7 +3,7 @@ title: Private Clusters --- - + _Available as of v2.5.8_ diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md index 659bc58eefa..2cbaa955b68 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md @@ -3,7 +3,7 @@ title: Syncing --- - + Syncing is the feature for EKS and GKE clusters that causes Rancher to update the clusters' values so they are up to date with their corresponding cluster object in the hosted Kubernetes provider. This enables Rancher to not be the sole owner of a hosted cluster’s state. Its largest limitation is that processing an update from Rancher and another source at the same time or within 5 minutes of one finishing may cause the state from one source to completely overwrite the other. diff --git a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md index a0e092fee87..3c363d053cf 100644 --- a/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md +++ b/versioned_docs/version-2.5/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md @@ -3,7 +3,7 @@ title: Rancher Agent Options --- - + Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes](../../../../pages-for-subheaders/use-existing-nodes.md) and add the options to the generated `docker run` command when adding a node. diff --git a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/examples.md b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/examples.md index 7c586657eb2..c65722cfa97 100644 --- a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/examples.md +++ b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + ### ServiceMonitor diff --git a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/helm-chart-options.md b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/helm-chart-options.md index 0a0cb764e2b..fb2f68e6460 100644 --- a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/helm-chart-options.md +++ b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/helm-chart-options.md @@ -3,7 +3,7 @@ title: Helm Chart Options --- - + ## Configuring Resource Limits and Requests diff --git a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/receivers.md index a3e33a76e18..bfe2f5ac7df 100644 --- a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/receivers.md @@ -3,7 +3,7 @@ title: Receiver Configuration --- - + The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configuration/#configuration-file) Secret contains the configuration of an Alertmanager instance that sends out notifications based on alerts it receives from Prometheus. diff --git a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/routes.md b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/routes.md index 9115fbced37..62e68e8bc53 100644 --- a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/routes.md +++ b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/routes.md @@ -3,7 +3,7 @@ title: Route Configuration --- - + The route configuration is the section of the Alertmanager custom resource that controls how the alerts fired by Prometheus are grouped and filtered before they reach the receiver. diff --git a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md index c46c7970881..6e7150b1105 100644 --- a/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md +++ b/versioned_docs/version-2.5/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md @@ -3,7 +3,7 @@ title: ServiceMonitor and PodMonitor Configuration --- - + ServiceMonitors and PodMonitors are both pseudo-CRDs that map the scrape configuration of the Prometheus custom resource. diff --git a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/architecture-recommendations.md b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/architecture-recommendations.md index b0a4a11590e..14230cf82dd 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/architecture-recommendations.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/architecture-recommendations.md @@ -2,6 +2,10 @@ title: Architecture Recommendations --- + + + + Kubernetes cluster. If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) ## Separation of Rancher and User Clusters diff --git a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md index b676e11d6ee..71a22d20698 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md @@ -2,6 +2,10 @@ title: Communicating with Downstream User Clusters --- + + + + This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services. The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters. diff --git a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/rancher-server-and-components.md b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/rancher-server-and-components.md index edb00a9424c..c7092bcec23 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/rancher-server-and-components.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-manager-architecture/rancher-server-and-components.md @@ -2,6 +2,10 @@ title: Rancher Server and Components --- + + + + The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment. The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service). diff --git a/versioned_docs/version-2.5/reference-guides/rancher-security/kubernetes-security-best-practices.md b/versioned_docs/version-2.5/reference-guides/rancher-security/kubernetes-security-best-practices.md index a863dd44e52..ace8bd95fab 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-security/kubernetes-security-best-practices.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-security/kubernetes-security-best-practices.md @@ -2,6 +2,10 @@ title: Kubernetes Security Best Practices --- + + + + ### Restricting cloud metadata API access Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. diff --git a/versioned_docs/version-2.5/reference-guides/rancher-security/security-advisories-and-cves.md b/versioned_docs/version-2.5/reference-guides/rancher-security/security-advisories-and-cves.md index c24aef100b4..0c9b9ed016a 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-security/security-advisories-and-cves.md @@ -2,6 +2,10 @@ title: Security Advisories and CVEs --- + + + + Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher's GitHub [security page](https://github.com/rancher/rancher/security/advisories). | ID | Description | Date | Resolution | diff --git a/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index d7358c29b62..1d9d46c75d4 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -2,6 +2,10 @@ title: About rancher-selinux --- + + + + To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides a SELinux RPM. The `rancher-selinux` RPM only contains policies for the [rancher-logging application.](https://github.com/rancher/charts/tree/dev-v2.5/charts/rancher-logging) diff --git a/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md b/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md index fe124221e5f..c5edf5e0017 100644 --- a/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md +++ b/versioned_docs/version-2.5/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md @@ -2,6 +2,10 @@ title: About rke2-selinux --- + + + + `rke2-selinux` provides policies for RKE2. It is installed automatically when the RKE2 installer script detects that it is running on an RPM-based distro. The `rke2-selinux` GitHub repository is [here.](https://github.com/rancher/rke2-selinux) diff --git a/versioned_docs/version-2.6/backups/docker-installs/docker-installs.md b/versioned_docs/version-2.6/backups/docker-installs/docker-installs.md deleted file mode 100644 index cc211cee5e0..00000000000 --- a/versioned_docs/version-2.6/backups/docker-installs/docker-installs.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Backup and Restore for Rancher Installed with Docker ---- - -- [Backups](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) -- [Restores](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) \ No newline at end of file diff --git a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md index b74d1d7d4e9..a4e4f9e0771 100644 --- a/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md +++ b/versioned_docs/version-2.6/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md @@ -113,20 +113,23 @@ This reference contains variables that you can use in `questions.yml` nested und | label | string | true | Define the UI label. | | description | string | false | Specify the description of the variable.| | type | string | false | Default to `string` if not specified (current supported types are string, multiline, boolean, int, enum, password, storageclass, hostname, pvc, and secret).| -| required | bool | false | Define if the variable is required or not (true \| false)| | default | string | false | Specify the default value. Only used if there is no corresponding value in the `values.yml` file. | | group | string | false | Group questions by input value. | -| min_length | int | false | Min character length.| -| max_length | int | false | Max character length.| -| min | int | false | Min integer length. | -| max | int | false | Max integer length. | | options | []string | false | Specify the options when the variable type is `enum`, for example: options:
- "ClusterIP"
- "NodePort"
- "LoadBalancer"| -| valid_chars | string | false | Regular expression for input chars validation. | -| invalid_chars | string | false | Regular expression for invalid input chars validation.| | subquestions | []subquestion | false| Add an array of subquestions.| | show_if | string | false | Show current variable if conditional variable is true. For example `show_if: "serviceType=Nodeport"` | | show\_subquestion_if | string | false | Show subquestions if is true or equal to one of the options. for example `show_subquestion_if: "true"`| + + :::note `subquestions[]` cannot contain `subquestions` or `show_subquestions_if` keys, but all other keys in the above table are supported. diff --git a/versioned_docs/version-2.6/reference-guides/about-the-api/api-tokens.md b/versioned_docs/version-2.6/reference-guides/about-the-api/api-tokens.md index 143964542e8..0d813665761 100644 --- a/versioned_docs/version-2.6/reference-guides/about-the-api/api-tokens.md +++ b/versioned_docs/version-2.6/reference-guides/about-the-api/api-tokens.md @@ -3,7 +3,7 @@ title: API Tokens --- - + By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password. diff --git a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/backup-configuration.md b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/backup-configuration.md index 2a792778e0a..e7ef2b056bf 100644 --- a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/backup-configuration.md @@ -3,7 +3,7 @@ title: Backup Configuration --- - + The Backup Create page lets you configure a schedule, enable encryption and specify the storage location for your backups. diff --git a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/examples.md b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/examples.md index 4336a204d98..bab7533302e 100644 --- a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/examples.md +++ b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + This section contains examples of Backup and Restore custom resources. diff --git a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/restore-configuration.md b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/restore-configuration.md index 5e958fcd674..b162a6ef873 100644 --- a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/restore-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/restore-configuration.md @@ -3,7 +3,7 @@ title: Restore Configuration --- - + The Restore Create page lets you provide details of the backup to restore from diff --git a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/storage-configuration.md b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/storage-configuration.md index 3ad8b94487f..b1b8bad0896 100644 --- a/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/storage-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/backup-restore-configuration/storage-configuration.md @@ -3,7 +3,7 @@ title: Backup Storage Location Configuration --- - + Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md index 9fc13c9ce70..dc200ae62b1 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md @@ -3,7 +3,7 @@ title: Logging Best Practices --- - + In this guide, we recommend best practices for cluster-level logging and application logging. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md index 820cfae1e49..35f8af067e4 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md @@ -3,7 +3,7 @@ title: Monitoring Best Practices --- - + Configuring sensible monitoring and alerting rules is vital for running any production workloads securely and reliably. This is not different when using Kubernetes and Rancher. Fortunately the integrated monitoring and alerting functionality makes this whole process a lot easier. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md index 3012223f423..9d24fb3c5db 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md @@ -3,7 +3,7 @@ title: Best Practices for Rancher Managed vSphere Clusters --- - + This guide outlines a reference architecture for provisioning downstream Rancher clusters in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md index 1298ff18b87..0cec0a91864 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md @@ -3,7 +3,7 @@ title: Tips for Setting Up Containers --- - + Running well-built containers can greatly impact the overall performance and security of your environment. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md index c19ac243d98..74243559753 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md @@ -3,7 +3,7 @@ title: Installing Rancher in a vSphere Environment --- - + This guide outlines a reference architecture for installing Rancher on an RKE Kubernetes cluster in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md index cc8811dc77e..99583f75579 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md @@ -3,7 +3,7 @@ title: Rancher Deployment Strategy --- - + There are two recommended deployment strategies for a Rancher instance that manages downstream Kubernetes clusters. Each one has its own pros and cons. Read more about which one would fit best for your use case. diff --git a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md index 1863ff82503..1ed05696fa2 100644 --- a/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md +++ b/versioned_docs/version-2.6/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md @@ -3,7 +3,7 @@ title: Tips for Running Rancher --- - + This guide is geared toward use cases where Rancher is used to manage downstream Kubernetes clusters. The high-availability setup is intended to prevent losing access to downstream clusters if the Rancher server is not available. diff --git a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/kubectl-utility.md index 45502753a08..fefa1a66b1b 100644 --- a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/kubectl-utility.md @@ -3,7 +3,7 @@ title: kubectl Utility --- - + ## kubectl diff --git a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md index f647eca1163..445d2b6446b 100644 --- a/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.6/reference-guides/cli-with-rancher/rancher-cli.md @@ -4,7 +4,7 @@ description: Interact with Rancher using command line interface (CLI) tools from --- - + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md index 6043df8f1ba..4640d142697 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Machine Configuration Reference --- - + For more details about EC2 nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md index 98d299762b0..ba7e806295e 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Machine Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md index 1d62fe9d9d7..634c7f48561 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Machine Configuration --- - + For more details about DigitalOcean, Droplets, refer to the [official documentation](https://docs.digitalocean.com/products/compute/). diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md index 2589d800c95..78bdc608163 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Node Template Configuration --- - + For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md index 8dcfd402deb..80f266d590b 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Node Template Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md index 584a6b14437..d4e70a8fc12 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Node Template Configuration --- - + Account access information is stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md index ff68438637c..e3294c0c885 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md @@ -3,7 +3,7 @@ title: Nutanix Node Template Configuration --- - + ## Account Access diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md index 159248fc1c6..baae6beac1a 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md @@ -3,7 +3,7 @@ title: VSphere Node Template Configuration --- - + ## Account Access diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md index 136c71a45a2..67cd280e470 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md @@ -3,7 +3,7 @@ title: AKS Cluster Configuration Reference --- - + ## Changes in Rancher v2.6 diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index b6110f8cafc..d9fe3d29059 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -3,7 +3,7 @@ title: EKS Cluster Configuration Reference --- - + ### Account Access @@ -86,9 +86,11 @@ Amazon EKS managed node groups automate the provisioning and lifecycle managemen For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) -#### Bring your own launch template +#### User-provided Launch Templates -A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group. +You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template. + +Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group. | Option | Description | Required/Optional | | ------ | ----------- | ----------------- | @@ -99,7 +101,7 @@ A launch template ID and version can be provided in order to easily configure th | User Data | Cloud init script in [MIME multi-part format](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-data) | Optional | | Instance Resource Tags | Tag each EC2 instance in the node group | Optional | -#### Rancher-managed launch templates +#### Rancher-managed Launch Templates If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated. diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md index c6d7893c7ae..0df4836a237 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md @@ -3,7 +3,7 @@ title: Private Clusters --- - + In GKE, [private clusters](https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept) are clusters whose nodes are isolated from inbound and outbound traffic by assigning them internal IP addresses only. Private clusters in GKE have the option of exposing the control plane endpoint as a publicly accessible address or as a private address. This is different from other Kubernetes providers, which may refer to clusters with private control plane endpoints as "private clusters" but still allow traffic to and from nodes. You may want to create a cluster with private nodes, with or without a public control plane endpoint, depending on your organization's networking and security requirements. A GKE cluster provisioned from Rancher can use isolated nodes by selecting "Private Cluster" in the Cluster Options (under "Show advanced options"). The control plane endpoint can optionally be made private by selecting "Enable Private Endpoint". diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 0b6e10c248c..a9a02deaaef 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -127,7 +127,7 @@ ACE is available on Kubernetes clusters provisioned by or registered with Ranche ::: -ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters.md) on RKE2 and K3s clusters in Rancher v2.6.3 and later. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. +ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) on RKE2 and K3s clusters in Rancher v2.6.3 and later. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md index 7d8916c6785..51f9d04929c 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md @@ -3,7 +3,7 @@ title: Syncing --- - + Syncing allows Rancher to update cluster values so that they're up to date with the corresponding cluster object hosted in AKS, EKS or GKE. This enables sources other than Rancher to own a hosted cluster’s state. diff --git a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md index a0e092fee87..3c363d053cf 100644 --- a/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md +++ b/versioned_docs/version-2.6/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md @@ -3,7 +3,7 @@ title: Rancher Agent Options --- - + Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes](../../../../pages-for-subheaders/use-existing-nodes.md) and add the options to the generated `docker run` command when adding a node. diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/examples.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/examples.md index 7c586657eb2..c65722cfa97 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/examples.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + ### ServiceMonitor diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/helm-chart-options.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/helm-chart-options.md index fabd9fc222f..112c41c9ea0 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/helm-chart-options.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/helm-chart-options.md @@ -3,7 +3,7 @@ title: Helm Chart Options --- - + ## Configuring Resource Limits and Requests diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md index b14f320a3ee..631e589009c 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/receivers.md @@ -3,7 +3,7 @@ title: Receiver Configuration --- - + The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configuration/#configuration-file) Secret contains the configuration of an Alertmanager instance that sends out notifications based on alerts it receives from Prometheus. diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/routes.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/routes.md index 38e29ec82a0..9fb4e3896e6 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/routes.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/routes.md @@ -3,7 +3,7 @@ title: Route Configuration --- - + The route configuration is the section of the Alertmanager custom resource that controls how the alerts fired by Prometheus are grouped and filtered before they reach the receiver. diff --git a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md index 780d13c2673..30fccb634c8 100644 --- a/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md +++ b/versioned_docs/version-2.6/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md @@ -3,7 +3,7 @@ title: ServiceMonitor and PodMonitor Configuration --- - + ServiceMonitors and PodMonitors are both pseudo-CRDs that map the scrape configuration of the Prometheus custom resource. diff --git a/versioned_docs/version-2.6/reference-guides/prometheus-federator/rbac.md b/versioned_docs/version-2.6/reference-guides/prometheus-federator/rbac.md index 47887415d85..8b54ce9559f 100644 --- a/versioned_docs/version-2.6/reference-guides/prometheus-federator/rbac.md +++ b/versioned_docs/version-2.6/reference-guides/prometheus-federator/rbac.md @@ -2,6 +2,10 @@ title: Role-Based Access Control --- + + + + This section describes the expectations for Role-Based Access Control (RBAC) for Prometheus Federator. As described in the section on [namespaces](../../pages-for-subheaders/prometheus-federator.md#namespaces), Prometheus Federator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: diff --git a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/architecture-recommendations.md b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/architecture-recommendations.md index 0440180b112..8940a45f8c1 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/architecture-recommendations.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/architecture-recommendations.md @@ -2,6 +2,10 @@ title: Architecture Recommendations --- + + + + If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) ## Separation of Rancher and User Clusters diff --git a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md index cc266462e91..586b55b0db8 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md @@ -2,6 +2,10 @@ title: Communicating with Downstream User Clusters --- + + + + This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services. The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters. @@ -24,7 +28,7 @@ the pods. Bob is authenticated through Rancher's authentication proxy. The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters. -Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod. +Rancher communicates with Kubernetes clusters using a [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/). Each user account in Rancher correlates with an equivalent service account in the downstream cluster. Rancher uses the service account to [impersonate](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) the user, which provides all the permissions the user is intended to have. By default, Rancher generates a [kubeconfig file](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster. @@ -76,6 +80,87 @@ With this endpoint enabled for the downstream cluster, Rancher generates an extr You will need to use a context defined in this kubeconfig file to access the cluster if Rancher goes down. Therefore, we recommend exporting the kubeconfig file so that if Rancher goes down, you can still use the credentials in the file to access your cluster. For more information, refer to the section on accessing your cluster with [kubectl and the kubeconfig file.](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) +## Impersonation + +Users technically exist only on the upstream cluster. Rancher creates [RoleBindings and ClusterRoleBindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) that refer to Rancher users, even though there is [no actual User resource](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes) on the downstream cluster. + +When users interact with a downstream cluster through the authentication proxy, there needs to be some entity downstream to serve as the actor for those requests. Rancher creates service accounts to be that entity. Each service account is only granted one permission, which is to **impersonate** the user they belong to. If there was only one service account that could impersonate any user, then it would be possible for a malicious user to corrupt that account and escalate their privileges by impersonating another user. This issue was the basis for a [CVE](https://github.com/rancher/rancher/security/advisories/GHSA-pvxj-25m6-7vqr). + +### Impersonation Troubleshooting + +On the downstream cluster, five resources handle impersonation: + +- namespace: `cattle-impersonation-system` +- service account: `cattle-impersonation-system/cattle-impersonation-` +- account token secret: `cattle-impersonation-system/cattle-impersonation--token-` +- cluster role: `cattle-impersonation-` +- cluster role binding: `cattle-impersonation-` + +In this example of a typical impersonation cluster role, the system is configured to use `github` as the auth provider: + +```yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: "2021-10-06T18:20:13Z" + labels: + authz.cluster.cattle.io/impersonator: "true" + cattle.io/creator: norman + name: cattle-impersonation-user-abcde + resourceVersion: "3528" + uid: a7478731-72a0-4343-b09f-c3bf12552d77 +rules: +# allowed to impersonate user user-abcde +- apiGroups: + - "" + resourceNames: + - user-abcde + resources: + - users + verbs: + - impersonate +# allowed to impersonate listed groups +- apiGroups: + - "" + resourceNames: + - github_team://123 # group from GitHub auth provider + - system:authenticated # automatic group from Kubernetes + - system:cattle:authenticated # automatic group from Rancher + resources: + - groups + verbs: + - impersonate +# allowed to impersonate principal ID github_user://098 +- apiGroups: + - authentication.k8s.io + resourceNames: + - github_user://098 # principal ID from GitHub auth provider + resources: + - userextras/principalid + verbs: + - impersonate +# allowed to impersonate username example +- apiGroups: + - authentication.k8s.io + resourceNames: + - example # username from GitHub auth provider + resources: + - userextras/username + verbs: + - impersonate +``` + +When you troubleshoot impersonation issues, check whether these resources exist for the user, and whether the rules in the cluster role look similar to the above. For example: + +```bash +kubectl --namespace cattle-impersonation-system get serviceaccount cattle-impersonation- +kubectl --namespace cattle-impersonation-system get secret cattle-impersonation--token- +kubectl get clusterrole cattle-impersonation- --output yaml +kubectl get clusterrolebinding cattle-impersonation- +``` + +If you see an error related to "impersonation" in the UI, pay close attention to the *end* of the error message, which should indicate the real reason that the request failed. + ## Important Files The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster: diff --git a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/rancher-server-and-components.md b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/rancher-server-and-components.md index 7a588ac91b3..9d25e318ee3 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/rancher-server-and-components.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-manager-architecture/rancher-server-and-components.md @@ -2,6 +2,10 @@ title: Rancher Server and Components --- + + + + The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment. The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service). diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md b/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md index a863dd44e52..ace8bd95fab 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/kubernetes-security-best-practices.md @@ -2,6 +2,10 @@ title: Kubernetes Security Best Practices --- + + + + ### Restricting cloud metadata API access Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/security-advisories-and-cves.md b/versioned_docs/version-2.6/reference-guides/rancher-security/security-advisories-and-cves.md index a89a75fd09e..b7dec08a23e 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/security-advisories-and-cves.md @@ -2,6 +2,10 @@ title: Security Advisories and CVEs --- + + + + Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher's GitHub [security page](https://github.com/rancher/rancher/security/advisories). | ID | Description | Date | Resolution | diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index d7358c29b62..1d9d46c75d4 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -2,6 +2,10 @@ title: About rancher-selinux --- + + + + To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides a SELinux RPM. The `rancher-selinux` RPM only contains policies for the [rancher-logging application.](https://github.com/rancher/charts/tree/dev-v2.5/charts/rancher-logging) diff --git a/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md b/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md index fe124221e5f..c5edf5e0017 100644 --- a/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md +++ b/versioned_docs/version-2.6/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md @@ -2,6 +2,10 @@ title: About rke2-selinux --- + + + + `rke2-selinux` provides policies for RKE2. It is installed automatically when the RKE2 installer script detects that it is running on an RPM-based distro. The `rke2-selinux` GitHub repository is [here.](https://github.com/rancher/rke2-selinux) diff --git a/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf deleted file mode 100644 index 25f33709b3f..00000000000 --- a/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-benchmark-2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf +++ /dev/null @@ -1,14862 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 292 0 R 304 0 R 311 0 R 315 0 R 317 0 R 320 0 R 325 0 R 327 0 R 351 0 R 376 0 R 409 0 R 442 0 R 466 0 R 505 0 R 510 0 R 513 0 R 516 0 R 518 0 R 521 0 R 523 0 R 526 0 R 529 0 R 531 0 R 534 0 R 536 0 R 539 0 R 542 0 R 544 0 R 547 0 R 550 0 R 552 0 R 555 0 R 557 0 R 561 0 R 564 0 R 567 0 R 569 0 R 572 0 R 574 0 R 577 0 R 580 0 R 582 0 R 585 0 R 588 0 R 590 0 R 593 0 R 595 0 R 598 0 R 601 0 R 603 0 R 606 0 R 609 0 R 611 0 R 614 0 R 616 0 R 619 0 R 622 0 R 624 0 R 627 0 R 629 0 R 632 0 R 635 0 R 637 0 R 640 0 R 643 0 R 645 0 R 662 0 R 676 0 R 679 0 R 682 0 R 685 0 R 688 0 R 691 0 R 694 0 R 696 0 R 700 0 R 702 0 R 705 0 R 707 0 R 710 0 R 712 0 R 715 0 R 717 0 R 719 0 R 722 0 R 724 0 R 727 0 R 729 0 R 732 0 R 734 0 R 736 0 R 739 0 R 741 0 R 743 0 R 745 0 R 748 0 R 750 0 R 753 0 R 757 0 R 766 0 R 774 0 R 776 0 R 781 0 R 786 0 R 792 0 R 796 0 R 800 0 R 806 0 R 810 0 R 814 0 R 817 0 R 819 0 R 844 0 R 855 0 R 858 0 R 862 0 R 865 0 R 882 0 R 889 0 R 891 0 R 893 0 R 895 0 R ] -/Count 131 ->> -endobj -2 0 obj -<< -/Title (RKE CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Creator (pandoc) -/Producer (WeasyPrint 54.3) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 1057 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 510 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-manual) [ 893 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 743 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 317 0 R /XYZ 84.259843 207.170079 0 ] (cb1-1) [ 317 0 R /XYZ 101.433071 205.473057 0 ] (cb10) [ 351 0 R /XYZ 84.259843 342.035606 0 ] (cb10-1) [ 351 0 R /XYZ 101.433071 340.338585 0 ] (cb101) [ 624 0 R /XYZ 84.259843 504.320079 0 ] (cb101-1) [ 624 0 R /XYZ 101.433071 502.623057 0 ] (cb104) [ 629 0 R /XYZ 84.259843 772.370079 0 ] (cb104-1) [ 629 0 R /XYZ 101.433071 770.673057 0 ] (cb107) [ 632 0 R /XYZ 84.259843 313.070079 0 ] (cb107-1) [ 632 0 R /XYZ 101.433071 311.373057 0 ] (cb110) [ 637 0 R /XYZ 84.259843 560.570079 0 ] (cb110-1) [ 637 0 R /XYZ 101.433071 558.873057 0 ] (cb113) [ 640 0 R /XYZ 84.259843 110.570079 0 ] (cb113-1) [ 640 0 R /XYZ 101.433071 108.873057 0 ] (cb116) [ 645 0 R /XYZ 84.259843 418.070079 0 ] (cb116-1) [ 645 0 R /XYZ 101.433071 416.373057 0 ] (cb116-10) [ 645 0 R /XYZ 99.933071 189.008799 0 ] (cb116-11) [ 645 0 R /XYZ 99.933071 170.061778 0 ] (cb116-12) [ 645 0 R /XYZ 99.933071 151.114756 0 ] (cb116-13) [ 645 0 R /XYZ 99.933071 132.167735 0 ] (cb116-14) [ 645 0 R /XYZ 99.933071 113.220714 0 ] (cb116-15) [ 645 0 R /XYZ 99.933071 94.273692 0 ] (cb116-16) [ 662 0 R /XYZ 99.933071 799.173057 0 ] (cb116-17) [ 662 0 R /XYZ 99.933071 780.226036 0 ] (cb116-18) [ 662 0 R /XYZ 99.933071 761.279014 0 ] (cb116-19) [ 662 0 R /XYZ 99.933071 742.331993 0 ] (cb116-2) [ 645 0 R /XYZ 99.933071 397.426036 0 ] (cb116-20) [ 662 0 R /XYZ 99.933071 723.384971 0 ] (cb116-21) [ 662 0 R /XYZ 99.933071 704.437950 0 ] (cb116-22) [ 662 0 R /XYZ 99.933071 685.490928 0 ] (cb116-23) [ 662 0 R /XYZ 99.933071 666.543907 0 ] (cb116-24) [ 662 0 R /XYZ 99.933071 647.596885 0 ] (cb116-25) [ 662 0 R /XYZ 99.933071 628.649864 0 ] (cb116-3) [ 645 0 R /XYZ 99.933071 378.479014 0 ] (cb116-4) [ 645 0 R /XYZ 99.933071 340.584971 0 ] (cb116-5) [ 645 0 R /XYZ 99.933071 321.637950 0 ] (cb116-6) [ 645 0 R /XYZ 99.933071 302.690928 0 ] (cb116-7) [ 645 0 R /XYZ 99.933071 283.743907 0 ] (cb116-8) [ 645 0 R /XYZ 99.933071 264.796885 0 ] (cb116-9) [ 645 0 R /XYZ 99.933071 226.902842 0 ] (cb117) [ 662 0 R /XYZ 84.259843 569.399864 0 ] (cb117-1) [ 662 0 R /XYZ 101.433071 567.702842 0 ] (cb120) [ 662 0 R /XYZ 84.259843 196.152842 0 ] (cb120-1) [ 662 0 R /XYZ 101.433071 194.455821 0 ] (cb121) [ 676 0 R /XYZ 84.259843 550.251496 0 ] (cb121-1) [ 676 0 R /XYZ 101.433071 548.554475 0 ] (cb124) [ 679 0 R /XYZ 84.259843 571.820079 0 ] (cb124-1) [ 679 0 R /XYZ 101.433071 570.123057 0 ] (cb127) [ 682 0 R /XYZ 84.259843 575.570079 0 ] (cb127-1) [ 682 0 R /XYZ 101.433071 573.873057 0 ] (cb13) [ 376 0 R /XYZ 84.259843 711.620079 0 ] (cb13-1) [ 376 0 R /XYZ 101.433071 709.923057 0 ] (cb13-10) [ 376 0 R /XYZ 99.933071 501.505821 0 ] (cb13-11) [ 376 0 R /XYZ 99.933071 482.558799 0 ] (cb13-12) [ 376 0 R /XYZ 99.933071 463.611778 0 ] (cb13-13) [ 376 0 R /XYZ 99.933071 444.664756 0 ] (cb13-14) [ 376 0 R /XYZ 99.933071 425.717735 0 ] (cb13-15) [ 376 0 R /XYZ 99.933071 406.770714 0 ] (cb13-16) [ 376 0 R /XYZ 99.933071 387.823692 0 ] (cb13-17) [ 376 0 R /XYZ 99.933071 368.876671 0 ] (cb13-18) [ 376 0 R /XYZ 99.933071 349.929649 0 ] (cb13-19) [ 376 0 R /XYZ 99.933071 330.982628 0 ] (cb13-2) [ 376 0 R /XYZ 99.933071 690.976036 0 ] (cb13-20) [ 376 0 R /XYZ 99.933071 312.035606 0 ] (cb13-21) [ 376 0 R /XYZ 99.933071 293.088585 0 ] (cb13-22) [ 376 0 R /XYZ 99.933071 274.141563 0 ] (cb13-23) [ 376 0 R /XYZ 99.933071 255.194542 0 ] (cb13-24) [ 376 0 R /XYZ 99.933071 236.247520 0 ] (cb13-25) [ 376 0 R /XYZ 99.933071 217.300499 0 ] (cb13-26) [ 376 0 R /XYZ 99.933071 198.353477 0 ] (cb13-27) [ 376 0 R /XYZ 99.933071 179.406456 0 ] (cb13-28) [ 376 0 R /XYZ 99.933071 160.459434 0 ] (cb13-29) [ 376 0 R /XYZ 99.933071 141.512413 0 ] (cb13-3) [ 376 0 R /XYZ 99.933071 672.029014 0 ] (cb13-30) [ 376 0 R /XYZ 99.933071 122.565391 0 ] (cb13-31) [ 376 0 R /XYZ 99.933071 103.618370 0 ] (cb13-32) [ 409 0 R /XYZ 99.933071 799.173057 0 ] (cb13-33) [ 409 0 R /XYZ 99.933071 780.226036 0 ] (cb13-34) [ 409 0 R /XYZ 99.933071 761.279014 0 ] (cb13-35) [ 409 0 R /XYZ 99.933071 742.331993 0 ] (cb13-36) [ 409 0 R /XYZ 99.933071 723.384971 0 ] (cb13-37) [ 409 0 R /XYZ 99.933071 704.437950 0 ] (cb13-38) [ 409 0 R /XYZ 99.933071 685.490928 0 ] (cb13-39) [ 409 0 R /XYZ 99.933071 666.543907 0 ] (cb13-4) [ 376 0 R /XYZ 99.933071 634.134971 0 ] (cb13-40) [ 409 0 R /XYZ 99.933071 647.596885 0 ] (cb13-41) [ 409 0 R /XYZ 99.933071 628.649864 0 ] (cb13-42) [ 409 0 R /XYZ 99.933071 609.702842 0 ] (cb13-43) [ 409 0 R /XYZ 99.933071 590.755821 0 ] (cb13-44) [ 409 0 R /XYZ 99.933071 571.808799 0 ] (cb13-45) [ 409 0 R /XYZ 99.933071 552.861778 0 ] (cb13-46) [ 409 0 R /XYZ 99.933071 533.914756 0 ] (cb13-47) [ 409 0 R /XYZ 99.933071 514.967735 0 ] (cb13-48) [ 409 0 R /XYZ 99.933071 496.020714 0 ] (cb13-49) [ 409 0 R /XYZ 99.933071 477.073692 0 ] (cb13-5) [ 376 0 R /XYZ 99.933071 596.240928 0 ] (cb13-50) [ 409 0 R /XYZ 99.933071 458.126671 0 ] (cb13-51) [ 409 0 R /XYZ 99.933071 439.179649 0 ] (cb13-52) [ 409 0 R /XYZ 99.933071 420.232628 0 ] (cb13-53) [ 409 0 R /XYZ 99.933071 382.338585 0 ] (cb13-54) [ 409 0 R /XYZ 99.933071 363.391563 0 ] (cb13-55) [ 409 0 R /XYZ 99.933071 344.444542 0 ] (cb13-56) [ 409 0 R /XYZ 99.933071 325.497520 0 ] (cb13-57) [ 409 0 R /XYZ 99.933071 306.550499 0 ] (cb13-58) [ 409 0 R /XYZ 99.933071 287.603477 0 ] (cb13-59) [ 409 0 R /XYZ 99.933071 268.656456 0 ] (cb13-6) [ 376 0 R /XYZ 99.933071 577.293907 0 ] (cb13-60) [ 409 0 R /XYZ 99.933071 249.709434 0 ] (cb13-61) [ 409 0 R /XYZ 99.933071 230.762413 0 ] (cb13-7) [ 376 0 R /XYZ 99.933071 558.346885 0 ] (cb13-8) [ 376 0 R /XYZ 99.933071 539.399864 0 ] (cb13-9) [ 376 0 R /XYZ 99.933071 520.452842 0 ] (cb130) [ 685 0 R /XYZ 84.259843 560.570079 0 ] (cb130-1) [ 685 0 R /XYZ 101.433071 558.873057 0 ] (cb133) [ 688 0 R /XYZ 84.259843 556.820079 0 ] (cb133-1) [ 688 0 R /XYZ 101.433071 555.123057 0 ] (cb136) [ 691 0 R /XYZ 84.259843 369.020079 0 ] (cb136-1) [ 691 0 R /XYZ 101.433071 367.323057 0 ] (cb139) [ 696 0 R /XYZ 84.259843 565.251496 0 ] (cb139-1) [ 696 0 R /XYZ 101.433071 563.554475 0 ] (cb14) [ 409 0 R /XYZ 84.259843 171.512413 0 ] (cb14-1) [ 409 0 R /XYZ 101.433071 169.815391 0 ] (cb142) [ 696 0 R /XYZ 84.259843 102.004475 0 ] (cb142-1) [ 696 0 R /XYZ 101.433071 100.307453 0 ] (cb145) [ 702 0 R /XYZ 84.259843 514.251496 0 ] (cb145-1) [ 702 0 R /XYZ 101.433071 512.554475 0 ] (cb148) [ 707 0 R /XYZ 84.259843 309.320079 0 ] (cb148-1) [ 707 0 R /XYZ 101.433071 307.623057 0 ] (cb151) [ 712 0 R /XYZ 84.259843 103.070079 0 ] (cb151-1) [ 712 0 R /XYZ 101.433071 101.373057 0 ] (cb154) [ 719 0 R /XYZ 84.259843 613.970079 0 ] (cb154-1) [ 719 0 R /XYZ 101.433071 612.273057 0 ] (cb157) [ 724 0 R /XYZ 84.259843 403.070079 0 ] (cb157-1) [ 724 0 R /XYZ 101.433071 401.373057 0 ] (cb160) [ 729 0 R /XYZ 84.259843 178.070079 0 ] (cb160-1) [ 729 0 R /XYZ 101.433071 176.373057 0 ] (cb163) [ 736 0 R /XYZ 84.259843 628.970079 0 ] (cb163-1) [ 736 0 R /XYZ 101.433071 627.273057 0 ] (cb166) [ 745 0 R /XYZ 84.259843 595.251496 0 ] (cb166-1) [ 745 0 R /XYZ 101.433071 593.554475 0 ] (cb169) [ 750 0 R /XYZ 84.259843 267.651496 0 ] (cb169-1) [ 750 0 R /XYZ 101.433071 265.954475 0 ] (cb17) [ 442 0 R /XYZ 84.259843 543.320079 0 ] (cb17-1) [ 442 0 R /XYZ 101.433071 541.623057 0 ] (cb17-10) [ 442 0 R /XYZ 99.933071 333.205821 0 ] (cb17-11) [ 442 0 R /XYZ 99.933071 314.258799 0 ] (cb17-12) [ 442 0 R /XYZ 99.933071 295.311778 0 ] (cb17-13) [ 442 0 R /XYZ 99.933071 276.364756 0 ] (cb17-14) [ 442 0 R /XYZ 99.933071 257.417735 0 ] (cb17-15) [ 442 0 R /XYZ 99.933071 238.470714 0 ] (cb17-16) [ 442 0 R /XYZ 99.933071 219.523692 0 ] (cb17-17) [ 442 0 R /XYZ 99.933071 200.576671 0 ] (cb17-18) [ 442 0 R /XYZ 99.933071 181.629649 0 ] (cb17-19) [ 442 0 R /XYZ 99.933071 162.682628 0 ] (cb17-2) [ 442 0 R /XYZ 99.933071 522.676036 0 ] (cb17-20) [ 442 0 R /XYZ 99.933071 143.735606 0 ] (cb17-21) [ 442 0 R /XYZ 99.933071 124.788585 0 ] (cb17-22) [ 442 0 R /XYZ 99.933071 105.841563 0 ] (cb17-23) [ 466 0 R /XYZ 99.933071 799.173057 0 ] (cb17-24) [ 466 0 R /XYZ 99.933071 780.226036 0 ] (cb17-25) [ 466 0 R /XYZ 99.933071 761.279014 0 ] (cb17-26) [ 466 0 R /XYZ 99.933071 742.331993 0 ] (cb17-27) [ 466 0 R /XYZ 99.933071 723.384971 0 ] (cb17-28) [ 466 0 R /XYZ 99.933071 704.437950 0 ] (cb17-29) [ 466 0 R /XYZ 99.933071 685.490928 0 ] (cb17-3) [ 442 0 R /XYZ 99.933071 503.729014 0 ] (cb17-30) [ 466 0 R /XYZ 99.933071 666.543907 0 ] (cb17-31) [ 466 0 R /XYZ 99.933071 647.596885 0 ] (cb17-32) [ 466 0 R /XYZ 99.933071 628.649864 0 ] (cb17-33) [ 466 0 R /XYZ 99.933071 609.702842 0 ] (cb17-34) [ 466 0 R /XYZ 99.933071 590.755821 0 ] (cb17-35) [ 466 0 R /XYZ 99.933071 571.808799 0 ] (cb17-36) [ 466 0 R /XYZ 99.933071 552.861778 0 ] (cb17-37) [ 466 0 R /XYZ 99.933071 533.914756 0 ] (cb17-38) [ 466 0 R /XYZ 99.933071 514.967735 0 ] (cb17-39) [ 466 0 R /XYZ 99.933071 496.020714 0 ] (cb17-4) [ 442 0 R /XYZ 99.933071 465.834971 0 ] (cb17-40) [ 466 0 R /XYZ 99.933071 477.073692 0 ] (cb17-41) [ 466 0 R /XYZ 99.933071 458.126671 0 ] (cb17-42) [ 466 0 R /XYZ 99.933071 439.179649 0 ] (cb17-43) [ 466 0 R /XYZ 99.933071 420.232628 0 ] (cb17-44) [ 466 0 R /XYZ 99.933071 401.285606 0 ] (cb17-45) [ 466 0 R /XYZ 99.933071 382.338585 0 ] (cb17-46) [ 466 0 R /XYZ 99.933071 363.391563 0 ] (cb17-47) [ 466 0 R /XYZ 99.933071 344.444542 0 ] (cb17-48) [ 466 0 R /XYZ 99.933071 325.497520 0 ] (cb17-49) [ 466 0 R /XYZ 99.933071 306.550499 0 ] (cb17-5) [ 442 0 R /XYZ 99.933071 427.940928 0 ] (cb17-50) [ 466 0 R /XYZ 99.933071 287.603477 0 ] (cb17-51) [ 466 0 R /XYZ 99.933071 268.656456 0 ] (cb17-52) [ 466 0 R /XYZ 99.933071 249.709434 0 ] (cb17-53) [ 466 0 R /XYZ 99.933071 211.815391 0 ] (cb17-54) [ 466 0 R /XYZ 99.933071 192.868370 0 ] (cb17-55) [ 466 0 R /XYZ 99.933071 173.921348 0 ] (cb17-56) [ 466 0 R /XYZ 99.933071 154.974327 0 ] (cb17-57) [ 466 0 R /XYZ 99.933071 136.027305 0 ] (cb17-58) [ 466 0 R /XYZ 99.933071 117.080284 0 ] (cb17-59) [ 466 0 R /XYZ 99.933071 98.133262 0 ] (cb17-6) [ 442 0 R /XYZ 99.933071 408.993907 0 ] (cb17-60) [ 505 0 R /XYZ 99.933071 799.173057 0 ] (cb17-61) [ 505 0 R /XYZ 99.933071 780.226036 0 ] (cb17-7) [ 442 0 R /XYZ 99.933071 390.046885 0 ] (cb17-8) [ 442 0 R /XYZ 99.933071 371.099864 0 ] (cb17-9) [ 442 0 R /XYZ 99.933071 352.152842 0 ] (cb172) [ 753 0 R /XYZ 84.259843 607.820079 0 ] (cb172-1) [ 753 0 R /XYZ 101.433071 606.123057 0 ] (cb174) [ 753 0 R /XYZ 84.259843 298.679014 0 ] (cb174-1) [ 753 0 R /XYZ 101.433071 296.981993 0 ] (cb176) [ 757 0 R /XYZ 84.259843 715.370079 0 ] (cb176-1) [ 757 0 R /XYZ 101.433071 713.673057 0 ] (cb179) [ 757 0 R /XYZ 84.259843 375.479014 0 ] (cb179-1) [ 757 0 R /XYZ 101.433071 373.781993 0 ] (cb179-2) [ 757 0 R /XYZ 99.933071 354.834971 0 ] (cb179-3) [ 757 0 R /XYZ 99.933071 335.887950 0 ] (cb179-4) [ 757 0 R /XYZ 99.933071 279.046885 0 ] (cb179-5) [ 757 0 R /XYZ 99.933071 260.099864 0 ] (cb18) [ 505 0 R /XYZ 84.259843 720.976036 0 ] (cb18-1) [ 505 0 R /XYZ 101.433071 719.279014 0 ] (cb180) [ 757 0 R /XYZ 84.259843 200.849864 0 ] (cb180-1) [ 757 0 R /XYZ 101.433071 199.152842 0 ] (cb182) [ 766 0 R /XYZ 84.259843 655.220079 0 ] (cb182-1) [ 766 0 R /XYZ 101.433071 653.523057 0 ] (cb182-2) [ 766 0 R /XYZ 99.933071 634.576036 0 ] (cb182-3) [ 766 0 R /XYZ 99.933071 615.629014 0 ] (cb182-4) [ 766 0 R /XYZ 99.933071 558.787950 0 ] (cb182-5) [ 766 0 R /XYZ 99.933071 539.840928 0 ] (cb183) [ 766 0 R /XYZ 84.259843 480.590928 0 ] (cb183-1) [ 766 0 R /XYZ 101.433071 478.893907 0 ] (cb185) [ 776 0 R /XYZ 84.259843 490.251496 0 ] (cb185-1) [ 776 0 R /XYZ 101.433071 488.554475 0 ] (cb186) [ 776 0 R /XYZ 84.259843 429.304475 0 ] (cb186-1) [ 776 0 R /XYZ 101.433071 427.607453 0 ] (cb188) [ 776 0 R /XYZ 84.259843 116.807453 0 ] (cb188-1) [ 776 0 R /XYZ 101.433071 115.110432 0 ] (cb189) [ 781 0 R /XYZ 84.259843 772.370079 0 ] (cb189-1) [ 781 0 R /XYZ 101.433071 770.673057 0 ] (cb191) [ 781 0 R /XYZ 84.259843 459.873057 0 ] (cb191-1) [ 781 0 R /XYZ 101.433071 458.176036 0 ] (cb192) [ 781 0 R /XYZ 84.259843 398.926036 0 ] (cb192-1) [ 781 0 R /XYZ 101.433071 397.229014 0 ] (cb194) [ 786 0 R /XYZ 84.259843 799.370079 0 ] (cb194-1) [ 786 0 R /XYZ 101.433071 797.673057 0 ] (cb195) [ 786 0 R /XYZ 84.259843 738.423057 0 ] (cb195-1) [ 786 0 R /XYZ 101.433071 736.726036 0 ] (cb197) [ 786 0 R /XYZ 84.259843 410.926036 0 ] (cb197-1) [ 786 0 R /XYZ 101.433071 409.229014 0 ] (cb198) [ 786 0 R /XYZ 84.259843 349.979014 0 ] (cb198-1) [ 786 0 R /XYZ 101.433071 348.281993 0 ] (cb2) [ 320 0 R /XYZ 84.259843 730.370079 0 ] (cb2-1) [ 320 0 R /XYZ 101.433071 728.673057 0 ] (cb201) [ 792 0 R /XYZ 84.259843 230.570079 0 ] (cb201-1) [ 792 0 R /XYZ 101.433071 228.873057 0 ] (cb202) [ 792 0 R /XYZ 84.259843 169.623057 0 ] (cb202-1) [ 792 0 R /XYZ 101.433071 167.926036 0 ] (cb204) [ 796 0 R /XYZ 84.259843 583.970079 0 ] (cb204-1) [ 796 0 R /XYZ 101.433071 582.273057 0 ] (cb205) [ 796 0 R /XYZ 84.259843 523.023057 0 ] (cb205-1) [ 796 0 R /XYZ 101.433071 521.326036 0 ] (cb207) [ 800 0 R /XYZ 84.259843 700.370079 0 ] (cb207-1) [ 800 0 R /XYZ 101.433071 698.673057 0 ] (cb208) [ 800 0 R /XYZ 84.259843 639.423057 0 ] (cb208-1) [ 800 0 R /XYZ 101.433071 637.726036 0 ] (cb21) [ 510 0 R /XYZ 84.259843 565.251496 0 ] (cb21-1) [ 510 0 R /XYZ 101.433071 563.554475 0 ] (cb210) [ 800 0 R /XYZ 84.259843 296.926036 0 ] (cb210-1) [ 800 0 R /XYZ 101.433071 295.229014 0 ] (cb211) [ 800 0 R /XYZ 84.259843 235.979014 0 ] (cb211-1) [ 800 0 R /XYZ 101.433071 234.281993 0 ] (cb213) [ 806 0 R /XYZ 84.259843 640.370079 0 ] (cb213-1) [ 806 0 R /XYZ 101.433071 638.673057 0 ] (cb214) [ 806 0 R /XYZ 84.259843 579.423057 0 ] (cb214-1) [ 806 0 R /XYZ 101.433071 577.726036 0 ] (cb217) [ 810 0 R /XYZ 84.259843 428.570079 0 ] (cb217-1) [ 810 0 R /XYZ 101.433071 426.873057 0 ] (cb218) [ 810 0 R /XYZ 84.259843 131.823057 0 ] (cb218-1) [ 810 0 R /XYZ 101.433071 130.126036 0 ] (cb219) [ 814 0 R /XYZ 84.259843 799.370079 0 ] (cb219-1) [ 814 0 R /XYZ 101.433071 797.673057 0 ] (cb221) [ 819 0 R /XYZ 84.259843 768.620079 0 ] (cb221-1) [ 819 0 R /XYZ 101.433071 766.923057 0 ] (cb221-10) [ 819 0 R /XYZ 99.933071 596.399864 0 ] (cb221-11) [ 819 0 R /XYZ 99.933071 577.452842 0 ] (cb221-12) [ 819 0 R /XYZ 99.933071 482.717735 0 ] (cb221-13) [ 819 0 R /XYZ 99.933071 463.770714 0 ] (cb221-14) [ 819 0 R /XYZ 99.933071 444.823692 0 ] (cb221-15) [ 819 0 R /XYZ 99.933071 425.876671 0 ] (cb221-16) [ 819 0 R /XYZ 99.933071 406.929649 0 ] (cb221-17) [ 819 0 R /XYZ 99.933071 387.982628 0 ] (cb221-18) [ 819 0 R /XYZ 99.933071 350.088585 0 ] (cb221-19) [ 819 0 R /XYZ 99.933071 331.141563 0 ] (cb221-2) [ 819 0 R /XYZ 99.933071 747.976036 0 ] (cb221-20) [ 819 0 R /XYZ 99.933071 198.512413 0 ] (cb221-21) [ 819 0 R /XYZ 99.933071 179.565391 0 ] (cb221-22) [ 819 0 R /XYZ 99.933071 160.618370 0 ] (cb221-23) [ 819 0 R /XYZ 99.933071 103.777305 0 ] (cb221-24) [ 844 0 R /XYZ 99.933071 799.173057 0 ] (cb221-25) [ 844 0 R /XYZ 99.933071 780.226036 0 ] (cb221-26) [ 844 0 R /XYZ 99.933071 761.279014 0 ] (cb221-27) [ 844 0 R /XYZ 99.933071 742.331993 0 ] (cb221-28) [ 844 0 R /XYZ 99.933071 723.384971 0 ] (cb221-29) [ 844 0 R /XYZ 99.933071 704.437950 0 ] (cb221-3) [ 819 0 R /XYZ 99.933071 729.029014 0 ] (cb221-30) [ 844 0 R /XYZ 99.933071 685.490928 0 ] (cb221-31) [ 844 0 R /XYZ 99.933071 666.543907 0 ] (cb221-4) [ 819 0 R /XYZ 99.933071 710.081993 0 ] (cb221-5) [ 819 0 R /XYZ 99.933071 691.134971 0 ] (cb221-6) [ 819 0 R /XYZ 99.933071 672.187950 0 ] (cb221-7) [ 819 0 R /XYZ 99.933071 653.240928 0 ] (cb221-8) [ 819 0 R /XYZ 99.933071 634.293907 0 ] (cb221-9) [ 819 0 R /XYZ 99.933071 615.346885 0 ] (cb222) [ 844 0 R /XYZ 84.259843 607.293907 0 ] (cb222-1) [ 844 0 R /XYZ 101.433071 605.596885 0 ] (cb225) [ 855 0 R /XYZ 84.259843 434.451496 0 ] (cb225-1) [ 855 0 R /XYZ 101.433071 432.754475 0 ] (cb228) [ 858 0 R /XYZ 84.259843 799.370079 0 ] (cb228-1) [ 858 0 R /XYZ 101.433071 797.673057 0 ] (cb231) [ 858 0 R /XYZ 84.259843 448.229014 0 ] (cb231-1) [ 858 0 R /XYZ 101.433071 446.531993 0 ] (cb234) [ 862 0 R /XYZ 84.259843 799.370079 0 ] (cb234-1) [ 862 0 R /XYZ 101.433071 797.673057 0 ] (cb237) [ 865 0 R /XYZ 84.259843 394.701496 0 ] (cb237-1) [ 865 0 R /XYZ 101.433071 393.004475 0 ] (cb237-10) [ 865 0 R /XYZ 99.933071 222.481281 0 ] (cb237-11) [ 865 0 R /XYZ 99.933071 203.534260 0 ] (cb237-12) [ 865 0 R /XYZ 99.933071 165.640217 0 ] (cb237-13) [ 865 0 R /XYZ 99.933071 127.746174 0 ] (cb237-14) [ 865 0 R /XYZ 99.933071 108.799152 0 ] (cb237-15) [ 865 0 R /XYZ 99.933071 89.852131 0 ] (cb237-16) [ 882 0 R /XYZ 99.933071 799.173057 0 ] (cb237-17) [ 882 0 R /XYZ 99.933071 780.226036 0 ] (cb237-18) [ 882 0 R /XYZ 99.933071 761.279014 0 ] (cb237-19) [ 882 0 R /XYZ 99.933071 742.331993 0 ] (cb237-2) [ 865 0 R /XYZ 99.933071 374.057453 0 ] (cb237-3) [ 865 0 R /XYZ 99.933071 355.110432 0 ] (cb237-4) [ 865 0 R /XYZ 99.933071 336.163410 0 ] (cb237-5) [ 865 0 R /XYZ 99.933071 317.216389 0 ] (cb237-6) [ 865 0 R /XYZ 99.933071 298.269367 0 ] (cb237-7) [ 865 0 R /XYZ 99.933071 279.322346 0 ] (cb237-8) [ 865 0 R /XYZ 99.933071 260.375324 0 ] (cb237-9) [ 865 0 R /XYZ 99.933071 241.428303 0 ] (cb238) [ 882 0 R /XYZ 84.259843 683.081993 0 ] (cb238-1) [ 882 0 R /XYZ 101.433071 681.384971 0 ] (cb24) [ 513 0 R /XYZ 84.259843 125.570079 0 ] (cb24-1) [ 513 0 R /XYZ 101.433071 123.873057 0 ] (cb241) [ 895 0 R /XYZ 84.259843 768.620079 0 ] (cb241-1) [ 895 0 R /XYZ 101.433071 766.923057 0 ] (cb241-10) [ 895 0 R /XYZ 99.933071 596.399864 0 ] (cb241-11) [ 895 0 R /XYZ 99.933071 577.452842 0 ] (cb241-12) [ 895 0 R /XYZ 99.933071 520.611778 0 ] (cb241-13) [ 895 0 R /XYZ 99.933071 501.664756 0 ] (cb241-14) [ 895 0 R /XYZ 99.933071 482.717735 0 ] (cb241-15) [ 895 0 R /XYZ 99.933071 463.770714 0 ] (cb241-16) [ 895 0 R /XYZ 99.933071 444.823692 0 ] (cb241-17) [ 895 0 R /XYZ 99.933071 425.876671 0 ] (cb241-18) [ 895 0 R /XYZ 99.933071 406.929649 0 ] (cb241-2) [ 895 0 R /XYZ 99.933071 747.976036 0 ] (cb241-3) [ 895 0 R /XYZ 99.933071 729.029014 0 ] (cb241-4) [ 895 0 R /XYZ 99.933071 710.081993 0 ] (cb241-5) [ 895 0 R /XYZ 99.933071 691.134971 0 ] (cb241-6) [ 895 0 R /XYZ 99.933071 672.187950 0 ] (cb241-7) [ 895 0 R /XYZ 99.933071 653.240928 0 ] (cb241-8) [ 895 0 R /XYZ 99.933071 634.293907 0 ] (cb241-9) [ 895 0 R /XYZ 99.933071 615.346885 0 ] (cb242) [ 895 0 R /XYZ 84.259843 347.679649 0 ] (cb242-1) [ 895 0 R /XYZ 101.433071 345.982628 0 ] (cb27) [ 518 0 R /XYZ 84.259843 425.570079 0 ] (cb27-1) [ 518 0 R /XYZ 101.433071 423.873057 0 ] (cb3) [ 320 0 R /XYZ 84.259843 523.623057 0 ] (cb3-1) [ 320 0 R /XYZ 101.433071 521.926036 0 ] (cb30) [ 523 0 R /XYZ 84.259843 715.370079 0 ] (cb30-1) [ 523 0 R /XYZ 101.433071 713.673057 0 ] (cb33) [ 526 0 R /XYZ 84.259843 211.820079 0 ] (cb33-1) [ 526 0 R /XYZ 101.433071 210.123057 0 ] (cb36) [ 531 0 R /XYZ 84.259843 451.820079 0 ] (cb36-1) [ 531 0 R /XYZ 101.433071 450.123057 0 ] (cb39) [ 536 0 R /XYZ 84.259843 730.370079 0 ] (cb39-1) [ 536 0 R /XYZ 101.433071 728.673057 0 ] (cb42) [ 539 0 R /XYZ 84.259843 294.320079 0 ] (cb42-1) [ 539 0 R /XYZ 101.433071 292.623057 0 ] (cb45) [ 544 0 R /XYZ 84.259843 575.570079 0 ] (cb45-1) [ 544 0 R /XYZ 101.433071 573.873057 0 ] (cb48) [ 547 0 R /XYZ 84.259843 129.320079 0 ] (cb48-1) [ 547 0 R /XYZ 101.433071 127.623057 0 ] (cb51) [ 552 0 R /XYZ 84.259843 350.570079 0 ] (cb51-1) [ 552 0 R /XYZ 101.433071 348.873057 0 ] (cb54) [ 557 0 R /XYZ 84.259843 538.070079 0 ] (cb54-1) [ 557 0 R /XYZ 101.433071 536.373057 0 ] (cb55) [ 557 0 R /XYZ 84.259843 301.323057 0 ] (cb55-1) [ 557 0 R /XYZ 101.433071 299.626036 0 ] (cb56) [ 561 0 R /XYZ 84.259843 799.370079 0 ] (cb56-1) [ 561 0 R /XYZ 101.433071 797.673057 0 ] (cb59) [ 564 0 R /XYZ 84.259843 350.570079 0 ] (cb59-1) [ 564 0 R /XYZ 101.433071 348.873057 0 ] (cb6) [ 320 0 R /XYZ 84.259843 138.376036 0 ] (cb6-1) [ 320 0 R /XYZ 101.433071 136.679014 0 ] (cb62) [ 569 0 R /XYZ 84.259843 598.970079 0 ] (cb62-1) [ 569 0 R /XYZ 101.433071 597.273057 0 ] (cb65) [ 574 0 R /XYZ 84.259843 772.370079 0 ] (cb65-1) [ 574 0 R /XYZ 101.433071 770.673057 0 ] (cb68) [ 577 0 R /XYZ 84.259843 271.820079 0 ] (cb68-1) [ 577 0 R /XYZ 101.433071 270.123057 0 ] (cb71) [ 582 0 R /XYZ 84.259843 571.820079 0 ] (cb71-1) [ 582 0 R /XYZ 101.433071 570.123057 0 ] (cb74) [ 585 0 R /XYZ 84.259843 144.320079 0 ] (cb74-1) [ 585 0 R /XYZ 101.433071 142.623057 0 ] (cb77) [ 590 0 R /XYZ 84.259843 440.570079 0 ] (cb77-1) [ 590 0 R /XYZ 101.433071 438.873057 0 ] (cb80) [ 595 0 R /XYZ 84.259843 715.370079 0 ] (cb80-1) [ 595 0 R /XYZ 101.433071 713.673057 0 ] (cb83) [ 598 0 R /XYZ 84.259843 275.570079 0 ] (cb83-1) [ 598 0 R /XYZ 101.433071 273.873057 0 ] (cb86) [ 603 0 R /XYZ 84.259843 556.820079 0 ] (cb86-1) [ 603 0 R /XYZ 101.433071 555.123057 0 ] (cb89) [ 606 0 R /XYZ 84.259843 125.570079 0 ] (cb89-1) [ 606 0 R /XYZ 101.433071 123.873057 0 ] (cb9) [ 327 0 R /XYZ 84.259843 509.420079 0 ] (cb9-1) [ 327 0 R /XYZ 101.433071 507.723057 0 ] (cb9-10) [ 327 0 R /XYZ 99.933071 318.252842 0 ] (cb9-11) [ 327 0 R /XYZ 99.933071 299.305821 0 ] (cb9-12) [ 327 0 R /XYZ 99.933071 280.358799 0 ] (cb9-13) [ 327 0 R /XYZ 99.933071 261.411778 0 ] (cb9-14) [ 327 0 R /XYZ 99.933071 242.464756 0 ] (cb9-15) [ 327 0 R /XYZ 99.933071 223.517735 0 ] (cb9-16) [ 327 0 R /XYZ 99.933071 204.570714 0 ] (cb9-17) [ 327 0 R /XYZ 99.933071 185.623692 0 ] (cb9-18) [ 327 0 R /XYZ 99.933071 166.676671 0 ] (cb9-19) [ 327 0 R /XYZ 99.933071 147.729649 0 ] (cb9-2) [ 327 0 R /XYZ 99.933071 488.776036 0 ] (cb9-20) [ 327 0 R /XYZ 99.933071 128.782628 0 ] (cb9-21) [ 327 0 R /XYZ 99.933071 109.835606 0 ] (cb9-22) [ 327 0 R /XYZ 99.933071 90.888585 0 ] (cb9-23) [ 351 0 R /XYZ 99.933071 799.173057 0 ] (cb9-24) [ 351 0 R /XYZ 99.933071 780.226036 0 ] (cb9-25) [ 351 0 R /XYZ 99.933071 761.279014 0 ] (cb9-26) [ 351 0 R /XYZ 99.933071 742.331993 0 ] (cb9-27) [ 351 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 351 0 R /XYZ 99.933071 704.437950 0 ] (cb9-29) [ 351 0 R /XYZ 99.933071 685.490928 0 ] (cb9-3) [ 327 0 R /XYZ 99.933071 469.829014 0 ] (cb9-30) [ 351 0 R /XYZ 99.933071 666.543907 0 ] (cb9-31) [ 351 0 R /XYZ 99.933071 647.596885 0 ] (cb9-32) [ 351 0 R /XYZ 99.933071 628.649864 0 ] (cb9-33) [ 351 0 R /XYZ 99.933071 609.702842 0 ] (cb9-34) [ 351 0 R /XYZ 99.933071 590.755821 0 ] (cb9-35) [ 351 0 R /XYZ 99.933071 571.808799 0 ] (cb9-36) [ 351 0 R /XYZ 99.933071 552.861778 0 ] (cb9-37) [ 351 0 R /XYZ 99.933071 533.914756 0 ] (cb9-38) [ 351 0 R /XYZ 99.933071 514.967735 0 ] (cb9-39) [ 351 0 R /XYZ 99.933071 496.020714 0 ] (cb9-4) [ 327 0 R /XYZ 99.933071 431.934971 0 ] (cb9-40) [ 351 0 R /XYZ 99.933071 477.073692 0 ] (cb9-41) [ 351 0 R /XYZ 99.933071 458.126671 0 ] (cb9-42) [ 351 0 R /XYZ 99.933071 439.179649 0 ] (cb9-43) [ 351 0 R /XYZ 99.933071 420.232628 0 ] (cb9-44) [ 351 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 327 0 R /XYZ 99.933071 412.987950 0 ] (cb9-6) [ 327 0 R /XYZ 99.933071 394.040928 0 ] (cb9-7) [ 327 0 R /XYZ 99.933071 375.093907 0 ] (cb9-8) [ 327 0 R /XYZ 99.933071 356.146885 0 ] (cb9-9) [ 327 0 R /XYZ 99.933071 337.199864 0 ] (cb92) [ 611 0 R /XYZ 84.259843 440.570079 0 ] (cb92-1) [ 611 0 R /XYZ 101.433071 438.873057 0 ] (cb95) [ 616 0 R /XYZ 84.259843 685.370079 0 ] (cb95-1) [ 616 0 R /XYZ 101.433071 683.673057 0 ] (cb98) [ 619 0 R /XYZ 84.259843 238.070079 0 ] (cb98-1) [ 619 0 R /XYZ 101.433071 236.373057 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 743 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 891 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 889 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 676 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 311 0 R /XYZ 84.259843 612.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 893 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 745 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) [ 736 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 865 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 817 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 645 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 844 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) [ 510 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 598 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 603 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 606 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 593 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 539 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 544 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 534 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 776 0 R /XYZ 84.259843 332.207453 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 712 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 513 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 691 0 R /XYZ 84.259843 524.420079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 696 0 R /XYZ 84.259843 257.404475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 702 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 632 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 781 0 R /XYZ 84.259843 675.273057 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 707 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 640 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 637 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 624 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) [ 796 0 R /XYZ 84.259843 208.126036 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 796 0 R /XYZ 84.259843 425.926036 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 577 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 582 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 753 0 R /XYZ 84.259843 163.687950 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 753 0 R /XYZ 84.259843 454.079014 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 531 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 526 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 521 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 796 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 729 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 719 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 724 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 590 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 679 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 696 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 792 0 R /XYZ 84.259843 445.970079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 781 0 R /XYZ 84.259843 301.829014 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 611 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 688 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) [ 800 0 R /XYZ 84.259843 138.881993 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 585 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 619 0 R /XYZ 84.259843 408.470079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 614 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 685 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 786 0 R /XYZ 84.259843 641.326036 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 676 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 627 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 800 0 R /XYZ 84.259843 542.326036 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 518 0 R /XYZ 84.259843 595.970079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 682 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 586.670079 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 325 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 552 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 557 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) [ 547 0 R /XYZ 84.259843 314.720079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 564 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 572 0 R /XYZ 84.259843 258.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 569 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 557 0 R /XYZ 84.259843 501.723057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 557 0 R /XYZ 84.259843 264.976036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 776 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 662 0 R /XYZ 84.259843 411.552842 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 748 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 757 0 R /XYZ 84.259843 519.629014 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 766 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 817 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-manual) [ 865 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 317 0 R /XYZ 84.259843 170.823057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 317 0 R /XYZ 84.259843 347.570079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 315 0 R /XYZ 84.259843 277.251496 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 423.051496 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 327 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 325 0 R /XYZ 84.259843 209.270079 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 320 0 R /XYZ 84.259843 365.776036 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 320 0 R /XYZ 84.259843 694.023057 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 317 0 R /XYZ 84.259843 478.370079 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 317 0 R /XYZ 84.259843 609.170079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 766 0 R /XYZ 84.259843 383.493907 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 766 0 R /XYZ 84.259843 195.693907 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) [ 810 0 R /XYZ 84.259843 392.223057 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 750 0 R /XYZ 84.259843 553.851496 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 750 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 351 0 R /XYZ 84.259843 184.188585 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 327 0 R /XYZ 84.259843 668.570079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) [ 442 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) [ 753 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 691 0 R /XYZ 84.259843 727.220079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 317 0 R /XYZ 84.259843 739.970079 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 315 0 R /XYZ 84.259843 146.451496 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 340.070079 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 325 0 R /XYZ 84.259843 470.870079 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 893 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 702 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 891 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 893 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) [ 750 0 R /XYZ 84.259843 423.051496 0 ] (kubelet) [ 776 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 745 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 315 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 817 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 817 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 855 0 R /XYZ 84.259843 238.710432 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 858 0 R /XYZ 84.259843 603.629014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 855 0 R /XYZ 84.259843 589.851496 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 862 0 R /XYZ 84.259843 323.081993 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 858 0 R /XYZ 84.259843 252.487950 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 862 0 R /XYZ 84.259843 207.281993 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 862 0 R /XYZ 84.259843 453.881993 0 ] (minimize-the-admission-of-privileged-containers-manual) [ 855 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-manual) [ 862 0 R /XYZ 84.259843 584.681993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 817 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 865 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 304 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 855 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 889 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 817 0 R /XYZ 41.740157 784.430079 0 ] (rke-cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.23) [ 304 0 R /XYZ 84.259843 784.970079 0 ] (scheduler) [ 696 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 889 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 304 0 R /XYZ 84.259843 166.076079 0 ] (the-default-namespace-should-not-be-used-automated) [ 893 0 R /XYZ 84.259843 193.251496 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 810 0 R /XYZ 84.259843 670.970079 0 ] (worker-node-configuration-files) [ 750 0 R /XYZ 41.740157 784.430079 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 1078 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2625 ->> -stream -xœ½šM¯c· †÷þ^…©/ È¢@6i4Å  Zt‘3 Š;&]ôï÷Õ±õáëw>2Sôö="u$‰zDÊÖ³àõBñQ]C­­d?_ޜޞ$”$ø;jÜõx—tVñ’¶\ÓùMX ¥¥Xòùé„gŽúÓé/_œþužch-GMç__u•[(µIDÕ 5¢J)”S&ª¬ØSÁŒT<ú£ªÀ o51Ìð+QU˜a^ÔU fÄ¢ÎT0C[*D¥;4ŠP w‹D§)d zfº¨!×Õè´D¦3 ¹¸&eºrΩ2ÖÔD™.Á–¤îÂt°Å­¦Ë°Å² ÕÁ–X‹1]-£Óˆ®ÂxW¥:Ø"Y”éš…Ôª;Õ5褖ú¨‹’BªfÂtª!Á7ê°¢0I¹]„-YR£:Ø’L"Ólq¼˜œHVj%«5öÕmbÊt ¶ÄXœê` &Ÿ fØ"%3`…Î%Æ€XJðA V ^½2 -ÄÚ‚—b ±¥à¹Æ….* lIž La‹cåRl±æŒa *0˜Á–èÆX` ­Ã[ ¸uiÊX`à­‹fÆpa¦0ˆk5;c¹p¥ÆX``®Œèb¹Æu-åÈX`À®y͌08¸k†;©¶À @Ç`Z±ÀÁ]S)ŒîbEÆÌj€fÆøJˆµ -cƒ»±Š38¸ ¶ª+kÐ Ü Àvnp7&‰ŒîF™±ŽÀ¡Ñ¸ „$À–±û=tÑ ÐXˆK ¸« ÛYÓ UÐÚ2cAwµbú¨®-q²n1ÊAsnŒ ÜÅFeŒ Ü>+c°£FÆ‚îªa§f:pWcÆ‚î"nHŒp‡  °¿¸.Õµ ­VÆ‚îK‘±»p -’P] p$e,Œƒ e,Èà.¶÷ÆXÁ]IfŒÜGØCu°Åjd,@\–-YÓVƒD‚éÀ]QÌ0Ó»"¥1dp·o›Œ¹tA¬Œ00 -ŽŒ¹zh¥dÆ‚Ü:„|T—ʉ±  È¢:ØâÅ X‡f­2”[,FÆ‚a BÆD¡)¢ošÀ¸ Ͷ Rd,ÉBmîŒ%eäcU¦Ë1Ô\S]…N cA)°+cr©P±è øÐÃ%Ƙ:cAi°K…±[Q¨‘9Ó)lAÍX€H:UÆ‚a ¢AÆ‚+²Ì,ŒØ¡‘Kb¨™Î¥ç™•± z=Td,À2A¦ RRl& 0?=ÙNŒH~l"Í¡:ØbÉ j=ݬŒµÂ–(‘±¾ÙóÍÂXж âc,h’C“ €qèD šVä›Ñ °.{¾Y š òM¤xdÝ6Ë=ß,ŒÍaKBˆBu°AS#ëLB¾ :1]†-±9cA˹盕±aòMDôôH ö|³Ðãp75‰éÀ]D¦™±䛈lYn/o*ˆÏ¸²öŒ³ÒzöVzd `/v«BÏ ðí9=4€™È,k¦§ØV¡T¡Çþ"ó&\OŸö#ª w(Ø3kéÙ°,ÑýÌ9V5{Gµëùد?Ÿ¾ü ›ïùçŸ^qœ”—ÂùÍsO¬s?çU9¿Ùånö„ZÏOÛ‡ä[;·5~SB<~íHÓ–K‹M»Ñ¼o0”Wï+ åüxñðàãñ»—'¿J_ôÙBÞ¡×í¶óˆHõüòÍéË?üø§ïþúfìåëÓß¾ê>\òÞµÇ-øÇ .óµœ:QoÌrâkÜ㨟 sÔóà*Ì–¤®{u­§òõßÏ/¿}‡aˆv6Ã[òµ]wû:ùWGQñ?ö¶óõ}ô}»>ú½Ù‚¡½Ú÷®{;x¸ç¡ÿ{òƒ=éÚ÷ñ\Û³ý¥m|ÒŸkûß¼Ä]½þ-È"nóÜ6gï >õUº­¥­¥¡ØŒoG½|iÜzï+ZŸ; v‡ëÉtÀC?–ƾ†±`'yw‘o¾ÿãïÿüýÿËE®ÿï§þ*ÿßLù­ýôYÓøö”ˆD¬Ù ²´~l dëóÒÎ= -Bˆä:¦MÖó;î<ûßÎZ·óéG=¼~9°nõß°!‚èãߣ®ëYb$é¹XËýŒéQ „ÇwáíRf[Hã3Ùå¤ðàö¼&p¹]¶Ù¸¥q äu·õ=ab¥¾®!îÌú(îO/Aoâ~Þ]ƒÝJyš‚¤ MájÐ÷º«ÁuãÅj² Ó£P¶î–8ú°G{~4‡./á4}:ݦÔe›Î÷ /'tkÏ¥OTÚOÙFSct… ™mFµ)M£æœŸóDD—¾Ñ´c2§~›µž«\…u8’ÏzmÔ#¢Ë‰Ö»µ–æL•Y«®[ÛùeÊru«sà‰ì£›´ô/ð¶5"6.ïŹÏÀ˜kŽËoâƒðrB\íâ§S*¤vZ¬4\oÚÖîWYþ²¤ˆ¯oC…¥9d=ÒëŸWT¤)íä9.ôŽÛz¶¶J«“¾6§ø~vyžÔq6êeÕ݆KK™>»—V!õ;tgí9bwÒmÈ6yiü© {±N¯›âŽ°1>“•»P†èn‰Ótå§;ñ²3Í¥šdv–us÷4Û]â<Ùù´‹Ëœqí©÷´w¶»ùü^ŽÍŸ‹»ë×ÑÉG™»Ýêl.Ã…%^}:ÄcµN:õ¯ÇåZdlǽœ~9Û\´[Ø‘g"cÜ£.=ÿu¾ÅûŸ'?7R—ë>eÒ"N¶Þ‰÷¬ïX?RÜ¿‡¹l6aô ûK¬uÕMÃæ>ãÆk_·Ëû¨©“ :µ»0­1ÜÄqºnTÛF&½Gxy6Š3ùܹYöµhãáÐõ¤wX…Âþ8(Ö¥³µ%Ÿ·&QêU×–­ÇíFöFQÜ:l˲;3»CîÌ¡ïöû>ÖûÚ -[Ñ‹¶t¾¶Ù½é!;žb«‚ØöÂÞ°ëÞi»³‡ýÉËë³çýfr+ K'Ú§ôi—ÎëÒ <.µ£˜ï‹sϱs/ŒÅ»Fh¶eÛÚ³䬥±B ¿+ì>ºIëºíV!íúÝu:6Š‰ ÈdÈf‹eØ”o·a9ž¸ÒQ*3¦XÒ_ö‘Nû¬ÌALû¬ä‡º½Ý±ãÍhÉf”vw.ëédÕœ±d%²¼ß=¥¾jÚ=öí÷}Ýö¼=†/CòŠLeÝ–j~ÿ>eíÐ)Vk¼Ž“­ë°õqcÇï·¤æ †xÿ -®xÝŽJ~ó=ï?;yÒo€wžšÒãC=~Š¿ÛÑ,–ž*ö_^Yzkÿ¸ˆÒ£"õ»£“ãõ_¬PK -endstream -endobj -6 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 5 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3667 ->> -stream -xœí\]¯Ü¶}ß_±Ï¢C?€¢mó’6AÒmÓ¢öÖNP\púпßCI$‡Zí¬ï—»kãÚÒÙ9<3‡Cj¥k?·ø'y;¥”cðÇÓÛûƒ™"ü™-†“ùãïð#ÿû‰)2ç£v21EoŽoÖ¸Éùà9JünÄMLJvþ—Ï? Y&N„C¶“MÖ:r˜B¦lÝñç×ïa…µ™Bùç?ÿpøâ%|?þðïÛÏ桇HS6Ì–ŽDqŠÑöópÁ"HtIâe¸¡áŽ:Žæ[;_‡Û/¢Ô;‘u0{†ÐÞº0ï ­ãÓAâ!L®·-ðÔ[é=âpµ–þuô4Œ§ã…@lqD¨Y÷4ȶi—à7½•ÞcgjŸïÑoì!qŒCà-.Sž:G‡8Ð…8A¢Ù•?Çóƒ+í£y{Aº—¥(q‰›Do½IôL¢­¢R¢Ò“qôagD7‰Þ$z“è3It_Š÷_è^’îM¢7‰Þ$úd Ý÷%ÚñQŠ™ö«¨ÄÏ$š’XM‹‹:>J´ãR\;(uŠ¼#Q‡ôm­´åj-üè$*p!.Ñ〲l›v pÓ[éíLíó=¦´ ö‡8Æ¡ -¦ãCÊä)œKtŒ]ˆÉ8Ä3‰:`'ãÐñA¢)-zÐ!öB„0Úè¥D;Sû|?B¢b4o/H÷²‡l‘¸Iô&Ñ›DÏ$úÀ½è Qéù8ú°3¢›Do½Iô™$º/Åû/t/I÷&Ñ›Do}²…®ûU´ã£ÙîWQ‰o%ê|«iqQlj -\ŠËç›H¢ãQ¢‰ëí•Q¢IÜé=‚x>OŽŽ©ÑñQ¢—bLâV‚@Y¶M»K¼^öØ™Úç{ô[{ˆCãPÓñ!eòDgÝÄ.ÄAà˜FÎ%šÍ^::Ž§ã£D³¸µÖSº÷8 Cì…8X:“¨`jŸïÇH´æíé^–âÍ"7‰Þ$z“è™Dº••žŒ£;#ºIô&Ñ›DŸI¢ûR¼ÿB÷’to½Iô&ÑG-t­µ$AÂö—ŒE£ýo½¾M×pÙPénköˆ0ev!Í" ±çšM˜˜%VlMì] -F³I;Ï9(6¾cXYá‘È.#‘;2Ì…CöåA–hÂ!CÄ.Ää™irœ Í>ûìŒÆa€ÏÞ¯qX¾A+Qã0†2Õ±Õ8LðÙyÃ2eÊI™8û‰²‹¤pŒ™(yÈL³ E¶Yá0Xš(p&…À K…Ã@ðÙG—ƒƒÏ.Y§pˆìB1H)(Ÿm†R5øl B¯Ø0|6ÖD%ŸCÀŠ&—7D4›0ÙDì5Q§mt”4cšlðÆj&THôćå&»g¯Õ”á³CéR8ŒX+Y‚¥Âa4ðÙÆ#ê 5Ék5É>™œ­VS"ê I9k5ÃÆ­¦DÔA­ÓjJD4¤pQ j6ðÙc&Ó8DD¦:«qˆ:hˆVS"ê ±“2'DÔAck5%b—s$­¦ÄŒÅ\ŠY«)1—EsŠZMIÆM9d“É°1¤Õ”dá3›ìÁgS8ÄJkHòFá09øLÎj5%9øl±QQò9yøl|ÐjJâ²NFåÕ8dbå§Õ”í)!‰´š‚IwJ!bß ØDžÊ›sZMI >{ÈTã[8pµš‚ l –ˆš |&KZMÁžgžµš’-|6µš’q³óZMA^L1y«Õ”Leãé³VSÈS X½("—'Ì/N«)×è#ņ᳃ê5>"¯Ì 9Àg[Ô£ØDøŒÕ¡VSr„ÏÆD­¦ää°c·¬Õ”\¾äLDAã0ó¢3ZM»v -õB!F{nﵪ‚]/ÜöLF¡FðÛa¨ðˆ'ÇÐâ6©×]èÞÞ•±à1ó;´XÓáË~»y‘æ¼o¾¼ø»³Ç~·óÑo^°YZ^,Xs*#fÏ#öte/êñÅÛÃ_~óíïÿü óâÍáï¿å¾üüúÇ_¾|æß³$<§h™Ždó•øA`á„ÍöQžfP;ï×A^ÚÏóâŠ6 K8Ìë(ç~nþwßÿöûoÿôtÍsIØgl+gÿ|Í£jbô|͇²Ö|¶æcÑç•æã#šÇ,{-´h>a³w-´ióÿµÐ>¢ù\ÞÃxÆæ] mšßmÚ/èçe±!~s5ÎùäæÆÿð×?~ý·ïzã 6$øA5b”PŸú1¯é*¦2kçpeÚ'V'cÇhü5~РqKGtÂaXÎ9¯#+µ2¯6°Ç¾Çx^áÅ™ù¸:·^OÜõÀü+ã#¬µæëüëÅΚåÿâÏü™°¯}4xô‡_Âæ´öýê>>ªÄ U¬p5pQþ_ûšƒ@;|qŸKöû Ù^ g¿qîß\ów¬Y-#W_gn+ïAp°òêìÚÏŠ×\¨¾`Õ?sì_.¼rS\¹_íæëªí› Ï´ú%™/wÖ›×Ø,cwYVö|0T„C©dNœÕÁ«ƒÃgÎ-É>D¢äMÒ¹NNµ-X±™“ôdÝË×ëñ.)ëço„NôgVû°ú!®­Bj‚I£LB•h–DÏÜ–dËYÇØÆlúy볊)ôäœĘs·7¯ž9u‘4ñ¯‰6szRýNåÁÈÁïmNð'’´Lfm¢âÕ‡WëµnÍ…SÏ‹ûç›-Ÿu’™J>üó{ºx2v·¬Ç3ÎGWžp`Šaþ&ùðÓû˜”±Æìæ¯ìË㬖hb›Câ ߯½—oî­òEkyúc½ÇîËÝëèøé¾›¸ï÷ k*Ì²Ï N^¤SêÇs;U -õvÃz?|eìá{Ø÷g_N½;”gO}yø‹Öpy¶ØÏÏx•·Åg¼üzkxÕ¸Ù™i{¼péü{½ß5«õW}›‰-O¯.¿\œ¬öË7eo6û© <´e'^Ž£3ÞÂw{žüìËšïp=4­-o«aÃN‡ò%ZÞZºò¬Ãr˜[ã×Ãò´E¿žëen‘8Õ³"‚¥ãW{—Ñ—×fA(‹¨õ,4W8TŸö½´í ö ¯ÂÖò9hDw†&sµ¥v˜[Ì6×%uV„¿ÚRáÔÀÓݺ-z·‹’mUvÉ4Ì §rC¹Z¶€ø§¨¼ƒr~njÓåeƒö¹ˆMiSM$ßìrµÛN‡]»µ5n‘ŠÍ*õKse¾»ÒSÝ¥Fü6s´¢˜&îÄiùršj$Jj¬MyCgàéPæ3øîÀqÇšû\a¸¦žh·ÁÉô|éhyäz9‚4+Vò)ÿ.S7´Ì<óõ-¥ÊKý¬wR´Ùà‘$‰‡6ëø=¬ÝVÐecl9+ù²ÉìØ—I·Y7ÆTP&ð˜«{e’j“ÇÛ–u .SXå§Í•4Õ t×an©|7ÀÝOnR-Ï^¯`°"ݹµÛáÐæÎ; Çq|D¯Aä|Osaó[¸¤~ªt˜L«v½3vÇ0)t¸O£w3\ÕÚf'›s;ì"Û«¸§Ã‡¹Ì‘cÊåV7?ø.—]öøØ|…Ÿüñëú0ßRÇÉ´Ù‚ÚÜ:À²’¹«0Qn`“É‹i¿Ã6u[®ÙÐê8‘˜¯}¿Üô‰½ZÚ6ƒÚö©¹s(`j©KÖ fXOÛBæ±±é{9uupè¦> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (rke-cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.23) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.750423 648.111024 496.429134 633.111024 ] -/BS << -/W 0 ->> -/Dest (rke-cis-v1.6-kubernetes-benchmark---rancher-v2.6-with-kubernetes-v1.18-to-v1.23) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.690364 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.521907 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.961024 498.679134 507.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 510.561024 491.179134 495.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 491.361024 498.679134 467.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 470.961024 491.179134 455.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.761024 498.679134 428.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 431.361024 491.179134 416.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 412.161024 498.679134 388.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 391.761024 491.179134 376.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.561024 498.679134 349.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 352.161024 491.179134 337.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -25 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 332.961024 498.679134 309.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -26 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 312.561024 491.179134 297.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 293.361024 498.679134 269.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 272.961024 491.179134 257.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -29 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.761024 498.679134 230.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -30 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 233.361024 491.179134 218.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 214.161024 498.679134 190.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 193.761024 491.179134 178.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.561024 498.679134 151.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 154.161024 491.179134 139.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.961024 498.679134 111.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 114.561024 491.179134 99.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -37 0 obj -<< -/Filter /FlateDecode -/Length 3687 ->> -stream -xœí\KÜÈ ¾÷¯ès€­Éb=Ç<. d#Á"ÈÁîµ7Æ69äT©%öŒ§½öccf$êS‹UzÁÙËÿo@~å.ç’b8_>ž~%-Œèì}41ŒŽ ±g “çLL ŽS! Lò‚Aô†ï@ŠŽ#ƒ‰É¢3gï ï,:³/&¦ˆÎ²7\ ½èL1yÃЋÎX¢‰Ñ1ÃP¢”ÉÄ èì3ÃÇDgP ÿAŠ.”àML@r”c&»J61ƒ©þƒÑ»9Ã0ŠÎœÙÄ$Ñ™!Ã0‰Î!‰É¢3%,†ÿH¨ ÆC±ü§ˆÎBˆ…!/:—bøyÑÙK!±0 :{HÙðÉrŽJˆ6&:ʉ³ácD(²á?DÙQ’ß&G1b6üG²“#.`cDgFŸ £(:‡P²á?$%(e#5ȧløØÆ‘™!r6|Œ¤ Š÷„lùÔAñ!²0Aê ÆløR‡9ƒ‰‚Ÿ ÿ R1QI†ÿ©ƒÏÙÄHD.)þ¤"c´1¢s`N†ÿ©ƒbÁ`cDgJ†©ƒ’£1þ¤"$°1¢3xŸ ÿ RÑc±1ÙAᜠ“:à¤^¦døLSÑÆD'ƒâdøK”V‚£§høK”R‰Ñð–:(s °1¢3 ÿa©ƒ@PlŒè,Å0þÃRe7EÃXê ÌG£½d<Ãdž%Óü®0Ë”g™ ê‰ÃeqKe2øie²nvDó>z^Ìüû‡Ó/ß‚óçþsúð‹iYE¥âY<àÌRc[ÊxhZw¹,Z¤ÙÚ­@š<ÆTÛYÉç‘õ“$sôN†“¹4&±WrqóŽ.2QÚJ‡Ž/§QN,i¶µ=ÈSo¥õ©Tô8¨.½¬ŒÐåjY#\ÉAf Ýz\Iylw <ȇÑ=–Ú·÷eÍC<à!®yˆ¼•¯\&»¶Ò xÀà Ï·ÆÃÒcÔ"rÍC—®yèò™[ùàÒC+éŠ8àaŒ6ú¡ÇÁRûö¾œ¼+¤ÿÎ×vˆ£ùxºÇ¡¸ò扗} Ñ—½ -ѨÿÒùzã !:j¸}ÜÑKˆ¾„èKˆ~¦ÝŧOtB÷%D_Bô%DŸ5Ñ]Ý!šnÉ is_M/å4‡ó|lhçÖZ? Îä<ø’y»º¦BÎ&&:¢˜ LFGœ3‚…Éz7M”0E/(cârŒIÞ»€!a¶0Ñ…ãt³áèBÌ1š˜,Aê#E£7Hãt³ê£7H(ðtîsä`p‘:N™Áà"…¬7áB¶0Ôq|¥¨7)C@ƒ¯£–%Ê_’#„{q “]Ohq‘ƒK„X,.ŠÞàMLt)E$ƒ¯,y:•ŒÞà+{ Dô ¾2—B0¸6\ŽÀà"£ä }¶0¤¹8{6øÊ’2 y_9WJ6øÊ,¹.Qaƒ¯ÌÑ•Â .rÔ)‹‹Xœ§’£…Ñg "d²øÊ’‘ÅÞâ+'A¤dñUȦ,.¤¸C( .¤:H³…pP(ƒ¯"›,£70H)q6ø’R¡7?$-® .JGž‚Åi Éò|±øÃä(¤@_â^Ž¤hxƒ¯Ù‘TÁdð%L¹DÁâ"É´˜¼ÅE&'Y“‰)zƒÅWa½¡Ž`ðÆŽ‘滔ǠäXò<lÈlˆËœ :Tçâ‹ BvQo'lI»º Ðg'Ãmñtñ †íÄ`„ó>üð>À;‡~õæTæg¦ŠL/õÖ2z­Î^’/j‰7O¿üÍw¿þîO–¡¼ùpúÛ+1xŸüúïç7¿;ýö4þÔæ£Ì;o4_>½y)4Rú?_ó2ƒŸ¯y}R?có‰nRûŒæƒxþ-jß>£ù”oRûŒæ™à&µïžÑ¼ÌÝ,jY»x\ó—GãÔüdÝD]X“—I”vðÛ?þé÷ù㦃ôéú'oÖs›';°øyYGgÅ·¬ÿ ßÉÁ,~žï°KÖ:@Ïh>Ú¥Íó32¾G;²´ý¸jßíqq{œžÄôuédñ2Í<ŒZØüÕÇe€Ù{Kÿúd#³.çc,KìðN~¼½’-ý;Ét©¹`ôo=Gÿ6Ù¥·¯x=Î8Ëø²´¯ûog¢ê6õ©çÓÒÞe–OçÄ®GÕQÛÙÓ¾ßÊf›ïÛUÐí†U[zÑÃb«ª¿Æ›;\ÌvÅ1òªÝ]Žâ8 -³N“ž—¹-ícâ[Ž}/Û†öiàÁw»O6¿ôó+“£~7P4]Î?ûÅ/õOÝÙ´eÜÚ²öÏÕÇxÖµúܤwé:Þ‰S™«ÇÛœ¦¯€Ó;ÇØt>.?KŒ­e–Ýdͺ±Û}ø˜¾ÍG¾“}b—MÜänwæ×ô¯þŸãÖÀ_&ðd¶çð6Ñåk%ú«ŠF­1ïD’.îo“ôöNÙq°{uDÝŸìþ¡Ûü0X²êÛ¯*bM£¦+£>:²»³üôôVÚmgx÷sv†»EµiHÜòvôß•H.™ó\îC$¾ ñÕ’ny°+t»UgVñþ5êùæò…¦ÙÔ/KØ4omúd®ú¥PР]n•Ü¸:6;,\ŒGc@•VÄ<.䎯Bq÷˜{x‰–mÊvcì2DÎâ% —{;+Vß.Çü2`èý>úŠSY¦*Î2ZòŸgõ›èpõËâïe^p±g¢={ë]Æm>Ùþ•ç´ÏÇlX–Õ†wºBWmXu]e.x¼y´eìX3%)[êÓ$ë¿jË;]kþø~]9ÚT?-Çß-ãI³Ý®2ürA[nä{Wâ\—PÕžù'¶g\d—µ½Ú±GÍÎüfö}§þW3Ë®¶v½åÔÜض—xm3ø:«»\Ûä>>SÂáj­úÌ.’=‰³GøÅ^þk3âËb“‹¿KüÎ<™vŒ[;~>e@‡K´Jè.¨­&YG$|? `˜:×ë*SaÛú‹þíexÜ ëLM/ô„×X^Íž¤×cÓñeÍÿ)ì-÷së=ãÄ¢™÷é3äåLɥ˜âô|Ôé_èàR!—¦' tÚŽ¡Äù!«' –ÞõÙ70¥&s½}¢ ‰D¼»z ^–ZµÈÄyå@•«2øbM*Üù­WЛÙxNÕ×ÆÈDA™å¸$ÑÆý²½ç;¸øÕ€iíËSûu’4è3N’¦1´ÄxuëÿÇgÔÏž°~–Áë§f(0âô¥¥4ÉÏœœh3VÞ`²4œN¾ÄõcC-çÒgÆA?2¹kØYðósOú]!%@¿Žç-ëg‹¶â¡½Ô·çWâ Ïè:Hs?mðØi¨²U§µP´t¡ïfWYk1UârZ5Ë4â¼k¥Ôæ]úÑÒ<²ÒŒÈ#+ñ -«íÖŠ×fKÔ&@<ºsê£óÙæ’yGdz›4t$UÙußaÝw­¶ça¡+ûÌÔ÷Óø -ùIùïSbg÷ö=ÔêÒävIÃëGW!Ò¹èt'Ç(9D"«æ‡k%O>Ǿxr}‰¤^<{}û\¿Å âo*<ÈrûÀÐÔòöþÁiúRóΞf€Ã·ãö_7 GËG ¦+Dm7éR‘KÖ·Ô}– /üÁæxuìÛÿÏ µ -endstream -endobj -38 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 37 0 R -/Resources 4 0 R -/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -39 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -40 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -41 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -44 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -45 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -48 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -49 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -52 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -53 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -55 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -56 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) ->> -endobj -58 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated) ->> -endobj -59 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.982112 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 323.270079 491.179134 308.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -66 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 259.070079 491.179134 244.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -67 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 219.470079 491.179134 204.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -75 0 obj -<< -/Filter /FlateDecode -/Length 3500 ->> -stream -xœå\M·½Ï¯˜³Ó$«ŠdI|qÃA„Fƒ4ÖÚVäò÷óØÓü˜™ÞšÝQ%Vê®®®f¿GV=²»7ì=þ~ðOáàJÑœxø°û¸ó.‹ÇŸÅãdg9ü'üÌCÈ®žMe|,.Åè9ï?ÌÌ5ÐþærÅ<‡yÜýõ‹Ý/۱žœ÷JÜÿú~vÉìr1—§] -n,jâh¸$—¹xŸŸvÑèrJ”ƒáR\.œ)=í<»â)å§}‚w%Nbù$WHKTÃ'FW¤eËTä$bàmVÖhÐØ;ð‹ îÈ)…$A¢SôÂ`a(Åi*T *Bb§%e¶0Ì$x ÃœÄÙ°àã_ âÎ'½…¡Šó¹H20ŒmÖ¤d`}v@ªa äQJ†1¨C c²'5ús¤àB)Y #e‡v‡`p™®ÇÅÀ0²:ø6¸ˆ"."ç Ã\,^²ÅEB›#ÃÂ0“£É[\duD Ý°ˆ#aOåHja¨Ù,l?íCžã@40$¯ŽcFR0|‚8f)b`H18FjŽ†³ã¥‘CÚ@ê°|ÔI@20$'”S60$ N$y6ú3Iv’™½…aB›5ælq‘Ô¥YfA Å­[\”àç’, Kv)% WÃGɥ¢†ª.{¤ƒ ö‚¢Œ‚a`È!¸LÈô†ŒÍ,¨†ÉeHž``ÈmVd`È$®B3|ªÀB †ÌØdEB4|„\I%²…¡(Ä\BG4|’8õŒŠaø ¢¸ãå“]R‹ ÔAî“…!ê B$E‹ ÔAU ACtvç³\ˆ/Î#±FC ì J1¸@ÔeÒbù$çAF0¸Š.ø¤–V*.D!K¬ -³ LÙR«"Þ…T+ªå“P—=[zUÚ¬¥XzU Ó#Ä”¥W‘ ]$K¯b;Üz±ô*Š€‹*ÀÂR=*º¡ÑŸZ|QK¯b`9Ô²ôj‚VGÍÈ–^MÐê”P - . Ga¸[z5A«³Gƒ‹­ÎAƒ¥Wчî#dp‘ ÕYD-½ -!ï Œc2¸HÐê ÉÒ« Z½ªpK¯B9t²ôjÊÉ •¥W‘R eZzÇI†Êr¾Xz5{ºŒÉ®5}õÉ%R±ôjÑ%A:40̘Rãþ£¥WsD›jËÀJóiò–^Åu’ÄÀÝ3jÍ–^ÅŒSêâ-½ŠIæÔè9a¾ì¡- æËP6jq‘1_æ –^ÍóeQóe( K¯fE›5%K¯fÅ|9ˆ·ôjATTnK¯ÔA¤Â:¨ÙK¯ÔA”¶ôjVGç)–^-Ðê˜TFK¯huT&±ô*d(æÔUÐ>Ðê YzÌ©«2| Õ±ë-½Z ÕÕfø@«©É×ðV¹&Ës|­ÞðV¾fù`¾ëÅžöQhõˆb`éU…VG–WK¯¢*aNÉҫС®fK¯*´:F²·ôªB«cT¥W¡g1§–léUL 0§æ`éU…V'…<´0„VgŒ.K¯*´:æ!ÑÒ« -­ŽùƒXzU¡Õ¡ûÕÒ« -­Î…ÉÒ« -­,½ªÐê†êÓ>Á{L˜kß°½ÇŒY2’°å0eÎ)ØK¬íVFâ´œ"&Í9úÈu zcáZP‹ÐÊmUé\Œ|¡†·l{××ýi÷Õ[ä¦ýOÿÜ=|±®´_úí›—ïšlш¾j;¯K“‘ŽÞ|Ø}õû~÷Ã÷ƼyØýí7uõ?åë¿ïß|»ûæ ‚¿4|Â,öJø·¯COvøw7„Où¸~õDxè²@¯O(ƒñJx¹!|&“ÚÃ3ú½Eí­á¡,jkøüúðBá*µzCx(·kÔÞÐïå«ÔnýaQ‹I|àׇǬۤ¶ÜÖs2”‘Em¹­ç@Ž›Ô–Û2¦Öç2WÂßÐsªÄ¸Fí =Å7™ÜêEÊÜŒêñQs\ú¦!å!1ývlÆO•²þÿÎ{ ËòlÎ ªÔm¯hë1ÁHaø1·Ol«N]~Ÿ2ŽcÞqŒuÀÿ?ŽË~<^³žW…×}Î#æâ[Ï}»ÆôÇcK;×v,q°Ïh7?ýZŒz/Õ§>ÿ±¸ncWŸð*^÷§{ZÚì§ûX¯çf\®sÝ9î‡ÿpb”#ž1™x¥s¼îÄôs²y¨ût.ê±Ú¦¥‡5N:Å|ñKc¹7Y9xXãÒ„éÛuo£žòQqžq‰ë9­3g+7K»l-üb8Çï>¼D.užuþŒxáõXµó×QqO²^+ž_‹5gõ{x?éÇûðC¨·ñ:?ò¿ÁÑzÎÃñ'fKœ)§½| Õgðñ‚#jœ„õÚkû®ðRçÈ×yIŸ/´bÈs×1Rù‰g±¼ß·cÛGßWò“Ï1­1X×ö‘ïõñZ[»ïš¿­võ2ÚÊ«íõ}„!6¯h>Ά>·>²œ£Û¥ÖñºÝâoé”õŽçøÝ'§Ö÷ ž¡EÊgÄKXÛÐôaZýyâ§ÆNãïajïËyÊçxÞ‡' ñ9ÚD?#ž>E{GõŒO¡O$ÉsôÉÛψ£“9ëªéۘʃ'^÷/®ýrnÊ9†÷á&…òrïuˆÃˆsÑ¿Ëê#ïÞG›7/˜çáÛø}Ñ\ø&ŸO²Qßëx†¸÷ZÄ3¸5Ï,c$¿ëŽíhO¹´…†ŽºÇéZí–û­#4?9~OöÕOŽgN×j¬Üoþßñ¤–“½}?jÜ’ÞÞ¿.š§Í;ÓhÏ}0,Q¯Õ@¹ßý|‘[ jyôáx·†u¿Ÿw÷ÁöN¸•x­>ÉýæÐ/Æ­ù®qÛúÃÝóccºå‘~ s­Vý9~Ë94¯±½h–‰Ÿûñ¨õ»©ë<Þiž{ëúì2çy¿^Ÿ>§üjNåËÿ§õ‰ëœÞiŽ| §]ÿÿø‰ÆçÊåëø õuŸô%t}pÙŽfA«„Å¥úÂŽî)»¬sZ^Úýò—zcYÉååEŸ}¨_\JÐTä‰}֫דÂÅÃÓ´•9ú÷ZìXs}¶>;ýæ»ïÿð—ïƳÓåùÕûc?[ú[:® SãO§þÙÖdp¾Œ÷wlrÿ­ïÍk[‹Ñ£}=MýcÝÞêOqík …}=~{64µ§­¥õ{hcëòÝŽ;A¹d¸Ô×=ÒK}=7—û¾~‹•|Zß絛w-H‡ý§.ß>ì^ëçÐÞ -¼?~+=í¬þÇîvay7¼þA¨_¥Õ-˜ë«ççæGЮõ­þ 3×WQžg®ÆuÓ÷Xšc·v]XÏ=©¾¨vÜÔÆu³¾(7ΗvÇsl{u/¼aÄ™)\šëÝ{V³,_öÒº—zS$µ6×Ï{@ž}GÀqâU3R×d”K£Ÿ.7Ì“Ú|cßÔÎ9Œ½é3ta¢¿ùÆ<Ñi;\–έ›Öº-6t£ï6š¥Ý*ͳ§ Óa·aüÒ·Ðõ;–~|b-º²KëHÜý´ùm˜»M¿5št¦r÷*ãTmȦŒ®N¥¿a[0Z­HÓnðÔ6OÍ©2иöeê7ñÂxØÕ¼sa~ÜIÞð–‘+¼´®7iŠÛÍÅþ2¬¹4¨R趴O\ÿ=¦ -éÖšy–úâHhæ½q‘:6»ù¤ÙžzÖá-çá;ÁU¿È§ ;b¿á_“n÷îˆX'È&{ÖÖ¼š¤zò85‡Þ뺹¦°†OÏ•³Ñ·FàrÃ,½+?ž˜G;¥Utöv±¦î.=î0§ž;gsîŒ×_”ÐnbÔ4õùf<,…Ï͵ë—v‘aŽ¾W»q±É8†¤0Ì#>.æ6Z{v -ª}s ²­Š{Øý¼[Ê\¤úÙ!ºgýf‰NdWØÿ >ßâç;Þÿ±½‰}¬ãÑ÷l{n=1Ï•,Fj^5ǨÝ؇ÍdŒ<¥ýaeøJë ½ŽÇ8åk§û‘Ø›gè4ô£³Q†“9ö®[{Ä@F ãá Å.dnåfìã.µ›óõ÷Mì{‡ª;óí`·Œc4Jò~ -‰½ê:J:ŽrœNÄλÓu´ì¤™µCÎéÐ×öóLÕkM;“Œ¨»4Žñ(³sèf[îbrá0Ìá$0‡ù¢zÒžF¿zxÝÌûÚäÔF@µöÔÞ­³µßXµö„·m¥e7îöšC˯*iƒw ÔcÑ4ö¨‹œ14†´à“¹NÖ2N[d¾(7ÛÉE[¡èé¢>½i¶1·6¥õ´ËrÇe¥Ü5Å°þ<#-3+D™YI¾5n«x]-Q@2wç<îÎÏ®%ˆ-Ígw+Oj¶Ëkóéµ[µÝO·Á£!i(S?N“ ÏWå¿×ŒÍ7µ·¼N–FBéK…šC¦H{­r§Ô_„ÁRgÍ\¦µ’Ÿc/ž\.‘´Å“ùJ “vª¿æàÃSMxĽ~` -µþ"²'NS¿yK/àÉÀ¶ß«'GËŸu…¨ïæ:U-õó;_0È5d6׊Î>žXþþ‘ä§" -endstream -endobj -76 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 75 0 R -/Resources 4 0 R -/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -77 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -80 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -81 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) ->> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-automated) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -84 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -85 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 394.370079 498.679134 370.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -98 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 373.970079 491.179134 358.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -99 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 354.770079 498.679134 331.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 349.370079 491.179134 334.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 315.170079 498.679134 291.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 309.770079 491.179134 294.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 275.570079 498.679134 252.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 270.170079 491.179134 255.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 235.970079 498.679134 212.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 230.570079 491.179134 215.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 196.370079 498.679134 172.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 175.970079 491.179134 160.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 156.770079 498.679134 133.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 136.370079 491.179134 121.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 117.170079 498.679134 93.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 96.770079 491.179134 81.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -113 0 obj -<< -/Filter /FlateDecode -/Length 3631 ->> -stream -xœí\K䶾÷¯è³Ë,²ªH†I|qÃF Œ ‡ÙƬ`ÖÀ:‡üý%‘,uK¥i­ÀÌ g¤Ò§b±ž$Åœü~ò'! )åÈx¾¼?}8¹!’“Ÿ±8//ý ‡rwHgŠ4¸ì3„ó{Mç4ðD~rÚ!+.O§~vúyœý3#¹ó/qàDÉ‚$7pL¼a[ì2€q)"¸m8‘—\01 cð.[‘80˜/"ûì\²0"³‡ì¢ "3`21(2»[‘Ù961äÊY˜4Pb41ŒÅ˜èã½3|"Ä&&‰Ì”œ3¼’ÈL.›˜,2cHÎp1ïDæÀÑþãÈì3›™½Çlø—(% `b¼Èì’φù 2;€lø<`FgbИX®Y˜4`ÌÉÄ -ÆÇløg7 gÃ<‹Ì”ÈÄD‘™³á?>ŠÌˆÁÄ$‘9DŸ ÿ‘PŒƒlùO™Å &8‘(g™ "³ƒ˜ ÿ‘,7„Œlcx)R2|,/‡ÉðŸÒ¢üµ0ˆC`öÉðÉNC  6Fd&ï’ácEfÄœ ÿ RCˆÉÄH ÁÅdøèfd6Fd¦døX2(ÞƒÉò©ƒâCÁ ÔAŸÉ'ä>%°1,pÑð”:ècÈÑð”:(ñœLŒÔAO9FÃPê 'Ï6FdF¢høJ ¢™„høJ”í£á?(uÐC#2ƒsÑð”:èÏ6& )EÃǤ R/c4üG†©‚¶1§5,"eGâg’ªÈm*ã IÝé2i¶µY4:s¬|ô©gý&ɽu“¢ 3‰E¸¡‹›wt–Ò5U5|9iz I³·¢ÇÎ¥µÈ!W´îT§^Jèô¢™#ÜÐAF ÝZ\PIóö« -VtÕ{Õ¢ÒÔº¾/K;ð†xi¦kúÂeÒñšze¿aEOƒÃf‡¹E.EäÖº´C§Ov¼¦+—V-.¨ ;À†T`´Þ«•¦Öõ}9¹!‡òs¾=°CTõæýFèn‡â›•%^Cô5D_Cô&D¹üÄóíÁ3BTK¸ì=¯ôè5D_Cô5D?Qˆ®‡âóº[¡û¢¯!ú¢w tOˆÀ«Usݲ”ÓDT3æ ºf´òh­ßç08Ï.ÅëÙµX*È<}\0ÝÄðrô &ù1c “ÊChmaÊ -ÓBç&ºò Š22G±—g††ÌQ”ÁgÈEÙ‘=FCæèqH€L–ÌÁ ‰EKlaxÈÝøPg ƒo¦…¼ML– !`20e-Eþxo`ð‘³%³Ä4Äœ¢%s ƒÞ¡%s”D›Ðƒ%s¢!Iɖ̆±%³$SDƒaÓäBKÎÛ˜<ÐNì$ vb'yIL;±“|âN줆¸;I -ZÚ‰„4¤ØI$õw'vI¾ß‰$9ÊíÄŽ8×àvb'IŽ‚ØI’£`'v’ä(¿;Ir”߉‘d;±“%G…ØÉ’£p'v²ä(܉\âîÄN.qwb'KŽâØ‘bÚ÷tlb$¯îÄN&âNìd–¼º;™%¯îÄN.ã˜ØÉ’£ÜNìdÉQn'v²ä(؉,9 -vbœ$)¿<Êãc¯›è¹Y–ïõ./‘0¸Õuy §uøæÂü‡•KzsÊÓ&¦,ã½ò¬×»ª®h]âÏoÞŸ¾øËþỿKWÞ¼;ýëKçJÌ}õïó›oN_¿æÏe/E.í°ç—³óÈXÅfŸî`/åwØ?¼œ}ytïwØ¿½ƒ½ ,Ó>È'¼œ=z2MûpŸç`L¦iîó -`šöá>Ï¡„¦i ûüqì罇, ”=,(Z?³/3Ýàƾþö»¿þãÛ«îpÍèìÀº—}°ëá>ÏO`Va¹ƒ=Ûõö¾ÀÊ`Vaw°g;°ÞÞ™ñ·#ë–ÿºÛûÙíý¸5ÒÕAÝà0zpë¼Q>Pø«ÿeÔœóIB#–O9–kIã5’9/Š\2m´#·ŽŸzáÄg<æ ?^/÷]ä¿›¯ù¹½™ïØFáñ0Ó+æ2ñåàùº¾ŸÕq˜?4·5µ?8g²u–ݲ]©ENúí±Ë=òušŸ|Š<“¯8EZð]µÏÃÁö©ú*úȳfÌ}ÏYÙºýðÝL—>Î×Ã1¶«ºlÇT}ÈÔ#_ëñ ûd’ÉÆ®}ÞþÎìóø•ç/g—Bƒðð8Ù­¶uLŒYºóp­»Å©cl8îÖÝ·áåXV]vªvÑv6¹O{¼6~¾}ùQ÷ñùvækýþ6v–Þàm;su«q·¼fc#öVì|ÍKëlÌJGÅù­˜:ö×:>¦öêeé`ßðàxçYï—¥~Û5ü”yøȱNÙéý)Æ:XbíÛ…~¥<Œ[ ¿ÖÙA¶ ¼7®áés¸-`Òÿ¨“ˬ“:ðÓuûFZÅž[«§{f[>üZcŒ×úûmr]ÙY¾3¶)vŒ/³ãÇÚË]÷{Å^[ãçèm¬ó8mÍöºOM½…k½d¦ƒ¤câªÈÊÿY'ázÞ0÷ζÒ:¬ý[Œ#jL¤õ~̽67«|ëuÅWÆ{æþÍöû1ÎkL}¦k}þxQ<®üëÙvìK‡P‚i~´°³tˆÝ˜­Ó¾'˜ª˜±¸¼["Ta`VþC½n)‚“žLm¯êðüÿàÑ éHv³àV«-s{Um¦hm|Þv9F{«”uè -¥Ðè~³Ó6g§Ü3Ç¡¶lýS# jσ*¨^ÅÁyæRg6ë/oÎúø*HÒŸÊŒ‡¬Ö°SUk©çêwUwÇÙÆÒi‚›YÞb%îHû%Üœ­Uû½pôò©V×~YùýùmÜÖò;Èo)oÎúª} é§uuú9Ïðif}7g}Õ= -Ôõ¯eô_A‰1Ôœ÷®ëskë¯VÕ°®xò­ßþ6O 2_ëö 'ÎmNñªÑ~<„5¹ÍK”-)Æé£oÇ¥Ytí±×Ø¿põm…ù{çvó3×ú\7’´B(ãŲ§,ŸCb&yÜÃtúùc EИÃÇ]Jeªá‚,Ãú]JsëeÛ„eª9Êä%Z±”€ô“ÔK™6†j¬üª&ê6Ä:PwÊÖÝoôôs è<Ñ=v?Ñ>³æ~ö½t°à_§JžÅ7«iöíΑ'*[ÄRÞeàhÜ'2n¡ôe'`¡Ÿ)"'_í£¦á¼qëøúª 5¿Ñª¼=Ê7¦×]©“?íx*/ã)({Fa éHÈå]?×ä'1{®_9_±ì£ù8r!·®ñB¨ÀF»œ ”¯J\!Õ­uóòe‡éÐSíM¹ŸêmaŠO_ÏJL ¯åN†[ré}ùfÍD¦ñõLa>ã& -q•Yˆ!jlgØoÜ%KêQDº%:Õ\'KLæŠõí07›ßEתeþŠõQ™Ó"^NÒl¸¦>­R=4š¯Ú-/Ë©ò)¡r£RE6ƒ`³Ó -©|Må†ø¹«¬QŒÙ®+«ù!ÍÄT .WÜ -érZÅÍܨY*6Tê·æªù.JwõšâWh£Žfª¤‰'u -e›lµƒ&s±@µµKÊoü ñr*yç†üt¢¸‚¦ž+U×ÓÄ ø6rrÝ_:5¦ª*†F+[íÊß)UP£–Ì3”½-Pè³ÞH‰ÍF^*IÓ¹e\Ó`ìX¥.ˆ±ù¬Ö—L8Vð%é6tÓØ‚ªT¦èãžìÊš[òX’¡y]#—VõÓr¥&º*„4×ÉÔ\ùiAîrR UqöÚƒrwj|;™[î|ÒäØ,^ÞvW;Ñë+Ÿ¯ÄËXØðš\\?ÕF:Ù»VízcŠØ“¤ÐÉ=>ä­-;AÎí°ÙZŽœ~:eÎò¹|͵¼ðhù:8ÿO0ßÈç?'<ÿ­n#ŸêxyÞܾo¹uAÖ•ÌûPM¸Kö>7b Eô¨Ò~'CêXªÞÐê¸÷*_c¿ÝõÄ^‘Ð2(´«šH]‡Šì›ëzJ3d/WZl™{mÓ ötj礙PÞT¥’Ý9MýZè%ù¬XÊYö’å ‚êF9ÑLåT5˜»d 1‹CêFšê‹ü¨MJ[êD #Êiè×°—YͺÒÆ^(‚ºaÁA7šò¬ýâðºÛî³È\# P[joÔ'Mm+Ô–ðÖ©a<ååi«9á\Njðv 5^AÅ^hƒœ}h‹í£Ššúm3€t£Xi‹Fk¡hé"´oÏPç«L<ßVÕ2ö8­j)¶1E§þ¤5MÚ*M‰¤­Â7Ø·V¼6Z -mDÚcïëÈ6–L+4Öw7*vd¨´Û¶qÙv­¶gÕ ì‚p™º~Ý _”ÿ^;«›Ì×P‹¥HmIÕ7•B >œsî$fÉ!åË•1©µ’gßc/žÜ.‘ÔÅÝ’˜C&íÁEÛáI.äý ŠÕü•÷Û²[íÒó°ù ¶õ¯„!ÌoWˆÚi,SEÊ ËÛ’y†è6žn§›e°ïÿ¶;dd -endstream -endobj -114 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 113 0 R -/Resources 4 0 R -/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -128 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -129 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 483.326107 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 323.270079 491.179134 308.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -151 0 obj -<< -/Filter /FlateDecode -/Length 3797 ->> -stream -xœí]K䶾÷¯è³Ó|Tñ>$ñÅA Y$0‚Ö]Á¬;‡üý%‘U”(jz¦× bÍbv[ŸJUdU}Ҥ^sÕôçSCE0*Æ<\o.?_´ -¨ég’h¦ÓßÒ¯üãƒUI#{õQùd“q×£I+)uQÀOûÇ°÷¡(‘ð_?¹ü$/ñ‰ ˆK&MA+³†}0U½Q°«ÍÛEÀFeY±À+©æŒ1EZ´M 7Ùg¯5`m«4[lÐ uÛžg%lXGµÇNêú¹i³Œ¯tlÝïq‹¡Ó 6`ã~»ã~ÆVªûsÆØ®ûíŽûmë~k\d°°(ÑÖý¦ï~†k×…=vR×Ï7bcrùçºýðË—ÏÞ¥¯?üëòþ“‰˜—jO>ôIºK;é?ƒ“Ž'ótôù'\·î cÓ—¦ç¾Ó›“'!OB>„}âÝ;[Ý£éIÇ“Ž¿y:Þ3]5&%ÖjAGÆó¢ç&áBO!dW™¹:e¦Ÿë/ï° - ’èH&ªà‚Ã8AP F=ñF™h¢¶#™ @ƒ¶0É1´ÞBÉ$!‚O™è•Ú'3Iö؇)úÐRVùÐR"ùÐÒÇ®—à÷2)6Z‡àó§i‡cÕ)]éySd<í³ys¥3ʼO,xÆEahðõ8cÁ²‘æ"+”qé¸&,@g†›ÁÆF]ÊóS‹[ÖÂÉq°©vmªÀ›ÁFàbœTKݶëàÖÂÙS}·í–Ánâ`Ú8,c€À›”Éåv‹6q°;q¸Sv3ê؈Ý8àN°Ã2 -\¦4[lÐ&f'FÆÁlÆ᩾¿_±Q"zóa‡ºûTl¼("qRô¤èIÑ E_¸yÒP´iyÓ{ßéÑIÑ“¢'E?EûT¼¢»GÝ“¢'EOŠ¾j¢+–´ƒ (ãŽwëš­”=\èÙn±ˆ‹òr\[¯cX­­A…€ùľŒ5 -S°ÞŒd‚òÀá@Æ9´ñ:d’ -èBµPE GmF -FãFm&ç%£µÙ;•ònΨ͔ëÚ€ÇQ›ƒWÚûhý@†ŠŠ1)oi d¢2È$PÖ:q_´V6 Z;’ñŠâêÓ Í`¬r!Å0h3P¾‚³mKe6‚5£6;­’Fmv^aŒèGm¦RêA7ˆ)o¯îÊ ¨pÀðZ…êrÀ˜ªì˜;¢Jܘ7ÐÆÜDuë€;åê˜;¨2ÜAªQö€;H5Êp©F¹î Õ(wÀ¤ÜAªQpÀª© -¸Cã Âî Õ(À¤å¸ƒžêêw0  -Ü¡´ \sc¨ç®L¢ºzÀLI¥îxªQú€;žj”9àŽ§e¸C©¬ìw<Õ({ÀO5ÊpÇSrÜñT£à€;žjô¸³Þ’“±%O<èïÉ7âØΦ¼IéÎZEàÍšÄçmÿÎvBƒonþÒ|PwæÈooÿ2.V>Š™³énÖ*|%îm -<±–j1Pùò›9²@›9²À›µŠÀ››·Õbƒ©ÛvÜàb6Ì÷€ÙS}·we°ed°å}`Æ›§æ¨ÔoÖ*«8Ø80ni°Y«k»q°;q°m–•ƒÀå]\¶(Ñ6f'FÆÁmo³§úþ~Ŧ¼è͇êîSQzQFâ¤èIÑ“¢Š¾pS¾¡hÓŸ¦÷¾Ó£“¢'EOŠ~$Šö©xÿDwº'EOŠž}ÕDW¬iC¨ûͦ|/zÏKæ]œõl7åÅEyAKíh×›gû2^+äçñvd‚¼З   gk½A .7Œ²½ýF»ÒÏÙ)uoe -¼©ŽQ‹»x"±|]5£Öl¤¹¨¹ÍUk˜ÀE½‹šŸ"–¨¸Ý(qe%`4ka‹`k}íc´a«À›ª)pQï„E‰rûšªÙ8²ÁÅÓÏl‘=Õ÷w[ed°eU’Á–5,‰‡é-{ܨ°©š«8Ø8X‡¸©š\7n'®ÃRÃ.RZX”h³×ÞË:R'}Åö€è͇êîSQâ2'EOŠžÝPô…Û E›þ4½÷=)zRô#Q´OÅû'º{Ô=)zRô¤è«&ºbI›ÐŠ2ÉAÜ{^0ïáBÏv{@\´ûš] N¹ƒWúbH -^é‹U8x¥/&bìÁk‘1EZÖ_‹LºÙfèËÊ¿ƒ×"“¡¨¼™¬;ô!>ôarxèÃæЇ B߇ë-üg¼ÙHßùZäÏS¿{s1~ù.*õ¹cà³Ô~2é4µù͇Ëg_~ýÍÿò5õäÍûËß>×Ú|O¿á‹¿_ß|uùò ièO³ú4?Þ­Îb¡W^'CÙ“Õÿá»ß÷ÍŸ§ÞR á1êWÞñ¨½MWësá»'½¼ý’Šíúü ûúï_®ˆB#ïßè×½\=ê\yÆêý+Ô{: >¾B}rÃÐfõoïUï¼2V;¤õcbAöýóý/³ß*ž‹pÐHÓ¡ýì/FîŽ÷ƒÊÚ0 -wšhúA -¨Á]£EšË÷ãîJÄýˆ1 ¹ð)OqŸa¢MÚ#7åo¶€2” ‡‚¬ßä.ÐøCvœ×ò/U É0Žùß÷ó1âÜšZζh€„|Gm²eò£¯¬ÑûYŒMÿÂlÔfÅtŒ~6†8Ëç0,ùsƒ-2téô‹n¾­qoß-¾Íºáí,;éÁùx²¥—ŽÖ?]ã[~9/l£]äÒ¬/Û)r×Ô6 ‹þE~²³ô¡8VßFÎÌ_ßÕ™]ÿácý(ü æÏS",z';þñþœú‡¹„.ýs«aè/·ö×Ýqèèh¶ ƒö6™Ù(v¶õKCÌ’@7á<»±Üt]‘-Lô#g8—WlûLÄÃ@(ÑÅY†VÌÄ(2Æ°“êµï¾°þóåúÛàÚA¶m²2ö³n:/e¬üyrxÍ–¡ÃQ:üEÙ××(©MìÍ~ÏSú´×Egd}®¸TœiøyheÍoAߧþÁ>]µu¥/òÙRTªíÿŽcR¶ïÃðøQ"çßkëLW߯^{F¾Þ°j|ûüõÈcÞ”íÇ8þJ1þŸ­GC¿ùµß<—ïÇ#ý -ñø¿­e4¾î±o_æWXæU¸\7õÚ¶ÛUÃm©9~Ëg»Êí©Ÿe¶æšµñmd–˜'œåZíØ×rÒú˜YóÑ.ƒ_M@W”I3é”ÕÌx]è‡ÎúGOÏ(9BžþfÒ¢#M‡vª×Ôà;"¿®j÷8½p@\ÚúÌ™ÑÏÈ)3õÃsö8ÍA™ì.käqÆíçG—iïû¹A¹ÔL¿u¡?ŠfŒQLýö£ùÊõQå¿ »1&oˆèB‰^‰Ž[:÷ž£Üãø„/mÙðóaõ1ß1YÍõÖ~zÐZäEþ( ê´ÍÆõ¼NŽ1 Û¸®£r‘.³ÜÜ—éËv]Ù HÎÍï™ûü mºº BÊïœO·–.?=G$Ç'¤üµùîQ&PþÆÕä#îÜ>Z¬ç»of°e˜w¶— |û6‡]ÒBWÛws¨K¡³ä6W†$Ša™–”£âÎïEæsïxú1í›”½Ÿ OÆí²d¯EgùÜ›bØeú1¥Š(¦U?rØäng-nIN­6›»?_0RÙ"Š–Ñù}mÓw ب„_1(j¶ÄÍLž6×K§ÿæç*µü‡1ùÛ3LŠpÿ7q°ÈÏ;Í.†¦†9ùËŒÂùÁd ×ð…=ßaÛÂåaïC8ƒËG]uA}X¼b·‹qùi„•¤ÃrÏÓ¤ªœÀåc -øz,—¹¹,Ùr”I0î€t¥7[8÷>?¼2ÃŒÊ-G¾6}i3¬¤,+ä aã´q jaŽaâd*²¶~L5æÖ¦K×þ"kƒç¼]Ȭ[£O]4™GQU¼kuÅœhTª(ɨqê@ùI ø©.ª‚YÏ‹¨Y0–D‚*—Š\º]ºr‹6¬‘ -U*ò¥©xž›Â©îbu|›|´ T&žÄ¡Ñ®|laŸ#Pb=ÝcCÀÔeðvÉug?]0t¤‘kÍéÓtBo…£æ|a4Äâ*¢fÁò½ùü÷\*°¢¹òLò—Š›¢@±‘ÌÍ -·N’¸¯Uz0XV¸Ë„PsVúËDÝ‘ÏE·JW5¨p™Àó+QUµ¯Å£…Mͺ -çVüSk¥ui™ck*?50·+U)Ù‹1oDºcÕË°¯µóI¡FÜx¨àqÀ‹œ/àmØ` çÔÅÃV×ÑŽ FEa.£O\ØZ«“I©~d’õFÜÛåÇË4ÌY‡6å'Iåtû˜š¹þ›d¾¢ß^àú§ò|Ï<Ž[]«…­µµåHf­+!<„óS5¬´ Qö6‘e±dCÇ­õørÍ…½HšZAM=+Ad -ØÖﵮ Ï༭¼X'2¯ Øó¡+#3Î\kBåÙ:Œ|Îñ|*é(‹ònòHŠ é@*¥Ca0qËšfæ„”FªësûA†Âe[â@L#ò¡ãsÀìT]°©BŒ¸L£Œ4ššötýbz½:îK“}a@Fki¯è“DkÇ2Z ^uÓ¡oë˜ã®ù —=Tu9Á=W'9L žZ@s sT ‘/[P…‚5FË@QË…«_,…¬1”6ùå²â–©Ç±ë¥PçŒþ(=2*Õ‰(£â7²YoñêlÉÕ ÊtÜ;Í’u.;˜—WWXÒlkZÛe´½Šn7ÄóÌTóe¸‘|Qý{ wºÏ'õ¤š­ë–†¦LpÖ]SžîD渚PGhÕ Qì•Ü}Íxód»ER6O¤%“_pNCù¶Ó„§K˜Ç°ñ ¡jy®|粤»]ºÏ»÷Ÿ&sÊ-ÛO;Dõ0ä¥"¦ùý˜Ÿ1AïìÙ¦Í6Ø·ÿÏ®·£ -endstream -endobj -152 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 151 0 R -/Resources 4 0 R -/Annots [ 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.309749 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 734.270079 491.179134 719.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 660.470079 504.679134 627.770079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.237972 652.520079 496.429134 637.520079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 609.770079 498.679134 586.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 589.370079 491.179134 574.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -163 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 570.170079 498.679134 546.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -164 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 564.770079 491.179134 549.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -165 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.570079 498.679134 507.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 525.170079 491.179134 510.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 490.970079 498.679134 467.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 470.570079 491.179134 455.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.370079 498.679134 427.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 430.970079 491.179134 415.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 411.770079 498.679134 388.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 406.370079 491.179134 391.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.170079 498.679134 348.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 351.770079 491.179134 336.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 332.570079 504.679134 299.870079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.986019 324.620079 496.429134 309.620079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 281.870079 498.679134 258.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 261.470079 491.179134 246.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 242.270079 504.679134 209.570079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.506282 234.320079 496.429134 219.320079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 191.570079 498.679134 168.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 186.170079 491.179134 171.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 151.970079 498.679134 128.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 146.570079 491.179134 131.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -185 0 obj -<< -/Filter /FlateDecode -/Length 3770 ->> -stream -xœí\Ë®ÇÝó+¸6àq?ªú^$ñÆA AW´d#¸2 g‘ßÏé™éî²Y¼Þk%¦JœšÓ]§ëÑâvoð÷s‹Ù)¥ívwfŠlðgFl.æÛßã%ÿ†è¦l˜­Û‡4…ì²õû;kÐ+:õIˆï!U}‡k'Rü÷Ïv¿È&!w¢I£§h&{,ѶîíD§Â¦ó°bkâäzÇBž{'Mµ¶¢7!=È¡y± -À±Ü×Ð]ãFeßndY)¶½¦¯ihç gé_iþ´5à#±ÜÎt"ܘß1—[3jæ_ÕYë†æwgÌï¶æ·t,,4JéÖüvlþ.nCúº‘†v> ³/ö§o~ýi÷ÅÌþ§ïÞ6'æÆJm$ÆIz6í¤ý¤néxKÇß}:†ò'îOß<"7cÙŒ< FsKÈ[BÞò* 9N¼ÇîVÏ¥é-oéø»OÇÇlW­­râðØåÖ1r›.ÉE?5!‡Ù=”±ÙÿúnƒA.qÒ1ir1Åâ±³&`lP1ÁLrk5 8s$k ¢Í±ñ:œÉ;“Lg¬ŠÉàì²1IÀ³2žÇ8dºƒ!u 8›MP0œ *ÆaÚËž k˜0ÙHÅx7Ù˜½! “€F%~!£[ÃàÌÉ%~ƒ3›¬b8“OF‰1‡FnD£Ä‹àìrP1 œ£¬ÄKàlÙ«˜ Î&¹¬ÄncmV⎚L&£bÊd™îi˜0™˜“Šq³?Þ¥ÉY‰ïÁ™«g¶”•øñÎD^Å08ûskpöÆf%~|gçŠÁ‚b,ç¬ÄàlRR1 œ f3%~|Šš)¨˜ì§œ"'%ƤÀJJü`˜rô^Å`—”C@èkpælUŒgƬ¨ÄÖl,Ü”“?äÁÙǤbœ½‰I‰"pÆ‚¡bœ1Ù%%ƈÁ‰š”ø¡Î2Ëö…1 i¼Mɪ˜äÁ†I‰JyJÑç¨ÄežRIÃpÙrqŽQ‰ÆÖ-± *Æ‚31G%~Ø‚³O¤b8{ë£cìÁÙ– ƒ·6ZCàl‰Jü0³qYÅ0O˜xSTbŒƒñ1*ñÃ؉ÇdƒŠÁ~9Fâ¨ÄÇ<ÅIÅ$pÆ%Æ0L‘=–g ά†š ¡j‚?g¶è±sÓ0œ!¤ŒgcPâ'8pÆ BÅxp6žƒ?Á—“_ ̺ñûrD\B\2Î0dæ·Žö¯Îcøò‘˜^ô X‡5†.ßTN²£¢ßF~ReÀÄèFçÜ.ßÖº\ JC3æ~f”ˆù˜~ZjˆX [/McœÉŸu…tsÖòM©AÈe• kÜHìÛ ¼‘ÇÞK/6tKí½-7Hgoü@[?Ô‚C—oB&L|Rr8òƒ;ã'ýNj±,#?Ä3~ˆ[?¬5!ß” šÆtã{ÆBÞF/«ÝRc{?ãc21šgR÷|*n¬(kœ)b•åì4Î\Á0DgÎSÀÄ5ÎX°CÌl4ÎØÄHÆkœ#8‡ÄAãœÀéž4Î œѪqÎàÌÎ’’_Ö`á z]~ k²6+³V`Ðö2-ÞK†2/”« õÏÇ*è¸ö,VDQ{v9 –!<]œÇð³µçƒ[x³ƒ–¯{„}ðØxÄì‘÷™ Èk÷o>ì¾øúÛïþü·o1–7ïwÿø'¼<^ù«îß|³ûú 4(:ò¢"Ϭ+•û½aÂjh‘øEÅŸ~øãßýõº*r™^XEr“{YÞO_Vq÷ ©,¬/ª‚È<ÈÝÏQ%é!î~ûtØÀ=È݇g¨À¢ùw?CEÀ¾å!î~  -9ƒP9º o³Ç¢5Ñ…)d~=}1^N¾gªHîrò=WE¼œ|åÅOW‘íåä{®Št9ùÊ+lT\Š§ò +ÕÍ’º"E¼ì¢Ã vý1ìðbcè^iy?ß³Ë=Š‹¼È\Xñ¸G¯^¥µ¦/Ãq‘WÜÜ®b߯:Öña{½Œ[©ò@Öº1ಠÁ™ËŒ$!ãÒ¢ƒ ´ŸI½í7²S PÚÑÚ®‘­øÐ Äu@¡¶·þî]o3ã½À›Õ(aíG¨\Ïúéˆs8Ò—6f^)W;Ô{®;®üלšTCGièbÛªæ×ëuœÍ±¹s4°Ÿ£ÕÞ+¿y¬5Ò@æ ñ‰6<Í¥FZŒUq×ËÌdΞzÙ\µúÔ²N[IgXiWm/K²¶sõgÔì®ÚËÛËUßÜ>_¹üå+¡ß›ï¯3Â}ÇgOÄÕwáʾ;³›j÷Ê,n+å3óA®²óûã*J]ÙÒ†ªíâ±í®ã“òÊ™ÓiõI¼®Oj»yŽX}ÑN™ï—Xœebw°±ë•æ©ºz_ÉŽáì ±Ú1]ÙŽrG´Ú³íâìb£í®Á´Õ}³{sֱ笧⪭]·Õóæ4Õžéä4ø¾\?²«Ÿ F&žBùI•¼÷±|ÍÖÅ0?ç²ûå!2–X$›Ÿd)›7±Í!ñ™'YVíåQ«|lˆ.×'f•íLô<ÜÃx^ö-®†[X -ý¾š? -OÜ]F릯™­Ü{×C¯üïƒØåEîÖ)¯¹i}? -·†J ·tÔݸ ->uSÚÆPÓêô1”;NØòR¾ÔmöòÄñåÒgùžãv!¹ê7;[ÚîÏ4 öcC­?k&ö¶üôÀòÛ±âbÅ/Ÿ6ØÙLSq@ydÒN¼¼ƒÊøX|·çúÍÛ˜æŸ~y¸×·¦õE¶›ì°³¾<1~„œŸÏYÞæÖ9„ëÛò,Xoϵ™_RØÕ«’‹â-ƒ=—Ñ—/,b8›¿^…F…Cå aï$¶wØ^c&B>¡®‹‘“¹b]{››Ï½ëÔ¥é¬pÅ–ZÓƒ„‡ÔúcéýPêl“¹j]gšÌ R¹I¹"›C¨ùi *OëŸ?7µëòØq»/¼†#á*L5¨árÅ D‡Ý·öÆÍS±¡Roš«å;•ê>5Ãd³V)¦‰{qi¯o·âPÞÏâš­mv²9··=ÉF+îa÷ón^æœg—Ë·ýÊ/¿l¿Jd÷ÿæ¼þµ£ý_ê£ÆË:îL›-\›[7b¹’9ç« /ŠËƒ½UØÒF‰i¿‹mêX®ÑÐÖqçÄ|M½¹é{EÚ6ƒÚvW -¹ÛPˆ] ]g½° +ÂÑÛFæ¹¾é öréëà Æ—‡Ö++\Èáà2õ{¾/É{Ñ%® -´/é¸KN4Ä…ì—BaîÌ64K@J%Íô…?IWø¢K\ˆmD¹ôýõeVv]eó(„¬hLvÓ1Y©4oø H?9½ží÷•r¨P¤mjoÒ{)m+Ò6á¥~¾ Û˶æø}¹¨ÉÛ-Ôúò"÷|ÛäôÔè[ Ú\ÈÒÔ›­–J©Ê6JëBѦ ÈL•µcåÖfÕ,óˆÓÐJ±í)ºôgii–^iFdé•p‚-ýÖ¯í–|Û± çØGg:²í%Ó@dë&¥ŽôUvª›¶ºëj»àN$ô©éÍøù¤ùï)¹3|Fy„Ú”Flj% ƒ…šlôÎïËv™æ*?w)‰ZÉ£ÛèÅ“ÓI-žHMpíÞD‹x;Cá7ò墫õ›¿gše3Òã pö[Nã'Êýä×/DÏ¢vËQ‘s*ß03 Ižm4g>ïº;)ƒ}ÿ_Ëg¥ -endstream -endobj -186 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 185 0 R -/Resources 4 0 R -/Annots [ 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.434505 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -193 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -194 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 640.070079 491.179134 625.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 600.470079 491.179134 585.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-automated) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 581.270079 498.679134 557.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 560.870079 491.179134 545.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 541.670079 498.679134 518.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 521.270079 491.179134 506.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 502.070079 498.679134 478.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 481.670079 491.179134 466.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 462.470079 498.679134 439.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 442.070079 491.179134 427.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -205 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 484.911067 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 232.970079 491.179134 217.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 213.770079 498.679134 190.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 193.370079 491.179134 178.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.170079 498.679134 150.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 168.770079 491.179134 153.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 114.170079 491.179134 99.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -221 0 obj -<< -/Filter /FlateDecode -/Length 4007 ->> -stream -xœí\K$· ¾÷¯èsËEê{H⋃6²H`9¬;»6‚Yvùû¡ªõ`U©Ø³Ó³ð¥g1;U,J¤ø‘¥z¸³å_8þ/¡3)åð|ùxúõdM$Ë? Çêd¹ü=ÿÊÎESZûtÆ fÈΟ?JzH&\ÉOLN7È¢—§Ó?þpúeÞ•;{c'çßÞK–ˆ&ºœ“;fI<,Œ³ÂLŒè\8fÉ`’eÅQaáQA‚cgÑ$"ïeœ³ ø5ž`²ÍH¤ð˜ì¦$“ƒ§l&g()<ìVÖÅš>EŒYÓ_ˆ.OGÙØœ2hú2(gQay6(òŒcܽ¦OòlñB'ðAÃ4“à¼Wôë ¤„VÁ”u1Þ»¼Âã¼auÈ+ú€ËƇ¬‚)ŸCˆ -¦àAð5}|4H6YS@o0ÆL³!uÔô!2äÙ’ -¦Œƒ!ŽŠ¨`Ê`bOEMŸè C -NÃ4fѤašÈ+kIŒ%§KD§aš£‰¬MR0õÖsÂä,¥èãmæŒILÙ9eBH -¦lΙ9jyÌRàŒ¨ðxÏ9Ó§¬`ê}6ÙÙ¬å1Ä9³h­ðãœIœ}5žÈ9\Ðl/dS-çÌÀÒxçLÏ™^áI`œµè5}RâœY*…'#çLd4ŽyÐZΙŽg'pÎLÑ*˜¢Ι£‚)r%’×ôäœYf0…Ç[Ι!GSôs&ZÔôA0>ò ®`Š˜8g&žZBΙ¨é,çLή -¦‚)3nÚbZK­IyF,ÚZN³¸ ™ìR®»•Ü4羑¿ýtúò—çŸþ{úð‡¥œ ‘ËKÄj#g,ÛKHžÚšÖƒÎÅ"»J§‡Açt8úôëÈd#BV@tÆqævôÀBçæ3¡vÁ—“ äQíJºw£—.‘8yUn¡Ÿ ^äx½ùdKww—(©C¿Ò7L ¼¢ûÑK—(,5·÷eƒ;ÀÁ­q´¥¯\f)\vÔp€Ã {0ˆ‡*‘CcŠà€k¸¾ÝÐ…K ‰’ºÆÁàà$;U¢°ÔÜÞ^æe_~Îû=DÅh>„îq(J+J$!úÑGˆîB4”ŸxÞ|Bˆ®Æ³}˜Œè¢}„èg -Ñy(~z¡{º}„è#Dï*tå-êȯngÍo\ÑE?û¢Ñ²G9oÖÖÐĘ©mONyËBßf˜ó“ ¢ -Oâ >û¶Å;çÉËVºÕt.[×ÌdCÙºÎÙfEçP¶®…¬è\ÙÈŠÎÁeöNYÑ9™€„YÓ™“Jô`“¦³çC—BÒtF_¢ ’¦3f“³KmxÊCe«/aÛΙò0.³i<ɹжҧ<÷ Ú–Ø”'Yƒ€)j:§`Ø™ûíˆ)§RÊÉMç̱“gÛcžhKì8ŠÎ±Ü^£˜‚¢s,·×1(:G(±Ã3›¢sä´Ç§ ›Âã9v,i:c‰›HÓ9vbDT|5rr€_TbÇrh(F/$ -KÍí}Yã@8ЇZõ -úÊe¢‰»:{ƒà‡´«³³ËSòyC­z]¸´¸¢®pp8ˆÀ装¥æö¾cCYŒæãAè‡âÊŠ‰Gˆ>Bô¢»}á†ò*DWš¯F&#z„è#D!ú™BtŠŸ^è…î#D!úÑ» -ÝÕ£ÞÀ‹Z€²Ù²ÚQÎèÅðÇšùˆ.;Úo)‹VîÌ0±âi»¼Î˜ÊÖ".[yG<¼LOÙÚe åˆ'XS¢å©êCž`BŠŽ¢ÂË–E—4ždq_žÀ=âIh|‚´ä ÆEþŽyœå ¶1(†f&öþmR,Í^é ûØu‡í˜©ÜùuréoOùú -J>϶v3—åx·Ùžß~<}ùçþôÃwã¼ýpúçWÖ2f×ßøæ_ç·ßœ¾~Ë>UDà ð é™ÓúçQž4ÇÏ+‡É3Dä;DDÿ,¸ï@Ï‚ûÇ;Dp^zÜÏáB}7+,7’¨ÜŒsgâX„rä!_ûÝ_þþíFñ¯ù8(ß¾;E”»g·Ð¸WDº|wŠˆþvðÝ)"¹ÛÁw¯ˆp;øŠzÛ&ã‚÷Üs¶å ”Ûn^>ŽÌãxkó1@Ïúhy»Î}å…‹ÎÎûü몌ò—+&[nô$k‰Ï)ðo9æ똮׈Ûàü‹×ã­òpÓå—üµ-Aåáë®Çå:¾á«+}ás•çC½ÞÚä*¯^+í‹nEÖB/ú½«ºÚÚŸúáeð—¿Ëu¡{ѯS•S§Ÿ¹]Ë[ðŖ–ÇUÇÖç¢ Š±™µ_äµÖªßFï^£ª£Äb±ý¥âëuºÚ~±]¨mëX oÇ, ÙKîwÇ*lmúJXåòÈ…ŠÕ¯‹U¡-ºÖZâ‡LÊõ,bŠ*>qô÷É8¸Ã3\Š=}³Ÿ«˜àÕ't¯åP·áå•m˜„}ÜÈE„Õß?ƒ¯:_ipí³õ¿üý°Öi±Yá}Wõ¿´˜Rí¶vÄ{­Æç79Ú ±°ðOì¶Ðƒè+î±yXóåq+ÝOpØùÕrc¬óM¹­ÅÕâ7ο{?0ìvuuLJ_ÒÖ”×öØÍE–â£;_Vódy{umã­O/ý¼Ð^ÉÊrÿ¶à+û¬a¶8m|/§°æ}q^¹‘{ežiuRó³xÇ­-_£ò6ì¦ÖµEgŸß5àâ;ùêóÏÅÉàï߸CË|D#¿6ûy‰˜3ᙘþ~5 ÂÖƯ„å[5MÁ.¼N|ݧϙ®útó‰IÍÚ훆[{¬ë„[¿­ž•.êÞ¥í»:®šïÆœ¬Ú1ní¸øÔEôÑü+¼0?Ž5«s`°>zvc«% [à]ƒLPbÛI+HˆXÏCUz5iFbNuu*”•Jßëu‹²†§ô M5£ãuð‹õë -ÆŠYn5ËÈžyªðÆfÐ^ÙmuoZ[é^ £fH0Éä/«Èƒß­@·8´Ì-ì³ümçÿ^gÇæ-J»½dæk6 -¢‚¹cä7>DAŠõñrE¿[…mm_s‰õvV¥–¹_ÅbÞ­¶ãkÉìs‹¶Cµší’'ªÉs[½Ï+ÂÖGÛ‰‘+É£<äœf¯ä¶özê¢<”mu^¸yÏ$µ´oœ‡¯ªÓɲb¶}%J‹Yi²ð¬ä߶>7AÓd’nØ0+åoË´„¸µí6³€ˆT‰Jä.Õk.›6R—6pm ™ŠÏ(D±úìÔ¾-¶e@Cä2ߘ»E}›*ŠAÞ­=¡»bó±a:+o¡Yo´{‘Øz„åC[¹¼Öࣉ庰ÜP?ýò–@ÌÞÄåžyq0ä2O©7Í«ôòp‚Sn²,¯¥Öý¿âvÑÓÔ×–òôý5´Y.W[Ì'™£UÎö½èž©Êµ÷¶¯íWþúá -c¡ -¸E0ÎÖvP×}Û=ÖÞ? ØúÞx…·¡ßÙÝJúõD‰C“Y-gˇ”<.A„dâB?S4¬]HÐps‹¥Ýù éò-Ì_;Wý<¦5åCŽ Ï×ogŠ“ʽ¯õñt}D ü°Gº1™…Ñ–üÄ°gƒ2OðLr!ÖCÛû*ïmh—“óåq­ §/Ï|\sïÜ÷—qÊC'£=µfþšw • ¸ -ž¹ep{r}yºïJf(_ÏBW…BÓ™‰£C”¼£ÃÑð&Ùy+ˆ´'Z!n9&sã…~˜;æLìªKÓ9ã…(àÔˆ—‹õ[êÓ” -®Ó Yl§y¡TîTjœì8MHåQ¹ñ Ûº.;õë5hß +÷5êQçËoBºœ¦|µ7êHÅΕFÓÜ,?T®^^–;¦-6ªTNOâÔYß×äPhX—÷+#tñr*ygG~:QœpÓÈ–šëI¢ývr²Ã_5¦f*ÍF ç€åÿkª N-™g9(7`]ë@ž !%6;ym$I=ëàÌåû±nGå¾cì>+íť̈́¿$ÝÎÝ-¶¢ -“ zÌM½’¤zòX“]÷ºN.)¬Ù§çJI´M 7ÈÔ]ùiEzRUvö&,8áîÔûäÐsç“$ÇŽ¸+ßèúö~…Ï7âe™ØpK.®ŸšAÛg»!L‡bœy¤Ñ§…Ü¢µg'—s?A6›q/§ŸOË4ž —Gí=ûôú9^wþó|ÿÿ9áù¯í©Æë<¶g è¹uE–3€oÞ$äNìa#ˆ€"í²Kƒ—š7ôy@äkÍíHìÓõ êúUI¤aCA†îºå{ÂÃ2¤/+öBæ^lÆ„}=õmp¶|øܪœÈáði×ü˜’Ï¢K>+¬cJç«¢!ŸÈNùTÌC³•šÅ!¥nú¢?J(|‘%NDQNý¸†cš•]7Ú2 -Á‚N4F·êšWúL”~qxÝ{U9´(ÔžÚ;õIRûÀ -µ'¼9Õ/§a}Úç¿|¼ºï°PïË‹Øó½È¡1J \HÔ4šU’B±ÑVBÛDÑÓÓl£õcÓ)ÔfÍ,ˈÓÔJ±×ƒú³´4ITºI¢v¼¥ß6ãõjÉ÷ˆ¤;Ç1:;8{-™&´ [w*Nßh{Ù¸–ÝfÛ³E¨LíhF;Îå¿—ÄÎôiÈ×jkÄ¥¾¥aË'…]ôàϹ”;å;Dg_>eM“Ø+ùä6úæÉ~‹¤mžHI /Ú½Žýí@…'¾o_]Õ×nše;Ò§àð…Šù³«Þøú6Ò²CÔOcY*RNåË,6•÷Ú\´û’?î¶Á¾ÿ?„Ø/ -endstream -endobj -222 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 221 0 R -/Resources 4 0 R -/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 705.770079 491.179134 690.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-automated) ->> -endobj -231 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -232 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-automated) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.154476 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -244 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 377.870079 491.179134 362.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -245 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 338.270079 491.179134 323.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 185.270079 504.679134 152.570079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.622493 177.320079 496.429134 162.320079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-manual) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 129.170079 491.179134 114.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-manual) ->> -endobj -257 0 obj -<< -/Filter /FlateDecode -/Length 3771 ->> -stream -xœí]K$· ¾÷¯è³ËEê{H⋃6²H`9Ìvvm³Ö9ä҃ªV©zfv,Üc÷vÕ×,‘â'’’º¦Æœ5ÿ÷¥áBôÏ—÷§'­ E¥cˆ0³Ç‘2@1N5Þ(֧݄Rî’2̻٬FáL&*°nÆi$ÎX;±´Qê §l‹²†xÈOdŒUlÙ‰=`¢².:=နÎù §`B°göX¯tÐN­Bp -q¨ãÌ"E–=9á”yPÄQá'œ2™Šx¤âÌoS -fÆ©Ê1£aÆi •¼t }èÀúÐqª9ò¡³qìÃí‹ _채t4Øbé¤i(}Ë‹ãуÊ#ð®Â8.’C‡o+sÔ”t‘h¬Õ‹š‘.¼®GBqWyü’´¯+×ÔZ©ýbì6ã ´Ëxï*ÀEÍ;dÛ0tp‡ûÖJÕ(<5ö÷¥çwxÀž‡\Þ §èªòlx€@òà®*×~ȃßáÁ÷<ä: p1¤…Æíx0;<¼ö^hžûû[,¢7ïwBw?;/ -&î!zÑ{ˆ^…è3·Xºí,ïzï=º‡è=Dï!ú‰BtŠOŸèî…î=Dï!zÑMtå]–醠¢âζu×m¥ìá¢ë-qÑî’ÝÛÀÌ·<¢²ÛžtºKlº=àÉ)°ÅÂÿð²~¾Åâ[,ޓƒ-¶E¹ƒ-ü±Ó@> Zú0ð(;òa00öáv‹EÃK'ýü-–î]Tw& 4\$‡ßVžÀCOà]帨õ  Å]å ^~—/ñÐZiƒ®õHØ×Ð.ã ¼«<5ChìP'Û†¡ƒ;\·VšÆ橱¿{»%Ù¾ç!×wC&*Uy6<À yW•'3äÁìð`zr¸ÒMc‡v<˜D`ÔÞKÍSc¿`‹EôæýNèÄýäF³{ˆÞCô¢ÏÝbéBTZÆ_‘÷¿‡è=Dï!ú)BtŠOŸèî…î=Dï!zÑMt寠Z'¾îxÛºë¶RvñÖÎõ‹¸(-Ç1çŽþwayÉ.îÙ‘ *¶¥ÿXê^ϾŒå‘?ҵ݆‹íkŒ¶:iJïn||ô‡×§¸þ"v<;ö¯mÉñˆÜ6û ϯߟ¾úÓüñû¿rG^¿;ýãk­ ò‹øå^ýóüúÛÓ7¯YÁSU8’ŸV¤»rnPá_ ‚ƒ?­ -«9qÞ "¼@…·7Ñý˜bæ«àüx Ý7ª0.?¡À±f|ôu‹múEݤä›ï¾ÿóß¾(‰ÏïùÛ‚ï*Ý|7ªØº*DÖ5»êÍóûá¹ß/PRÆýx*6®J¿^Næ\º}øØU—ç÷#"Ý”©zã>@îœù2®G¹4)Œ·øe²Žü®íò¿Æ‹f'ä÷rþ/~« y>~ÓΑmE/dÝúZŽamk¹Ž1æk\ûli…^n—hmc¹î¡µ»è-rÍžÔÖr\dpmc×æ7Y²#Wƒ±Ó£6š#“ïÈfû`íÇb¯köÛ>ë5Ù-äŠÏ\³G³=äBëÏr fÛÃêc}™ÚÊ“ÌÐÙzųû=óÜø±éÝM}鶾ü¹ŒéÜ)—þ÷ÌåÌw`¶¾«6úÕ¶¥¤ëíÿ#NyA=ç6|Üf½Uç»õµ´ó°ÆØâã$×÷E&¬ã ½CöõâãÒFñeµwêK·õåÇáȦÇèÌ9Š¿-G¥æ,/ÿtÞ’_lñƒYýS|~à‹´žûâáó¯[¬YÇ¢M8·k)¡Wh¹¯ö¡é\|Wl&1¦sû4÷£ßúñùœ¤Ç£Ôú7Ÿ'E'ʽÑïËyøc)ÕÝËgæ×gøo‘¶¥|]ôá´ö¢ßúï&.Ú:̘´Sº´u´º/Ä”IíA‘·Å±¹ãèv:nÚà—“ÃtÐP¸mµåò;æÆCöˆËÕj4ûÁ–í·£©—¿ˆT*ki¯è°ù•³8ë#:ðù‘çìîêÅén•úT¿ÉÙIíçÁl¯ˆÒVì«Å‹Ú’åŒ}x{kd9ÚúçÉ3a”m Êr#;hIK$!—–%ŠPש^uö’ÆfõdÅÔk?š|Mu¾ÖÜYrc ÛuÈAgJdʦÊüµæ[h#£êº¹Má[Žß´Q»øÁ[&~­Ù­Dõïæ¬4ŒŽ£½ÀÒé’’·‘D-²7N:ú6HðÝŒ N,Œö£(ljRU–GüÃuŽ…2ÛÙx¹D`¦y]®¤÷"rÔö(ŸRÚÅyxeéë<*H·h¹øxÆ5u"ºÍêr;kdˆ(¤ÛG]ÞÙ-ÈžØÂô(Ï1ò’AùHàÝòeåé—[DR?|´Ê/ßG¦Á ŠLtv¾ÌÚÓíÞf²C¾<ø"o`¤ðð–†1±,žÞ®±P†Ô²éæZ[6¸Å"H —¼!TK™(­)$º*ônMö 9i íx”H!k™Œºöi3lßl’|”Wß|8QàÂ"Ì–ÑéQ—Ç,CP~ÁÏä[çÞÌâisÞ¹tyÚö‡*•À­UzTtÀóútnq’å×/%ÞŸLL_¿¦ŠÖ#†YmáG¦=*Àˆå»íC8ùP׶°~7^±ËÉØtoÆFÒR¹ÉÞÄÚ8ƒù¨ô&]Oå2»†/”³«âÈW:s §Þ§[yV˜I  l>sÕrÅf[ƒ(e[ƒíÂCØX-@ºµP×`ŽÉXd¡Æʹ…fºtôYð‚Îx9±Z»E‡(˜ŠAñ.èŠYaT¬(ÉJVžPº/æ -üR—¦‘ɬŸ Ö <•4mÌæ£*‹Üºœ†r¹5ªLù*Ú¥±x¾™Ò†º ÕñlñQF9M<ŠS£m9ìátFåZ1nà -¼œRÞ¹‚OäÒÔr…¦2ô$hE»º—†úP\Å¡Y0wv˜þ]SU4ežå }óeJò¬)I±YáÞIw5ëàÈé õæ -å¶Ó£tþâéÕ@>%Ý*]=Ö¡Âe_îE(M»š‹&ù,‰¶’Ο"ˆ ùD6ʧBal–uf¦)•T×'ûQRa“.q"¦éԶϰ•YÙtÁ–^4âb4]Ãh¤ÒØÙ30úÙáõb޳ɮD@Bkj¯è£DkÇZ޵˩ëOkͱ˟Ç(ÁÛ> -endobj -259 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -260 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -261 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -262 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -263 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -264 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -265 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -266 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -267 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-manual) ->> -endobj -268 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 626.570079 491.179134 611.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-manual) ->> -endobj -269 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -270 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -271 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -272 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -273 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -274 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -275 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -276 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.070980 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -277 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) ->> -endobj -278 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 417.470079 491.179134 402.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-manual) ->> -endobj -279 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -280 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -281 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -282 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.118587 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -283 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -284 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -285 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -286 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 247.970079 491.179134 232.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -287 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 213.770079 504.679134 181.070079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -288 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.131038 205.820079 496.429134 190.820079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -289 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 163.070079 498.679134 139.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -290 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 142.670079 491.179134 127.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -291 0 obj -<< -/Filter /FlateDecode -/Length 2237 ->> -stream -xœíZK7¾×¯¨s€("õ ’Í%‹ d rðÆ íœ=ìß_J%R¬®êjœ26Ú]úŠ")¾D© ³¥¿Ÿý“=˜œKŠ~^ÞMï'kR°ô§Qlíõ÷ôÑcBSl€sÌ&,àæwXâJL]Vð…àÈprŽ11 ÿôÙô=%–!@M0qJÖÀ5{0~ŠÌeR0Ødp0VxLD0µÒM¡‹^ŠÂ«U<)pƒE¡7hÒ¼ñȲ†ÁCä #Úy£³ö¯6Þš?†+X…½.~nÌ7Ì?p°Æz1€‡æÇæÇ­ùÁ_ã*‚•DnÍÇæ°,]ÉF:´óBÙX\ý3ïþømúâ ;ÿößéíg-17V’•¼;NÒ›i§í§}ð’Ž/éø·OÇXÿ¤yÿðŒtܬe³òx°š—„|IÈ—„üSò8ñžÛ­ÞJÓ—t|IÇ¿}:>§]HÌÄa GNǃ‹jåïáŠ'ä!3˜±¶ôóOÆ”g4Ù8ôî„&xãèìâ M´ÆÅB>£‰Æå áLŠ6o”3}R6#útB“½ñ>`9Ó§Xã£wÏh¢ñÙ¹boÓ ez°è݉>h³ HÖ'4àMð6¸}­ ¡„|¦FRŽ˜OhéLéLGé”ÿ'1†ž -š )øC­>Ù>!š˜\Ž'1F.—œ½M“Mºó˜¼Iwbóz_tó˜£IwbžrÔ¤;1…rþNÌ;ª\ùNÌÓ’L¾ó¨Ø݉y‡´sÅ|/BG•+P°6åD²3mb¶]µ]å’&ÇäëõÜA}ðêˇ b¿þ‹st‰Ê'‡Ì…ŒUœ˜ÞM_|ýíwÿüñ[ZËÃÛé—WÖ‚§‰÷ú×ùá›éë’p"£¬" -Iˆк‰âÕ ÃTÿøù«Ÿ¿ûáÏH­Ç_,‚2 -ÿZª§Ÿ+➯k·àרºãëLJuxCæ¬Eúö„èß”ãžtðo×÷Ž>×±_èûw¥«ŽÔݬzPyêOx—L&ú„`ªiß¾+»yU$¤õ¹¾kŠÑ¸Þ[W%šÒõ;®t¬|›Sñ¢æ†u!›:mÐ ´m\yv±‘ê{Ö¯Éež¡Gñ ýYt}sj°¤ VmÔæø¾^–Çv¸’eׯF«lqär&—Rk åî|ºoº šyØ¡­µÚóq؃1M×¹éζ³ëšÚûn[j Ü›§tì¿EÙ5ÿ°œÊ«Ñõç&ãé5ÆW#°»ß«¥ëšW9Ì‹}Õø.[ÿŠŽÏ©MݵMW¹ëº$n9NqØõ}Ás_vèûZ\_ÿÒ^ùH|ÜueŒJçnÏðxì·¼.ðjoG),Iå¹y(Ç«\ê¼>Ýfµ°ç6ëú¸«x¾K’¿ÏÃF-î†s|êœãú’}µv]Øí’í²Ù`x£þ×ÎÁkgYfê!µ;)¶~‡Ú ©6NÅ™Ô:šº7QoM-(õúÇM—^[B8Ù䈥tÙu·K.îqõl†Ok¹â0Âe íf¶Ò÷ÙêÚÒi¸¤CwÍ£2[}÷´ÒÕÊ°I“·«û+ÞÌUyêÏâ~n¬ûnsõ2Âhß·2¥×e¨¬ey]îy?…\Ž´ ÓÆR3J-n@Š{¤ó@ÃgÚŸI»˜‘ýÍÒ0ߘÚ~#~/Týgc:~9(Ù÷ߔՠӯ½ü©1é}-€ ëÁy0`:÷ÇÚìía:^áÂìVxy`BÁ– \½¦¹¢tµO[‹0'°?bàÕÔù§¹µ´ j¬‚@ša×Õ×˼&'„l\EQ…ˆEÀÁÐkÚÁpL¼ ƒ³ - {Ð*q¦œ,L‹ò(g™ -ŠêÚt ÜÏ´˜”;ÏÀe"±î½¢‚![­`N)U L)ñ⧨^“íÀÏ-³öäLy¯¼FçËf$/t…é e:¤ëÜ‚x* US [~¨2B½ÞuÜÆš:Je⢆`?náX=À¾¶YÅ îÀeªug_¦¨Ã¨6pèiÐ)¾g;âe )³©(5£Ã´¯ÿ®¥"Z+O{¨W‹À ôh©¹)ðÖHRuü‘À§A«ÌUn‡ïlèkÑj±ØU&Sx*¬^-RR<¶0HÔ \KÛGj¥-+Aâ$”/xè$U)ØYXîAø8Jí¼h8‰Ç!zYÄØ¢Šy—¶±ùk¸†~f!^¯F¯„)p(FEaÀ£Œ^ÌÙ*Õ J‘Ç‘dG;î2ý>µm]ÀRRsÓÛ;|˜ÿG4ßÐçß“ŸÿÅWNë>ŽVªJmÝÀz'Ctì»p½àaPÒFèUÙ0äA8dGTõÚévv¦©  o5† ŒºtjU– 'àreEid>Õ7cÃ^‡ŽGbÌPu —CÃ<Þ¹±%ÏŠ%*éØÒé­G5‘š) •À24Û¨YR ÓWý½v…«²Ô@µuèÆ;?¶YÍš±¶ -EâAMö°aìA -}”þèôúd¿w•#g@E¥´ zѨ,¬¢RðŽQ׆q;”=ÇÍuÀÉ;,$¼œÊ='MÎHÑZøÍ@ǨBó˜Ö ‚êÛåBÊa–1á˜X§Ø§±YÚŠó¡•’ôý][:h¯ˆƒöJÜÑV¾¼ãI·ä¤ -:œÓX”ÒKæ,êÙ‚úAéÛËö[Ù¼ÛÎj~(GgjÇ´°£ü¨ú÷1¹sx£~Dµ¹,W–6jÉ¡›KmwrŒTCh!tjöYÝ•<{ÎùåÉþŠ„/O´$rÚM@ñvC… ½(÷_(VýG÷ÓŠ=\Òó pó×®ãß?œqý"´"¦zT %ûúŸ2%ydO~ûr»«°ïÿ0ÒO% -endstream -endobj -292 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 291 0 R -/Resources 4 0 R -/Annots [ 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -293 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -294 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.986019 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -295 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -296 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -297 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -298 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -299 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-manual) ->> -endobj -300 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 655.070079 491.179134 640.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-manual) ->> -endobj -301 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-automated) ->> -endobj -302 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 615.470079 491.179134 600.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-automated) ->> -endobj -303 0 obj -<< -/Filter /FlateDecode -/Length 4785 ->> -stream -xœÍ\ÛŽäÈq}¯¯¨gÃÍûØ€,y –5°=Ì–¶%=V~ðïû$ÉÌŒ$YU]cÙÓèébD2·<™dQ_~>iü—œžRÊ1¸ëíë始š¢Wø7föoñýU+'¯sHþúµlœbö&†ëûÿmåð÷ËïvùëxŽ¾š)ç`´¿þíÇÂrvŠ)Få +ƒ¥´%,龍ôsf,¨á£3nÏŠPÃåä j8ca%¨a]ÔvÏÊPÃDí jèì#ai=´QŠò ˆrÎÂÓ~ -pz`<£§²É”ÁÓÑ0žµSˆN{Íxy -!øÄxºø¬4ãyèâµsŠñ ‹³)2^€.6XEyÐŤh/BïdÂKÐÙ•(º¨ 4ãe;ùœœ£¼ žJ1íyFùÉ'kãi=y䦥<Ì()DÂ3Ð%(Ÿ)ºx« ãYèâðÃxÀ ocJd¶š2»­²šñC ‹ŠAfÐTp‰a€‰qrÙ8&ÙÉ%— -˜”'£e0`²Ÿ\È‘á€U<£X]¼ ¬†.3—ò ‹ÍŽa5ÐX ]Œ³ ,ÐÖ![XÀ­SY3,°À[§t`X`¸PS1,°@\›‚cX`¹H¥Ì°Às-°“aèbºG†¨k}0 ,`׺Xà®uZ1,pÀ]kq&åA$0àãdu² p×j8à.¦‘aX€¨NÈÃÀ°¹2™”ÃÜ5I9†¸k"JåÅ sÐ2,pÀ]ãa«ÜÀ]ã•aXà€»Æ™À°‰2퀻€ÏÛè€eX€zž± l2hKxà®Î(dN­&r`Xà»:!|”—'áq2oáåI‡xà. -•eXເÏÄ°?¡¢†¸«-*5ãwµÉŠaî¢oð “FÀ°õmÒ -©KyyR9%†¸ X2 P…'•€$”'$’fX0žúP†¸‹òžà®òÖ2,À]åÐöPt±É0,@_¦-™ÓhV'e€ŒÜUf<à®R13,ÀÝR6„X&1,€‚º`ð $7åÂxhù(/L8ö ¢Á²(º¸è ±ž²Í‰aA4ÐÅð è‚–a:‚)ktßty].t}à  :E†@²)eçD°ƒW/˜)EÀ5å%ðtdX£›PŠ5쥦„IÏ°?•v‰aÔO;†1CL†(ES2èÌOC4Ù Ð邧5Âd  ºA†É$¬2ƒbX€ -µ$\ÍxN•ufbX\˜J«È°Ó+M %åAÀÃħ,¶=Ã,~°ØÄ2‡ò ‹õŽaAJ¦,7” ‹Q†ar³¬7#¬  :>†Y…©´É ãà)Å° ë„õ¦q 0/Ëz31,ÈVa½‰%™·Ù†²ÞŒ ²ƒ.- -åA4M™Ì[`Ö›@'Æ ÐÅdÇ° ‡PÖ›‰aÚ ¬7ÑÑÓ-TÖ›‘nw}21pi`X€¬7ÑÙ²µ½ðúˆþŒ3SYq&ºc ½µ•n(`/ªU¤{ -à[ÖHtÓjbe™Ý5@YS+ºm €¿èÇÜ–Ý'¹E53ÅbdÆ´pèîÛš£³Öý±¿ýùòÝßëŸÿëòö³y§¬þí0<±60X£¡«±×¯ëBYp úûH·>ÈôÙ&.¬ìƒ`Ý„«¨øãh1ê“žMBÁÀ¿xÝ vZ8\g=Ú‡…±û}¤ ;9[û¸0”¬§"ºÅ>.ZŒúˆ}¾4j -YêFûÊÂro÷ûHv r¶öqaeo,]jþl-F}Ä>€ïTjˆÝÄÏcfìí~éÂŽAÎÖ>. ½¬ÍKšíã¢Å¨Ø'“½ÐóÏÞ¥w9§óOaå°Ì;&Æ,ìçì‘I.í9žo FúÎ.¬ÚÃE~Ø¡‡åñ‰VÆÅóŽ=\Ø>v/ãcŸ´2^ÇøÁðt¤ïìãÂj¼¸ÈÆkÐÃòü‹CÝbùzÇ.ì ïE¼^ÅûB2^ÇxÈêÃHßÙÇ…Õxq‘Œ× ‡åù‡:ÌòõŽ=\ØYýñzµ~éVwd¼$]Æ…×»‘¾³ «ñâ"?¯AËó/}Ë×;öpagõXÄë›Õcïý#xoïÑ…œS¼W×T šïjoÊr›†Q®ÎƒuÇèȪß@ß[Ç…m¬ã’_µNhÅ{)A?ˆõ븰“Z-D|»Z=Dï+Y-è{û¸°Mô¸ä×¢7hÅ;Ç!z<—ïXÇ…Tn½oV¹‡è#'«Œ}o¶‰—üZô­x9Dçò븰“:.£÷Íêø½¡¾¬7è{û¸°Mô¸ä×¢7hÅ»Ê!z<—ïXÇ…Tu½Wªú~ì?_tžŒjO}ꇺsÙµÚ¤ë篗ï~ù›û—ÿøÍU_?¿]þðóòŒ‡RæGü¦_|Ò?/w¯ð9à÷†¡Ó|Ù[vøÕøÍë8œç×ó丄cüõz¥•ã¸þ²L[Çázî‡åsyîĹEŽûq¯Õò·è:óÈyõÚMW¿Ð¥¾þË:ö¶êUÎýãõó÷ù±|ìŽ,¾û¨ýƒ/Ëßã½9[m -¿X´«ºaÐÓ«)d[ž«z?½-vÏ>[ýê~è:—¿ýú+ýì¿›å¸Ä ðæ1nM‰+h&w½›?Âês³È™ùENîלu¹-c嵋¾>­y‘–ó}\ìÿåçò@åìƒÿÕå»XçÅà 3™lµÊ3”Çõ¼ÊJÒßË#™9'å¯ÿ}ùÝáDë®ÄHWïæ–Ö‹ž³ZdW?š–çÔ0áBÎ5jÖl¼˜×¦9“O2Àø0)£Eا=¼Ž‘ã×HÏãÍ2ÞÛ:#I„E&µÏY¶ÓÝérs.ù˜î^\#ŒYÛgû8Ó;ª­cÂrN³Õwð·Ólt‹óss6ÊÃR'éOg“ [”¦ï²i¶»"c챚í(¿¬ñù²Ø8çÊ<îÑÙRžíkö¤yylÒIÚ¾AÌ©}zÍ;äÊ+v¯±·ëü©óIðkn×1•6çIÍ‘š¿·>éõdŽ¦Óù™·9^pÖÏ?i³ÛÛ8ÏëšëUo1/« _ùn­oë5É9­Oçã[×kæÇ„÷®UÎXýÏ|hõ·ñ—׬WõóqUÕž¹ÚÙ•_ýQe¦5Vßù$|—æ­þ­ç­òw•ð§N*çi¾Y»óÕQ~¥3ºm-WîζYÿnrªúhæ­±jÇêû–³ocnRÿÝÍ—^qüÍ#uñ(ªî~Ä -o»MóÜ ûœªãjlgÙ‹êø“Ž©É¤±ÿ8ùvê·¼óÛÐWÛ®ÿ8~ ;–.[m:lµé®û?ím0}÷Ñæ æA™ƒzzp¿½Ž=ŒëNŽÉ}?q§ï±ÏOå¼¢S}‡l￧ã{*ÿ=ËøjÝ ÚëùPþœÊ|E7‘üwÉAhr'VãjþT–ÛÉz>Î"qÖ7Ék éFθ8˵—ý#rƒÄôå|Ûë·ß1XõL¢GYvÎäîb9î.ÜÛYð)äÂ7×{…Z“î­Ý¶X¿]·õªÏÔÙ[ ké0Ž™õ©x&ÖÇ¥6ä¤ðÏü\üØgmúÙ+Iü¨5³Í£2þ´ß{¬Ÿ’=Ŷç8êõeœªíÍ?'ý™Ø5<óQùžF²Ú¨çæË“=„ì½ôjŸØ±òëšiîook–/«¯D¾µK®ëLö„uý·1kñò ,Kã Ýd—MbøÇy­£¹ö]ÈòXåå¯9¥D æþ`¥6¦~QxÞÎÑx—¯íƒ.Kù7¬ë±²ŸLyÀQœÐ–’Õä–þn·Ü÷ãîi; Ê6u‡¸÷ÏßÿO¿þ؆nA’icsµ¶|´àÀôô)ÿ·’êzwæ ³ÉZ9‹ç™óÖ»8¯mËlvc”Ÿ\ìözwwcX!±ãë -ñ­ÏΊmW&-2ë*q‹,u¥ÝVæWš{(8 û<»OÑ)nül÷HVපòÚ*ºð+j(¿-‚«ýV’µÊºŠÜ‘È‘92ìJíQü‰îKú)ÓJW»懓݄yõvºrÖþ/ìh~•÷@DÓô÷½RÜÝ‘6ª­ö½ïþh»²â?²ã…_U=ÿÔ_~ë/–7ƒ>¤Ö<¯;ô>Κ³½Cz(ži·JÛì€ÎvšžSRÙI9±ãèžœîB±9´Ù’ùÚƉ™Œ«ôIúmWy{’Úú¤uªçb›Ó›ë¶kmw’ë.eÅå­¢Ãòsjnnw=C·Ev¶œÜÖgì¬Êý9Ƕ»Á ÿîVÌç×±¢‹võÎK÷w»ÃûÕýüõL•¢&ö™ †:0è½™/æ¶×c~~§PèPn ÷;…å+¼Î¦ é¯Ü)LAš¸¦ãš¢~Øäûù]Pyñ(l3åf64 AÒŸ¿K(ÄœÛöÌ=õ\¶±‚“÷Ô7h·ËÐ:ÉÖUÔ.¶Þs«ãÌ"¯ÞWæ!DBàc~â>÷ÿ·½’F_g5ß/á~=Ú9ïrÞú̹moã‹Èú£=ŽM×ت˜Ð‰u~ ë56¦¼Ÿ\÷’¶äCÕñÄOM§Pþéè¼æÕå±]øÖǶ¤*´?8¸¶›—m¸¯ŽmVMÀ×oׯ†F/Ìë„lý›¦m·àî;»;T{[¯^¾N«Oð"Ë;álº7¹ËרϟÎã -}*ïÁN¤=UWóómqm¡›MîÖÏlEµ¿7±‘oµDöíEº„ùuz~%ŒBÕ¦¼3îÏ%.ùZ^A”uº†MÏŽÖ׃3ç7íýÔF­/ßSå}<å] Ë›ùÄÁ:~©‹_/0j±™_”¥fr2õ “ß/åqyGÈÎõM ;äB\?ª&Ë鶧Ti·‹FçíHëë#µâ¹FÛö Œ¯Ö”ó}=­|Ý©:ÈÎ_á^.Lˆ83è=¹X¯&½’ËËæÒd×£ÐTñ¡ê bèäØ.°Ÿx—¬­D¿'*q¹N6®ê£ËËIšëB'6Õ¥ë´k¢çñvÁeí–úN©åWUTõ. J³B©Ü¨¾Žlq-N„t»â'UE;³ñEÔLmý5‘\—ë8Bº]è¸Ušo‘ŠmTê§æêù®JOu›šã í&žýåí™bŽ([?ŽäP"Pc­’ȳ#Þ.å)ñùýâ#í;V(_SO­ÛÈIõ|éÔ˜ª«05+­¼f¡ü¿@…oÔ‚<óíZJ•W¥ô£~‘27yt’¤‡†:Žy@»ØÇ -wé[ÎJé¤ÈøºmtóØ@.ô˜«z¤xŒdݲ®‘ „Uÿ4¬”DU•Àå:Ù·T~È]Oߦ*’½^,h‘î¾Éíäаó]’c‹¸.ï½iú6¹"ç+ñ66·%—ÔOõ"lT«výb‚Ø(tr‡Ñ÷™\gkC§ò.Ïú±O2Vqo—¿\æ2g¬7åM°º¼ÆMv]ëOuý¿ÿyq×­ßYê¸Q -LÃÖ,+Yyégz\^Z‰mÚ¢qö;Y§>Ö×lhuÜ×®Ÿ®:°×‘º!¨n\Iô݇‚lZêm…gü ñ¶ñbkd^M/ØË¡­Æá2¶¼q¦jU¾¥#´Áaê<ÛKòUˆÄQÚK:¸Îˆq …âP\0wÍ5KBÊ‹4×ý …-×¢(‡¶ó\/³Rt¥ÍVˆ!h­<‚–̓>DéO¯—㾪ê (Ôíú.©Í°Bm€Ç©ó×.{“¸¶šc¯å NÞî¡&ËŠ¹g[“Ó§Fo-Üp sTPS?màåE]¥ ­…¢ÁhªÒšÄXu -ëiÕ-³Å‰z)¶ž¢Sÿ"=íeTš½ŒJØ-rkÅkÝ’m —é»uªl½d"´ ÏnT×GÚJÛ_Û×®Õö*Ìp]‘Ð;SÕO󻑿̺·ÊFÕŸygD§þ¦-j§£5v~yºJ!C\yÿetIl•<}ÎùÞÉ~‡¤îÈ+!“³VE]^ƒÏUx#ßgQõùü´¬¨IÏ9àð•e|'|~2þ­Dí0–¥byí¹-Mo*okê`c¼l¹aûdþùà=T§ -endstream -endobj -304 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 303 0 R -/Resources 4 0 R -/Annots [ 305 0 R 306 0 R 307 0 R 308 0 R 309 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -305 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 740.570079 409.271317 725.570079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) ->> ->> -endobj -306 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 311.068925 661.574079 462.272294 646.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke-1.6-hardening-2.6/) ->> ->> -endobj -307 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 646.574079 183.998124 631.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke-1.6-hardening-2.6/) ->> ->> -endobj -308 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 351.653153 216.824079 461.230790 201.824079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -309 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 201.824079 165.615800 186.824079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -310 0 obj -<< -/Filter /FlateDecode -/Length 3495 ->> -stream -xœí[K$· ¾÷¯è³Ë’H½Ã@8 bÄñ">9¬ÛÁl€uþûù¨*I¬.ÎÌîúâCf03]¤J¢øøHªjÂÕãûÓ€_•ƒ«µ•Ì×ÛÛË»‹w%y|õ‡‹Îþ?%]ƒçâRh¹¦ë[!Pq¥¥Xòõñ‚_w—zøãåÛO.ÿ9ޮѵ–cHן“+µŸ VË2X)¹RbÊ+‡-¶f± F*ùÌ*ƒ[M bpŒÕ`UˆA\Y bÄØbAŒÐR1XÁCŽ½7yÄ3S4x!¹ ¥g‹ƒËµÅfò -x¡D‹Gärá‚Åk.眪ÅcÈ’š/A–˜½Åƒ,LµX¼ Y(“7y%ÖB¯@–í4ƒW! ¼«š<È⳯‘K­2›¼ž¯¥žyÑ'—*‘·x!¸ß$“‡ˆ‚‘r1x²dŸšÉƒ,‰|´xYß8‘¨ÔjDk”è&OÁâ%Èca“Y`| b†,¾d ANpÉ€XŠãÙXÉqåj¡@¬Íq)dÁ@lÉqnÅÂò¼, Yg (@Fäš<ÈB-, Y0ÀÂ"È™,,  -Ã[,, À-û,, à-û-, .Äô—jf  Wj0—€@á^,,  .¥-, À.qÍp—8x ¸K„;Md[Xtt*YXÀÀ] -¾XXÀÀ]„Q´°VuðÃla|ÅÅZ½… ÜÕ³… Ü)Àä‡$ ¸¶`enànL>ZXÀÀÝÈ1[XGqÀoVÀ]@H²ËÈ€µ°ù¼H`2Q–XX€»¡!ý1 ´r¡¶laAî† -ó™¼æBƸ…–]ȹYX€»HTdaAî>«…Àx‡Œ-,HÀÝ@ÈÔ¸bó$à.ê†daÜÁ ¿¹àáº&¯9ßjµ° wKÑÂdaç+ÄäG -ŒGjaAî"½7 2p×'" 2p×3Ê“Y¨F P×€‡°5bŪóHañ€»>À¸ë}idதM rB¬@@‡*8ZX+»VJ¶° 7J>“—®“…ŃY&²pa PX»F­ZXP"d¡-,(² d°°kÕ·Ù@¸‹Ù0dA¥haÌÕÆlaAIý´jñrtµ®M^/ Ja‡T,,@/å*‚Þ¼“rɈ^` Jƒ, Š\¨Ì-^€,(²-,@¥ ^ÔYP ZXPcE—™½…ÈÐè%¡j‹Ç^úÌjaAåì¤T´°a‚NHiò `ÂÂØGšídaš4›hsLd¡ÄÔ¥Ý¬Ô -Y¢À7¥ß,4YPñYXÐ|vR&[XÏ{ Z¨è7#[X€¸”~³ZXÐÈ£ßD‹gÄm£,ýf±° 1dI(QLdAÑÔŒ¸&¡ß:Y¼ Ybc ZÎÒoV Pf ßDEo Té7‹y\ÜM Èdñ€»¨L³…¸@¿‰ÊÖêí=€7Ôg6³JÇYÍèMÈ­æ‘ö"[óÌÀ|¥G2 &:ËšÍS¤U0ƒ7 <ðõŸ0a;}ÒGTîP3k‘M6„£ºŸ=ÇFO ÛÎÇ~þñòÙ$ßëÿ½<|ÒOÊÆw¨çÞX7‰ƒØ`ï·”DNb—‚¦?^2‹Âîé"çÍÒ垨yŒ½]Y]°SüöñH—:¢ÓÕŠ±æ1Zɧ¨7½EQtÞÓQ0®ÑsÅ5ê¹ãÒU^:9ÐçîÕŠJS¶¾o—oaúwÇ™&—4ݺ @)+uÁ=bÞÒ–ùÎ~œ)æwŒZ {þpð ¸Ä×GW '\Ž®àý=É|†JùL=¸BxÂ*ÍÓöÅ\–+¤'\!]5Þ= +™£çŠêÁè WPô¹{µ¢Ò”­ïÛÿCò7’&vþþõuÂöŒ"K¸[‘,#²>ÒÁ뷗ϾüêoùÇWÀ÷×—~ŽÆæ üö;üTïSÚþ¢¿òŒò/Eü·Q$vž\óÃÎg\c,’…çÛ>&ï¼xØ~ö¹;¯­¹úsÚî2ôë¸Ë"s¼ÙçÛšcýˆµ"è4ÖÜeïãò6ŸÌßåÞ¸x°×;ïå‹]_¿zBŸMëST8UåÕ’a›n¨Dþ&Ú–ìâ õܶë!–Ì#Ÿ)©yòÑDSde.™{ªuÌ[öõŠR}\s¤ße[›ÊáÆ›Ú=Âsj‘G½Œýv9ÕÚ]Gj-Óîdëzæ»ís±»‹ˆk ÷ès×»ýó®Ë¬æ6trgìÛùj?Ú…Ãý|ÏêN~õÝ>ÖÁ>·èsîIí[ü&ÂÕc]zèã•>§m?`Ÿ3´÷õRVúÚÇJˆÍýïki} ™ú=éU¸k(š-ü°‡jZ±Ôç{Øæùòµ<ísýý—Ï~·ããaNrµ¡n’¹’tC\Ãþ(OtƧë/—oP€œ÷I´|nýwË_‡†^»nš²éMù˜‚ã‰ov=¬1¬|oŽ}Øõ}Sø1}ødƒ~Âïc’"lð=îågõ}¸_雡(_Ñé'Mÿ`}¦y^ß*¶Gú:`ÉÀ·ÛÂY_Gz©â¶hÓF·ŽùrÂÌg0ùl·}¬ò™.Û¾pŠAµÎayŸçaáNÓÞÒV1Î]  ™o˜#ÄþLÍ­<£4KÈCqÃÁ©ðýŽGÿ6Œ~Ù},rƒªªoþÑi%ÚÕ%J²<ؾ¿w±÷qËK- õ¯ëù”±u* zÜ!¬åÀõ¨‡ |òæ4ß8/£<`Ú¥>êñϯ^ýáOß,=Ž²eú·W¶ï~ù’͈äX.¿d³'s2혦ý§)ßy`Út3•·V ){§~£ÔìËxI#1[öþà[~ö†æ¦ÔÏÛ;e•ÒûÚ8É  hÃ/ÚXç†dc— -òT\…(9Ÿê`Uò¿ˆ7U[¼YØ:ê…;3)ÈþÚQ›óR+Áš…B¤jî6vi¿ø4|Þ+Ûíïlt¶ë-[àóáëýˆª$,›äõiÊš:ñšÞøâ¼ïÜãí«O;?‘›äÕ"½£ô—EŽsM¾+ï;*1cà­\ {ÚˆïÓea\Ø;;ÚKÀæm£G^¥·.Ãû<ûÜ#%EÃ%ó¿Ð&õ=¤±‡/îÍøî’ûc‰ÐMû\]ˆòîÚ5³“ìTÚU0¥zâ0̺¢Ãõ‰;ûïæ¨ý%@/ïÈ3¡í Au±ßŠ¨·9ÈÕû ;¾“k‹üx‘¶Ø 3¯xx,Äý£Ÿsq˜á5h·K€·û‘‚(ûǃ¤’ÙØÜŸÆmrÎ~ ¢~”¼-lqgg²ì ¿“¥¬Žö«ÉY,0lí«ò›x"Þ.‰g$.òã%ctZXáÓp=M$5ï$W¿üeQKªBhš<î‘ßT¤IäéO—’G¶ëj-"±9ÉG%izž¨Ã–—5V©+”2}Vë+ToŒУ§ÆT¥2E/mˆ' 5ÁãHÓë&Y lègb¥&ú!„œ/Orš®üx /9Ó Õäçb9(wOsÞEÎ;5¹L‹yþ>åó*ŸÄ[Ol|Oׯc‘EŽ~f»µ˜".Á -‹¼`ô±“G´Nt’wŠÇÇdVƽ]~ºô4‡’96|Èäu2]u…ë/ó -?ÿ¾ðõ¯ãùå–ÇQõãÄÖYg2yù¸¾'Y^FÄ6ŠYÁþ"‡ºÆ¦á 3Ǩðš×í~û&‚†ÉÕÄ´t¨Èqºn ¤4“ž!Þî´8 ™_k›•°·K›“–[ž|©p¡·ƒËºx´RòUM‰+ºR:¸ոГâR-Ø–d1Å!õ"Sõ"?kS¬¥.T!—´x¼Ò¬žzÐú.Ô”À¤/ôÄô¢í !ôG‡×¯¶û.r Ô í“ú¨©scB€gS©_æãåÌ9t•‹¼KCs.R±G³ÈY¡±J >\hUÔºnÛ$½(ÚaÑ‘(&\€æmÎX†Ly¿m¨¥ï¸šZ*³¦XÔŸ´¦“¶ÊTbÒVɧ±2ïÈx³Z¢Y%íÎeíί‘³–¬-ë»'•×H´óÚ|\{dÛ«Ú/AòªLýº-F~þ}Lì˜ñÖ¨ñÝOFB]oü Qs(©ÿ—¯9CXÞÃ-\ÕQÉßóüÙÉù„dœè•`ÇD¾ùw<[„G0ÚË 5ÕøW=û¶æÍ-}˜ž|uÊ~lBóø²ÍË"­¢üûIÑ[å­ñâí§(ý(ŽOú÷ÿÚ V -endstream -endobj -311 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 310 0 R -/Resources 4 0 R -/Annots [ 312 0 R 313 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -312 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 443.985184 754.370079 487.998612 739.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/tasks/tools/) ->> ->> -endobj -313 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 297.976884 739.370079 309.064286 724.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://stedolan.github.io/jq/) ->> ->> -endobj -314 0 obj -<< -/Filter /FlateDecode -/Length 3612 ->> -stream -xœí\M$· ½÷¯ès€•%‘ú  øâ F,âCú½k#è °Î!?Õ%‰UÅÏÌîÀ±w<î®G•DQä#USUáìñó*àŸÊÁÕÚJæóåýéÃÉ»’<þ[Zlñßð)é<—BË5ß @Å•–bÉçë ÿìuóëéû?þ½='œ£k-Çο¼“+µŸ QƒÈ2D)¹Rbʆ(‡)¶f‰ F*ù(*Pƒ[M–jpŒÕU¨A\E jÄØAÐR1DÁC½7ePÄ3S4d!¹ £gKƒËµÅfÊ -d¡DKFärá‚%k.眪%cè’š–,A—˜½%ƒ.LµX² ](“7eÐ%ÖB–¬@—ë4CV¡ ¼«š2èâ³–¬‘K­2›²™¯¥eÑ'—*‘·d!¸ß$S†ˆÂ"åbÈ"tÉ>5S]ùhɺ0~,x"Q©ÕˆÖ(ÑMž‚%KÐ%Ʀ º`ñ-ˆºø’- -@9á%‹b)Ž[d‹b%Ç•«Å±6Ç¥E±%ǹ‹ÈÈb°ˆ€YIb”‹õÔɱ) -hk›¾¡‡ªZd‘½]Яæî¤úîV‚Çáöï{‚\Æ{3#—ét£ÿNôJŸ EȘ©Ïá°ŒNyyî),Ͼú\]ˆòrŒsfG².í,ÏZUOú²…ÅÐá|Ç™Ë+E>ŒVë[F¼ßÁË’Øx‹ë×>È„£Ùn¦À©Ha“F¯ Ü£u°“¼´¨AfeÜËéçÓ’æ"¥Øä†e -ò¾ -]u…óÑæ[|þuâó_ú Ì·<ý`‹8¸uëL&o7ª„åmGa£ÀÈŠö'êl›º7Œ<£âkž§ûIì½e †TƒiÚPÁq¸n ¤,“î/;+ŽBæc×f&ìÛ!õÉa’Gk»V8ÐÓÁa2š)ù¬ºÄ‘4)RŽêDèNq¨lS³šâzazÑŸõRŒ¥T!‡4e<Ó¬îºcË,T”À¤tÇô m£¡ô“Ãë£×}U9÷tPû@¯tžÒr˜·‡#çÐYzðN ¾HÅ"g†Æ,-xs }T¡už¶6HzPîØfО(]ó=–®S^OëfYf\M+•QSLôgmé¤We1éUɇ¶ÒoÏx£Z¢Q%íÎeÎÎÏ–£–¬–õÙåÙ’:v›·c÷l{VÓà©Hž•©Ÿ§¥CË'ñßSbÇ|,ÀjÕ–+#¡ÎW - Qs(iyK¤¯9ƒCX^ôS¸ªK%>ç©´ë‘°Ž‰| ò¾O[…+íת«þ.Pû´æÍ)=Îw¾›Á|ˆ#,/|[žþX.Ã"[Ey¿#IÑ[åµTÅßóPGÞ\>Y~þ.¶Ø -endstream -endobj -315 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 314 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -316 0 obj -<< -/Filter /FlateDecode -/Length 3668 ->> -stream -xœí\M·½Ï¯˜³ÑEVñ 0|à Q#Fçä M´6‚U9‡üý¼êi~twí®´«…­ØZ¬fXÅ&‹ÅWEv÷ú3áç…ÇE¼+¥æ$çË»Óû¹ ÿ–›Â¢þ¿9ž=IvÑ×Tâù -8»\cÈé|{»â\ýöô·/NÿÞ^ãÏÁÕš‚çŸÞªJØå’3ECU¡"φ*F—sˆÉP%ï0ÄZ-`Ä,AŽª RK´T€!!CUƒ%{>ª*`„ìÅR†¯1*OÀá‘©á`è|t FO–.x—J ÕÔeè|–ŽÙ¥,>zKW]J)K'À+yK%z²tÀ"\²¥KÀ‰ÉÔK(™-]–ëTCW€ÞUL°P"oé*»X‹ˆ©«ÐQÉå¨ ],Ìdé¼w¾É¦+ -“”²¡ À’(VS,‘)X:Á¥ODÎ¥«5èêfboé"°„ÅÔ &ßb€€…r²(+È)/YrvRƒX$ -;)R,¥:É™-5:I5[<Àä¡ Þ"&`‰’,&`,‚•kꀅ«X\ÀXPÁâf` Â0ØVà-0èV¨z‹ |+ä“Å ÂL²¸€Á¸\’X\À \¸Rµ¸€Á¹ î´¸€AºXîÙâërLÁâí²”dqƒwY¥jqAï"P±Å¼ ú,€ã"j°¸ ‚w=#R[:ð®•,.ˆà]ä Ñ⸃óH,.@|sžàº¦®:ª¥X\Á» ¥`q¢°£&1uÙÁ‘¼Å cGÈC-.Hà]„÷jqAïRd¶¸ wIö˜:`á,.@^–­±¦‘¬: -` -KÞ%¶tà]¢\-.Hà] ›¤¬‚P,.@‡,8X\Š¸šs²¸ U‚)Ÿ©KåhqA&"(ËÔ‹d±¸‰µ«\‹Å9 ‡`qAÀ‚”Áâd®zdßæöXà.æþ@€™¢Å`2WªˆÅ9&ìÇ`UK—‚+tmê -t>[\³8„boqöR®`Ñ[\‚wš.Y\Ðy±¸ W`ÁR±¸¡È•€ÌÜÒy`A’mq2]è¼·¸ `A6hqA »ÌD Bc/ S[:!Ýg‹ Š$§©¢ÅX&Øi‚)M°€&,.Àüèf;Z\€Í6›Øæ˜:`á(”t»Y,.(X‹ à›ºßÌTd|TJNÓd‹ @ãÐY\P}Á~3ˆÅX—ºß,T&ì7±Å3Ömå¤ûÍlqA`‰HQL° iªÆº'a¿ v²t XB‹ jJºß, ÍÀ~½y$Pt¿™Íãðn¬`&KÞEfš,.@ûMd¶ÖÞž@¼1#?³•EwœÅ<1 PoDl5 Ü‹h•Í3ùêÉ<4Lì,K2O V¡ôdøù˜8ázú4Q%¸CFÌ,YY±,Ù}ßsŒj|GµëùØO?œ¾|à{þá?§›/–“²öãáü,I7ÖÊȸ+æ|å–ö;L$ÛA"ÀÇ\£ r =hq=tSÅ·õÜ¿ø-d VÌÉÌ22Ùô‹­‚Ç\q2±~ô5ŸëÑì¿{u¿\Ï6Óy² Y[À^½;}ùÍ·ùÓ÷ߢÍW7§¿¥çDRˆôLA?á4$ü -dë÷ˆeļû~ýó«—s?z“ûšºíG›FzG7¸\»Hk“ú=^õ‘¯ß—.êÚ]ÚvÛ`i}Ѻ—ëw…Þâ·¬º|½FZ_¸–^_û¤µŸE'Wp#ou×v®ž0tWoXË7t\€aÕåm;ˬ–µ½ËäiïÛñ½ö#¬˜÷Vì­¿ÞöÒFÑGÝF|¹">:PõºekÉÖG÷‰ÖgûÌÊ~wëô:zs][}§v4ú[,}¹oìÒft¦Ncm_qÛI¬ µÚÛY¨Ó¯ë#NˆmßlgY)w3‹6^Iwá}rd9¶ýë-!ííñ[lùØÊÁnŸIláÝ[^?oliŒ¹xB3óü±cò‚Æø´eöÎêF{‹îÃí,{;wÙÇØ{"ˆÆyŸ¯¿4Ùhf€YÖÛî ?E8ìÖmVÇ5Ÿ6êè$úQçØÎóD½£tÞ'GcÛ¿î¨#²·ÇsF=ßür"ÌôýÞÈq¯-ÓÁ–?s„‰z/ÿþóf0Üÿm”ù{·yØÛüóÙŸè}Tù‘âØÎóD -½ŸzÞ'GŠcÛ¿îH‘üÞ¿EŠÇFŠÄ[þÌ‘"åèÊý‘âò¼Q"¤#£oG¿eíÆ(ÍS:»Ï9øÛµíË®Íæum?m=ñ1g\©î-ø¤ÝÍW;?ûïT˜¦ö[ou½Þw2³+Ÿ îÛYÆõzØ1ú{q¤zŽ'Ç“cÛókøÍäkÿËøÃu,Ž Áí ?Ly4þÛqÚ̃‡þ,n^û>æ_S;áAÛ–ýøckcæ´´ÊçتKíò0ön+.¯¹‡äÆ+3XqçÍÚÑÈM´)æh¿×u4ìº]w÷Ù¢„¸³Eh1¼Ùvòõo^-w$¹ß‘ŒÞÆ(ë™áT>x•úâ4Hiº‹ù±×<ê.æzóÒ}<ãu\ƒ>NA.R-$‡;šÒz½š¦=ÇŽ7%‡Iñ–œ|ùò÷øë¸Á9(ªÑÌT¾þÎNô†³Ï‘$Õ3d¾½Àre¶ôºQø.¦¼ÓûÐ-ᣠÜÝ]îBÍúDeõœÈ@íoºZÀ‹EôžãÕ}|²³)\܇QnãðaØg¡œË$¯£,7;»¥çFªw)û,œÁ÷åÐo”«7}@l®{²Kóvù!ÕÑO~þñçžòTžÍú¹ÝÖ{zÚR“¾z‚6ÓÓÒ–c;w¥-ðýïÖqrDCQ_BJ5Ô:=×ÓùÿÁ*Ðýñ) öHÍÙï`Ù>¨R5 ËúhÀÚ®YZ»ë9•yÇ« B—Ûά÷Ù›‰ý6÷Lùí ñeÁ´ìçæêè*»Ý^û¾ßÅ-ý­;¼eä±hzû-Ëšðl2í3¶1¦ñý)-_úå|J±YßÐ;'q¬óRÏúÀg!ߦÍ/†öç;®\Þk|ßk­¯:’¾ý O¾^߃œ -ký÷Ë„¿ÃÊ—ÚZ_^K¢E\B+ ñíI_KC,2ã± -ׯÔÛßù§É.Hh²«ûšˆŒ´~$¥™Äõ+R­4®í2}\P¨Uâå¹kdžW&ëèÉùU¬¯öÇk)u(15ÌŽe®;>(öL“0…4u7ÄA¯‚wÓ¥!ìÐgÓùiú[ݧé¼Ox9¡[ÞKoM©¾PÔšjÖ Ôe<ª][Í>!ÒçÉ]N†ðµ¦“ÙõÓ¬écÙWaiŽ$½^mõ ÑådÖ[[‹}¦r¯UÆ¥µY~@®Î¥Þ]¦@žõ]åi·¯[±n[û\S™ü&„—S”¾‡øö³Q;® Ø\oòÔnþ2¤¹4Sai6™>Ôªÿ_©"v©2ÏòÅKw)}0}”F'º6»xk¤Yž:ëˆe/yÔÌåsî>;ÛË2ê+éöÚÝbéd²Ižkƒ§$ÕÉc+öÝëºX)¬Ù§så,¤Ý qì®|»œ±/ÕH½³ä'w½Ý!N;ogqî3îõ-ƒŽ··;ù|^–À&{±º~i q íFg“p) ñ ÑÛEÜVkg'}sº}‹ÌŠ¸—Ó§%ÌŽA·Ü‰½¾47g]þü_Ôy‰ßäüçö”ö5Žêl:·nÄs$ÓW¬ËŠõ•ë&ìËf™hˆ}ucó†ÇC˜øZÆå4ˆ½ÕôA}×ÎÂ8l8‰CwÝày²L¼GxÙY±'2O›°¯EnƒC7¬Ï÷7T(ÌÃA± |žšDI«Ž­„éBæFQœ:¬Ù¦:äÜI7½â—y*ôhe.Li„yèd„Ù¹é&[F1UA -ÌsanXüÜiÝà1@?zy=yÞWÈ©­•vjïÒÛYÚ¦ÒNx¶”—bÚ{Ìá³Úâêmñ´ö¸'9ciŒÔB6…ÙG'i—­âÜ©4Ù¦Ó(:]@FMÖ[Ì SZ/kfYF\L+åžS é³¥ã<+݈qž•t¨«í¶ˆ×³%î PœÝ9ÑѨÙsÉbÈÒ|u—ʨÉMvì[¶}·h{ž†!H™)Ëâ¡æ£øï1kÇ|)ƪÕ~–“_Æ{MÔâ3^þT •”À!¢og)ÓQÉG_sÿÙÉñ„¤Ì=a:œ0SöúG‡l·PÔ‡SSíÙ—U2‡ôq¸ó1û¦å¯Nàßz@Ô‹Y·ŠúGfX“Þ¢ïÆg²_iZŽòæødùùž‰Ê^ -endstream -endobj -317 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 316 0 R -/Resources 4 0 R -/Annots [ 318 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -318 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 205.473057 101.433071 186.723057 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -319 0 obj -<< -/Filter /FlateDecode -/Length 3955 ->> -stream -xœí\K$· ¾÷¯è³Ë”D½Ã‡1bd‘ŒÆm`ÀÎ!?UzU§§wwœlï`¶»H=(ŠüHªªÆž ?[ü—ÙšœKŠ|¾üxúéD&¿ÚbwQÙ_á7…³%N&Øs8ÿ(ŸL*Á¥x~:Ύ˵ùÓé¯þ±ïcÏΔ 矿{“rJV‹¬WX!˜”\ˆ -+Zƒ%–¢± FHìøÈJƒK b°sYaeˆá9Ydˆá’e1l IaY‚Ö©<BÌÞ)<L„Ò£ÆsÖÄ\\Qy <›œÆóÞÄÄ6XWLŒ1dÇ%²/@–`™IãAö9i¼Y|ô¤ò ‹ËÉk¼Y´S^†,°®¬ò E²¯xJfVy<Ê)yŽ‚ Ù{ÒxÖšÛô*…MŠIá9È)•Y‚'§ñ°†9;)7³†9CGNÃئԛIÂBŸ†…¢‘4YÃÀ8xD›Qo:Ö°~)õfÖ° xB½‰OñÛâ£Ô›IÂÂ% EQyISQü˜„zè¤ñ"dq…5,(1J½™5,@šz½z$¥ÞLêqp7 “Æî"3àõ&2[­¶'oHÈÏtf–Š3«'è ˆ­ê‘{­’zf@_©‘ÔCˆ‰Ê2GõÔaLK걑ñ¶Ó§õˆ*ÂbfN²È·`d÷£æ˜Íü3Ͷ󱟿?}ò€à{þþŸ§ÇêIYÿ±0~ϱÖb_Åì7ðÊÔñ&’m'H$„€ïÒG„He -i‹íÐM„D(F¸-çñÅîE†Ä"³E2SWÆ»yQ*X앪¬oÝç•d:BÝ‹ú/ {»_¯wöyu½®óÞ«×;û¼º¬R'Á9=ñÕ¼Tÿ©²ÞÙçEY½ü;¿¼$2Òmz]Ö¿®Óö -À‹Ú¼÷Úë}^ÝÖyïµ×;û¼†¬GøýÍ›òŒíG}Óú -=NÑëîÆ|¥-ïq¡µ¹eNmÙsÌÃòWC½^~èCÈòC&6zlÓ4ÍÓåeчÖ¾}\Û–Ðè¶áJ³µ«}¾iãˆjý¢ŠÇ©z™·oÇ'4šÛæ·ßiäo©È¢.ÙëÈñ¦ŸnuÛ¸ÛŸ¿©ÞåG”E&ê|X -Æ­PÉF³Gå·íóNÙ+BÉ‹õ_œ”Èû¨ ä;x'÷Y7ÕŒKëÃ-;Ugýý_üöwžÎâg[ùLÛ'ór½)þÙIÝ6h\úô±iÑ~z—[°+·K@ûØ×8‚~lðû¸‡ÞuœèåŒFîÇ»ÙÃR¼%‡Ü|FŽ÷N>Žc×ìãV& XvÏ$ªe–Û!v„ˇ9Ö½ó¼-ÞóxS¿îZû½ÙgI>¾Û+Ïzh©KÛ›ºþ4cEWë´¶Ž¡£²¤ -ôz™`MÍûZl·¥Òx·uÆ×:«ëîvéŸßÃ.³}5;»©¯xÐWO1ó~2÷=ïØvy¥Ô”¦/NŒÞ~ëuŸ³Ùrù [úõN_·Ö,·Ä÷k~›´•QÿåR‹BÉŽ,¥zÿàfÚzgŸ&mEΆj7eÁ´u?É­´µ?LÁÎðÉiŸîMSé¡{I{jØSÅ•—¯Ö—ñÕP·­ %ÚÌäÔ”Ï5§è)/µß -DÇ`~ –ò0L‘ÛÎW“ÖÔòã rwª¢x'ã Æ{gŸ÷9dú%l8¸pˆéá -f:œ_”ä´ÛÆ’Âuûê6µAø¾d!¯Í£—ª5…oYÓ°”DãT¢BöjM 6«庖£%±)%äd¯&¼iIÅv«ðpé,»þ’!ÝÕåC³£Hñ–ͽ}ç21y,1c‘÷—‰aZØÿT©Øi{™G’ÞQ·ËrY’¶ËÞ+÷%â\Gãî‚1¦Uù_z\·$¥š.^·¨KTä ñ¼w+êŽã¼]Q—8<'Ç{uDZÿÿŠº¯uðkQG/u)_ëìע2ôõß(ê®î7Ü‹«¯[ìÉ»A{]8ž8¢Þ»Ñ0¦î}äv÷zí¾Ç—iëÃN{‘¹îko¯éùµð¨ÛdÛ‹k›m¶koÞËñZ=.ð5·ùG-Ó}§Ï×Û>,ØÖm*ÐÀîí¿}v¿|˜:¯è¯(¬¹Ï·é¯ß6û´øíj¿K^qK?ùZ?Ã6,ÍÛ”¯9ٕͼ÷~ »»¿÷£p}û¦”rvÙ›åºÒû;û|0‡%$y:2´é¿Ì!Ç~’·»7÷ÁvyF6[*é?xرŸôªDýª=²–:I7å9®²<7,÷Å&/êñy¹þÐÉÙ^=â±W †”wU}>;XLIòxçsÕ½ûnScÅP‘ƒßúŽe© [åº:¼ù‹ð¾›XÕßs—Ç £„î®rÑþ]Ë1Ý3x<Æ¿…ÿ} ¡¯á°?b}LÙÖWU(fc¼ËzŽl¼ì‹@ø—gÛ·ÍVEÛó3=ëÀ?Ví¥`’÷„äñíá墵ÿ©nø()ÙÄ^DÖø¨’xášüt’8Y!3ÏJô²ÛWc!§qW´  8™rÝpGíë¬~·¯.ôÕHÿлÉCL½‘¯–n+DôŒöH–Õ“±,/ÁfãÛU¢Èóƒ8äµípv|‘l=-Äp$Ò2Ý$;îòXyib¨.Nâ}U]¶¿·uiÙÎ[ÄËIŒ¼¦>©Tyõ®ÕµëhÐü"TÔÐ[Ž á±O -érRˆSš±™ƒ¿ìš¼À°s7$íJo§.'µ]-ŒJ£Už]K×üešºÏCñ -í²œ%y«ñòýëž,c¯)/vãÄË)ððÄI~:…¤´+P¿•#Ñ/ãr¦i/“šrW\³ÓäñoùƒŠ0¨‚<õ‹åaRr2;¯æ$⛃¼WÒJuXÓ€å4Û.ê²) ›]õe3)ítG롱uQÙBOã)^©{²V7Èa]?+W"u!0Ý$‡aÊO;ò”3 W 4&‹v1÷0Æä8°ói%§±ãVÞÇòŽq›ïÄK l|MÓÏ}’Iv4¢Ýœl!NÁ -“©?ÿözn½ -endstream -endobj -320 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 319 0 R -/Resources 4 0 R -/Annots [ 321 0 R 322 0 R 323 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -321 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 728.673057 101.433071 709.923057 ] -/BS << -/W 0 ->> -/Dest (cb2-1) ->> -endobj -322 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 521.926036 101.433071 503.176036 ] -/BS << -/W 0 ->> -/Dest (cb3-1) ->> -endobj -323 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 136.679014 101.433071 117.929014 ] -/BS << -/W 0 ->> -/Dest (cb6-1) ->> -endobj -324 0 obj -<< -/Filter /FlateDecode -/Length 3542 ->> -stream -xœíœ]oÇ †ïϯ8×2á 9_@‘‹)Z Ôh/‚^(§v‚B.àô¢¿/÷ì|ì.%Y–ÔÄu-X:KÎÎp9œ‡œÕ®ü™ðõ…Ç·"Þ•Rs’óåÝéý‰\Ž„K‹ÍÁ¢þÿs<{’좯©Äó;pv¹ÆÓùö„o»Ã¹ùí鯿:ýs{Ž?Wk ->žz£*a—KÎ U…Š<ª]Î!&C•¼Ã%Öj©`FÌä¨Ê0Cj‰– -fHÅP˜Á’=Uf„ìÅRÁ _c6Tž`‡D¦†Cç£Kpz²tÁ»Tj¨¦.Cçs°tÌ.eñÑ[ºêRJ±X:-±’·t¶D/B–¶—léláÄdê`K(™-]†-Þ©†®ÀDW1u°…yKWÙÅZDL]…ŽJ.G] èba&K罋ˆM6uXQ˜¤” ]€-‰b5u°%2KÇ°EðeéÀ‰È¹cµ]ÝLì-]„-!d1u°“o $ØB9YÀ -rÊ%‹!g'5ˆPØI‘bQ ”ê$g¶0jt’j¶8Àä¡ Þl‰’,°‡-‚•kê` W±XÀ¶ ÅfØ„-0h+ˆ‹ Ü -Uo±€Á[!Ÿ,0€ 3Ébƒ¸\’X,` ¡T-0˜Ë`§Åt±Ü³Åu9¦`±€]–’,0¸ËâÉb€»Ì8ÓÔÁ°ÅÐѱ/l±@À]ö”-¸‹e,`Vâ0Y,@¬¸P -Y,p7‹`ê²Ãd‹K°27¸"‹î ÉbÅ?dVà.ír¶° ï¡ l±¹€²ÄbAw}Eú3Ö4hå|©ÉbAw}Áô™ºê|†Çu /;ŸRµXÁ]$*¶XÁ]à³X,ã2j°XÁ]ÏÈÔ–Üõ¡’Å‚î¢nˆ Σ°X€üæ[,ÈYR±·X€½”+Xô x§å’Ř‹¹Â,‹HE®Tæ–ÎÃÙ PéBç½Å‚` ªA‹%ì2Y,@†Æ^®¶tBºÏ, Š$§¥¢Å,ì4AJS[€ ‹˜ÝlG‹Øü`³‰mŽ©ƒ-ÅbA)A·›ÅbA)°%P°X€ØÔýf¶XP ¶ â³XP)9-“-ãÐY,¨¾`¿ÄbÖ¥î7‹Å‚Ê„ý&¶xƺ­œt¿™-T-%Š©ƒ-(šª±nÁ$ì7A'K—`K¨b± ¦¤ûÍb±eö›¨èÍ[E÷›Ù¼]îÆ -2Y:p•i²X€ì7QÙZ{{xcF}f+‹î8‹yÇ€€ÞˆÜjÞ2 °Ù*›÷ ðÕ=’yÓfbgY’y×iJOæmQÉ ×»Oó-ª„pÈÈ™%ëEV, Auß÷£ßÑìzì§N_Þ ùžø×éí¯–;eíË£@XZ ê+,ƒP1ÝÕ·ÇåsÂs± †=¦­šë0ʃëM65 -éNÿ6–ÂÐo·Ãz\óÛøPãg6’Û¸(s°ttX*1D|Îà´ÊúÉÔGžòŒvl(Úp ŠL¬»$›Æ¿y}ÂêY­¸Þ˜í‡žc3 Ç]B<¿~wúò÷¯^ýöwFl¿~{úî×hzC$å«/<>Ç|ý)iý¹û¿?ÜFûAMJrYÛ­z•E^eq=§lÛôc¿öÿ·óëW§¯_¢—šÖkLê[ì½Ór¿ Ûªžc¡ëÕ}ýÍŸþð—oÆÕacˆÞµWüןñ:ŠÊ°Äë0¤^“·×6°f< "*ŒÝ€ß-ÞùªÙ» Ô8-nO±A/DÚ‡ò”H{‰Ó[­÷DØ“£ËŒìÐi²«N±*EoÉúPÌØ@IˆYÜýLט="·‘›|«%º1òýj¯\òµíg‹¤+eô¯ã ÆŽa;®Ôõ¼zm¯1ÚÇå5¶ãÔ_Ú­¬Ë±Ïye.öÎ×’†½óu,}\WŇ8>ÌŽ_|­\¾þ_ú ÃË1meÝž¶~ÛuåUvYý•×k¬ãúó'Ó\å©osÔp9¬÷ùZ´>Û¬÷Δ´òâíµ¿Æ¹ŸÄZœë àc? {”xaøz±»ÍíÛqKÜÄ6ÿ÷Ú[Ó]öÒ¸æ¥_™ü®\4®AaHBªFß‹Íi°3¦áÛ>·ë<.cÔ§ÛqgëuÆËê|ot=®º|=§ùéçÃfÃ";¬Ói-¾Yç/{›-ýÒ}¾f¿÷‡´¸ZsÊÖ˜×5¿ŽÛÖxˤiØßú½fÈ1KßéF¬}[×ßüÖûNÊ¡¯>x•cßìh»Ê-¢¶ÈþˆÚÚÞìÎiÑÑèøýDWnuÏ®æy’rÞûøº’Vû œfÑ»tÏOEýM=ý¼ õ7wØûd*ûþ¼©(yïωŠú; y˜Šeâ¥ÈØ ”¶º%ZÖ¾›WtŒ_f úÏóÞó3ã´çO· -©:yÞûyÞ&ŠwÙûdÞûþ¹y»°äfZíZë.»x -Û˜[üz™86_WȽ¾{ÜÅÏvÄòù]+\e{S#ÊL“#IZ-ò·»?Ʈ˔×1ÒjË(öL“0…4 7ÄAš=^Ÿ©î®KCØMŸ]ç§éomCž¦ó>áå„ay/½5¥úfNëªy7P—ñdTíÒØZö ‘>O†èr2„_PëZ0™]?Íš>ß|–HÒÛÕÖÎ]Nf»µ·Øg*÷VeœZ›ç‡)#Ô¹tDzËT¨g}éwZ#ÄíãV¬5WŸk*SÜ„ƒðrBM&ñí)f£u¬ ØBoòÔoñ2¤¹4Wai6™>ªß¯¨ˆ]ªäY>èa¾u0AtmvñÖI³P¬ï.7a_6“0È„ý!öe´-zׇÜòN¦§Ó{ké;A}×ÎÂ8|8‰CÝàyòL¼GxÙy±2O›‘°¯‡Ü.ð>(߬ÂÁ|98,CÇ#%Ÿ§.q¤MGJ‡VÂt"æNq8 X‡e35 çAºëÕ~™§‚u¬é`*#ô‡NFš»n²å*¦&(y>˜;?Z7öFôòzò¼¯&§¶TÚÑÞ¥·³´_˜J;ðl)/‡i{ØsŸõ -Þá¡ÞOk{‘3–Æ(-ds0Çè$-ã´µAœ•&Û ÚEÇdÔd½ÇÜlJëiÍ-ËÓK¹×Cúãìé8ÏJwbœg%Új¿-ãõj‰{çpÎãêh´ìµd1di>»Ke´ä&;Ž-Û±[¶=O—!Ã4*S§ÅCËâßǬë9»»V«öµÜñe¼ „D->sàåo¾PI }m7K™n•<úœûïï´{'óH˜'Ì”½þõÛ„[(êÊ©«ö—}ìÓ*™—ô8Üù¦ÕQ¡w†–?ß°¼:±Ü ê‡Y·Šú×ZX‹Þ¢/™g²ß<¹þ~sûdùú\Å£ù -endstream -endobj -325 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 324 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -326 0 obj -<< -/Filter /FlateDecode -/Length 4635 ->> -stream -xœÕ\K$9n¾ç¯Èó£‘Dê,æ`` { /¼pc}øÐÛ³ £ÆÀ¬þûþ¨="’™U]k—»¤E~¤ŠpW‹¿ïþËìLÎ%E¾Þ~¹üz±&‹µÄ梲ÿ€O -Wg9™àJÌáú‹(™T‚OñúrÁ»Ë¹øËåß~sùÏmwõ¦”è]¸þõ«°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ ±1BbÏ÷¬1¸ä ± {ŸV†ÄÉÑ=«@ Ÿk,ˆáJH -ËYÈá¼µ*‚Xfò -Ï¡ô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx YB±NãȳÕx…)'! E²*²øœHã%Èâ¡¢ð2due•Yl´Nã2¡df•WÀ³9å{ž·Á„Ld5žs&À6IåÁ£0I1)<Y¢ EåA–@Ök<‚,Œ?œ”rV¼Õ‹w“%§ñdñ>±Êƒ,˜| |„,6E àAFpIß’áâYŸÉp次€ÏÅpJ¤Á€/Áp,Iò<ï4 YG ÈA†çª<ÈB…5, YP@Ã"Èâ™4,  -ÃZ4, À-Ûâ4, à-[5, .Ä´—rd  S*0—€@îž4,  .…è5, À.qŽp—ØY ¸K„š*²À€5,:r™4,`à.9›4,`à.ÜÈkX€Y5°Ã¨alÅøœ­† ÜõÙ²† Üõ !@å%$ ¸ë† Enà®ÖkXÀÀ]Ï>jXC1À«fÀ]@HÐÓÈ€Õ°ñ ´2.—¨aAéSyŸ+~ -cÑ° w¨HÂÜ|f €ñÕkX€»Ž©5p×ùb5,À]ä A؃qH4,@|3ÎÂtU^1¶ä¬aAî–¼†ˆÂÆf ‰ÊK†ä4,‹kX ²`¯aAÌlJJQÂX,xHùT^4¸$ Bd©<ȉ5,@bm -•¬aAò…¼×° yÈ‚”AÃd¦8dßêò²À\ÔõCdŠÉL.̤±ƒV5^ô&'ÀµÊË๤aAJlŠ†XK™ §×°o$]Ò°b€çXÂT \EÄ"“=2sç ’l é‚眆ÙCdƒdŸ±ÊŒVÃDh¬%¡jÇVÖ™YÂÌÑHª¨aÜ+M ¥Êƒ,€ 0?²Ø`ñƒÅ&–9*²P` rö²ÜÌä Y¼õÀ6e½™4,(² ãÓ° Øh$MÖ°0žµ—±Þô¬aüRÖ›YÂBëM,ñ¿-e½™4,( YR•Y4ÅoIXo4^„,¾°†%FYof f`½‰Œ^ÝȲÞLêvp7 “Æî"3àëMd¶ÚÚÞxCB~¦3³¬8³ºc`½±UÝ2°À^D«¤îX€¯¬‘ÔMˆ‰•eŽê®Â*˜ÎªÛø‹|Œï0aÙ}š·¨"Ì!!fæ$ƒ,p Fvß×£=(¶ìýõÏ—ï?#ø^ÿü_—ŸSwÊÚŸƒñGYX3Kï æxej{Œ,+!r¾©’ˆ‘ÊÓ×m7Á·\û·2‹ÔéLo:ÆbÁa¶(êÒ¾¾Ò{H{¯ú¿ûtAçmß·ün\N*Å2Ñù|ýôËåûßýþ_þé¿GŸ~¾üô[ ããvß_~øÎýVò'¸I^~·~Çõ»Ñƒµœ—²˜1Ëk](¨^ßÑײŒ@ü®í´´×èüóúÉ âYÙ ©m»ÑžÊ8½m.k¿øæÛh·Ê×Ê~ÞÕYÛlcîc@ý@?üûõÓ§f Ì3ðSk %÷òViM°z=)¦£ŒûÓcžÔ³_0‰¯º ºÎ9©Ðfyç¶p†ÍÖZÝ}û¯’}Ï6×µ\\çxž×ª×gúôöNŸ<Ú®¿Ã$ÓjÏ]s¹¤ëlžß†µM7ømôáÜyð“-ó¼A?5äÜþ¶áF¼¦µÁaŒvõÍS'd¦µ®¿ ›½ˆãQ'oÝ„©¤Yö+´÷Z|[КmôÿcüÁ -Èäwˆ?÷íÜûëS9äfòß(®Ü·Ý°ÿÎ'¿LøØ,ò絟Ï;Ÿßãà4?ƸgŒšqí®? £×¾[ŒÖðqùýT·q?þÐÚ˜1*®ô9ÆŠÛÜŽeïzÐâóšƒpjX·"È>þH/k;ÖŽEú˜bˆôÛæ£ÉS¿f¬õ¶ç=ß­ÖñOu–÷:눥.¾¿®þ±A¿=ò-eëX¾.s÷¼_Æ‚M¡Rë×·\£Íý*?ÅÕÃÀ¢~*€G!(íÛ5ñþÝ'¬Åê}cÊXå_í–µ˜ÇZÌFd=ÈI:˜öõÛëë¼iù¶®Ú°>´( -&/{IÖ[²å»¥\ØF~éuy7Úøþüñïÿá_ÇZ®™[ Lu -ý½«V7÷[³l&QË·”ÀÛMÀW¨u¿LS Ç$úrXvCQbÉ]¢Œxå²™§àõuþw¦€[¯ËôKG¡Ë‹òd -¬d]¼zQÞå0aù®ÞZTnÑ{¥çqÚ’µ•åm{§!±Üh" ÐiÿiÑoPú¶—"w³m)åäFBÎuSü¹dçê¼ËÎÊ{H<ˆ»fL {l ‡-$ݶ“ºIÇv†ÓËRK¥Fµ6ãâ©^kcNõ6Fx—€oÛšÛX°g¢ß¥¨SÛá@öÌá@æÖÞ}º:ÝŸŽËlBË<¥²3ïIîšùhl[;0ßsUþ¯Qmˆ ËLÞF=°”IY¢D]M\ä†[Ï¡xÄ‹äôt®ÎÇQTd#Gh¬êÝ<¢n<4k/[O[–—;Oßy[G„tËîKÏÉãf”ඳºý~*sòôz;dÙx±Û]§‡“~¡yÌb6±É-Èçær¦ÆÇ1–,1,ËéDÝXt¸ † Þ¥ ¢õÄz9WåÃ(&:¹½èäHî3/š-ªÇ¼]ΔÊá´c¦×AGŠXÐ9‘£©ƒ<„ŽSU>ŽbŠ &ò¹­w;ÚÃÅa$-‡Ÿëá!ï †déh s²Î‡Qm’‡(²·‰OÁHW]ت´¹vƒ”}αÉìue#eÆXåÞT?/ú^ ØV r:BŽ[äÉ^G’«óñ°)F#Fu3;!´Þk»#”×Åìêq>­eÂ]j´yàU)ÉêÈùx¢Ÿ}¯‰Îr,×LW¤ù˜ÂáRïd7ÑrÐPÎö… /úZοnCÑWù¬›µ›—CzÎæâvÍÏ[·kç`–ÔÚá¨v‘Í,9 ­Õ–ÛN__g¾Ñôè fÙ¥âé-òÊC3vý[tE@kL|dMWâxþHz‚)¸â(ªú:ì¿>NÉrüSû™ñ‡bê#‚Yí¿î£âsÔJ}Æ•VÜ×#ÁjÉȶ3¥mUÜn_íá,ûdRŠVN¨’ö',ŽÐã\“$ÈS´¥„ìÏëŒCwÙX—ù]³?)+„å>ZK»¤Lf±%¥ÍC‰äÞËF˜Z;œHh&Ç¿3 AäD’ÅÊIÐ,Ç7Ÿ[Ç©*Ç8¢éìY(o6ŽM³³q„/gö™2ñ„$³ê’<«WϬ?Wü©*Gñ{üÒo:ô-ë‡ý'o69äÞJíðN÷çŽ2Ê€@Qœ·Q×áÉŒ2 -›5MœÊ(#ÒˆúM¯É(å9¸1ÒÛóåÉ:&v¡K„Ú"ïixϤaÛìûd”÷m¾&£TjcFYä5Á{xÝÙŒò\•cò²‘T_Ðò®Æ±iöõ¥ÜV•‡ÙŠ§SÊ“u>Œêur4‹ÙéŽy—Tþa} •·àÄâK™,ëj9,r …*¶úD×Õír6í8Zˆ&åPXm× Ÿä©Ií±¨ý“òTG çíþB™Î¯¯©™o'+Ý8Š×Oš†å8^KRú‰ÈõÄ®(Sèõôäô´@û½?Ý_û[Oþ×£}ë ÎMûíTï$Ï椫ôÚ~ØO㯗XŸþuõ ΃´¿dy`ßH¦“ÊUž8Ζ(×isUÑîú f}±Ö¯½”ü’•×oÈ£×uZ狵ü¯u¹È_Í¥äh|}/Ž­äìÛÅ ¿\ä½H¬™Çùú²ן¶·Å®Ôl´ü™Ç¾$cןãL?ƒ¡Fê‡VMžWeÛ -Q}bséX!¢ft÷d½5n%Ë»¥$ô,W±‹b“ÄÑ ÏeGƒ£â!Ù‘ˆážh§îÙs“ÇÉ»ºêâ vÑgÕ¹iú[YŸ¦é|F¼]Ð-í©/*UÞhÓšjÚõ¶Óhªtjh%û„pŸ'…t»(Äïlkš1™?Íš¼`!æfHÜË•VN!Ý.j¹µµÐg*õRyT-MóC”aê”»âÚmzî%ÉËò&±Ô~nÉò˜DŸk›'»ñwÄÛy0ß‘_.!)¥ÃÀ -šéÍDšÚíäl‡½ ªY~Á5Mžª–ÿ¨*ÈS8î&%·ÆÕèD|³“·Jšé±£kpœFÙI].¥n³³¾\¶JyÝ^ºklCT6Ñ‘ÚÞtìà±%»nu,ÖôÓ±r&Ú&ºäÐMùeCr†îªÁö΢›Ì=ôv9vì|™É©Ï¸“×\ty{»“Í7â­6Þ“Åôsëde9Ò̧w6‡`…A0úRÉÍ[;:É«ûÚÏádZĽ]þr©aÎc!!™h$'omš³.wýo”ùŸÿ¸ðõŸÛk–8ŽzëßwlÝçH&ïøË'ÉòοFìn3=O°?È.²¡YCãÞOxÍ£ºÀÞJºŽ ®sgb:œÈ¾›®<ë14žo;-öDæ[çfìå’ÚàdûM^0ѤÂÅ<’sUG#$_§&q%EGH—ýTs£¸œ:,C²˜bs']õ"?ÏS!7æ‹)K<avnºÑê(¦"Hi¾˜–;´£­²‘GúÍîõÍ󾊛µC{§¾ÌÔ>0¡vÀÓ©T/ãö²Çª»»Íy‡†z[4ùõ$g¸ÆH-xs1ÛèDÍ£ÚZ Ìr£m:m¢Ãh¶Ñz‹©É×jM-uÄYÕRê9Å þeÖt˜g¥+1̳ïÊJ»-âõl‰zfsNctv”ì¹dVhq®Ý©©ÿñ̲ -endstream -endobj -327 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 326 0 R -/Resources 4 0 R -/Annots [ 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R 336 0 R 337 0 R 338 0 R 339 0 R 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -328 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 507.723057 101.433071 488.973057 ] -/BS << -/W 0 ->> -/Dest (cb9-1) ->> -endobj -329 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 488.776036 99.933071 470.026036 ] -/BS << -/W 0 ->> -/Dest (cb9-2) ->> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 469.829014 99.933071 451.079014 ] -/BS << -/W 0 ->> -/Dest (cb9-3) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 431.934971 99.933071 413.184971 ] -/BS << -/W 0 ->> -/Dest (cb9-4) ->> -endobj -332 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 412.987950 99.933071 394.237950 ] -/BS << -/W 0 ->> -/Dest (cb9-5) ->> -endobj -333 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 394.040928 99.933071 375.290928 ] -/BS << -/W 0 ->> -/Dest (cb9-6) ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 375.093907 99.933071 356.343907 ] -/BS << -/W 0 ->> -/Dest (cb9-7) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 356.146885 99.933071 337.396885 ] -/BS << -/W 0 ->> -/Dest (cb9-8) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 337.199864 99.933071 318.449864 ] -/BS << -/W 0 ->> -/Dest (cb9-9) ->> -endobj -337 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 318.252842 99.933071 299.502842 ] -/BS << -/W 0 ->> -/Dest (cb9-10) ->> -endobj -338 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 299.305821 99.933071 280.555821 ] -/BS << -/W 0 ->> -/Dest (cb9-11) ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 280.358799 99.933071 261.608799 ] -/BS << -/W 0 ->> -/Dest (cb9-12) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 261.411778 99.933071 242.661778 ] -/BS << -/W 0 ->> -/Dest (cb9-13) ->> -endobj -341 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 242.464756 99.933071 223.714756 ] -/BS << -/W 0 ->> -/Dest (cb9-14) ->> -endobj -342 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 223.517735 99.933071 204.767735 ] -/BS << -/W 0 ->> -/Dest (cb9-15) ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 204.570714 99.933071 185.820714 ] -/BS << -/W 0 ->> -/Dest (cb9-16) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 185.623692 99.933071 166.873692 ] -/BS << -/W 0 ->> -/Dest (cb9-17) ->> -endobj -345 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 166.676671 99.933071 147.926671 ] -/BS << -/W 0 ->> -/Dest (cb9-18) ->> -endobj -346 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 147.729649 99.933071 128.979649 ] -/BS << -/W 0 ->> -/Dest (cb9-19) ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 128.782628 99.933071 110.032628 ] -/BS << -/W 0 ->> -/Dest (cb9-20) ->> -endobj -348 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 109.835606 99.933071 91.085606 ] -/BS << -/W 0 ->> -/Dest (cb9-21) ->> -endobj -349 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 90.888585 99.933071 72.138585 ] -/BS << -/W 0 ->> -/Dest (cb9-22) ->> -endobj -350 0 obj -<< -/Filter /FlateDecode -/Length 4932 ->> -stream -xœÍ]K$9n¾ç¯Èó£ÕƒÔXÌa5ì1¼ðÂû`øÐ]ݵ £ÆÀ¬þûþ¨ ="ƒ•™½[]¨® Q¢ù‘T(”îlñóƒÃ™œÉ¹¤Hç—_N¿ž¬Ilñ¯ÖX]TòŸð›øì,%îÄÌç_¤ $“ -ûÏo'üwu9W;ýÇoNÿ³nãÎÞ”½ãó_¿ -‰‚I9%Ë -©€d]PHÌ&%ÏQ!Egp‹¥h$ˆÁ‰9ÒHÃN -ÉYÈá¼µ* ‚X¢àšc1èQ£ygb.¾¨´šK^£…`b"ÇN£cä¬Ñ²p±N£1daGd5d¡“F‹%Ä`Udñ9– ‹Çè…–! ´+«4Èb£u­Ã%©´šÍ)oiÞ²á‚ÕhΆn•‹Â$ŤЕVŒKqÅn1ÊÆÅX4,`à.Uа€»€Ï¬a0ÞÀ£z ¸ë<µFî:_¬† ÜEÜÀ@ŒC aü›qª«ÒŠ±%g ¸ XòÀ ›$*-(’Ó°`l,âP "pî½hX»–Cа w-!ìQi%d¯aâÐ`¶ŠM#X5Ö)4p×:Ì°FîZ›Š†¸+nS˜¤Àg  Aì5,ˆ™LI)jX‹ !ŸJ‹׬aA²(`@–Jƒ,”HÃÖ¦„’5,H²ï5,H² dа)Ñ·š@¨‹šdA¤¨aÌäB¤aAâˆ| £ªÑ¢79®UZÍ% R"Wì4,@.e2Œ^ü‘pIÈš# R,0 àŠLöˆÌ5šƒ,²5,@¤ šsdY jX}F–­†ðÐÈ%1Ô¬ä™YÂLÑH¨¨aÌ™&R¥AÀ„†˜I¶YÃ$?H6‘æ¨4Ș4,ÈÙKº™5,Ȳxë5,€nJ¾™4,(² âÓ° Øh$LÖ°0šµ—‘ozÒ°v)ùfÖ° ‹|)žb·%DÉ7“†… #DQiASQ옄|è¤Ñ"dñ…4,(1J¾™5,@˜|½º$%ßLêrp— I£w™F p|‘­–Û[/'Äg:1KÆ™Õ èeøVuÉÀ{á­’ºf`¾’#©‹™eŽêªÜ*ˆÎªËø‹xŒ6˜pY}š—¨"Ô!Ágæ$7Y`„è¾ç£Zx§Úe}ì¯>ýöœïùÏÿ{zýM])k?Ê(JbÍb"¾`ºW¦²#dèˆ -c !à#mDˆT†°¸,º‰pÅp·åÜ?¸µÈXdvfêÑÜ/2‡© -Q—õî6O’uŒ¢YäïÞ;;‚nøqìÚ¸lóôqûƒ¤Ézw›§Ëšc$d²6®ûU…Ü«¼+]çí‡!«“?*ä^å' ú ZIp‘^€? -%(™$/¼¼ˆ€°Ÿü¯óÏ?½/%¢-BÊt%å®`·ÙÊ$¢fäu[¶H=-D¶´°·aGÆPŸ‘Ķ[f² ›/ƒ ŒåsÀ¯ûrùì?I¦‰@‚!EÚ½ÆAž19ăJcL½Lap—Û á"!:Km:ÓRwíN‡²4Y‘o;”§5öË–õ)D÷ʜۗKã?ü¼6=Àò [J9{àDÛr;æz°ÍCöú=ÌɶA[L¦n§Ÿ3øŸ+ø´>Dy€ï’ª»]YÁ¢=N%›Ùéûž_HPr ÅÞVÇÚ|°JòLŸ‹õÏ«»jáΨ{¬ ·'Ö†ç]€µmý÷¬ûïg¬í|ÝXô=Övv¿ °i¬-ŸGë}i°vÓ® °¶œÞ¬,ë¶ÅEöÖ3nWýxZõ"»¥²“$êL)(Ÿ#ÙÁ6o%Ã{Ä©ÁÉö½g@éš]5–X• ·ðU~÷82¶È“w…ã>ôYoR±²–¤´>´ˆ2 W¹#¾ËëyÅF³‡ÓIÙ8–ÏX ;=/»yÁKàÞÑ©ÈÏÛ>æX›¥{Ù(Ûhò ×rÔÅÄl,bŠà¯Ø>ìbÄcSFJUŽ¢ëá ¶­÷ŒaŠÍ•Öi¹ëÞI1¨$ëzܽì—'àk­é¬ùìªõØk59Öÿä*•{ë›-géd}Ù¯³ï´&× Ü~Ëò{Lß?—ÓÃŽ‡µ‰D›0rª}íKmÊ%‡â™Í)ÿxP›( šeŠÙ2A›brYG>à¿ì×ÙwÐ&q)«3pÔÅE Z}¹Â*\¹¸(Oµ#sÒFã.ëƒH—d,k-í>>Øæã¸8ÄÌ1æpÀÅuuc)iÍþ9KI[ž÷,%)­ùâxû#ªW=+j°Q“œdÿ™ì-Dv_B¨«"·µäP“£$òfOvfù]”dÍ~VžžkŽU©ë €6ˆ¬eã.{㢅åíLÀ±&g<çì;?5]³mϸê€ë2¼|Ýý~x 5ù8Ͳ% JyÊbÒšÝ -þ4ÑÁEȲ󃉛·ýQ?Öæã {’×IÅ'ë÷Ší3­-Ç{-¥õ‰–ÒúîDë F¢õÈÝDKi}g¢õHÿ#ÑÒîýoŸhi÷p04žVÒ¶\…ÆS¢µåpOhr6‘m¬› †ÆÛ|P"+ïYy7þ{D=köÏ ·<ï •Öß“ ¦àšÂáÐøX“£$^ž•ùÌü}”dÅþþÐXÞ‡v)ÚGlÇš|œ `„:…™íSC‡5ÛýÐ8jälŽœ#y%®n¸=Їš|œ–W°8×>%4^³;0ÀâÈ­#Yã’áBÖb÷vlóa†˜-°Ï㓾ÛwµÏów‡wŸNZ½îàØ.ß±GxÛÚ½¶ßã´a -À•Öû!t÷Jëï°¨ñºg?Ñû÷umŒö%’¼†½·ÛävÕoPûu/+ð1{»/Ðͪ të}9ÁAθqòª©o‡íAƱ&ÏôÉÐ!§pÙ"‡©ÐñXh9CǪƒ»¡cÛš‡qõü* +¹Èqlõ À9ÛcM>Œ'ˆVÎ’¨çŽÝšÎwƒÀ ot,ýÅ¥£xžßø¤hlòrÚ–ôð‡?þë?ÿûGžd:ÄçHÂýââ}^zZ¼ÔáVÇ_pÐ}ѧMÖ€7–× )É™OŽì^4z°Íß{â¸Ë‹¤±9ÝÛ. y)j¶Å}.»ZÚÛX=6š’°kwC׫Ÿ×ÄW|g÷ÕÊÒmiÓw0u¹wW=R[õXKßµ( _÷œ§Qzç±d¥íìýé¸â>W£We‰Wwøz—I%9´JÞ— ºI-¦Ãa2Ÿ´|^Ì+ðåšÓ¢×*ñeœG§²‘*!Ï5×V{ÇüãÍ”¼½B=’å¦ùl³k~7^þV˜bºe…²±x×÷,›»ôWC'Ý¡©ÝÕ‰Ôã«€ý²™ùHß?׺ló-­ë•°æf“ÖÕ%žEÛr•c«qpH…srWÞÒ89UfÑžùécM>š¾eÊ·ôíæ|«3¼ÀN}öËyÞqÿ‘¸¥Î;ü${úÛP< ]ôc•w¥ãýE€Ew.º\Ñõ¬Ê—ºþëŒÉ‹þñè§éãé†ç(ì¢ÏCç¦éouˆûC…/'t®KßÔR º«6ºÞö²0 Uz)·š}B¨Ï“RôrR -°5a2;}š59iðR˜›"Q¯WZ=¥èå¤Ö[¸qŸ©ÔkåÑ´´‘¢ U¹¼Rö2IŽßŸlĆöq]eÚ\#ðzã7…/'¦n‰£øíÄI©Í+,7Õ› ÃÄ·g;ôe”Ê {—O0ÍV&ç´Éÿ¨à^*ÈS?8ê*%g-Ž«Ñ‰Øf/^Ò\;ê6ŽÒ¨; —K©ëì<^.[¥¾€n¯ÝGlU: ÙTžJO@ªƒÇºØu­ëÅam|:VÎ…¶ îF1wU~[9¹›*ÛÞYt“ºsç;ŠcÇη¹8õwrpf—·ót¾¾TÇF×Å¢ú¹u2ŠåáMSŸÞÙT8(Œâ£oµ¸YkG'ù2€öq™æq_N9U7ç{YÆ‹ÁÉ9ÐsÔåÎÿ‡:?á÷¿Otþ—vðàÅ{ÛÑÂwl]ÏžL¾5 ,–oh…Ýl¦BOìb—G]nÚÐý¸÷^Óhn°·š®#¨ëÔ¹ÇNž«®wa¾Qør5Š=ùÖ¹ûrÚÍ¡› GV6©p1ß.ó …á’ÏK\IÕáÒA%?5ÄÅÌ—S‡eH¶SrÈOóTékº˜Â¹ ƒFÃÍά[Y½‹© -Bà0_ÌŒÉÍ–•<ŠÐ›×7Ïû"rl ¥Ú{éÛ\ÚoLJ;à饡^Æõe÷9¡®£6ã#Ôy…ÉöBr†iŒÐ‚V³ŽN¥y4[*ðÜ)µ²U§ÍQt¸@™mecj2Å¥Y–zÇY¥ÔcŠQú—y¤yž•>ˆ<ÏJÜÔ¾Íãõh)ôˆguNãîì¨Ùcɬ”Źu/¥Q3´²mß´î»yÛót4‰#2µ£oj>„ØÎ¥ÍÕ*„V«ýÔ•—ÇQ½rpªKÁ‡úíK6ÇèÎu½•åi©äî6·×N¶+$mídî Óa(›œ|–.ÂeŸ0±jß±¥7“‡ÂÊ-Ý7ÊÒЀ9»Yª_¤R¥ëQ¿”9^¾7)HЛåë’uï¯í~^-ŸÔŸÿS†Ò‰ -endstream -endobj -351 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 350 0 R -/Resources 4 0 R -/Annots [ 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -352 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-23) ->> -endobj -353 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-24) ->> -endobj -354 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-25) ->> -endobj -355 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-26) ->> -endobj -356 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-27) ->> -endobj -357 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -358 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -359 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -360 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -361 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -362 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -363 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -364 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-42) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-43) ->> -endobj -373 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-44) ->> -endobj -374 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 340.338585 101.433071 321.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-1) ->> -endobj -375 0 obj -<< -/Filter /FlateDecode -/Length 4737 ->> -stream -xœÍ]K$¹q¾×¯¨³€å’Œà t0 Á^Â/äÇÙÞ B¯•þûþ‚™|dVTevO¯UÓ¨îÊ>"ƒ_™IŽ»Zü|ãð+³39—ùúòóå—‹5)Xü«%6•ý'|R¸:ËÉWbן…@ɤ|Š×× ~í.ç⯗ÿüÍå¿·uÜÕ›R¢wáú÷ÏÂb2)§dƒÂ*`YG -+“’QaEgp‹¥h,ˆ{¾e%ˆÁ%1Øû¬°2Ä NŽnYbøäXcA WBRXÎBç­UyÄ2“Wx.˜¥G特ø¢òx.yGdbbœÆ+&ƲÆcÈŠu/@–à˜­Æƒ,L9i¼Y(’UyÅçD/Aí…—! ¬+«<Èb£u¯ %3«¼žÍ)ßò¼ &d"«ñœ3¶I*…AŠIáyÈm(*²²^ãdaüh<àD ”³â­^¼›,9 ‹÷‰UdÁàkà#d±)j2‚Kø” ÏøL†3g |.†S" | †cIuày§YÈ8jH@²0•WŒKиâ·Ð²q1 pŠ4,À]ÀgÖ°oQ½†¸ë‘Zãw/VÂÜEÞ4,€9‡@ÃÄ7ã,LWåcKÎà.`ÉkX€(ll’¨¼d`HNÀ±±ÈC5,ˆÀ]„÷¢aAîÚ@¤aAîZFÚ£ò e¯aòðඊO#Y5Ö)4p×:Œ°ÆîZ›Š†¸+aS˜„ೆÐ öÄ̦¤5,ˆÅ‚‡”OåEƒë aA² @–ʃ,œXÃ$Ö¦PÉ$YÈ{ ’‡,H4,@F`ŠCö­N ÌE0dA¦¨aÌä¬aA -ó1hUãEor\«¼ žK¤Ä¡ØiX€¹”Épz ðFÒ% xŽ5,H²ÀU4,@(2Ù#3×x² ÉÖ°™.xÎiX=dA6¨aAö³Ìh5,@„Æ\ªÖxlež™5,ȤŠÀM0ÓRª<Șаã#“í a&?˜lbš£ò Ö° g/ÓͬaAÎÅ[¯alSæ›IÂb! 2> ŠFÒd ãàY«aAqóMÏÀ/e¾™5,(d1ßÄOñÛBQæ›IÂÂ% EQyISQü˜„ù&ÐIãEÈâ kXPb”ùfÖ°iæ›ÈèÕ%,óͤ.wC2i<à.2Ó¨a.0ßDf«Íí-€7$äg:3ËŒ3«+Ð[Õ% ìE´JêšøÊI]4€˜˜Y樮 ¬‚鬺l`¿ÈÇø–Õ§y‰*ÂbfNr“nÁÈîûœc£;Å–õ±¿ÿåòí'ßë_þçòå7u¥¬ý8?q¬kÌobñã ¼2µ=2 Z‘«ˆð]•DŒT†˜À¸.»‰˜Æ¸åÚ¿¸­ÐY¤vHgê½ñ¦cLF‹¢.íÛ+}„´·ªÿ§ï/À˜e}3^'%ÂÑ<¦ôýÏ—oÿÇÿ×?ÿm~ÿåòÃoe-ÁZÎÖʺ‚ü…áX~Á‡A[¿Ì.ÆÞýô»ÿº~ÿÝÜ,ÇD‹¹MÙö#M#ū͇¼T—ëÚäKWrÍk÷üeíæÓJëµ]E㥠Oøöǵ®Ðã½öáôWÖÛû2ÑÖ¾¥Oí¶G›7·?©¹ìo?´&äöÃÚL\éqífÕ¼}9½«a®ÛÚuë-¬t·¶ ÍÒæZ®ÖùqmGTK“*¾ ÕK¿•ï‡Zk“k;N"ZZ>õÚ¯m§¥¾óT%_·ºâÏ‹žš9ˆ¼u¸ót¯qé§Êüy"¹¶?-÷[MFꥇ}#e¸§·­oÏkßmØ×{¢8Ú¬ôuL4/°²h€˜”ö--åÿ=à¢.m""àYV¸EÆ‚X *¦î¶>{èóö:ïB˜X02^Ü›¡â%ÝA ÃDÕò Ú„Ö뢆~é1Õlòn´ñí¿|÷Ýþù?ø4S«Þ×aõ·^Z=¼ }3»K\ù“ÇVSYÿò“úe¿£u‘…L{¯óC€7Ræ+22ñYýo¯óÿ£~n½.êï—b#M^ñ@ýV¦¼zUþÝ7NP+®Ãò·zöú_Vžk?®Ci€¾–åm{÷†Ác^Ęºâíöý -¥o{ñHq0Â¥\an.’Ü=–ì\ üa Cpäv¨Öä@5Š^¶ƒº„´u€w†ÓËÒú7:j;;lÆÅS½ÖFðS[³6òN–|ÛÆ‚;S;eÈÅ_”z´¥µ¶ƒÝÝoÜÝÇËVæYÎÚ/?u§‹¡Ã;Î$ dH:‹¬a€ˆï|dº§ªü£mˆ+ËìLÞFÕ`5Ùç*} Dáº3„ΑŠ½;M±ÙË”ò±ÏÕyE̵ýCÏoÖ½QÚÞJw´îiW§y׎ß=¤Üzä¾ßÙcº—~9çů›BÙÜfýþI—©—Ý˽»ÿýýíï!¼(†øÛ½º‡“<6ÇMfYI–õƒ,“þ‡–y®ÊÓ¦<Nè¶$ÝÃ?팩 rÚ*ÿVÓ=o'’ÕW—d!3ø“ËG‰àÉ:Ï£TÊ““·^zû>ö~ylÙZl›-›ËI¯Ô&DcsŠ×lb!’5éÇÃr¦Æó J’ö¨ÀrôA¹Ù¢ä’;äÏUyÅ Vˆ1ÓCk1¼g™»L©Yt›´ï•É6Êr²<*8ퟬó4êÄÌ`U(ݳ³Eý#¹/ß댾­ï”¡Þ}è]ÖevÈ;%Ú•¿ ‡µÍ_1”¾[¦)Ä> -ÍíÞë³—ÙO ÜÓ$‡Àâå %cšFò”á(.¬ó<¦Éldʉϙæ?øÓ‡NÌ秕.7…kY†äÏ»!ó”eJ·^ïçö^ì“ל¯¯œŒ}§j<ÏÀ'y5 º¼)öqö†²<˜BJ“äuc:ÌOÖyÕ”h"<"žô ëuY^ì°CánÝEËÕö3©ö¢ÁþG®yô§6ŠÕ):-û¢}°ÉÄ`#ç³qªÆÓ {ð€îdååì·xD¨ïéŒúš£©7y” ž«ò<Š‘·ýÆBxq'ìœlÈ7n1¿‡³MOtHCúnl 5=»Ðr²ÎÓ$9ÈÛAèúÎâqu´ÉfDšms?ÌsèýÔê<|Ü´y,Ñ·µÃ‰Å ÉáoÌB6ÒûL@‰³è¹*ÏcItÊåÎBÿ[bÓÜlažèÜ]˜ÈYkË}Ä$9àîå{¬ðSUžFᲇ¹‡œq¢†ïöàWUOÞå@ ÙýQæõ¸èGe^…$ŒFLâzXô#ò¬mwÑJÅEªïkraÇGˆ~²Îóå„À?9'&ýñÄ×æ„ÛæßšÞÖ–™$Ïe½õ&[by²c…3“WkÿjyåÈí4™ÏfF#CS´w&3š2´ÛÞ’9w‰ìÅö²eÛÛtøòÉ:OƒÉ²•Ä pc„?$ -îÚûa5"¿f!bHuž½]3´Ã´ß{kœœ÷µ.³vïë1rµú¯æc²¢tÛvÏM)ØŸÖý»0X{ rv™ìh-Óvànt‡El¬ÊªF’«Ûáövo+š”ƒû(_«Ã'Ùë~ok«ÿ¼h³¾ÕWM¶'ÆeyÑMvŠ¹ž}Û€¸n(l!EŸu#àgÛ1ôM‚ëþUøºP'eÛ®´<¾·-¶õ}Åu3‚ÿd—͇²ÛmÝè¸i¿íqäÙlü,ËÛË=Ü ã/—XÏlpõܳq^ö»F6b@99'"[J6W-ÏVÔšõ8Ä_z)ù ’•C“dA§ë|±–ÿ¥øÏ™3ˆþÅk—ÓÌl%gß.ùõ"§Ù±Bfn› ÉB\¿ÚÞÜÂïh/@Qàö¾¤¬˜®_û.˺ÃnùŠ™oõC«&§ °m…¨î³_:Vˆ¨Ý-Y’egi6´^Å.JˆMfGƒ<— ŽŠ‡dGv"†[¢ºdÏM'¯™tÕÅAì¢ÏªsÓð·²>MÃùˆørA·´§¾ªT9‡¬5Õ´ lo4š„*ZÉ> ÜÇI!½\â7¶5ÍÌΟFMNsYˆ¹÷r¥•SH/µÜÚZè#•z©<ª–¦ù!Ê0uÊ]ñ -­êh¥&9âtòKíë–,gô±¶y²C|¹îž8ȯ—”Òa`… Íôf"Mívr¶Ã^5å¦*¸f£ÉYò{ŠÐ©‚<õ‹ãnRržÍ¸ˆovòVI3=vÔaMŽÓ(;© J·ÙY_.[¥¼€n/Ý5¶¡N*›è©4ñ¤:xlÉ®[]' „5ýt¬œ‰¶ î9tS~݇œ¡»j°½³è&s½ÝAŽ;_grê#îäp¢.oow²ùF|©÷d1ýÜ:d™]5óéMÄ!@aŒ¾VróÖŽNràjû:œL‹¸/—¿^j˜ó¼äù‘œœµ7g]îú¿(ó>»ðõßÚá.K÷¶£…ïغ!Ï‘LNfÍ'ɲ™º»ÛLDÏì²Ë£lhÖÐã¸÷^ó¨n°·’®#¨ëÜ™†'²ï¦+Ç Í„Ä—{"óµc3örIíæРɱ@M*\Ì·ƒË> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 709.923057 101.433071 691.173057 ] -/BS << -/W 0 ->> -/Dest (cb13-1) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 690.976036 99.933071 672.226036 ] -/BS << -/W 0 ->> -/Dest (cb13-2) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.029014 99.933071 653.279014 ] -/BS << -/W 0 ->> -/Dest (cb13-3) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.134971 99.933071 615.384971 ] -/BS << -/W 0 ->> -/Dest (cb13-4) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.240928 99.933071 577.490928 ] -/BS << -/W 0 ->> -/Dest (cb13-5) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.293907 99.933071 558.543907 ] -/BS << -/W 0 ->> -/Dest (cb13-6) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 558.346885 99.933071 539.596885 ] -/BS << -/W 0 ->> -/Dest (cb13-7) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 539.399864 99.933071 520.649864 ] -/BS << -/W 0 ->> -/Dest (cb13-8) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 520.452842 99.933071 501.702842 ] -/BS << -/W 0 ->> -/Dest (cb13-9) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 501.505821 99.933071 482.755821 ] -/BS << -/W 0 ->> -/Dest (cb13-10) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.558799 99.933071 463.808799 ] -/BS << -/W 0 ->> -/Dest (cb13-11) ->> -endobj -388 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.611778 99.933071 444.861778 ] -/BS << -/W 0 ->> -/Dest (cb13-12) ->> -endobj -389 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.664756 99.933071 425.914756 ] -/BS << -/W 0 ->> -/Dest (cb13-13) ->> -endobj -390 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.717735 99.933071 406.967735 ] -/BS << -/W 0 ->> -/Dest (cb13-14) ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.770714 99.933071 388.020714 ] -/BS << -/W 0 ->> -/Dest (cb13-15) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.823692 99.933071 369.073692 ] -/BS << -/W 0 ->> -/Dest (cb13-16) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 368.876671 99.933071 350.126671 ] -/BS << -/W 0 ->> -/Dest (cb13-17) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 349.929649 99.933071 331.179649 ] -/BS << -/W 0 ->> -/Dest (cb13-18) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 330.982628 99.933071 312.232628 ] -/BS << -/W 0 ->> -/Dest (cb13-19) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 312.035606 99.933071 293.285606 ] -/BS << -/W 0 ->> -/Dest (cb13-20) ->> -endobj -397 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 293.088585 99.933071 274.338585 ] -/BS << -/W 0 ->> -/Dest (cb13-21) ->> -endobj -398 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 274.141563 99.933071 255.391563 ] -/BS << -/W 0 ->> -/Dest (cb13-22) ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 255.194542 99.933071 236.444542 ] -/BS << -/W 0 ->> -/Dest (cb13-23) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 236.247520 99.933071 217.497520 ] -/BS << -/W 0 ->> -/Dest (cb13-24) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 217.300499 99.933071 198.550499 ] -/BS << -/W 0 ->> -/Dest (cb13-25) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.353477 99.933071 179.603477 ] -/BS << -/W 0 ->> -/Dest (cb13-26) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.406456 99.933071 160.656456 ] -/BS << -/W 0 ->> -/Dest (cb13-27) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.459434 99.933071 141.709434 ] -/BS << -/W 0 ->> -/Dest (cb13-28) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 141.512413 99.933071 122.762413 ] -/BS << -/W 0 ->> -/Dest (cb13-29) ->> -endobj -406 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 122.565391 99.933071 103.815391 ] -/BS << -/W 0 ->> -/Dest (cb13-30) ->> -endobj -407 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.618370 99.933071 84.868370 ] -/BS << -/W 0 ->> -/Dest (cb13-31) ->> -endobj -408 0 obj -<< -/Filter /FlateDecode -/Length 4928 ->> -stream -xœÍ]M¯#»qÝëWhmàÑ$«øýr²&‹?µÄ梲O -gg9™àJÌáü³(™T‚OñüqÂ?W—cñÓþêô?Û:îìM)Ñ»pþë7a1™”S²Aa°¬#…‚Iɇ¨°¢3¸ÅR4ĉ=ïY bpÉAcA ö>+¬ 1ˆ“£=«@ Ÿk,ˆáJH -ËYÈá¼µ*‚Xfò -Ï¡ô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx YB±NãȳÕx…)'! E²*²øœHã%Èâ¡¢ð2due•Yl´Nã2¡df•WÀ³9å=ÏÛ`B&²Ï9`›¤òàQ¤˜ž‡,ц¢ò K ë5AÆ_œ”rV¼Õ‹w“%§ñdñ>±Êƒ,| |„,6E àAFpIß’áâYŸÉp次€ÏÅpJ¤Á€/Áp,Iò<ï4 YG ÈA†çª<ÈB…5, YP@Ã"Èâ™4,  -ÃZ4, À-Ûâ4, à-[5, .Ä´—rd  S*0—€@îž4,  .…è5, À.qŽp—ØY ¸K„š*²À€5,:r™4,`à.9›4,`à.ÜÈkX€Q5°Ã¨alÅøœ­† ÜõÙ²† Üõ S€ÊK>H0p×Ü‚6sw}°^ÃîzöQÊþX5îB‚@¬†˜ïÁó¤a3a‰†¸ë -¦?ŧVÆå5,À]—1|*¯— qÅo¡eãb,à.&*Ò° wŸYÃ`¼ÁŒê5,À]G˜©5p×ùb5,À]Ä A؃q4,Àüfœ…骼blÉYÂÜ,y 0 ›$*/’Ó°`l,âP "pÓ{Ñ° wm Ò° w-#ìQy…²×°q xp[ŧ¬ë¸kFXãw­MEÂÜ•iS˜„ೆÐ -öÄ̦¤5,ˆÅ‚‡OåEƒë aA² @–ʃ,œXÃÖ¦PÉ$YÈ{ ’‡,4,@D`ŠCô­¦æ¢æ Y)jX$3¹0kXBD>­j¼èMN€k•—ÁsI”Ø`*v —2N¯aÞH¸¤aÄϱ†©@¸Š†˜ŠLöˆÌ5žƒ,²5,@¤ žsdY jX}F–­†˜¡‘KBÕ­ä™YÂÌÑH¨¨aÜ™&RåAÀ„†I¶ƒ†H~l"ÍQy…kX³—t3kX3dñÖkXÛ”|3iXP,dAħaA±ÑH˜¬a`)vYûëŸO¿þŠÉ÷üçÿ=½ÿª®”­ŒŸ8JbÄE|Áp®LmŽ´ºéÔEBøH"•.¤,.‹n"$¦bL·åܾ¸­ÈXdvfêñØ/2‡¡¢¨Ëzw'ÉÚu”ÑÂAŽyTR#ÈÿT½NÖyº^Ç~»’4Yï®ó,Yií°†´ AñY&ËDu¢ÉL™RIï«ñ 9ÑDX¥¨x™‘3È%,o -ÿ×Àiéþ²îÝ.±#14ëíùËϧ_ÿóO?ýã?ý;ºýò~úÃÖrþÍNþ¿üâr-ôÿ:ùéôÛ/[5Àä¡(„‘¥:"ª¡àMÍÍUyHu !»FÀ‰ÀLÕ|~Suóykˆ„#Ù ¸Ø´& ð|Q3&ÝúñYVýðqº·xL=NÒ“¼ïÀ†ÃÊ5¦Æ +•!MøID¢Ø%c¿HöÖ¥”;©åP'ILõ Kù©Ä׶4@ÐiKÁh'Yv«áçM[›«ò2¶†ü )(âN§»'"K~ûÌbAKäwöH-7‹~‡:¶½ I÷9RA²^“?’l®Îë«Õ‡Þ–)­\À›ݾ¸¤ŸÎfD Ûæ/SÀQm™ñ™A­}Ïiª-²Î§Õ†ºÝ!À;'„È—Gúæ–î}0U¥6Ï;Ǻ ãCý#v,ÀS¯Ö3÷Ô•(e¾6­uúçz#G­8ŒKÅ“ÒŠû6q'ä‚KDÖ¬(¤Åªÿ؃¸àtsÈNf\¸…eZ‰¬oƒÀdפÛÀSyîÿŒ¨mÛÜýx¾uÔÝ€Èâyb–şɸf®Êë ‡<‚“5ëü@\ãcu@—Üa\s»è³âŸ“,JÉ‚#!xÍ…:Ð\׋käÉv¨ºªöî߈=9¸ÇG*mñûÇ#(´òÎùì¯Äûó6Häáz:)Ù·+·àê—öë-峟·*8×µÝ}«ô>D,8ð7U®Üïñ¸%’j.&ÒZZ“½‰”T5Ø7Ï”&G/[ŽövÑg9,Q6Î×'{É}"> -{'ë¼ ÃYùÃÌPT‡ _‡Hám»ÜÓ—yf"ámG÷FÂûÚ! R ŽËÇŽ;ĨšTÇ]Û¿'fÜ·Öæªk½-«!Á]Ê 7ÈöÃl5mÌÅ„`í%]°K²sÔHˆdáæ^R®>¸ºísu^&ô $»âæ§D‚ÛæªÙÒ6Ê;œ½F'ص֌?v70¥ÑvmÞ“¤)µ—Yá.Ãÿqf p0ÿûe& ±+qƒ6&ïw8Î}ÃBÊ6iµ×‘ y>îHò7‹©kÒ,qÇq;l½I”=­¯‹µ=ŠÄ\&ÕÚ›4ebáAvÐ…â’jéŸF9C6£‡›EŸ=°#C#†>û06¡äd׋dðùÂSàrÛÜãëo} lßâ1¼‰[[05*µïX=Sj!ódªs0> ïŒèjF¥öÌz…bêËù¡þc2%r*jí™õºËi•hýO®× )×¾•©Øl€Ñ} ÷¬×ɾg„Ý -¥ºmÕ]–åoâÏ\—‰Ò8 ª,!ý¹ôvfá'fc1é¿jöaø!`×âDtÕb3¥öOg•Úi‰?§—Б §Cܽ¼½ÄÌ9hµgÅgW_íµ™ÌõŸë¦é¡{ïËöŸhÿÙà?Ïýò²Øšçt]Í‚ŸØ ÀVõ 9ðë‘ß¾…»À/¢Mä›ô -^ˆøúhq|²Î뀟l€ F:~³ Ø“ÌmóÏI2÷mÞ“d*µÃ’`ò6ÁÜl@º±5„ÅË­c tŽ¦…ã)rªÊË ¼ÑoúÖï5’m󣑄a¡°ç²×Ð*â6y xã"’ãi®Êë €¼Ú”)Ò­`³Šï!ʶÙã§aq[>foç=Uåu„‰nYú| -ºmî±]Žòº˜¼Pëä-6yK(×7;nk}®Îë¨]Þõ·E^™~ª}oš}F¾oñž\©}G®Ô¾;D‚‚?r÷=Wjß‚?ÒÁµ{GH)‹‰éò¹g}C“Ÿ²|îXkx`L†EÛ‡­bx4ü€Ãrï£2$ZÅ°ÂñHÿýQôUÐŒ.² d–@ÿ;­€m·«Žë‘AÖî8xÝÏç¬B^††V‹î¯‡Èà äiõ£"/M{—“îé3VÄ/l`ÿU„¤HºSÖfŽf4iQ^‹Œ-}bSépúfÀ—êéc:¼ Š-ä½³Ó¯•ÌUy™ !Zy/ºž¡£n6¸#Ó."f@Pç3ýÉ:¯£.’·†˜ÝLŒeïNâ¶Í?'Óß·yO¦¯ÔþÎL £ñͺéL®ÊëI¤’ôú71’Mó÷gú1ÊûÖãvgй*¯3Y0µõ-fBÛf3ýX@iÅÏ¿”8Uåe¬l¬óÁÞ²ôùLÛܱ‚1oC„|,p -v|”ÕOÖyË»µ]ë»7{Ä~\6ñLììV½í`n`ßC¸¯íÞ×ÏüSýdÖ”Úw¼£Ô^ =skôñžžI~~?;`oÈg¤ç£­6·‹~‡¹o{‰²K^Î ;èfчºõ‚x=& õ\äXÅXI8Uå’>2r=WŠäÐO2 )ÈØvp/d(µCÏ4ÖM¾ëp2c@œ«Pœ›dçª¼Ì IÞ‰‘¸ãæp~ü]ÚFÇÒ_\:Šçñ€‰D† “âåÉÈo÷oÿò¿^a™k¤iý2µ þÕ^…/eÂZÆ_æ"÷§O†­C©8YRd;· ?Yçï=p¡<àêY«1é…Ý2=ȉ¹£/îüóÛò¿ïËîŸíãmIØÐõ.»Ð߶õZý•>„+o•»•=|Ûçò´XÔ¹UIÛºËÚÛÔ¬RW »qíTÞ·+̟ܵSÚ¹Ò\•åZïWWœ0JöOÃȬmÀð×]±Ÿ/Fɉ±TdÓý^U·ªÃÔ¦ØÉA_ÈÎå¡t„ssUþÞîÒÅ¥lrt”tœÛ™²½ ãJ*¦DWÂ'·`Y ÏÒò}Á»zn†”[°Žß«]†»w*¯vÂGå]Ém§u€;þ~9{)ÉAΖ‰Êp”SÔÃ"ƒ¸jg ÝU@²U œæS’œæZ·´&9§LSŸ¨Æ»¨±N ±‡Ärdїž/ ÀµÌªNwQwCÄÁdºÞ7Ûv«WõÇe8Þ—Ýëv™šâåÓ†&.í,m·éêë2loËT–¯ÚK߃<µ0ÜCXïa7Œ¿œb=oÏÕ3WmÌuW–#2¼€—ª¦l‰Û1H®*Ú?©Y²ÿ¥•’A²rà­¬Ôa/–ò¿Ôÿù$›®ëk~rG=‰ÚVröëE'œä$rVÈÌÆO’…¸|µ­-Y»»¢½¥’)×%1sÚåkiËtzùêÃz7R?¬Õä„8Ù±^‰\:Vˆ¨Ýž,w„p!ËiîÙÐr›(!®2KØØä±lo°W<$ËùöD;t×ÉrÖÌZÖ·¯¥9ˆMôQunþµ¬OÃpÞ"¾Ð-]S?Tªœ!½6µj‰÷J£A¨Ò¨a-Ù„Û8)¤·“BüÁ®M3³ñ‡Q““8/ļ·re-§ÞNj¹¥µÐF*µR¹W-«æ»(ÝÔ)7Å+´ª£…šäç)±´~Ý’£ŒÀ:Ö6vãwÄ·“l³Ù‘?N!)¥CÇ -VÓ‰4´ÛÈÙv{éTD‡‹ªàš+MÎ1”/PU§~qÜLJ¢š~Õ;ßlä­’Fzl¨Ãš§^vP—K©Ùì¨/—­R^@·•nÛP• tD¶5xlÉ®Y]# „­úiX9í*ºëäÐLùcCîr†æªÁ¶Î¢Ì=´v;96ìüÉ©¸“ƒe›¼­ÝÁæWâ[Øøš,¦Ÿ×N:YVWói Ä.@¡“;Œ~Tòê­ äÇ2Ö¯ÝÉ´÷íô—Sæ</t$'ç¤Q—;ÿÊü„ÏŸøü¯ëÁœ—yÜÛ†¾aë†<Îdò«y’,¿²±›Û DÏìw²Ë½lX­¡ÍãÞxͽºíÀ¾–t A]ãŽÄÐu8}3]ïhÐL¸A|»Òb d¾wlú„}¹¤õæÐ É‘®«T¸o—¹ó¨OÉç¡I\IÑ>¥ƒË~¨ˆ‹±Q\–.ÙFL1ȱ“¦z‘ŸÇ¡µ¾ñb#ä’:û4;6½Òê] EÓx16Ìnì´läQ„~ؽ¾{Ü‘ãêBmÐÞ¨#µÝ˜PàéTª—q{Ùæªyæê¼]C­-|ZÓ]£‡¼¹mt æ^m)ÆNy¥m:]'Š Ù•ÖZL«Lq©¶ª¥ÞqVµ”ZLÑ©5ÆQiJ ã¨Ä]YiwñZ´D- -£9§~w¶—l±dVhq¬Ý¨ÜKÒJÛ÷ÍÛ¾×Ùö<ÜwAbLm¯v%¿G|çRçjB+µþ­+#.÷£¬1Q³Kä©þ:™Í1:yFŽ”À(ÇŒ¡©õ7èôj²ÑL¹¥û , u˜³»•¡úCCø³,µË$©¢ü®IЛåçP’uêRQ]B¡ÍòIýûÿ¿ht& -endstream -endobj -409 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 408 0 R -/Resources 4 0 R -/Annots [ 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb13-32) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb13-33) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb13-34) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb13-35) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb13-36) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb13-37) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb13-38) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb13-39) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb13-40) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb13-41) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb13-42) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb13-43) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb13-44) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb13-45) ->> -endobj -424 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb13-46) ->> -endobj -425 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb13-47) ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb13-48) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb13-49) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb13-50) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb13-51) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb13-52) ->> -endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb13-53) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb13-54) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb13-55) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb13-56) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb13-57) ->> -endobj -436 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb13-58) ->> -endobj -437 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb13-59) ->> -endobj -438 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb13-60) ->> -endobj -439 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb13-61) ->> -endobj -440 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 169.815391 101.433071 151.065391 ] -/BS << -/W 0 ->> -/Dest (cb14-1) ->> -endobj -441 0 obj -<< -/Filter /FlateDecode -/Length 4517 ->> -stream -xœÍ\K$· ¾÷¯ès+’H½#‡  bd‘ŒÖíÝÁ8€Cþ~>ªJªfw×쎓öbÅóË ÿÛ=ÎÅ_NûÅé_Û:îìM)Ñ»pþ郰˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ ±1BbÏ׬1¸ä ± {ŸV†ÄÉÑ5«@ Ÿk,ˆáJH -ËYÈá¼µ*‚Xfò -Ï¡ô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx YB±NãȳÕx…)'! E²*²øœHã%Èâ¡¢ð2due•Yl´Nã2¡df•WÀ³9åkž·Á„Ld5žs&À6IåÁ£0I1)<Y¢ EåA–@Ök<‚,Œ8(å¬x«ï&KNãÈâ}b•Y0ùøYlŠÀƒŒà’†>%Ãų>“áÌYCŸ‹á”Hƒ_‚áX’†dxÞi@@²Žƒ, ÏUy… -kX@² €†DÅ3iX@@[†µhX@€[¶ÅiX@À[¶.jX@\ˆi5, .åÈ ¦T4, `.;5, €.Ü=iX@@] -ÑkX@€]â5, à.±³0p—5UdkXt4ä2iXÀÀ]r6iXÀÀ]¸‘×°³j`‡QÃØŠñ9[ ¸ë³e ¸ëB€ÊK>H0p× A‹ÜÀ]¬×°€»ž}Ô°†b€?VÍ€»€ §«aâ=xž4,@cÆ#-Ñ° w]AøS|he\.QÂÜuÓ§òŠq WüZ6.Æ¢aAî"P‘†¸ øÌã "ª×° w!Rk<à®óÅjX€»È‚†0ãhX€øfœ…骼blÉYÂÜ,y …Í@•— ÉiX06y¨†¸‹ð^4,ˆÀ]ˆ4,ˆÀ]ËH{Td¡ì5,@^ÜVñi$«Æz …ÆîZ‡ÖxÀ]kSÑ° w%ljX“|Ö°dÁ^˜ٔ”¢†±Xðò©¼hð4,H„ÈRy…kX€ÄÚ*YÂä! y¯aAò)ƒ†ÈLqȾÕåd¹¨ë†,È5,’™\˜5,H!b=­j¼èMN€k•—ÁsIÂ”Ø ; °–2N¯aÞHº¤aÄϱ†©@¸Š†E&{dæÏA$Ù ÓÏ9 ²‡,È5,È>c•­†ˆÐXKBÕ­¬3³†™£‘TQø Vš@J•Y`~d±4,Àâ‹M,sTd¡Àäìe¹™5,Ȳxë5,€mÊz3iXP,dAƧaA±ÑHš¬a`ü ëûW?¿ûêô›wŠdàqqà°€õˆœ€Tëoþôç?üõOc¬X‚£]éSú‘>ñãÀ´ÊDEäÙ—2£ö?uäæär»¥÷]—wcDÈ&›Ú‘aÕ¬æ®Ý«ò9v÷s˜›ljß±·»ó­Ît1ÞN}öÇiÞ‘ëÉƶóYw$Ö˜¡é÷Ú·<ËœûfÃnkßM¶°ÚÍbÇøûÛfçËó}-ë?Lãk¶F?Íëïɧh­ë/«}XË´g±ÑËb£].šÚ· ¿cý]i^km—ÛXW›?¢z?«þ›¹·¼ÕÎìùN²eZg&Dø£žd®WGÅCcÕc/WÞ9Ë&yëÆ;;ÄÕ»?.í5¯Û‰$‹Ù¿n§kœ×¶â]9J¼%‡c©3ÚÆWgjA'E6yA-ûX”¶«…áÜlÃZš5ÖñK? áãúl'}»Ž2?µî:î9›¼jŠÅ¶¾¥OmÜ£Í{º%·hm¬ÞPÛ‰+=N'¦|y,{×Ã\·µëÖ1¬t·¶@]Ú -Jâïo×vìj;M‡î¥ßÊ÷C¯µÉ0ûÍòSŸý„"QžïêŠöºâ«lÐiLK?‹/r˳ýn‹L2öŽBö®²gƒ´ÏÛ&ÇâóÃnP\m2¬tºé¯Þʦ>ÖÄAißÒ•ë«GŠ՞)Ù¬¹#ÍÃZ/@Ôt=,¿¾Î'e®¯Èa‹ÐýÑ;êòn´q›ÙUWŽë”úk—­Sïoš•?¹o5›õ7£šÉK¨H(áG¤ ‰²”¬ó¿Qÿ|ˆÕwÔoeûŽWË»ü£å)2¡Åð¿›÷çPºoóð‘oMƒÏ&—L }¤ý»E?CéÛ^‡.å sÃtp‘Í—û’«ó Ê71!x̆2&ÐÝ6–”EXŸàáô²ÔÒ©)ÙÓÚÙ`3.žêi ¹^%Ï»ÝÔÆ‚;S;eÈÕ›z´¥õE„Ý÷*ñÝÊ<˹$¾wdÝébèð†3¥bØ“¼pID‹åâ#Ó=TåÿhC\™¼÷Wxû|?-?K¾5)\Uc°lbŽXŽŸ¦ØìeË÷®ÖyE'ïØ€Úþ®ç7ëÞ(mo¥;Z÷€Ýr»{׎ß=¤\{ä¾ßÙcº—~ÜÖ¹åů›BÙÜfýû½.S/»—{7þýøöcÅ¿ÜË¡{¸w@t±YÞôÊþ~–Mùû–y¨Êó&K,ÍrÈNõð÷;cj“œ¶Ê¿‚ÕtÓÛò%ç’¼(IdrL.?JÖy¥F9ùæäTê]oßÇÞ÷-[‹m³es9è•úÄdk81§xβv$yg|ZŽÔxžI),B–œoLŠÑÊ9èä’;äUyÅÈy¡bÌt×Zg ïYæ.Sj}kk\Þú m—Wù‡³ýƒužGrTÑJ·ìlQgÿIÓî´µc¯§ õîCo]AÒy§D»òwá°¶ù3†ÒO–é@ -±Bs»·úìeö wÃ4C4>z9AÄL†äÀ£¸t°Îó˜f`#SN|Ì4ÿÏ?}êÄ|¾[é2(!p½nÑ‹v(Üí»h¹ÚÕËòËößrÏ£¿ÂQ|hójárcêÉt9õˆC5žgÚЬ\žz•G„dÏLçMä£lðX•çQŒÜJB 7‘´µK³µ}ø‰™aÊõÌž•sðÈ?#÷H³Çê|*rÿϹ[ý¹øTÃSÛ•TÞh>ÜhÐÞ@6ߟð¨ãÅüöòÆÛÉnúû7§û·óÛÒ†KsFÝƺǿ Óøý÷ô짹èì¦âârÎä¾yªò4%RdKÔë[âê«×¸äê2ËÕ‘mãó) Ûµc6Ö%dºJm™YãEA·ì`Ôñ!6Ý/úfØ”åjÒ`9£LÅôhOõ`'Ä&¹“W„V͈òrÌçå ¯ø ÇkiÝ’#·µ\ZWÞu¶Oö×ë•— DÏ}Ƚ2Ý é -}Xäþ®ïÛ´Ù=».·çàѤ|ëë%•$×Ãn‚¯§‹Û)帪¢-âÊtRz…ißÎ -|Mç¹þ0¢~?··ž/¨¯¾ÓÏÊÚq7Ú~¶¾BXÏx¹ õåÚzqÓ~;ƒ:ɳ9—Y– ™e WÓøã)ÖkŽ®^u·ðz¤uE^β Hå,W+³%¤ãë´¹ªhw¾Q³~AèÇ^jý¨•ï ÈÓå‹CÓÃZþÇ:á?œœ¼‡²‹a/±•,‹Ù=ùå$€a…Ìf–’åãfØÝf"zž`]eC³†ÇåöVÚѤºÀÞJºŽ ®sgb:œÈ¾›®ÜHš wˆ—{"ó¹s3öòHmpè†ä&}“ -ópð˜FH>OMâIŠŽ.û©"æFñ8uX†d1Å çNºêE~ž§‚¤¯éaJ#ä‘G˜›n´:Š©R`šæ†ÙÍ–<ŠÐŸì^Ÿ=ï«È±y€P;´wêËLíj> -endobj -443 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 541.623057 101.433071 522.873057 ] -/BS << -/W 0 ->> -/Dest (cb17-1) ->> -endobj -444 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 522.676036 99.933071 503.926036 ] -/BS << -/W 0 ->> -/Dest (cb17-2) ->> -endobj -445 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 503.729014 99.933071 484.979014 ] -/BS << -/W 0 ->> -/Dest (cb17-3) ->> -endobj -446 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 465.834971 99.933071 447.084971 ] -/BS << -/W 0 ->> -/Dest (cb17-4) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 427.940928 99.933071 409.190928 ] -/BS << -/W 0 ->> -/Dest (cb17-5) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 408.993907 99.933071 390.243907 ] -/BS << -/W 0 ->> -/Dest (cb17-6) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 390.046885 99.933071 371.296885 ] -/BS << -/W 0 ->> -/Dest (cb17-7) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 371.099864 99.933071 352.349864 ] -/BS << -/W 0 ->> -/Dest (cb17-8) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 352.152842 99.933071 333.402842 ] -/BS << -/W 0 ->> -/Dest (cb17-9) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 333.205821 99.933071 314.455821 ] -/BS << -/W 0 ->> -/Dest (cb17-10) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 314.258799 99.933071 295.508799 ] -/BS << -/W 0 ->> -/Dest (cb17-11) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 295.311778 99.933071 276.561778 ] -/BS << -/W 0 ->> -/Dest (cb17-12) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 276.364756 99.933071 257.614756 ] -/BS << -/W 0 ->> -/Dest (cb17-13) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 257.417735 99.933071 238.667735 ] -/BS << -/W 0 ->> -/Dest (cb17-14) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 238.470714 99.933071 219.720714 ] -/BS << -/W 0 ->> -/Dest (cb17-15) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 219.523692 99.933071 200.773692 ] -/BS << -/W 0 ->> -/Dest (cb17-16) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 200.576671 99.933071 181.826671 ] -/BS << -/W 0 ->> -/Dest (cb17-17) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 181.629649 99.933071 162.879649 ] -/BS << -/W 0 ->> -/Dest (cb17-18) ->> -endobj -461 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 162.682628 99.933071 143.932628 ] -/BS << -/W 0 ->> -/Dest (cb17-19) ->> -endobj -462 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 143.735606 99.933071 124.985606 ] -/BS << -/W 0 ->> -/Dest (cb17-20) ->> -endobj -463 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 124.788585 99.933071 106.038585 ] -/BS << -/W 0 ->> -/Dest (cb17-21) ->> -endobj -464 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 105.841563 99.933071 87.091563 ] -/BS << -/W 0 ->> -/Dest (cb17-22) ->> -endobj -465 0 obj -<< -/Filter /FlateDecode -/Length 4916 ->> -stream -xœÍ]ϯä¸q¾÷_ñΖ&Y,þ{à Y#† ìÃ"‡Ù—ÁÛëüïç+µDR­z-J¯'èí™V‹,‘U«(Ší^,þ|çðWÎä\R /¯¿\~½X“Øâ¿©Äêbbÿ ŸÄ/ΆdØ•˜ùå!P2©°Oñåí‚¿n.ûâo—¿þæò?k÷âM)Ñ;~ùÇa2)§dYa°¬#…ÅlRòVt·XŠÆ‚œ‚[V‚¡dÖXP#xŸV†’£-«@ Ÿ\ÐXPÃN -ËYèá¼µ*ŠØÈ+<Ç&¢Ó£ÆóÎÄ\|Qy <—¼Æ#21ÇNãcä¬ñtábÆcèÂ.«ñ K œ4^„.ɪ<èâs"— ‹Gï…—¡ ¬+«<èb£u¯á’CPy<›SÞò¼eÙÈj<ç Ã6IåÁ£0H1)<]¢å¢ò  “õ KÀœ`J9+ÞêŻɒÓx ]¼OAåA ¾†>B›¢ð #¸¤a€OÉ„âƒ>“ 9d |.&¤D øÂ&Ä’4 ëÀóN²Ð…CÔ€t ð\•]¨ ÈCа€ºø@Ð6ÀZ4, Àm°ÅiX@ÀÛ`]Ô°€¸PÓjX@@\Ê1hX@€\˜RÑ°€€¹ìÔ°€ºp÷¤au‰£×°€»rÔ°€€»œÕ° w‰ ©ò  Xà£!—IÂÜ%g“†¸ 7ò`T ì0jX[1>g«aAîúlƒ†¸ë¦•— |4,À]ϸmæîz¶^ÂÜõÁG `(øcÕh¸ a=€.X 0߃çIÃTf< ¸ë -¦?ŧVÆå5,`à®Ë>•WŒKèqÅoÑËÆÅX4,`à.&*Ò°€»€Ï¬a0Þ`Fõ0p×fjÜu¾X ¸‹¸5,€9‡@ÃÌoÆY˜®Ê+Æ–œ5,`à.`ÉkX€YØØ $QyÉÀœ†cc‡jX»˜Þ‹†¸k™HÂܵaʃ.”½†ˆkÀƒÛ*>`ÕX¤ÐxÀ]ë0¸km*Dà®L›Ä$Ÿ5,€‚Q°×° æ`JJQÂX,xùT^4¸f ’Y*º„4,@`m -•¬aAòÐ…¼×° yè‚AÃD¦8Dßjz]`.j~  "E €d&—4,H‘¡W5^ô&'ÀµÊË๤aAJÁ`*v —2N¯aÞH¸¤aÔÏ R.p 0™ì™k<]dkX€H<ç4,Ⱥ Ô° ûŒ,3Z 0C#—DWk¼`%ÏÌä„ŠÀMi)UtLhX€ñ‘d›5,@òƒdiŽÊƒ.ÄAÂœ½¤›YÂœ¡‹·^Ãئä›IÂb¡ "> ŠFÂd ãàY«aAqù¦À/%ß̲È7‘â)~[(J¾™4,(º0B•]4ÅoIÈ7N/B_‚†%FÉ7³†3o"¢W—²ä›I].îr2i<à."Ó¨a.o"²Õr{ àå„øLgfÉ8³ºb`½Œ¹U]2°À^ÌVI]3°_É‘ÔE¨‰Ì2GuÕÓ*˜ÎªËø‹x,l0áºúÔ/QE˜CÂœ™“Üd[D÷5çhÅèb×õ±üíòÛϘ|_þö¿—¯¿™VÊ–?ÆO!JbÍâ"¾`¸Wfª.` ™ˆaÒ -ž‘%RiJ:Àâ¼è&Jb*Æt[^ê·V‹ÎÁÌtg¡o™‚ÃPQÔu=,ó(]iiî‡ôÁ*œ€(ßi8Vòáz!- ˆHl@V3D³‚Ôwy„¦è ‰Q"JQñ‚épTDãhº/ü/Ÿ.pï¹ùëÊq½ìôF¶…õ˧_.¿ý÷ü×û3šýôõòÓ÷ֆ׾sòo‘ÿ‘ÏÿùòéÇ;µË솸¸uíR¡¥=aéHk­cd¬|ö*‘!S¨±©Ä}¸àœ¬Íñ­/HœfóÿŸ|ýÎîZáï>­¨‰Ò–R¦eú{#·ƒ2§Pã[€*ä”觢… Ú¾ƒÃl"Ù,±Óªº oæN±u<‹ƒƒÆ¶Î}j(Ò|E¿f¾Îf°h8k¼XûÆ,ÒÊtZd5É ¼s÷¬bHäyŒêy«O!‡bU]oüs›&ÏÔ;<"¬É‘ŠLD²š=eu÷;|Häy:<ÉS.Öësv™»Iïž,‘{AŽ¼sÝ/úîXµ"Ï˲ØÝUè~чG^VS˜Z|,˜iƒ {ˆ>(ó|q —Ç -²—¿I ¸®þh$¸•v¤Ý‰Á#7NÅ–XÎh ö2°H•þfñd‹ê4Gã¢)½7uáÙ¶†#‘‘HŠ ‘nHï¼<ïûјÌÓ`²‡©3ǘé!“຺Ÿfòs "f$ŸÅä3Û÷½·ÆɺVZØ×½ŸV«1Þšô7s‡–£l[•ý5ö¿Þ¾|N²à&‹©bE‰Ân"?&ò4†'[²+”ÞÁí|'lU»L–/rôòlA¶«Ñô8änŸ ÊM)F·¦u(ÏòãRñ¤Ô2–gµGÛŽäY²£m%^% Ë´TöÖ+ež\afûÈm]Ýq<_;êf@"ÚÄtLa8®yžáÍœ}x“ïÆ5!Ë[.øýÇ¿÷‹>*®aÙŠ?ôWJ‘Ý^¼ûgPæùâšiokFÀ¨/Û£©ÉÞý×ÙbËŽøÈD›ýÄþ<þ(u­ÞO]êZ!1Ü> -ÉJ¶õÊ-LˉsýÓ-å³#·µÒ×$êž=*zåvû5‘¼«åb"­¦%ÛÈJeÓ}ÕñŒLÐGät»{¿èÃ6"ËäyhÜÜ {ežÐaåí5[ä% Íaùs)¼®W}ÚjÏH$¼nèh$¼•f^?*­RÖï[ŒªiuuÜ¥þ#1㶶:WÝöÛ¼ÂîZfàqt·‚¿mg,&ìk«é €M“£y Ô{¤ÈêRnÚÂyß/Ædž&ôˆVö°Oï;>"\W7™-­£¼ÝÙ«s‚mm'w6t°­óH’¦HϳÂ!Ãÿþج:†Ø‡¸A“¯ãŽs¦íöÐLÁ%þÈãqG’ýÌYL]Ófø1¦,%ÊžX«çólíŸ÷b±DªµWmÊÀƒ¼KÆÅ%ÕÒß‹¢ÃlëPÜî}Tô€¨Ýxøì‘‘¡âîÞœA™ç‹äõ£€ry@¹®îüú[[ÛÖ¸oíé¾"}`õL‘îCæÁTç0×·Æã}ÕãVzd½Ž¸˜é„|ªý¶›@»÷‘ûŸ^vŒ¨Dkp½®K¹¶µŒmí`tSÑõºe2íˆÞ‘8Ýu×Õ]ü“yž(-KT iýñôvFá'fÌ -‰ÉßT{~zØÔ8]µØl+}àù¬"æøsx ýŒ-:s÷rŽG!³&=(>ÖÈy{k&cíçémŽtêÞÛ²ý;½ÿhðï績Al͇Âz_‚ŸØ ÀVõ 1ðë"¿M ‡À¯`>ŽÉ‹iá…ˆ¯÷Çežü’•õ%þ¿QlIæºúÇ$™Û:$™Šô·Ï#³0!6Æ1GSˆxwŠy#‘×ð2šÖ÷|ØHVÕßNŸ‚7ä3MKòcï/Œ‰<Ï°„T)—{›ÁF;¾…(ëj÷Ÿ†¥(ûå™ñŽyžŽÎ²UÑÊ)]HA×ÕÛì8ˆÀ”䱉œ ‘ótÆÁý^“yšnÏÓÁ*$§Þ=Ò¾×Õ>"ßÖx$W¤„àŠôáüŒ-?s÷-W¤†àgÚo!¸vï)e11]?GÖ74]ð)óçÀZÉ1émO[E÷hø„Ýrï‰Qé“VÑ­pœi¿=ŠÞ± -é‹,™%Ðÿ U°cä+h\×==XÖî{ÝÏǬBŽC¯Ý_w5‡žåiõ‰Q‘ãüËI÷ô«`ñ ËÁŸ² -FHŠ¤;emæ¨VAƒV倠Ȝ޳Š¡t8}3àKõô>¾ àb~­dLäy‚’Í‘’Ýë› dú˜Ü ¥â"gúƒ2ÏÓ],‘xŽIß÷Ñ$n]ýc2ýmG2}Eúƒ™~Žr†““³»F3ý1‘ç1’,oI9J÷ö®~ÀHVÕÏô3ú¨Ø ã& c"O3ÅÊKCÁÆ{'Œv|Ë„ÖÕîgúÅôU’Ó%Gg1‘çéh¢iïr|Ì9!ëê:8 _Jàñ÷ež§‹Y°ê¾spS¿GìûyÏÀ.ÀΪW Œíì~ÚH»¯Ëgü©þ ºõEúÀ;1ŠôüXè‘[£÷÷ tç½{?sô‹A*Û±û»E?`îëVŠ¬s0fè}…î=¥ÐÍÆš?ÍÇü%iå'äð»ÒXõÚ-²£Ï4šê1#/îF7ñû8>ÆšŒü¾P~Ú3’äHLñóßýá¿ÿ˺×agþËÕæÄà|l6'×,Yzйk†5•‘H-ϘçØÑJä&{iñï[·ƒMëxñZ>|·‡‰]KÙxýLuÍߧzæº9Íí}–MsØ‚KWþª~žÛîô™êàîx¹‡jñË0þz‰ÓÑ®n:ÞÛÆi2–;#;ÜåŒ,ÇÂ}67u´{yGrúÕ”_k)ù$+g«ËÃÇiXû‹¹ü¯Ó€ÿr‘]MÓ>z_ôÀNdh|K~»È^…Œ É’…8µµ.Ù©vC{…£%SnK;-µrâå«çånDž19ŒTvù/Wâ׆"$£Û’åî¸3Y~8$š¯bU`©ÄVaè˶ -›à.Y^ykDÞm×\#Ë!aKY_¿–:æ VÕû®sÝð/e}ê†óñõ‚fé–ú¦Råç -–ª–ÞÅ̶ШSªT*/%뀄:N -éõ¢¿³KÕˆ£\åw£&‡>_‰y1¤PË•¥œBz½¨åæÚ¸ŽTª¥r-KÏ7Uš©S®¯Ð¦>š©I~ ©óKË×59Ê,cì Ùß_/ª'6òÛ…“RšVX^L¯'RWo%gÛì¥QS^º -®¹ÐäÈ\ùû -\©‚<ÓªIɱ×íª5"¾YÉëNêé±¢NÐzÀ…ÔÊvÝ…ø¬Úlß_.[¥¼€n-]{lEíº¬£§²¨' UÁcMvÕê*Y l韊•=Ñ.J ¹FæjÊo+rÓ“««²­E×™;×z9Vì|ëÉ©Ž¸“3Ì«¾µÞÎæâë4±…[²˜~^id ãó©uĦ@¡‘Œ¾MäÅ[+:Éï2-_›“i3îëåï—išóÄòâ(ÒI'?ÉÑG]îåŸ(ó#>ÿ} /ÿ±œ}ǽ­há+¶®ÈýL&?à”ÉòƒN ±ºMGô¡ƒýFv¹•åÅê<î}‡×¡‰ÛìKIWÔUnOäÖ‡ÙWÓõŽºžá;Ä×›^¬ÌGǦMØ×KZnÍœ¾h…‹þvp™Ú”üÒU‰+)Ú¦tpƒïqÑWŠË®ÁÒ4[©)Ù7R»^ôýPÈóõþ¢ #ä’/´i¶¯z¡MwÑALýE_qp}£e¥¢ôi÷úð¸Ï*ÇÅ„Z¡½Rßzj½1¡VÀÓ©4]Æõesh:ãqqÞÖCµ.ê|jÓ\£…auÑÛhGÍMl.À}£a¡­]&Š - Ù…VkL‹Nq[ºeºã¬öRª1E£þ½ïiîG¥v"÷£7e¥ÞeÆ«ÑÕˆ{sNíîl+YcɬÐb/]©¡•¤…¶m;¬Û^fÛ—î6BS$¶ÈÔ61Þ”<…g|ç*s³ -¡•Z­Œ¸Ü~5up‰> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb17-23) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb17-24) ->> -endobj -469 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb17-25) ->> -endobj -470 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb17-26) ->> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb17-27) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb17-28) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb17-29) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb17-30) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb17-31) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb17-32) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb17-33) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb17-34) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb17-35) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb17-36) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb17-37) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb17-38) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb17-39) ->> -endobj -484 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb17-40) ->> -endobj -485 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb17-41) ->> -endobj -486 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb17-42) ->> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb17-43) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb17-44) ->> -endobj -489 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb17-45) ->> -endobj -490 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb17-46) ->> -endobj -491 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb17-47) ->> -endobj -492 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb17-48) ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb17-49) ->> -endobj -494 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb17-50) ->> -endobj -495 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb17-51) ->> -endobj -496 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb17-52) ->> -endobj -497 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb17-53) ->> -endobj -498 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb17-54) ->> -endobj -499 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb17-55) ->> -endobj -500 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb17-56) ->> -endobj -501 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb17-57) ->> -endobj -502 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb17-58) ->> -endobj -503 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb17-59) ->> -endobj -504 0 obj -<< -/Filter /FlateDecode -/Length 3174 ->> -stream -xœÍ[KÇ ¾Ï¯˜³—É"ë:p(ˆ#Brr×’`@Î!?»»3Ã}I2­vwš¬›du/Ÿ __3~TåPk+YÏwNOJ"üÛF\\lìïñ]Ò™IKHÜrMçFJK±äóý ?®.×á÷§¿}uú×å>ÇÐZŽœÎ¿¼3–J(µJ«E,+¥PJLÙae¸ÅÖ<ÄHE£Þ² -ÄÐV“Ç‚cuXbˆ–[Vƒ±°z,ˆÁ-‡Å98¹<Bª§¡ôìñ"‡\[l.¯€Ç%z<‘‹rb×BÎ9U§%5b— KbUòxE¥—!‹d!—Yb-âñ -d‰ÐNsx²À»ªËƒ,”‰=^“ZUuy <ª¥Þò"¥ªy<æà›âòQ0R./B–L©¹<È’„¢ÇÈ¢øòxÀ‰$¥V'Z£E·°ÇK%Æ¢.²ÀøÄ Y¨dAÁpÉÀXJÐÕX%hÕê¡@¬-h)âÁ@l)hnÅÃ!/²B%iö@²("×åAiêaDÈ‚ˆ@–¨âamÞâan•{X À[%Îb’‡Ä•šÕÃä•š‡Ì`§‡ÐE¸ ¨+)G °+Z³‡Üeò°@»"˜éò Øàc®âaw…©xX À]„Qô°V ðÃìa|%ÄZÉÃîÆJêawcA -py% ÅÃîÆ„[ð27p7&Š(p7jÌÀQð‡Üj¸ I~9Y° ߃ÅÃ,"Ê p—ÒŸÓ@«Àµe p—+ÌçòZà;q -ιyX€»HTâaAî>«‡Àø€Œ=,HÀ]djÜåØÈÂÜEÝ<,€;Fàaò[`‚뺼¨ÕêaAî–¢‡ÈÂ*Äå•Gb ÆP‡zX»HïÍ ܥ$âaAî’¢ìqyEjô°u x['¦Q¬Š@ -Ü%†…=p—¨4 2p×Ò¦‡¹!V `@=,ÈUC+%{X‡’Ïåå€ëäaA! ËåA-êa -ëФU J„,£‡%B”  "Q}»íd»¸ýBTŠÉBmª””ÑA«/ÇP àÚåUð¸xXPŠ¤bö°½T¨z ðÁÊ% x¬”Y* …Q™{<†,(²=,@¥ ³‡5BTƒÔXÑefò°½$Tíñ”¬Ï¬TÍÁJE &è4”.²&<,€}¬ÙN ùA³‰6ÇåAIêaA­ÑÚÍêaA­%Rô°¾iýfñ° dAÅçaA£¬Lö°0‘‡+úͨ .­ß¬4!ô›hñœ¸m’­ß,4…, %ŠËƒ,(šš·À$ô›@'—!KlêaAËÙúÍêaÊ ô›¨èÝ#jýfq €»©™<p•iö°è7QÙz½=xSA}æ3«uœÕ=1 @oBnu Ø‹lUÜ3øZä@Lt–5»§H«`2¹ÇüE=¦7˜°Ÿ>­GTîP3k±›l Eu?zŽ9L¶ŸýòÓé›·H¾çŸþ}zÿÕvRÖ¿Î/š­±N"±ÁÜ€«°-§(!kB›² ù>aŠ‰PÚ‘ŠÇ‘›‰ˆDŒdÛÎã_ - yMbF)³Ý—®Û¢O`J²+éK§|!I§‚5ÂKHW ¡àFž±¤î)õ™s¾¸V×}§Ž&âÉ™ômÆ(ÄJÞÃpÕP [Ùñ¨Õž9çm·4äEC‡¹ %“g8æÝXö8i ÛÐ|wüŽÇï6 ­ï/C$å˱I®ø=´è ß]Îó;½¯Ã“×åcx"îÅŠg4[æi*ÙQc×À¶C¿Ãr)õ¦¡º¸ö¢÷î -0ÒwÍÎ:WšÛd¹ÖÆûÉ£‹ô¹w‹V®5N/ -Åg%tßhÝP¶ö|éÁhÇç"۱ʣaûÌ9Ÿ“ðè(õ‰^zûŒ„õv·Èu”m´îºÌÓK³qc8iÏÛûÕó½NHóºáQåùÔciñ:C%=¼­nrÜzœ¢ûKµðÕ†yœØ©Ñî=h2Ÿ•ÝŸ7åÿÍßdKiúÛ£öîšûþèuÑ-r$ÊUkÛÒ:}=9ä ýÜ6Ú½Ö>óUu{évXÒ^rI"ÔЊ =ätñÝy[µ8‹ZÉG`Ø–ðâ»cº£ò[UK»cšÓê»#áÐá´ùpâ÷{Z5úVíäý{Àh>Ö9ÖÐÛÃÙïŽê¨^­ŸŽ½yô q©ßëk3~<åí|“·g\„Ú›£½sÎÄìD­v6*:ZzÞÍçfn¯}£Ž·‰È0ÚáòþªÑrqŒÿ¸üɛӿ¹îþäŸ6rýb’ïOöæ‡:dÕŸI6âñ‘ÆZÊ}à ÝJh×#^t|lcq‹¹ýcLýnl~êÓìD%qìWûÆ33ß’íî)ðA¶·gjã*QRî2[#2Ôuì\pN|’ÌB 1ÝiÙn’£vyØž¶ ÕåI¢¯ªãÅü}l,‹9#Þ°­\Sï]ª}©®ÝHƒ&‹PmPS9 ¢ÃNéî俦¾´Â˜ƒ¿XÍž|ìÄÚIǸÖÇ9¤»“;îX- K•1ªÎ©­k~Š2]]êP¼CÛttP‹½¸ÄòsìvXÉÙ,ÐmMuñ›xC¼;%‘8É÷§TœÑib¥îz+Q–u¹Òô—IEÃq¨ -¡Ùivnl?w¨Hƒjȳ}`.eÏ~æÕÜÄbs/•´Òó@õ4ÀZæØE]\ÊðÙU_Ö5ÝŽ7У‡Æ.¨‹Êzi]<©—d^7Èa]?+W"u!°Ý$§áÊ÷ä)g¡šhl–yq÷4Öä<°ó~%—aq¶yCÞ±îâóx·%6½&›ë×¾É$GÙnn¶§`…Iž0z¿‘{´t²—ûÇd^ƽ;ý|ÚÒ\”í(# Û{)kÕÅçÿ`Ìk|ÿó¤ç?õ!{4Ð"l½ ¯™ÌÞb¬Ï$Û[8Âf!F]`’¹Î±©{ÃÈãÖ –+šM§ ì}$åÁ]‰iêp!ÇẑeÑLz„xw¥ÅQÈ|®mfÂÞ/¥ß¶{„Ö¥ÂÅz;¸¬“'3%Ÿ—%qeCgJg{^°LÄź(.— Û”ìBLsÈu“¡z“_WSˆíµ\,e„]ÊäéL³ëÒ¶ÝÅ2%°¬ëÂÊë¦íBGèO¯Ï¶û!rî`Ôíƒz¿RÇužO•í2_^Žœ#Û™PÞ©¡±–,±'£È™¡1K ½¸X}t¡Ö9íÖMµÓ.6í‰bÀhÔicÅÒeÊÇ´®–펫«¥2jŠIýyÕtZ­2”˜V«ä›±¶nÏx£Z’Q¥Õ˼;š#G-YZ^gªÎ‘Òi·{ëåÞ=Ûž—ÛÐ)Hž•)Íiéfä'áߧÄÎ>çêÂÕ¿¶“®óÕ$jå"Q¶¿¡š30Dí…¾¢u9*yñœÇÏNnOHúÙɺÌT„ -Ûßõø"܃ўf,Kõ¿ùñ§5roée -xðŒ[† m/volÛѸ,Ö*Úßqˆ½Õ^?-ÄîQÑv„’/ŽO¶¯ÿ÷ž„ -endstream -endobj -505 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 504 0 R -/Resources 4 0 R -/Annots [ 506 0 R 507 0 R 508 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -506 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb17-60) ->> -endobj -507 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb17-61) ->> -endobj -508 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 719.279014 101.433071 700.529014 ] -/BS << -/W 0 ->> -/Dest (cb18-1) ->> -endobj -509 0 obj -<< -/Filter /FlateDecode -/Length 4966 ->> -stream -xœí]K»qÞŸ_qÖn›ï`ÜEÉ bĈ/‚,¤#`@Î"?_±›d5»ºO¬ÇÒ`4ÝU|‹?Ù/}UøùIã¿äô”RŽÁ]oŸ/_.jŠ^á_I±:)êßã7ú«V.N^çüõ3 lœbö&†ëëÿ §<ùë忺ü×:¾š)ç`´¿þù©œbŠQyA•¡RÚ -*蓼*è MÌYRÁ q[U„.'/©`†3& ª3¬‹ÚnUf˜¨¤‚:û(¨´‚Ú(%ê`ˆrÎA§ýàô 錞BÊ&‹ºŽFÒY;…è´×’.O!Ÿ$ƒ->+-é‹:Øâ­2’·Ižð6¦$ŒVC£Û*«%‡-ÆD'ê` :_b`‹ŠA¢Œ ‰xIâãä²q ˜d'—\’XÀ¤<¹­D&ûÉ…%°JCg´DVÁï‚ÄVÇ‘+ê`‹ÍNâk` H\`-l1ÎJ\`Á¶h‘¸À‚nÊZâ ¾uJ‰ ,f*‰ ,צà$.° \@)K\`Á¹Ü)qéb¸G‰ ,X×ú`$.° ]ëR¸À‚w­ÓJâÞµ9El€%.;NV'+qïZ­¢Ä¼‹ad$.@¯NÀa¸X™LJJâÞ5I9‰ x×DL¢.NƒVâÞ5Mfnð®ñÊH\àÀ»Æ™ q€2” €wA!^` VâÌ÷Ð+q -› ‰ Ërwq¿qßÿ|?ßßØà ô/^· >f0o1sÄÙ?ßÁ÷cð=8øÄAöXȹ3  ¼ïolà=rbQ8YèB¹¥}W?›ÕTîjòd‚¡ åeUù5yŽW¢´µn¼Ë×v ¯KµÕSÙ©p«z½ÆºWD[ÎóÍmu^Ñõ$ÚG]Õ+y/ñ]ëNõýÖHoµP¯Ëqò*Y“DcÏfú†Fo7¨þîÝ=ZîÃßì&çR¹~E·•DÚƒ¿¾û|ùõo÷/ÿôo¿Co½{¹üûo”O*¬t¹ýBøCoó¹ J¹¤”‡Þçzüó\ßýrÑÀŒjw“ýÔOÙÈÐ»ðŒ±‰ª_×øóOú7˱[jO³ÌëåoXþV¹Ÿ- ´hÊ}˜åè‡r¾‘/iQEù-éjÙf¨ -&'4yZÛÐòW9«‡ê(:²ï=K£鞧¤½õr‹Í¡ÛËÛQl9ïë<úÚåÙ.÷²®ƒÊWæÞæíimWݧ”Þ‘M·¥×ÃbBàuñ˜2 еn»ô•TÇbÊÑ·åK—Jèvœm9ÅÕ¿¡´ãÈŽhöìP½-äÿÖ>ê C}$ÚF·eå@BÙ3f{™k v_£Ê‹£ª·•ìq±§-í§zÂb{^þ¹c5Í ¦cŒò–óOKÿxf“fé–>ÔæÐïyôMÃf6W<ÄZæ¶þ6ÎÚ8‘}E¼ák?ª¹Ê®}0öC³)°¶U¿ëî÷š¾Ù‡~ÛéçÚ†‚u²ãý‘ϬÞøŒóHmWZÛªµÄi½ÝÇf¿?7îê6¬ùê8´×¥Á^³”Éñ_ÇÐoß•YÒ¶¸#ºÉæ2KÒ-S&iãA_(Ò"c3ë£y¾*VY&ÒÉÐE}´ºª0kç¤Ü8»jWk]ÓNµõÍÞ”è^ScçÉöùåïÿá_ÙdKðZ¦=w«ÓÏ,÷–M7s'ìV˜Ã¤2Ý3TX)©t÷BëÔÅÊþ|\¢AˆîN¢P¢¹—¸ »ÇBí¹—««L¨’r—É´z¬NTö®‡L¹-Ûù`w<ä>­'y7Ô1Vï±0سäÉi-»ÛzgËVK–Þõ<Ý'×…(·ó^nê7p…5ßÎó.Œ²ä0]îcÓç¥ë´0—ÆŸÈI —ˆu½ŽbxK“³ÿ°ž@WAÝ T¶Ýo›éζ¡Ò2²wHÏ•j !,£û3Êý<‡¤w2Ï[V î£ûD¸O½¯ÓÍÒß/òh¢tsˆ¼ÖYÅ [Çòæiyâ—p÷tý?ŸGÈû} Yq™zYhÕÐǧà$NÁƺ)gOK¸u…GÈó¤ykÐÓ.Ó­‡È;™çÙ·!¯ñ³þÆŽŽ²(õË_ú}I¼Ñѱ]tï‡4—¿‹Ü˜E_?.ó6í÷›“xð8Ô‡rc­{eôP@EŒ:‰²syžeÝlzÆheOtÑÜVæ:µæ©2…ÁË{/` -š,CYí­´îÖ½VÒ|Ж‹kÞ[ÕgöËž—hÇÈlhÓB9ã6ŠéÇÍ/çë*>ÕÌÏqÔï 5…Ç‘z.ϳ!qÌ!R„èºAeÚrÆ!×ÜÖèYq×ÐÛãÛ1žå½­í+vTdÔ‘¥çQ'Ž¤¥}…×;·Ã±Yò䑧{;Z»olõ6ò§éùötãCŠ¡œƒá2Oæy:dšCm^glŽ¬#”„­×WÜ÷þ ùî[ ‹ma·Ñ Öuu4ï °Ç~Λ 1v Ä£ð\ž§Cá¹xQ\mìqÖ¶ãRWH¹ODÖØ“œK¨¯ÖQBÑsþye².Œ‹y}6íÛºâIawË݉!鹤Tž%9FÞ¹Ã#+¹={kž»«:±±ÇŽ§{2ÏÓ!ö8Þ|šð­kÞGVoß!ºydT¬Ò»c®öñ5üÉZ}œF½Ì±«¡ß¥WL8îåý{„¶üwtLãØñš}Ø^©ØÛ‹#~íé=¿Ñ}nsçß+¤Y?Η'ó<òî\§Ö·›±.ôìêêà8»Žw¤°«††¯‡÷vËGÄ>²»îôW»£¶ƒ`_Æ4iëèžý;>—çé|gÿô 1åt=²o¹º¾Å÷âÚ¦†Ž3 -Êﮞ¶ûO‰o‰§oC;ï l%÷îÍlïòìŠèdž§Cß¹xóÞµv'­RÆØIÚE$c±â_Ͻe$ï ´ÇŠ„¦Dˆºw7ÊÉ<φRrÙiþ_¦–#´ ÄhYU»sèÅ5 VO_ÛPµ‹?láǺ÷÷Ë›£‡'<}µ"d“3{dëÓ»Iîtáöµ‘õ›· ®Ÿ)A‘ôÉ›®=•#½åtï‰óiÞ?.Ï„ù¡b»¸±®8ËCõË=¬¦>…Rî0\Ø °…š4ýÔ»€?ò_ÎË~5¥ ª?»÷ÜU{(Ö”àÕüÐ/{˜¶•_neö¬ÄÍ˼TÚ°éÆ/—PÞÖ«ËÛU@Lbè“.×à&Ký‚A˜èM¿ÖéÚmº8Z_wr–á|i©–oã(z]>½*yþp;YÒ)þù¢³›Èÿåiüò UÄÉÔ“.~½ÐwLœ v®?ÒGLÂåPµ²œno¨²HŠ^˜2¤´~RËa=N3RìßóûšÞ/ëTMdËVçŠ!r½SëÕ¤1} &Mv9 Íz ´ {Ž§íöŒwÅÚ*&ô[¡bÕu±qÕMïo® ]ØLç®Ó¬ûkZYw oTkGé«(¥/PÔ¢ªwj2ËŒÊMêkÊÖ!®õ“ ¢7êl„?©Z´Cg6=ë5z÷,LH®¥Ë5 º]ÄtKi¾õTl©RÏš«ç»)ê65Ç ²{ÕF¤[±1¢l=\‹é-­¯Ub¸1áíâ]‰]\Þ¢´Mí;W(_¡Ç…–•ÛÄIu¼t)­Þæ# Í*£· Óÿ3Uø&%æ)Ú5HÑ›ÌûY¯„Æf¯Ä塱Ž“< ]ìi™»tŒ ³Ü_:)!=‘nKÝ<¶’2—1yÌÕ<"©Fk±n¨kb¢°êŸÆ•\¨ª¨®‹}ƒòëJÜíôm¨zÕ* šÁÝ·r»84î|åâØz\Ók雽­\†ù*¼•‰Íb‚~ª•t±Qm¶ë•1a7 ¤ÐÅF_‹¸ŽÖÆNô©­zØ™4ãÞ.º”iÎXoèmÁjúÊ -ºôõæüþçÅ]ÿ¹¾þkžÇjla·®Ä|&£or¥“búFW¶aÄÆ1ÚïbzZ_ÑÐæqc_»ž]ub¯)ucPÝ´\è»™Ø4èm™güð6x±2oí›>aϧ¶6ŽÞ^A/„¯Vá„7§©ëlŸ’¯¬HœQÒ>¥Cë ˈ^(NY…¹[¶2“É+i®'ûï -Ku±FЩí:קY^t••V°$-?á;Í+Í+{£¿zx½¹ß“C$mÔÞ¤¯\ÚFÒFx²Ô–Ó°>msŽ-/~¨ƒ·{¨•eÙس-ÈéC£‡nuÂ1ʤ©g[x^©«²U¥u¢ht™ª²Vb¬6…%[uKiq½[LÑ¥âžö¼Wš=ï•°IKåÖ¯EK¶@žÃ9öÖ©ž²Å’Iž»I]Oi«l[·[×]gÛ+k†ë†„™ªžÍoR~ÿ}ÍØß (¥ª?egD§þ! LÔNGklù¶©J!€C}ž*:öþÃÇóïì‡×„µ*júJ­lÂ+ù¾‚U¿`+gËJlÒc¶†:ÍmÞä¨Ëg -Ë`Ù j§‘–ŠôURKAo¢©EµófGÚB‰«í“òó¿Î$Ô -endstream -endobj -510 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 509 0 R -/Resources 4 0 R -/Annots [ 511 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -511 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb21-1) ->> -endobj -512 0 obj -<< -/Filter /FlateDecode -/Length 4928 ->> -stream -xœí]ËŽ,¹qÝ×WÔZÀ¤ø~†dØcX°à yaxÑ]3-Áè10ò¿ïÌ$ÉŒ¬Êªî{§FðmôíÊ>‚ÁÃà 3‹©Ï -?ßiü—œžRÊ1¸óå§ÓÏ'5E¯ð¯¤X]õñýY+'¯sHþü lœbö&†óû ÿ —<ùûéßsúïu}6SÎÁhþë¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS€Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbà,èlº’¨ƒ-*(-é²|NΉº J1muFùÉ'k•¤ÓzòÀ¦uQè¤-Aù,ê`‹·ÊH: [~$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØ_ÿ|úí &ßóŸÿçôö›²SV4„’Ú!¾Â00Ýí}k4ߢh†*ÿŠ…0ð‘×óóº Ç/Oû2× »—[–rJ”¥1%ª·OjÇž¿|úý—5dJ|~ÊŽeùʾ¸°Ø¿®‡;˜uÔ]fP "ÿ¼>ÒŽÁŽñº´Ç²rðٚŶËh²ÝþN„Ýo¸Oó< °æ»†(BÅ#=ký¯›z>fÿªl£‡ —1„[¨:–çéPåñÔ/Å;w÷î§ñÍ2¢è¯¢ß¤ðˆzÆeZs\Gʱp—û`ž§CêXõEˆ«-ãÄ;¼¾zàâuÎO÷‰FNkõ åPzsÀ®'sĘçÚjKËç…¶Q›¾î -QF¬{ ž=˜çÙënij7ö@Ÿ/Îûx$ó´«Å›QËšˆqæy:4_q?ºšâw:GÎ:r×v5 »ÞÃå>1õž;ÿ­rºgÿ2?{@Wü×hâ‘Î×É;è{`Ÿõ`ž§Cß8õo‘çîÙ©º‚ÎÍJéÂêܹ—öõövÌcÒƒ+®ƒyžÉÛsýU"ù3ö -§·9@ÏålâðÑ<ÿè³åÇFÃ8ŠúŠOF¯gñéÑ;¶ó<zýgCÇÞV-Ò“(ãJ§î}6TŒÅŸ -áVÑfvʼñ·l¿ó‰Ѧe¸ØHeè~ì9¯”>ð\ÁÁÛ×eîÝSlrÃíÞAë{°ó<Z¯Ç®­çÞÖ(Y=«©Õz_µÎ€;»ì­g†h`D-=W¿zj0­Ó•gWǡ׽­óoб ¦ìýîì-Ô‘¥êwîqæÑVlŽ¬<îŸ5ûw¾…Ø“=˜çٮǯ#;J«Ý¤ÀT=?ðÈC½Õö©ì$Û3>/ËùŠ£pƒ(͸ÙJAËf…´W×2Ì'p«e~m<ÎïË ó‰zÛA²½Ÿ‹æy:$_q­°žÝÜzÊžî±íqa-kàRËî¼nîË9V‡êbTцñî÷ø]‰+£±Ôi·yWL#cú]ÞƒyžÓ¿ùÅž,¨ßõkXçqFeÔ}Ýâ?—IÌ.1åæ‹ùWúyï^òÞwV¤»R4†Ç™ÀQñµÙhŒg$L·4?¬ã¡‚ÕÁ_âŒÂÛ)ã—=«éÀ> ?ßÂï±Áz}÷†¼ÞË,éýìùγ¾Ù¿ØDy[¼g™Þ¬Óõ}ƒÒK¥¹=p·“§UùNôºE­6Õ=F59ªý²Ô–j/?):MËÒiÊKùvé OœfÏPyú‡m9ÁÒQctœí¶œÒêêÍPŠW}7¾ N«.¬ovÚVý42Ǽ׻¤uWqG^­û²¦[ÆZ¹ûRǯfvÔ±{º±ÌÆr‘d?éåþ^I«fÛ•­íºê·¼ñÛÐWÍö°ÆíÌŠµo–ecóñîM·[ÂÅ–õ%Æïù$¦7jÓ^O‡ÄÑY·^hïŠÏ<óaZ·W_õcÆÚx]®Ylåc¡òÙù•³-Z›Ëñχ"¿ƒy:”ìC>ßì¥3F½Ì墣qɧ—ácYp1wÂn…9L*ÓѾC…µ«ù¦8A§ÞªÞ-ÑØ<ù€‹(”èßnåv©œ„‚hÏ­Ü>L٣ϤÜüAÞèÚ›2åλã¡oõ°ÃÍÖ;[N{¥“/ðïä,oú¹¥¢ÿ!Rô®:gºt+¿XÒÿ\:ü',¾0×åVy ˆ*bŒ=?ŠßOô'ˆ±(6Å$\>ªV–Óm XeLÞqÊcJLjùØ׉4kªe¨­¡ü¾f£Ãyª‰l9žv®X"gÐ[1µ^MzÓ‹tÒd—«ÐL¡¨ {Ž§íöŒ7ÅÚ*&ô[¡bÕu±qÕM¯7×….l¦s×iÖý5­‰¬;¯ /'TkGé»(¥×wÔ¢ªwj2ËŒÊMêkÊÖ!®õ“ ºœáwªíЙMÏzAŸ…©ɵt¹¦D—“˜n)Í·žŠ-UêYsõ|7¥C–ðû² ÛK‰ôf06F”­×bÚ"h}­ÃÙ/'ïÚHìâ÷“Bjß¹Bù -=.´¬Ü&Nªã¥Ké<Âù†f•ÑÒôÿL¾I‰yÊí¤èø~Õ+¡±ÙÄk'qyh¬ã$h{Zæ.cÃ,÷—NJHO¤ÛR7­¤ÌeLs5Hª‘ÇZ¬Ꚙ(¬ú§q%ªjªëbß ü¾w;}ª^µÊ‚fp÷­Ü.;ß¹8¶×t¦³·•Ë0_…—2±¹QLÐOµ’.6ªÍv½2&솺¸Óè{×ÑÚØ©á¶|ìƒLšq/§¿œÊ4g¬7´¼ ããúi}þ_¤ù¿ÿurç©g¢Ïó¸Q-LãÖ•˜ÏdôB³tPL/8«Â6l˜Ð8Fû]¬SOë+Ú%ŸY‘¸¢¤}J‡Ö–¼P\² -s·le&’WÒ\Oö;Þ–êb,Œ KÛu®O³¼è*+­`I[~Á všWšWöF?<¼>Üï‹É¡Ž’6joÒw.m #i#[CæÔfg¨¼ã±<Q6ˆÚe¤¥"½ÒÕRЛèMtQiù6z9¬{µ}R~þ,Q—_ -endstream -endobj -513 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 512 0 R -/Resources 4 0 R -/Annots [ 514 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -514 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 123.873057 101.433071 105.123057 ] -/BS << -/W 0 ->> -/Dest (cb24-1) ->> -endobj -515 0 obj -<< -/Filter /FlateDecode -/Length 4716 ->> -stream -xœÝ]K䶾÷¯è³Ë|?€À‡1bd‘‚f{wlãvùûùJ->D•$v÷ìXëÌN«Šùñc±ÄåYàçK‰ÿ‚‘CÑ;s¾ütúù$oþ)f£ú{üz{–ÂøÁÊè‚=ÿDí­òîürÂÍeüåô/Nÿ™ç‘g5Äè”´ç_>’ÊèÁï…eT*!5£²vð^YǨœp‹1r*˜a½Qf©ò0ÃÄ`9Ì0JF`†6^ê¥* å¥áT0CFë•°C*!X ÆhÅè¤Ýq:%¢Š¬ÎC'½âtZÎi%§‹ƒsÎNg`‹Br: [¬4Fp:ØbtðœÎÁí´`u°E¯9‡- -­]€-@W`u°E8!9]ÔƒÁV¡Á‡¥N ;Ø µàtRØÔ¬# -ä<£S°Å Yl±Z(N§a‹Á§OXíC`F«¢Ñ­…–œÎÂ¥¼au°Ï1€r°ExÇQFÐ@¼Äq€ò~0QŽTЃ &p, BŒ÷š£í`\ôh!¡S’#-`‹5Žc-a‹ÁÈeu°EGÃqV° 8.ж(£9.Ð`[´p\ A·FDÉqß!Ç„ 3ÇŒ«ƒ3hP. 9.Ðà\ îä¸@ƒt1Ü=Ǭ«­ShЮ6Áq\ Á»ÚHÁqïjœ¬¶À€-ƒæ¸À€wµžãÞÅ0R WàÐq\¬ *Áqïª Ç¼«<¦VçŒAÍqï*‹[àfnð®²Bq\`À»Ê(Çq€2€ë €wA!–w` –ãÌ÷Ð)Íq -ÜŽ ,xWFL̘[ 2DÇqïÊ€îcuq-ÎŒ[´ò ‹Xð.&*Íqï‚>Çàø3ªâ¸À‚w¥ÆLÍéÀ»REÁqïÂo°ƒ„Àqæ·A -@—ÕÅAÄ8.°à]В⸳𠘄Õù@’€Œ?”ãÞÅô9.pà]aµæ¸Àw…ÛÃê`‹Šãø5ÐaØ2cÎê ˜‚Ów…Ds:ð®>r\àÀ»4mr\à< Tà¸ð‚Ç.˜!zï8.pQ@—Õ¹×–ã/ ° ,V[Œ7À±¢Žã¯`‹VŠã¯` \Ž à QÂûf—°pa׶ÀSä¸L6„h ÇÞ:¬ÇЪœÎ©!xÐ5« ÐIÏq÷fÀT,9.ÀZjô€àr—8.€ÐIÃq°C…ãLECPðÌ9„-p²9.€§ ”[à r\TÀ*Ó Ž 0Cc-‰¦ætFÐ:3p\ŒÈUä¸Ã+M0%«ƒ-  Ž Ð?´Ø¶`ñƒÅ&–9¬¶hk8.AÑr3p\lQBq\lÒzÓs\lÇÇqAn 7™ãÐ8tBp\eÀzSŽ 0.i½8.ˆZ`½‰%3n£v´ÞôD[,\V[à4EfÜ‚“°Þ;q:[T4Dçh½8.€›õ&ÕC2‹ÌVÍËåz’ÙyYÙÆt-§|ÿ:¿ûöôÍ»2訹ÜÔNŽúëy7Æ°°TS˜#@ÔBß|÷×?ÿý»ÒBXl¢t*•î–,¸ÖB2ÐÆh¦»5t§×4°f¬¿ªv±ðZš -©ùáëdï zð›ö,(óF$æÜ„kgžGðú)`JÜ œ¦~ÏØ`0§Ëé/ýúë5«£ÏzÒ=5i>L'¹R“>ý~˜þÆeZóq>.Lƒ×ÙØÑóñµÀrºç¸”ö~,ß”ëSÝ+(Ãz/#Ft¢¬/ÏAPV̆«»²ÄT ]fbG+f|¿dGû¡ôfD“®P–z«eL7ïµ1ÍÇ —mFëSëeºdf´I¦œ†m©¼ô9·Ãs]c›VLo|«_AjT·#µ/ÏѪÄ&r‘²á•¤KÎØäšf¾ŸqWÓÛ¶AÆ1¶Ê{™Û7ÚÑúò:êØ‘4ÝßÈ뮺ÖÍg5å‰+#O–ûÈ÷}©|Œ–?UÉ·†LzÎ6¡ŒBÛÆÀ·ƒÌÎ<‡C¦ÞäÐÖSË­W#k %nÙê3î{: ß½²dIŸGƒ˜×Uм‚Ââû«3!f…}y‡Â>1÷Œ©°ÆYï‹.õÀR[îc‘ÕödÍ¥7Ô—ê]Ñiu]™ÌËoýâº>Ömñdj»Ku;>¤ªýAz ÆÐí6òúòy;>dÛ“~ÞÒ ôU=»˜ÉV>sÞ®‡Y-,x‡›Ù±ûyÛŸ3ª©âC%¯ä“ÚôV>¢ÄGE·ÑÛ—çhèÕ;~ejÁçùßÌ+OMÏV«–-¾«ÑòVkäѦ5oäýä33>mö4Ú˜RË“=+¹5{SžÝUX]|ÇnÄvæ9b·ýÍÃø€®yoY½½ws˨˜¥7Û\«ÍíkøÎ<‡Cî¶ú[‹è¼g¿%ºZwGß -šÝíëþÎ<‡Có¶ß»ðGw<nvΈÙut(õ0Ûø«-bÞœ?“ìýҶ‘·•›Gë·V>)mÜrÜ°³Æ¾êÞìo½Â³*ÓèZþ[Ckë±$.mî3G±îô>¸úóè\Ä‹WzdzûÎ<‡CèNܵó¹Qö š²EÒRW”ÑÓÄ¿¤Kˆ6Sú¶ü„Œ¡¹žÕí®Ùó£›oEãÖN®Ü–­mª|w<-5Åç4Ñð; mzÝFm_ž£¡Öîø©‚GK=j¹F<_}WE¿S¯(·ÝËë{„–ü·µ &slûÌÞ-ŸT¬ÅbYO ~ö4Ü1]³ºlGÕÞR+oçËÎ<‡CÞÎsúf}»ëLÏr»DóìÚîH©žªz=¼-o{KtÝl 鳨­ ¸ò/}¤6ÞíEœ:óÁ;ñÓ|ÊtÝ·œ=ߪc~nSFLJ+ -Æßžžæý§Ä·ÄÓ—æ>wPÖŽ’½½¢¶Š]ö®ˆ:ó}}þæÞ³víRZ߉‹¢ßâU¾âçÇsŒä”_ŽÐQ{»Q:ó ¥nÇ¿ì]uÔO)›ÕF‹ìa´*ò"ïÅœùy~Ž‚µ®zºá²: -¾·[ÃÉÛ÷uæ9\ïvúp¡iÕ•±:®&poŠV ®Ì,ɦƒ"Ýûë5§£Ù¿‚ªxûJ°3ÏÑPåwv-þʼssï¾ßL#jÇöwD½:ó);O_«¸â'óWvh·û¢zâ²Ü7K8¯®~–”W\UL!íº±rŶŽ¸ðMONR¼öŽ½­Þܾ»3Ïáкã½áþ“!áÖ½=‘¹v÷Œñ‰6Ý“XîhŸ™Í"i+H­"[½ß·êÌs8¤îDÃîŽ3Šûw“¼bäíó‹š­ òŽ€yŽ†ÈÐ÷M–‡v#ßòDá-Góíïß -‚ÃѽÎ<‡CðŽ¯úJûé~WÀ+‡jÕ¦.Ÿñ(_Aoõ¤µ÷ûy‡Þßõ3þ–ß«Œš7ݵ¸‚Æ;âŽy‡Æÿte7ôâ[¶pM^54Hø5÷¦.ÞÉö4qY³_êóáØäÞñìÎÿõÖ7JÌPtaÐPÅ=)º>Û?ÏqP³gtŒÈSŒöY,¾ÃusþzWNIªò¶ûùðÖ‹xÇsîÎ<‡CꎯúÄøŽ©«·•½õ{T‡][ßËjólÅPoyOÝÓ§]!® ö¶3ÏáûØîÃãùy{2‡]-Þùî€x‡Û™çhhFkmð£Ë©í—‰ŠÝǶ³ixëU”é¡{ý›äÓk€Ç­‘é•Âé¾z¶D~²¡œá÷ýôºyoÑS–ŽÚ£w±Çêíõs»Iv ¶|×}zû™~Z •e£H:gR‡³’¢§£ÖÞË­>^=¸ñ-Ínò̦ݨé{{RŠü&P•Þå=>M¿Îçvd1¾×Û|,Ý6¾×Û]ÓÓ{½© Æ9™ÒºëïXÖôy,'$f˜ê£ù›òÓ³OÕÏÊ·SÝ•=fzÇx¾›îaÑ?ŸÜxĈ™. RÑ9”ggÚrâ㙎5 B™ºMŽ -Ï+9ÇÓ;Ω¦=ñEç»\Oû¬.¦ô?þÓIF3PûÓ迾'F1&3ÛŠ_Ntø¢aÄÆ ªSLÂé£Èe™fÙåD'Ä6¥¶ƒ˜>Æ\8½”üúQÙt7”ߦlt(†)‘…¸VÌ‘ÓÉ¥˜î^ rÓ–aÐӕ˦X—l†°hê´¥À’qW,µ¨„v)UuE¬L²GÒG¹é\fÓ릓U÷§´ÊWݹ%¼œP­n¥/¬”ŽÍKE¥ÖU"ËteTÌR›Ræ1¹ŸÑåÄ¿©hƒÎÌúª×èð¡«0$ ™œ.¦tŒèrbÓM¥ÙÜS>§ -%kL-_L)P×!7<#Ûh’z:‘·#B§s±£H}-B…µ^NÖä‘XÄ/'ë™Ô¶p…° zµPWåfq/EJ;¯Ÿ04“ŒŽn¡ÿ¯Ta³”˜gü@'+ÈT@}U*¡±™ÅóFªå.³ŽáZ@_ÒVÍ%½Ï˜­ÛKÁ¤'ÒÍ©s‹Í¤U“Ur“yDR™<æb™Q—ÅDa©}2WÖB‘Œ@uEl3”_fâb§ÍC`O•9YÁÝær‹Øeî|©Å>÷¸¤³´²½¹Ü -óIx'6ÓŠ ú!URÄJäÙ®TV ‹a …".4ú2ŠÓhÍìDç§eq3îåôãiœæ”¶*âƒÓ’Ž†¬½.yþÒ|‹ßŸÌù/é,¢ë<®Df •¹u&®g2:H8tŠé`á$Ìæ*SÑ~ËPÒÚ„†<+Uñµ)ÙE!ö”Rf•Y[ miÃJ¬2t•ÔUËØ á¥iÅìÈ<Ú7e¾^êts¨FÓ)VÉ*\Ô·ƒËPtºLÉçªH\QÒ2¥KzCx•u¡¸¬*ŒÅ²™™Ⱥ’Üôd¿©»BS]ÕEåFÐ¥.:S¦Ùºè$ï¢JX×uÁFÖ•Æ™=ŒÑw¯‡û}2Ù¥@ÒLíYúRKó‘4/Õ㥛_æ9GŸé" ÞÒB¹,]=œ24Škaf5F+i(Ù¦¶®Ô$Ù¬Ò4Qdº€L$Y.Ñ'›Ü”-5ËxÇm%Ÿ}Š"ý±ni[÷JnD[÷Š[¤¥rÓŒ—½% [ÃÙ—»%eö%#suî,5%¥N²eÝf^wšmÏÕm˜bˆ+ž©(Ùì"å]üwÏعæi¢\ªô3FFd(§÷a¢6Òk¥Ï‘Üà8ÄЙºÞ„*TrsžíØÉ2B’b'uMèŽÁh-¼ÞVLx"î+ª¢^¦ƒùlQ°·t[0¡¡BsbÏVc”c€(_zZ*Ú8ž€+B  ½àpC(óðÉøóŒîZ -endstream -endobj -516 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 515 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -517 0 obj -<< -/Filter /FlateDecode -/Length 4933 ->> -stream -xœå]K¯äºqÞ÷¯èµ+óý /8pn#FÉÂðâLÏÁ¹®³ÈßÏW%ª¤VŸ9wÐpf0Ó­*>ŠÅ‹¥ÖW…¿?hü—œžRÊ1¸ëí§ËÏ5E¯ðgN±º˜ÕÄ¿è¯Z¹8yCòןH`ã³71\ß.øo¸äÉß.ÿõ«ËßÖyôÕL9£ýõï_IåìSŒÊ ª •ÒVPy?Åh|TAOhbÎ’ -føèŒÛª"Ìp9yI3œ1IP%˜a]Ôv«Ê0ÃDí$ÌÐÙGA¥ìÐF)QC”sÖ:í§§IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°ÅÀ;YÐ%Øt%Q[TPZÒe;ùœœu:•bÚêŒò“OÖ*I§õäM+ê0¢ÐI! -:[‚òYÔÁo•‘t¶8ü•tà ocJÂh54º­²ZÒyØbLt¢¶ ó%0¶¨$ -Àšˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.†{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»FFâôê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„1h%.pà]ãÑiæ﯌ļkœ (øG‰Ñxâåp¶€`%.À|± °É ,‘¸ÀƒwuÆô'Œi°Õ¤Sxð®Nè>Q—'áqaÜÂË“!K\àÁ»˜¨¬Ä¼ úL€ã'̨FâÞÕ3µ¤ïj“•Ä¼‹¸ÁK\8L€Ä˜ß&­]Q—'•S’¸ÀƒwAKFâÌ“J`Q'IK\2žâP‰ xÓ{–¸ €w•·Vâ‚ÞUa¨ƒ-6‰ ×@‡a+Œi«“2` -IÞU=,éÀ»JÅ,qAïÒ´)qAˆ$0Iâ8! -6„ä¦c¸ dB>Q&\{‰ ¢‚Àƒ²DlqÑI\€ÀzÊ6'‰ ¢-Ö‰ ¢-$.@D0eè[\ÀÀE\8Ø‚HQâ0Ù”²sD°ƒW%]0SŠ kQ— ÓQâ‚Ý„©XK\€µÔ”0è%.ÁO.I\3 ÓNₘa †ŠÄ˜Š¦d™K: [dK\€H:­%.H¶ ”¸ ™„UfP`†ÆZ®–tNÑ:3I\\˜(T”¸Ã+M0¥¨ƒ-  ‰ Ð?´Øö`ñƒÅ&–9¢¶Xï$.HÉÐr3I\l1ÊH\lÒz3J\lAÄ'qAVa¢0YâÐ8tJI\uÂzÓ8‰ 0.i½™$.ÈVa½‰%ž0n³ ´ÞŒd[ÜÖR¢!æº^ÑÈ{‰?¶ó{½"„z-ÖD&` ÈÆžÍôÁFÛÖ£™:aîP -Ê0óŸ¤ Zšú™Éfù@ƒðˆÒØlh-bí£Ü*ñ?}º€L‹Ë>}»dæ#¦Ó˜¿~úéòëùñÇþýŸ^/úRîëoÐøôiùt¾|–k_®½f²8¤ Ë'í<×ïõÓ½vݽºPظ¤±EwÊíÊ[™ÖCU¯–O,¥æºè_kËëÐÕó×r›-™Ù…6|ê½yîeÔúj£ŠF7ßþöÏ×O?^~÷i ÎyUUÀI¸q™fÖC<ŸËò-xþ%`œóÿ;ïAéx7;pá û~ëé›|ôÏ?úìóYdžÂ8„ª]ÊÊÐ¥;Rˆt“IéyqyˆÝ“yž ¼Ú’ð¦·*²â€žÈzæuÝ{îeMZ‚úÜIfE`mf§ÌGÏvóí,#À}a#•¡[wëÚA©u£ô\ž§C©;æØ=Ä©qŸB*7TNTÑ:#i;LÏG|yÊÐØt#JRGË -m¿ÈÔýÑóÓRY ªÜd´KÎÝCê¹Áz9}÷†¼Îl°%/Ÿª”˧_ÒQ¾ëYÖ>Óëšå¡Ûš{à”Ëw9yYÑNíКV›ê£šÕ~+µ…RMàå;Eçi,=OQÊ·¥'<ñuZ¼Båé/Ûr‚¥ÃFt }[ÎÊ‹aöÀ‘˜PwìP½-s/Õö‘çÍ2^ÛèÁ† œ Y({Fd^òϽþZÊzáHëhp±¤->ihÐ%­`“ªm×¥lÉ_ô u/¥L6(_õ{EÛ²+Se‡¾ôc{›CiWµëVúF-ŸsÝÅ/ á®ØÇ|ÒÚ}+eJ}R|`‡|Ĺs¹¬O×#¼ûpN\nnu1äõHô¶ôQ<ôMÜø&œVÿÜXßì´­úideŸ·¤uG±Œ#¯Ö}ÉÙ¤¤mãW3;êXŒ=ÝXfc¸ÆH²Ÿt¹·×­ôÅÒ®C¿å߆¾j¶‡-K.÷K'ylx6Þ½évK¸X³>g|Îö=ŸÄòFmÚëtXç¡Ú{vVЇ~ôX¯Ë5ÅV>*ŸQŸ§Óv>C€œŠúNæy×!¥ ÷|³—N{˜Ë7C©»Çåž.ÃDzàbé„Ý -s˜T¦ÃýC…µ«ù†8A§Þ¦Þ-ÑØ<ù€‹(”è_ïåvi~&Ñž{¹}˜²GŸI¹ç f¼¡dïzÈÌ™:쎇¾×A‡»­wv>ïmµdé]ÏÓSOp]ˆr;ïå¦~XóqžwÉ`”%‡Ðe›>—^8¬c òEN -Ú=à †õóéóz’\˜v/hÜeôô`¦çt†J瑽CzÁéJ`´¤g¬éTü!éÌó$KÝÆ}ôDÎ÷©—íÉ´»7ŽèÜ»u­^ê"g=jû”¾]înNÅ[#ã2ûœÒ³>û8mŒ= ®VÃifÁuéyç:ûõPáF#€Sðæ­9wÐîdžgÃh´á£É‡­èÕ–møòIÿâr-ê<;öñ2¤ùR>‹Ü˜¢¯ÿ¾”ϼMûýf¯;l]ìˆ9yœódž'AY7;è#”=rØèhS–,íØq|£N8rñ\‡Ôö†Ò£Ç]Ó›ü»Hæq¤žËótHM‡|ø­‡rÞ}Øhèíñøî1üXñmmßlÇx“|8ª±Iuã5.ÀíÚßMÉ“wFžîíhí¾±ãà–Ñ.2sãCzÇ€s0 ÜCæ¹<φ̤9tŒÔš÷8²ŽP"ày_žï>Yº§ß°zGðÎs=ösÞLÊ»@ˆ9~0ã\ž§Cá¹x±õ »µ±wT`Ù -\óÑRGsTnFúõ­Žá•5ÖêñøX…ð„Mû¶®xRØswbÈÄãÁ“Næy:ä݉!Çž¢Œèc=»™Év¾KÑ«GX-lxçèñ{ì~=Žçœê¯ð‡Ç&~ùQ»ƒ^#j3e• =~ŒÞsyž½wâÊñÚ°"ò/CÏòå|ÇÑò=eÛF>«þ˜ÅxÔø6ÔÁò>º’Û³·æ¹»ªÛAlÏ#ö\žgCl>Ž7Ÿ&üÖ5ï#«·ïÝ<2*VéÝ1×fóøþdž§CîqŒú¶£óaœý=Ñ]Ñzwôí Ù=¾î?™çéÐ|÷nâÑ;„4;¯Þu°32øîPía-ãï1ß?«ìóֶΑ•Û’ßA#‹IÏ>6|2ÏÓ¡ñ8ŽÝ»_È9×þ¶õt»ƒ}л‡+µw=بIJ ú‡cÊgwÖîÝ»}ïCò;âÕ“yž ™ZÝ X?xÚþX=´ùøÁá³…? ¶,ïF‹=ìé½ðô’³Ì^µÖ°z7ÉhÖ£ ÛWG]õðº®õéI?Š`ÓÕ9Ò{÷Î.˜¯ SÍw²ÃrèÕ–C¹4϶ãõån‰©çæ½ìe~j‡0I÷µCa>ûP…Î saÆv8[õó;å@0?è;×W*χ(ÙAÎV~=ÉìYÍåü܆M7þ| óû0õüNdÒ¤ ýhÂ5¸‰ÎÇ|¥wp&e®Ý¦gGëëNÎù§&~n©Ê¯O(z!5½ŒtîV~QÒÿ -©}ç -å+ô¸Ð²r›8©Ž—.©º -C³Êè=£ôÿB¾I‰yæ/Ú5HÑ»‚ûU¯„Æf¯Ä塱Ž“< ]ìi™»tŒ ³Ü_:)!=‘nKÝ<¶’2—1yÌÕ<"©Fk±n¨kb¢°êŸÆ•\¨ª¨®‹}ƒòÛJÜíôm¨zÕ* šÁÝ·r»84î|ãâØz\Ó‹Ÿ›½­\†ù*¼Í›ÅýT+éb£Úl×+cÂnH¡‹;¾Íâ:Z;Ío=)_û “fÜÛ寗yš3Öz!XM¿cÀ£.}ý_¤ùÿþûâ®ÿV_œ»ÌãF5¶0[Wb>“ѯޤ“búœ*lÆ c´ßÅ:õ´¾¢¡ÍãÆ0¾v=»êÄ^SêÆ ºi¹Ðw2±iÐ5Ú2Ïøámðb d¾µoú„½\ÚÚ8z¢‚^¹\­Âo.S×Ù>%_Y‘¸¢¤}J‡Ö–¼P\² -s·le&’WÒ\Oö;Þ–êb,Œ KÛu®O³¼è*›[Á’ ¶ü‚ì4¯4¯ìŒ~÷ðúæ~/&‡:HÚ¨½I߸´5Œ¤ðd©/Ãú²Í9v~¡Þî¡V–ec϶ §Z¸ÕÇ(“¦ž­$ð¼RWe«JëDÑè2Ue­ÄXm -%[uËÜâ$z)¶˜¢KÿÊ=íy¯4'zÞ+a“–Ê­3^‹–l €<‡sì­S=e‹%“ > -endobj -519 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 423.873057 101.433071 405.123057 ] -/BS << -/W 0 ->> -/Dest (cb27-1) ->> -endobj -520 0 obj -<< -/Filter /FlateDecode -/Length 4780 ->> -stream -xœí]]¯ä¸q}ï_ÑÏVæ÷`ìƒÉ1²È y0ü0Ó;×Fp7À:þû9ÅÉ»ÔR÷½3Öž‹žnUñ£DK”¤Ï -ßiü—œžRÊ1¸óåçÓ/'5E¯ð¯¤XõøDÖÊÅÉë’?ÿL§˜½‰áüzÂÃ!Oþzúï_þw™GŸÍ”s0ÚŸÿú™TÎN1Ũ¼ ÊP)m•÷SŒÆAô„SÌYRÁ q·ª3\N^RÁ gLT fXµ½Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS@£IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°Å u² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Åt«3ÊO>Y«$Ö“6­¨ÃˆB'…(è l ÊgQ[¼UFÒYØâð'éÀÞÆ”„Ñjht[eµ¤ó°Å˜èDlAçK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0rEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ] ÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö"§¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒŒÄèÕ 8 +“III\àÀ»&)'q)@ÔÅ cÐJ\àÀ»Æ㤙¼k¼28ð®q&H\ Là%zà]Pˆ—ÝØ‚•¸ó=tÆJ\€Â&·DâÞÕÓŸ0¦ÁV“N9H\àÁ»:¡ûD]žtD‹ ã­<é²Ä¼‹‰ÊJ\àÁ» Ï$q8~ÂŒj$.ðà]m1SK:ð®6YI\àÁ»ð¼Ä€Ã¤áH\€ùmÒ -ÐuyR9%‰ r”«ùÜ,Ós»LëÕõ.bÉGŸVgM3—ïA­î2ë‚P§tõÌÒ^Ä>²|/Cºù{<Ïj»Q=³--íYœ_¯¿žOm‡~>ßÿéüá‡Óï>,AW<Ñë0±„—‰îât_–·àôKÀËÚ;ð¼éZ4©ãðø8w“ºôeÙì­œËÚ1¸_7nÝUáìæôcù<[=¤[÷ÇnÇ#6? -Åj¿ÏëkËѶŸX¾¶¬ý× KÑûJ”XìÂ'qä$ÜÅìΖ•ƒßÖ̶]fL—ï -c¥'k_žÃ!ê¾×D¨x¦g)¾ñ-³ÏÛì—QeÕã+ÁyŽ†*{ßËù{óÎýûn|3¨ Ø>õÚ™çpH¹ï1ñ¸âó‡¸g[ÑU_÷²¾Ú㲋hÚ¸âd^¿ÔV\,¦à?vÙ³qᇮœÔxíÝhÜ -Z™/¥Í”U2tIÿ>Z÷å9Z7ü¯¯¸†ÿbHÐýw«C-ó=™®$´ÌGW'j,ä&ÝG–nŒƒûnï&¯²È–7“ò.ªî#u_žÃ!u#ötœ‘õðˆ¢µ‹ó_ òöíEÍdDºîßyºÕ ®DØšéwæ9"݆O¸2ë>ÕèŠÂ×㵶o2à'¢{;óÁ¾ê{ x-m¾Z¹nO3lóõÞÁû|Æ£ |½ìJkÈès,Õ¶Öä;ó½¾ëžë>ï„ð¯†ÐÃnY\AãqÇy‡Æ ÿtôöÇ+'C/•5uE쀄¿çÆÔVÛÕX¸lØ/õíp¬Œ\¯ìÌs4äú}WpŸ½¶þÕ:ì'“ö…½¿¾Åß¾?ÛiL³Á¹þ‰XëÎ<‡Cî>ÿµE’¢Ü¢#Â(ºh`qOŠ®/6ÏK4ì-yŠÑ¾\£øþÓòó]9c$‰å7óK7´º0/ eóý7í¼s…â:÷Î<‡CꆯúQðk+ZƉ´úbÏŧk~ºN4rZ«OØ fvصàÄaŽóÜ‹¡¶´|^X97:§/»B\AìþìÎ<‡CìÛvÏÏ{»'sØÕâ¦×"£9<áãîÌs44‡û>î[WS÷vOï¹j»˜…]ïáµ»ZŸ*§kö¯{èûá‘_l$¯ ï‰8ëÎ<‡C߆ŸúÈsDªî óf¥tauÞÛÅþEb+Hæ>éÎ×Î<‡CòÛb®ß$’ß#VÀ8ߟZV—£>¶Ï?¶Ù¼Ç`߉+èeþéÞ+¶;ó½{CÇÞV-Ý«ZQ1rßÂ9¬¢Í¬”ù(â·lpÇhÓ<ÜOl¤2t?·ÏKFi|b_ÁÎQ/+ÒRsñίä,/™û¥¥šß;§èU4ô‚ëKéØÁœþ—Òá?cd¹)Ô±TÞ¥Š8™zÐů'zG˜ÄÎõ¹!&áüSµ²œnã»Ê.˜—ã”Ç”Ö×gx3°¾þ4¾ž å÷5=»Ý©šÈ–§—_+„Èô­˜Î^MzÓ{ÖÒdç£ÐLñ¡Ú a/Ðñ´½ÀžqS¬­bB+T¬º.6®Ú£é½­éB6ÓyÓiÖý5­‰¬;ï /'TkGé«(¥·;Õ¢jëÕd–•›Ô×”­C\ë'At9 ÂïT-Ú¡3›žõ½#ã*LH®¥Ë5 ºœÄtsi¾õTl©RÏškËwS:Ômj /È.l¢ŒôâH6F”­?—â@=PûZ%†s#¼œ¼k#±‹_O> -©}ç -å+ô¸Ð²r›8©Ž—.¥Î\ahV½a€þ¿R…oRbžòC»)zKH?ê•ÐØlâe#qyh¬ã¤Ð.ö´¬¹tŒ ³¼½tRBz"Ý–ºµØBÊšŒÉc®æI5òXŠuC]…Õöi\É…ªêºØ7(¿.ÄÝN߆*À^+ šÁÝ·r»84î|åâØz\Ó+_š½­\†ù*¼”‰Íb‚~ª•t±Qm¶ë•1a7 ¤ÐÅF_‹¸ŽÖÆNå9 óÏ>Ȥ÷rúË©LsÆz“ñ#XMo0ã^—>ÿ i~ÀçNîüïõ•×yܨƦqëBÌg2zßeÚ)¦÷_Va6Lh£ý.Ö©§õ m7†ñµëÙU'öšR7ÕMË…¾·!›]£-kGxZ±92oí›>a_m=9Tcée+Õ*ðÓÁaê:Û§ä3+G”´OéÐ:Ã2 CVaî–-Ì$@òJZÓ“ýŽw…¥ºØs#èÐvëÓ,/ºÊÊY°$p-?à;Í+Í {£Ÿ^oî÷ÙäPGIµ7é+—¶#i#> -endobj -522 0 obj -<< -/Filter /FlateDecode -/Length 4848 ->> -stream -xœÝ]Kä8r¾ç¯ÈóÃåûs0°†=†^¸a ª²»vaÔ˜õÁß_PâCTè‘Y5íw!;¥>BäÇ”’RW‰¿þ‹V‰SðözûùòËEŠà$þå‹“¬þ>Á]•´A8•|tןI`‚Ééà¯ïü7œöÉß/ÿö»Ë-ó¨«)y­Üõ¯ßHe1éU‚J*èœ!hç•W—˜§‚.Xmת3lŠŽSÁ «udTf”Y«ÌÐAYN3TrQ) ;”–’ÕÁi­ÑŒN9áÑèžÓi%|L:±º -šÓ#|°Ê)N—„÷ÞENga‹KRq:[œ²Vr:ØbM œÎÃãdu°EÇ`8]€-­“]„-@Wdu°Ez©8]2Â¥h-«KÐÉâZ§¥.#9R›†ÕaD¡“|`t¶x髃-ÎHÍé l±øãtà gBŒÌhÕ4º4ŠÓ9Ø¢u°¬¶ ó9жÈà9 -ÀÄKè„MÚr$ £6Úȱ€ŽIØ G:9a} -© ÓŠ##a‹³žc£`‹ÅÈeu°Å$ËqÑ° 8.0¶hk8.0`[ ´p\`@·V&ÅqßZ©<Ç„ 3%ÇŒk¢·P. ”8.0à\îä¸À€t1ÜǬkœ×Ю±Ñs\`À»Æ*Éq¬¶À€…QÑp\`Á»FÉÀqïbiŽ Ы8ô+BÇ(9.°à]¥å¸À‚wuÀÀê‚À4Xð®v¸næïj'5Ǽ«­ö(ü#Yo¼ -q¼;[@°`¾‡NŽ P˜ÐpK8.pà]•0ý1cl%TLžãÞUÝÇê’P-ÎŒ[´²PÞ'Ž x•á¸ÀwAŸ‘ãp¼ÀŒª9.pà]e0Ss:ð®ÒIr\àÀ»ðÇ€ƒPp8.Àü&”tY]2ÅÈqï‚–4ǘ……Œ`V€¤8. ?”ãÞÅôž8.ðà]éŒá¸Àƒw¥…ÛÃê`‹‰šãø5ÐaØ2cΪLÁéÀ»R¡‡9xWÊ8.ðà]š69.ð:r\¼`ÍqV¤<Ç>Ièàò±:/pî8.Êbu°ÅËqk‘LŠ [ŒÖ [à2p\@$ï› ` àÂƶÀSä¸L&b²–ã‚à<â1´*§óZĺfu:8.Á -LÅŠãÄR"bÐs\‚ä.q\3 S–ã‚` † -ǘŠDÔðÌ9‚-p²9.€§ RD [à r\uD”é%ǘ¡K¢©9•gFŽ ¢õ‚\EŽ 0Li‚)YlMp\€þ¡`Ûq\€àÁ&ÂV[Œ³Ĩ)ÜŒÄ[´Ô›oŽ ’„-ðø8.HÒ r“9.C'%ÇIEÄ›Úr\€qIñfä¸ ‰x!3n“ñoŽ ’…-. -«ƒ-pš3nÁIˆ7ÁNœÎÃ,ÇÉ{Š7#Çp3o£g—"Å›].ïºfâtà]x¦žãœ Þ„gËÅöÄëü3^)âŒìŠõ:Ì­ì’÷b¶ -ìšùRŒÄ.ÀLD–ѳ«˜V¡T’]6à_øcvÅ ÓêS¿D净93ºÈ„aaáÝט£%3ɦõ±¿þùòûL¾×?ÿ÷åíwy¥¬ü)€ßXŸkð´O:¡¿ÁW"—gaÂÙÖ4‘…0ð‘80’æu½äzÁGÇ{6Ó'½ôß~¹€¹§Ucí° 34xôËÏ—ßÿáÿüÿúGôÖ—·Ë¿ÿ ­ÐHi£”´ZCߎÒÞð±ÍÇ1»ÃˆR_üë—Ÿúzh‘ËKDŒiY ÇYê®H*Žd¹ØשºœUú¾Íz?››\jÇYg&slhiI–M÷³éiþöüeP¾šæ­ÙAë·¹®0åÍçßpNe»Î&Õ¥‹“ J¯š¦ë‚46Mnm;ULž‹¢bÝFõªä3ó%m4 (]éE9]¦4Ë&»¡Úä»K+Í®Z³—ôÕþÒ’r=©+{¨‹LPr¯ÉèpÙfc[”®£²s»¼Îmf˜ø™l«ëÚ#.¯Q©][àq,m!ȺÚetüáKfSù¾½6™hi ~µv˜ò¢ càôvŒrož‡8z&\‚\¯0I“³a¾´+V±¥Ö©iê©2®Ú _Õ‚û´Ì$ó?ýôwÿ/d2”Ý?(êÆÛô …`bæsï©6+„g$- ¶É0ˆs=‰d?î—¨M‚S„“À”èÞŽr.BkÏÚs”qdrè3.·}!`ÎW2_Qn©ƒ2óí+ë¼Ùh!ûm.«´ÒPÇD0]}}ùÁž9ï4З²Ã«G°D‘döªïoyZOEÓùÀ_çQnê7ðyØŸÕò‘¢‹‰p›.ͽ°[¤Nút—¼ãÙiæ]÷ºœ á®S¿ŸÉìÒ¬§xº/‘hp¨4ì ÒÓp‰fs†˜Ü& -ùR¦»ãÑgßL„nT¾¶óúm–#“êÊøFl›Â—ù§éq9rkÝãhWË|FO¢ãç¾Æ „FYÐF‹vÎ8`û=•åIðÙ¬NvŸw÷ÿyŽ2t·z›£*ÿ„‰zߺrTšœ¶ÌM1[³æ'+Rr1¨¡Â=~¢›Ÿ÷òÓÉÆÈŸºåÛD¦©|HO®X Žµ“yž™n—CGO­¶^¬=”øu«/¸ïå ùî3¥Zú:ä²®qQr…ÂæûY§…tÖböQx.ÏÓ¡ðœ¿X{ÆvHØâ¬×.þ³ÇH¹EÖØ“=—ÞQ_©#»¢¯Sþ)2Y–?úÅ}}&nÛºàIf Ôø¶÷é)Ÿ˜ŸÌØGÞ¹<φ³¿'º ZGßšãýqÿÉ<φf¿ï÷®üÑ‚›+bvFF¿:Tz˜F‹üÕ1ß?‹ìum[ãÈûÊ­£uƒ[}ç“Òïr¥ÊÏãï¢ñdž§Cã¾»u¿°ç\ê™ÄÓõé…ÞÝÔŠ<ðäêÎÂbýQ²+d+ô/ã­CÚ‰•µœîCóÒ2ðWOæy:dø«Ÿåtݳn¹¸¿uâùðüܨž?¸{ZŸ?%¾%ž¾ ×ùðsîèëÖ.ÏFD'ó<úâ9óè^»å¢”ÑwâVÑïñÇ:_ñ·ÇsÉ\Zuc¬æhצ)bðmf¡•lŠ4é^çßÃ3:ÊS"Œ¢7/ÓoâÍœ·æ³-_Wý•EŸöeªƒ†Z®Ÿm)œ@yℼñ|Æuðøêï6ŸÅ×¹îúê®>ö.ˆU>­Ï\Ç`Çx^~-TË™Y˜m»Í˜Îïc=ðtäÉ<φ¨tp—8>Ö³´¾ñ[fŸÙÏ£*©û#Á“yžUO-þóÎݽûi|3¨8=°êu2ÏÓ!åàîk·®ø«ùÆOhÏEY—å~YÂyuý½¤quk -å©›²­Î#ëÂwÝ9)ëµ<ÛšüýOcŸÌóth=ð¿¾c ÿ«!áÞg άÌÝñtO^ŸÓ½Èõóã=³ÅJÚR»•­³¿·:™çÙJÍð‘ÇZv7Ôxôq’O\zûí-›UHþiÞ#28ôž£÷cÐƉ©Ûr²âð0ÉìÊfëÍ ¯jØ[q¹ßŠ¤—ØxÕ@W -´ŸêÖnúÛä]å½üìA•mÒæ»ñ´u\ù}¯.;tä9rZKªÛÄ‘î[Éy·Žy;º¼5[šäy«4/ÛVuóq݆-Cp®öE¢üÄhÝVsµü²…[gÏb›º4{xùVÝøËÅç}UÞ^zxéš^sõV#Ò•ö"ŽÒXUºMå†Vלù•;¿ÔTô?D’6æ§M™s·ö'sú_r‡ÿ|QÉ -jb„é2‹£.'Mü~¡7¦XFl­Ð'Å$œe-˪’°Ên Ö Ò˜Ò8!çÃT §­F¦Cľåw%í³eeIdò^®SÅŒ9½Z‹éê¥P³˜Þ:…™Ï|5…¶T«ÂV íÓ¶[ÆC±2²ºµPvÕ5±¶ÅE»”צóMXMï›NuÝ_ÒêÐuçžðvAµf”¾³Rz×E)ª´®–Uf:£R•º’²vˆ­ýĈnFøƒ,E[tfÕw½F;†OÂX€dkºTÒ1¢Û…M7—æjO…š*¶¬©´|3¥AÝÄÚðŒ,·Ñ, ô­nŒHS—bÚAµöµŒnôJx»8[Gb¿_\`R»ÆÒèõBÓ•[ÅQ6¼4)­gLGšEFû-ÓÿU¸*%æÉÊVHÑžéí¬UBc³Š—ÔË}e˵€²¡¥íšK…P1Û·{&=‘nM][l!횬“‡TÌ#’ªä±«Šº*& -+íS¹²ÊbªkbW¡ü¾7;]ªNÖʼêàîj¹Mì+w¾÷âP{\ÑøÕÞZn‡ù"¼å‰ÍŽb‚~,•4±–u¶k•uÂfH¡‰¾gq­•è¥^å° 2nƽ]þrÉÓÂMû¥z£è}.½×¥®ÿƒ4?áóŸ{ý§²ø4kYÙBWn]ˆû™ŒÞþOŠiËÅ"¬Ã¦jÛÑ~«ØÒº‚†:kÝñµmÙe#ö’RUUUÛ ]kÃN¬+tµ2]˸ámhÅêÈ|´oÚ„=šrq´ÿ+m=_¬ÂI98MgÚ”|íŠÄ%mS:´VwqÒŠÓ®ÂÔ,[˜I€ì+©MOöÛ¾+ ÕÕtnš¦³mší‹.²|]¸À¦?é ¶ª¯4-ìaŒ~xx}¸ßg“}$­Ô^¥ï½´^I+áñR“Oýò´Î9&oZok¡Z–éÆž©NN͵°‹“£4¶ls×Wj‹lQi™(*]@&‹¬–ŠM~ÎVš%_qd[)TŸ¢IÿÒ·´ë{¥6¢ë{ůÒR¹eÆ«Þ’©ëáÚÕÉ–²ú’‘‘ù>w•Ú–ÒÙºn»¬»Ì¶×î2l3Ä7ÏT¶ln•ò!þ{dì°oàR•¿¼2¢b{å&j«‚Ñ&¿EUFïÁ!–^„lì–Jîγ¿v²^!)k'}MŠVÙŒ‘AÑûpyÞ¡HÇŠ®¨ò®\>[’ì%Ý×ÌÒP£¹õ; ò óºe^ ª§BEzÿ©!§7ÒkÛ‚äß ‘—Pn‹å“ü÷¿É8_« -endstream -endobj -523 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 522 0 R -/Resources 4 0 R -/Annots [ 524 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -524 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb30-1) ->> -endobj -525 0 obj -<< -/Filter /FlateDecode -/Length 4792 ->> -stream -xœí]K$9¾×¯¨3Ò&~?$Ä ‹@ Fp@¦k§A¨iáÀßç gÚŽtFVe×Ô°µˆiõte„‘áÏ_„U.}VøùJã¿äô”RŽÁ/ßž¾;©)z…¥ÄꢨßèÏZ¹8yCòçoI`ã³71œßNøo¸äÅßNúÑéë:úl¦œƒÑþüÏO¤rvŠ)FåU†Ji+¨¼Ÿb4>ª 'ÜbÎ’ -føèŒÛª"Ìp9yI3œ1IP%˜a]Ôv«Ê0ÃDí$ÌÐÙGA¥ìÐF)QC”sÖ:í§§IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°ÅÀ;YÐ%Øt%Q[TPZÒe;ùœœu:•bÚêŒò“OÖ*I§õäM+ê0£0H! -:[‚òYÔÁo•‘t¶8üH:ð„·1%a¶šÝVY-é03»Éï®sÓäˆ !ŸÛ -ÛÚ]Åûí¾’l}w‡Ûši)è=NÞ/D2òVáÇ>-6ìeºŸâÚ1DÚIä&h¸¾³Ê VX#Õ -(cá'À|ƒE…r«Â?ûpK-VÌàí’™dI#êþðíéÇ¿úúë_üò̯§?ÿDV~ú•Æ_oç¿î²\‡å:-×~ù›·2­‡6ª^ͱ&P ˜òë>-º¥Œóë:îuh#.}PÝ0”¹ eõPþÓ ¿ fÛ~m»ènØØ|¡…vê5k¯¾öƒýGúÒê§9øúôókP–eÊ JÊÚ‘QÀ¹ŠãcU>Ç_¾9qøî@å=°®eZ?fùû²´õ øyfu‡éò\ð–¡Kx ÒîÖN…Ø=XçÙÀ‹eöUôÞœüCø ¡ï™5×î¡öö}Òta¸'ÑÞ4Ú÷3éÁ:O‡FwKdµ¿I%âšúzDÂ÷7ʬ¿ÚöÇ…Ë.½<É~8»ƒ\–˜b¥’U2´B¾ŽÜcuž¹×“ØÏK°¾„Æu¹ -õcøõs’í1^´:B|Ù”¹Å¹<%¤¸ln­ÂÖy:äË_«ÇêßÑ£#ÂW(ºh«Ìe@‘ƒÜTÇIê¯Ó’%Ü[ÿ…͈°F¯[,ÆÑNˆKCÛî…!rôó&C’‘jzÞy8;8XçÙjn䪅ܱzÑ2N|‡×9JíË\ßú-§µþ†v¨¼9`׊‡1ÖqW8°•åqaçÞèž¾ì -q±wä³ë<boä³{Q¯`ž*ÏûüLæiW‹7³–4ß‘ã¬óth¾žã~îjªŒFÍ7m#n†v9VĹ>ÂV3&à׿Un×´òÊóß?Æ5šx¦óågòúîØe=XçéÐw#Oý_ä¹÷ìT]Açf¥ta}:Ù_nïAF²å9éÁ×Á:φdûy{®?H$?b¯€qz‹zng“‡~àõGŸ½Ì¨ul6Œ³¨¯øvÐËòÓ£OmÖy:ô^Ïi7£5¬ZzxdV:uﳡb䨗Î3+«h3;m¾ñ·l7¸Ïe¸oØLeègÀ;vPzÇ{ Öy:”ÞxSÁâêOõô Cȸ—: ©¢µ ÓÍyå÷ù”á‡üäÀ²U¹Éh—œ»…Ôcuž©×óÚÿ?9ØÉX{ÍV¿ö‘x?qÝæÞ3Å&7Ün­îŽ=؃už ­îzîÚFîu’²gO7Wûª5îì²·‘²µæ•!šå  ¹µÝªyÝëºþ jÊÞïÎÞBYÔ– ï›qæŽÙVlŽì>y&4#aº•ùf¬þ# -¿O¿ž½7VÓ'ç5ü|ë3 Çê<~ý½]¿+?<Ír×öN—¼ƒž›˜:’ÛÞ·Ó¤v÷RÃn›ãþÊÒNÙwÀZ”oŸù¢‘ ‰vÉ>åé<mµIe$~þÛßýú¿eû”´CCkºö¬¿ì}=¦yx˜­ íäݹ¬'öy©w6_oäiðð'æÝ¥-÷:ÿ¥zóSÅEvYäÕ®O³-¥¯Ë’_^ÝbKí»\×ÕVäöÌ^>äÖÄÝ:?¯xÀ|Zäf©Ÿ±Ôùn[·e®¼N•Ð=_G¤”ëØå×3Ü-×ÅÞæÅã^ -jô’¢=kž™°¿Ü«26—¥·°tVí»8…lép§¥}»Ü¹§ÈµŒ@ñî7Ûv‚¥O>Óé:ÛvÔâÙSÅ[×ìHvÏÕïeåEzZcfæl£S–‚r&d¡í2/ó\¿ éuië#ŸoæÓâ‹j“_¢y꾦{,HˆK»‹ÿ:Ú–²‚ý}NõùäƒZ!®´eeû(k1¯}U.û8ªÑÅÆņz?E&Ùç»=þãR6uýhS¥Î/¹¿–îÛ ¾æ @íhÝï¹öW³¥RŸa¥úŽæ EGs|»²çªïÌè»2³Íz¼¼í>ÜåÐѯµÌ+ãvðêí1 –gY•4³£ÎéØËmêZïƸéåii);Gîk¾sß±ûqÓl쾬ÌOl—ñMç͈Ë+ø*úM„tklÏÑ骿‚„µ•ªÏÓÚ?{Íî±ò[?ëüAö‡qÝAµ¹g˜„|;Æä…{~ŒWý¼‰ <{ì埒G´^×còš{j\Ú~¤ÕOÁ–„Ó©b‡Ö1ëÜõY÷.`|³×ç)yš‘ïÓ470ôB_–¥Êó ìv˜Ã¤25tÈ!Ä·Lë/v[46O>à" --ú×[µ]*¬… Ús«¶Sö3©6[z[¶Ù›2åäRçƒÝñÐë­;7ïÞÙrˆ¨r‡çé(=¸.Dù>oÕ¦q¯Zó8Ï»d0Ë’C -ºMŸ—Q¸ÚǸl9‰øɼąjûp KRV »—üo“k:’2ÓáoC§efï^6¡XŽ“/ÏÕoÞÁ:O²yÓ¸/;uûÔGڮϾ‡žqãÍÅ«‡žãÆ !µ,™FF˜—ë~6†ÒÃHÛÔÍV³ ó1~ÛA'd<#6Þæ›Õ?XçIÐÙÍþ:ñÑø‡¢â8¢F¸F–¯a‡5T£À<ç­…úÊW ?7åìSÔcÿý~9K*zÔô”ÀÑiP™MÕ`u³È UßlO:ëá@£µûÐ$"orz¤s×ö|Gû ¦î‰„å³ËZƒYÛ ]‚š©þÖKŽþÂÖw~ηk ,¾,¿Ï³Ü´ý#š‚Úì«”þ>.cvQ«5bk¿®Ÿ˜=«õe^>¹Qîa3ŒßB9?P—3dUH“6tÈü9¸‰¶#b>Ó™…IY§ë°éâh}Þ©YŽæÿ®•ZNëWt€/Þ8åÏ.–òß•ÿö¤³›ÈÿeÓ°œ¬­Š™‡Åo':YÝ bçúÎã 1 ——ªµåtÛȬ² x2Ny,‰©–—}·“âæüÒøz7Tß×jtâ"ª©W4æŽ!j½ÓÝ«I/b:>Mv¹ -ÍÊ¿›°7èxÙÞ`¯xS¬­bB¿*Ö]WíÑtšis]èÂf:wfÃ_˚ȆóšðrB·v”¾‰R:Û¬6U½‹U}•YfTnR_K¶qmœÑå$¿Rµi‡Álz6jt²è,LH®•Ëµœ ºœÄrKk¾Tl¥R¯š«ç»)ê65Ç ² {"éë6ØQ¶¾\‹i£»µJ 7f#¼œ¼k3±‹ßN> -¥}ç -å+ô¸Ð²v›8©Ž—.©º -S³Êè\Fú¦ -ߤÄ<å…v Rt¶j¿êÐÜlⵓ¸<4Öq’´‹½,s—Ž±a–ûK'%”'Òm¥›ÇVRæ2&¹šG$ÕÈc-Ö uMLVýÓ¸’ U5Ýu±oP~[‰»¾MU¯ZgA3¸ûÖn‡Æo\Ûˆk:(·ÙÛÚe˜¯ÂK lnôSí¤‹jÑ®wÆ„Ý0Bw}+â:[;•-–—}’I÷rúÛ©„9c½¡Íµ`5ûγ.}þ7Ê|ß¿ŸÜù7õ Ñ9ŽÕØÂ4n]‰y$£o IÅô­!Uئ Çh¿‹uêe}EC‹ãÆ0¾v½ºêÄ^KêÆ ºi¹Ðw2±iÐ5Ú2Ïø+ÂËàÅ–È|îØô€=_Úzs´YHGÔV«pÁo—©ëlÉgÖ$®¨héÐ:Ã*â‚7ŠKÖaî–­Ì$@òNšëÉ~LJ‚6¼øK#èÒvëa–7]eå.X¤À–_ð†ææ•=‚ÑwO¯Ï÷ÅäPgIµ7é—¶#i#[¼ÝC­-ËæžmINŸ=µp« ŽQ&M½ÚRÀóN]•­:­¢ÑdªÊZ‹±Ú–jÕ-厓è¥ØrŠ.ý÷´ç£Òœèù¨„MYj·F¼–-Ù–yçØïNõ’-—L‚,ðÚMêzI[e۾ݺïmÏì6\7$ôÌTõj~Sò.þ»gîÌu†]©Tý);#:õ£¹¨ŽÖØòmk*…qô…Ñ%¶Uòî:×÷N¶;$uï„÷„ᘜµ*júÞ<Ù„7(òmkª~§ž\-+ñ–Þçak¨ÓœÚì •/N*Ûeƒ¨]FZ*Ò÷¤YJz}½KTZ~K\9cµ}R~þ<Γ -endstream -endobj -526 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 525 0 R -/Resources 4 0 R -/Annots [ 527 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -527 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 210.123057 101.433071 191.373057 ] -/BS << -/W 0 ->> -/Dest (cb33-1) ->> -endobj -528 0 obj -<< -/Filter /FlateDecode -/Length 4698 ->> -stream -xœÝ]ˮܸÝ÷Wôzsø~Á,L8È ƒÉ"Èâºí;ƒà:€'‹ü~ÕâCTI¢ºÛwäñE»[U¤X"‹%JgŽ¿7ÿy-˜÷ÁY}¾|:}>qæ Ç¿!Åä`Pÿˆ3gÁµcFëÍùS(Ç\0ÒÙóË ÿ5‡uò—Ó?¾9ýgšGœ% ÁJaο|Œ*­˜óÎqC¨T\(Be sNK¨¬`¸Ä(Ì0NK=W9˜¡ƒ7” -fh)=¡ò0Ci'Ô\`†tBS*˜!‚q„JpØ!$礆p­•$tÂ0‹J·”N -f}Ô9è„“”N)fFPºÀ¬µÆS: [Là‚ÒØb„ÖœÒÁ­¼£t¶(«8©ƒ-Ò;Eél‘¨@è0휢h@ô ŽâÅtRPD 8l1ÚRL lÑ蹤¶¨ ).P¶ ÅJÁ©Å -l«Š èVó (.Pà[Í…¥¸@pa&§¸@q•·šâʔŠ-œ«À(.º»£¸@u•±’âÚUÚ[Š xWiÁ).Ðà]¥“ÔÁ˜â°#SÂ+Š 4xW î(.Ðà]t#IqZ•‡–â`…Iï9ż+=×hð®tHc胊â Þ•—@Üà]i¸¤¸@ƒw¥––â…8é €wA!†v` –âŒ÷ÐIEqNÆ$ÜŠ xW DŸ[1ქ¸À€w…Gó‘ºÀ„CýµÌ„µâÞÅ@¥(.0à]Ч§¸Ï0¢JŠ xW(ŒÔ”¼+dàð.üCqàÀŠ 0¾1Á]RÞS\`À» %IqFaÆ=˜„Ô9 Š @ƌå¸À‚w1¼Š ,x—¥(.°à]®áö:Ø¢¼¤¸~ tè¶DŸ†³Ê¸SP:ð.haJÞåÜŠ ,x7›XÒS\¼`Iqõšç,Å6pèàò‘:Ëpl(.pÊ"u°E;MqkTð8 [””8 [à2P\€ÀÀ…œhØO‘â0óAkŠ œ±˜¡V)•Ì;Ð5©óÐ Gqsša(`.Å<:=Å xÝ%Š `tBS\àlAW¡¸Cóž9¥°N6Åðt¡‚â/a ¼AŠ ¼ô˜eZNqFhÌ%QÕ”Nó8ÏôxmYt).@7ÁLLIê` h‚â´OœlŠ 0ùÁdÓR[”Ñx/ãtÓS\à=l‘\R\lÆù¦£¸ pØâ‚À-‹n2Å qè8§¸ ù¦Ô _Æù¦§¸ (Žù&¦xD¿ ÊÆù¦£¸ hØbà¢:ا)ýœ„ù&؉ÒYØ"ƒ¦¸ X盞⸘o£'C>Î7.ïšf¢tà]x¦–â`¾ Ï–šÛs¯qðÏh¥3NOF 8¨×`l%CÜ‹ÑÊ‘1òs$2h31³ô–Œ`X…Rp2lÀÁ¿ðÇôŒ®Ñ§:De‡1Ó»x‘ÝBûÏsŽ’L-$»ÆÇ~ùéôíßóOÿ==3DÊÒŸ€ƒ0¤Öð¯Ð d@sxß—¯,Z°A¨ aà-y¢.#hq ºE#1üÅçù‰å0üÇ¡x•Š‡G”Å£9€ñ[Ùcú:Ä+‹wfy Á…`´µH£‚ŒìÈÁ¯äz’ø÷ïNêhÅ5š…2É|p*&ÃZšó»O§oÿôöíþø7ÀèÝó響ãܘïÞˆø-›owý†K‡î€¿ãÇ]I]ü­FÝS“æÃø=Ê¥õéóaüó´úãh—¿~ëÑn=Åè%c5ê.㱦Í×æ²ÁÞœ/•éšóºTöwÿ:¿{{úþÝ8ð82pxÖú²ÜƒµB,[ Æ\Ø~žbK?]ë×ðñ8Õóûª­R(má2`IUKmå§m¢í´Í†4\ð;”²’“òäò¹Ý.3Öqžt\/ýÎõðÜ_ÖP§¢ªg×êiœÂÝ ÔÎ<‡Cª\eC -!B4¬’t|ΫLs™¢gÂ\Mk›3Ę*ïejß`GBFêYâÚëÈž4^ßÀê¶:VÍo9æ =O”ëÈ×})v™–=eÉ·ˆL•ù0Æâ0ËÔÜn!³/ÏáiV94×b;^×ÈZC‰×ú„ûžÈw@–(ésoàÓ² -šPX<@1‡‡³ŽÂ¾<‡CaŸ·˜[FWHXâ¬÷E—Z` ©-÷‘Èj[²æÒå¥2Gôý5¿2sŽo½âº<å—mðdª»Ku¤¨ýÁ·ôC¬iy}yŽ†<¹áC¶-é¦5=C_Õ²³‘lá7åûçrˆ¹ÂŒw¨‘ý»Ÿ×ý9-›òG>”¢ñJ¾x¯¥Ñ++QH¸—1Š³ŠÞÎ<‡Cï†_™jðyúyå©iÙjÖ²Æw5Z^k†<Ø´ä¼}f§͞F5ªO¢ {frKö¦<›³ºÄß±±}y‡Øuó0>à½sÞ=³·WðnöôŠIz½Áµvÿ¾3Ïá»î£þÖ":ãì×DwBëfï[@³ß?ïïÌs44«u¿wænxÔ蜳Ò3êèPjáØ[L㯶ˆyuþL²÷sÛ -Gî;oî­ Üª*Ÿ4®4æbXa°ŠÆÎ<‡Cãº;CVªá -Y±eî™OK¿Ýº«3µä#7<9»³0‰?r2B6Cò2ž+¤uDÖ†twK ȼÁ_íÌs8dnø«µ‚ª]±ÇGø†Gó~P[ÅFãª,é…4[¨íËs8ÔnÄSïõ wû[¸W¥]ËKhm=–Ä¥Íuæ(ÖÞU~î³xñBo¸uß™çhÕq×ÎûFÙ3hFÈICtH^Qï&Îø%µXB´Ó·çOÈhšËiPݮ٘Ü?ê°y/Ûµ#µ¿›ë²µíC•ï†»¥ºøœ:¿SÇUz«¨íÌs8Ônø©œFK=*±ž†?_}W?c«H»ÞÊË+„æü·¶ -&sl{ÏÞÎïT,ÅbIO ¾÷4öÜ!]3»l{ÕÖR­öóegžÃ!oã>}3¿õu¢e'wÛѵ]‘RÝ5”õ|x)ZÞ"vOt]¯ 髨- ¸ò/gBig·"Ny‡àøé>eºöÄ-'÷·ê˜€›Ú”ÑñኂásÇÝÓ¼ú4òmäéKs(k{ÉÖJQ]Å.{gDyŽ†>ÓçonÝk×Ô,¥õ¨(ú¬ò¿>ž»§'Ó(5ÅW„#Ä|DÔÖj”Î<‡Cé†Ù;ë¨ïR6³ÙÂâ¬Èñ¼sâç¹) -JÔºjé†Ëê(øÖj £ö¯5êÌs¸Öíôá|S« }u˜MàÚdœ1Ø2²ÄHvœ1Ȩ{=¦t1Oša$½ŠÞùe<ïû*Ÿ.ùë²ò3uÚ§kqÂÏkG['Ä<þŠ¼aÆóˆë ñUßmîÅW_žÃákÃúµ«¶ÚÕÆöŠ‹È*kãžëhìhÓ³Bù<ø­ähÛeÄô0ã]`¬VGvæ9¢ìÆ]b[ËÆøÆ×Ì>÷ÙO£ÊŠý3ÁÎ<‡CÕƪÅ_™wv·îÃøfìQþ°½!êÕ™çpHÙ¸ûZÅ¿˜o¼°B»]Õ—¥ž,¡¼ºú^RžqU1…´êƈÛ:â»xí k[­Ý¿»3Ïáкá½âþ‹!aïÚ‚žÈÜŽÕ=C|¢M÷Äçë#Ú{f“HÚR«ÈVïóVyŽ†T· »9ÎÈo_MòÀÈÛ×5£énXØ™çpˆì{’å®ÕÈ{î(¼f žþþÍ ø†è^gžÃ!xÃW}Ðzú»ßðàg¨mêò‚ðôVwZ{ŸèÌs8ônø®_ñS~é5¯ºjq7Ä;ó ~Ã?]X ={êîɳ† ¿æÚÔvwœÉ \Ö¬—úz8váT7<‘Ý™çpÈí»ƒ{ó3§¯Ðf=µ.ìüz¿½?hë©M³õ.µb­y‡Ü>ÿuï%&(ºh¨âž1º>Y?OqP³ftˆÈÇí3Ÿ=õ;½*§$UyÛõüGxë…¿á>wgžÃ!uÃW}"|ÇT‹ÕÛÊ^û=²Ã®µç²Ú¦µ×Ïp®ñ÷pŸæcyq¶óÇ•RœßŒeWö ç0Õ5˜t ³fü|²ÃJbØE[Ï„ŒÛìž­fqª ç¸k“çJ‹Ôlb¨hq^È9lNü9§÷+æq ø}Õu3ãê`LÿyhðO'4‹õY⺷(Ä^¦ƒ"~9Že5!ÖšÉNqŽ?y>—)a–]@¶Ž…6¥2Œ?C>yÜ¿äúSšt51¿IÙâž?š§DjØõæZ0!DN+æâxõœ‰Q÷çõLG6›bl²ÂrB]§-',7ÅBñJhæB^WÄR'{DÜÏ-W-Âlz]u¢jþ”Vºª9ׄ—ŠU­ô…”Æ]AÓ©RíJžeª2*d©I)sƒèÜN„èr"„ox:µFcf}Õjqoµ«Ð' éœ.¤t„èr"Óg3¹¥\NåKÖj¾˜R ®|®xB6ÔÑ(uqÃñªp•~NÅ6¶@jkî+ÜÈ™ðr2:÷Ä"~9G¤6…+¸IЫ…ª:o{^ðR¤ñ9‰ë/tÍ$‹;SÅÿ¯Ta²42ÏðCè ©¸»\9*…ľ™ÅÓJªå6³Ž¦j@hWÒVÕ%œË˜­ëKxN¤¤›Sç›H«*«ä.$ó"Ieò˜ŠEF]G -Kõ“¹²òdŠ+b“¡ü2;Mîª{*ÌŠ -î&Ÿ·ˆmæΗZìr‹‹¸U`¶7Ÿ·Â|^†M·â}Ÿ -)bÉóhW -«„Å0B}Ä©·fvŠÛŸ§Ÿ¥“Q#îåôóiæ¤22à‡U"î|[{]âü?¤y‹Ï¿Oúü—´ÕÚu—<³…ÌÜ:×#YÜ'ÝwŠã¾éI˜»M%”º¢ý"¾¤5 y—²âk]²óBì)¥È *²¶šR‡•XfèJ¡ªš1+ÂKS‹Ù‘¹·mÊ€}=TéâPŒŠ›ô%«pP_}Ñ©2$Ÿ«Sâ(&-C:´ZVqPŸ‡U¡X613².$W}´_×M¡bYÕAåFÄCUtº ³õ©“l¸Š* \`UÔ'Ö¢.4Lì!Œ¾¹{ÝÝî£É6õ€(ÍÔž¥/µ4_X”f£¥j8´ÓÃ<æ¨s—ªúžÊNNéŵГƒ£•Ô—lcSª“lRh(2]@Æ“,ŸÑ%›ì˜-UËpÅž¬%—}Š"ý¹®iS·J®DS·Š¥çM#^ö–Tv€L gW®Ž—”Ù—ô„ÌÖ¹³T—”*ÉæeëiÙi´=W—¡‹!¶x¦¼d3³”7ñß-}皧‰BP©Òß¾lNŠZ §¤:‡èîxkÁ!:nî´¯B%»ó¬ÇNæ’;©KBs0­wx[0ኰ­¨Nõ2îëJg œ¼¤}@„† -ÍñYdH15Æ2‡Q>tqªh°Á7÷>npï¸ CEÃÍ<= Ÿ ÿ^3îZ -endstream -endobj -529 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 528 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -530 0 obj -<< -/Filter /FlateDecode -/Length 4925 ->> -stream -xœÝ]Mä8r½ç¯Èó£å÷`Ìa5ì1¼ðÂõaáCuv×.Œ³>øïû%’!*¤TV×´Û…êJEð#|| R”R_~~Ðø/9=¥”cp×ÛÏ—_.jŠ^á_I±º(ê?â7ú«V.N^çüõgØ8ÅìM ×· þ.yò·Ëüæòßë<új¦œƒÑþú·¯¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS€Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbà,èlº’¨ƒ-*(-é²|NΉº J1muFùÉ'k•¤ÓzòÀ¦uQè¤-Aù,ê`‹·ÊH: [~$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØßþrùí &ßë_þçòú›²SV4„’Ú!¾Â00Ýí}k4ßÙ1Ó`ÙC‰©Ú˜»YD¸l³‘Y˜ðèßuûae+L%c‘+¡@«SKÅàžRºÃ2+C³d·õáÄF»äܼžËò-xý5`šóL«›t^ÏwÃÿäêç6¬Fêhêõ0jºeHò¡ÄËk¶úµÄöÄu™Õ?߆ö»e¨Ò¦ -Q¯;HöïàâsyžÉÇ®eHk(º­{ê9{váÙ‘ÿG.¬e \jKc†ö9V‡êTц8Ô=ðùÑh,uÚmÞÓȘNï`çsyžÓÇÑð8Óœ^üÖyœQõN_·xÄÏe³KL9ÖÔÏ›ù##f„9žÆð8ø!*>šÆxFÂtKóe¬þgÞN¿¦ÇºNÓx ?ßÁïÉ<φ_sKø]ùyäi»–H"-q¤„›˜:Û®VWc„²ƒÿ’vg#Å1ì¶10n®,åÐ:À}¸^·Y¾m!SOŠõD»d»­†Ž·i«M*=ñû?üÛ¿üé½'Êö ­éËÊç<{Á4ï#µ!<;§õÄ<Ÿk«æë< ÞýÊ<»”å^ç¿”¯¤ ˵_ʺ-±ãmÑ-uQš¹ÇxÜÖëî=0ç%¿Í^=åÆÄÝøçÚJ?÷sç¢ÅZÝ- —CÇWß`iÜ:M¹¶Ë¯g-°½¼õ%dýL±ÊÚ-ŸZ§wToõ@Xšx›-îÌ–Nb.m¶K/yš–Þ*=õe[N°t›’ŽÂmËQK»æ6—vÙA§7e;ToËÊäo3ó‚`‰ Êaheäç9AãëRÖ Gt÷¹ùºø¢Úä—¹2u_SKŸÆ¥ÜÅ/KZÁþ†½ô™Ë«å—r¬lÅ浯wwü›Fû–úk[ŠL²Í3[^–´©ëG›*®ç1Á|–ûg©Ínð3g -*GëÞæZ_CJ~†“5;±¾tóõ̇IðËÂA¢?-³õóýôc»÷pêr·ûL9ûþ;ô݆ËÏø®òƯÓ×çl0ǘÀbpÝ.³”Éù¬ÎsãªÃ?[n¸Ò‘âS«Ž“yÞuÛû—¾Ùkó”¼U‰ËBaãvƒ^(вàvî„Ý -s˜T¦ã¢C…5là7d\ ¢<.Ñ p…ýë½Ü.•ÓÕ!ˆöÜËíÔ=úLÊ]‚Úñn¦½ë!S[r>عU×Evè±£[xã͇{­w¶œ ´Z²ô®çé=\¢ÜÎ{¹©ßÀÏÖ|œç]2eÉ!¤ÝǦ_vÇuŒ‹L‘“À>@x'ˆËʲ@ÿ¼tV »·˜Øëôœqì­Ö\6w±.ϳa?*}„ý†ÑáËj«6Àüò—~ã|-ê<;Ëô2¤ù²ü]äf ™uýý²üÍÛ´ßoV|ÏÖ¦Œ²HÇ´+bÔ9”Ìó$(ëf›p„²GNÐÝlà§åÆs{§Ðghá(ÑspëŸß}ŒK«Í͘®ßAª#õ\ž§Cª?äÃo=löîCtCoûÄx–÷¶¶¯Ø1þŽ ­FÒÒ¾Âë]Ûá³Yò䑧{;Z»o,Æ8¸º‹ÌÐøž†u„{È<—çé9tŒÔš÷8²ŽP"ëáy_žï>Yº§ß|Gð -{ìç¼™”wsŒÂsyž …é\¼Øz†ÝJÛ;3oc®ùè©#÷‰ÈÚ9Zþ@}«ã¥Ÿçü«£j@”°>³ißÖO -ûkîN ™xŽ{7ñèBšbFߪ=L£e|aDÌwçÏ*û¼µ­säcå¶ÑºÃ­™Å¤g‰?™çéÐxÇîÝ/äœK=ó-ëévgü wWjïz`W‰;dôÇïÏî¬ÕcîvùŽxõdž§CæxõƒgíAÕC{>[ô³ƒZ¶7JïE+§çî¡ö\žgC-¡àP¿58|8àú€›Uï}ÉȲ ÏsJ/GyOø!Õ¿y¦i{KôË{¦¢GozzÇ6½0*³×V5\ÞMr†õðÌö5öA&͸·Ë_/eš3Özö&XMï„çQ—¾þ/Òü„ßÿº¸ë¿Ö—Îó¸Q-LãÖ•˜Ïdô "餘¾Q¤ -Û°aBãíw±N=­¯hhó¸1Œ¯]Ï®:±×”º1¨nZ.ô݇Llt¶Ì3þ@x¼Ø™oí›>aÏ—¶6Žž%¢××V«pÁ›ƒËÔu¶OÉWV$®(iŸÒ¡u†eÄ/—¬ÂÜ-[™I€ä•4דýŽw…¥ºØ #èÒvëÓ,/ºÊJ+X„À–_ð‚æ•æ•=‚Ñï^ßÜï‹É¡Ž’6joÒ7.m #i#> -endobj -532 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 450.123057 101.433071 431.373057 ] -/BS << -/W 0 ->> -/Dest (cb36-1) ->> -endobj -533 0 obj -<< -/Filter /FlateDecode -/Length 4910 ->> -stream -xœí]Mä8r½ç¯Èó£å÷°Øƒ5ì1¼ðÀ û`øЕӵ £ÆÀ¬þû~A‰dˆJ)³ª{³îBu¥"H*Èx| †”’>+üü ñ_rzJ)ÇàΗ_N¿žÔ½Â¿RbuPÔ?á7ú³V.N^çüùØ8ÅìM ç·þyñ·Ó¿ÿæôßë:úl¦œƒÑþü—/¤rvŠ)FåU†Ji+¨¼Ÿb4>ª 't1gI3|tÆ]«"Ìp9yI3œ1IP%˜a]ÔöZ•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚOƒ$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ƒÑÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓµÎ(?ùd­’tZOØ´¢3 -N -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ³ÕÐì¶ÊjIça‹1щ:ØçK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0sEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ]L÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö¢¦¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒÄðê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãÑiå﯌ļkœ (øG‰Ñxâåp¶€`%.Àz± ±É ,‘¸ÀƒwuÆò'Ìi°Õ¤Sxð®NpŸ¨Ë“ŽqaÞb”'B–¸Àƒw±PY‰ Q&{‰ ¢‚Àƒ²DlqÑI\€ÀzÊ6'‰ ¢-Ö‰ ¢-$.@D0eè[ÜÀÀEÜ8Ø‚HQâ0Ù”²sD°èJº`¦A×¢.A§£Ä1º K±–¸{©)aÒK\‚Ÿ(\’¸f@§Ä1ÃL‰ °MÉ 2—t¶ È–¸‘.tZK\ lA4(qA2 »Ì $.À -½$†ZÒ9EûÌ$qAra¢PQâLì4Á”¢¶€&$.€h³í%.Àæ›MlsDl±ÞI\’¡íf’¸ %Øb”‘¸Ø¤ýf”¸ +Ø‚ˆO€ÂDa²Ä qè”’¸ ë„ý¦q`^Ò~3I\­Â~[½žþãwJ¹ðû4þz³ü¨Í]æc÷ó-z».ç^—¿µ\mçZDOô[œ_ôiÑÇåØÍ©L)?¶¿”óa]¿§¶ç×vÔöÉŽ{l.}Œë6ë9ê¹Þ* Où­öû±_/l,GÛ~fõâ cã¯ÕïÿóüéÇÓ>­X¢ÓD‡Í8ß ßÄî±*ïÁî×€,¶º7 ë• •ê&r¥Õ·Ë¨Wʸ¡,ý..1ᶋÝè²å¸”}Î÷y–W[[[/ý3•á6cSÚ®mhöCû|Š°.Sx™¶¥œ[—§T?Ÿ ;ÊÊßË™ë<ð°3º‰¼°öüÕD<[Ð1꫾ ä¨;ÊŠ÷Fr©õ*òFÄî•WLæn ‰£Òl·[t_†Y2¾g}۩Ǭ½6ÆamÓ‘sm"ØvDŠÃ‚Õy:»›Ü9z_Wž´ƒG”°ä@×È-ÍûY†ô6«âÚ¦†ŽŸg”ß×Q[üîªü²nË西ð-ñôeèçÊÆYÒ× ôõÒQÂ$müúŽÕy:ô 6¯0¬¬+N;rÇÃÁ ¿?ž{ÏLÞ@iM‰¥÷Pz¬ÎÓ¡t'¾<ºå`Þ·#² ÂhK—ßaånHb´•§.#tèÛò®áñ%À“ÙõîÁ:Ïæ]s0†KènÌÕ²›@ß íB_YLšw †t/󱤣:u‡Qõ–¢óËÒî «çz}~®²I¦‹—ý<Ÿƒ6 ­Ý°ØR9ê¤yeÇóýñÕ£¥ãø:Vçéðµa=êcæ«»|f\«|˜ôc°c<.ý±¬|¶f±í²`ºìx7Ë?ÀXÇê<¢nGM„ŠG³rcÜw{wy•e¶¼™”wPu©Çê<Rw²a癇G1NË`æíûËšm ²Çwž¾H‚P"ì®ôÇê<"wbÂU÷ž¬þ]W¾å ¯µ}—y_ÁîìÞÁ:φ`·«~‚7Ðr²·®ÛÓ -Ûb½@ð±˜ñY¾^v¥5dø[µ½=ùÁ:O‡ÞØõÈuŸBø7Cè=³æVƨD“¦ojíÝ@ãyǃuž;ñéíWN/•=uE쀄¿ž—ÙùØ-…ˆû¥¾ŽÝ@nº?p°ÎÓ!÷ØÜG¯­s„÷“I÷…}¿¾'Þ¾™?Çi,³Ã¹þ\ëÁ:φ\,~m™¤(èˆðŠ.XÞ“²ë" ÷Œ–Œ<åh_ç,¾yG}~WΘIbu[ÆKZCÆñpº4´Íï—¸çƒ÷Qø®s¬ótH݉U? ±cEË8ñŽQ_Ýsñ2קëD#§µó ÷‚™v­8qX#Æ:·r¨­,_6úF}úº;Ä Ä>Ϭótˆ}ß݇Ïç½?’yÚÝânÔ²æb܃užÍ·cÜ÷î¦nÝ=}äªíjvÝÃ[ßjYýV9]³ÿ<ß{@ï¾#ò«Íd}á<ëÁ:φ¾°§þ-òÜ=™ªè¼Ú)]Ø9oÝÅþUrHæ1éÁ×Á:O‡ä÷å\¿K$D®€q:ÿrjÙ]Žqø8¼þ8fË=Ǿ™¸^Ÿ½b{°ÎÓ¡wçÞÐÑ[îå®ïªVTŒÅï -áVÑf6Ú¼ñ{¶ßyÇhÓ2ÜÏl¦2t?vŸ×J¸¯à`§CéÎ}÷|;z绲ã^¾ Ó©ëoNãî÷|å ²U¹©<%`ïÉë<RãÁoýÿ•ùCžÛõë1û×mn]S¼ç1ñìÁ:O‡ÖÛ±kóÜë%«{5µZçUë -¸‘eož¢µt_ýê®Á´.Wî]3B5®{]׿BÇ‚š’ûÝÈ-Ô™¥êwî˜qæÙVlŽ¬Ÿ<®Ÿ5û7¾…Èɬót¾¿Þó$ úÆGCRùGòRT×we'Ùž[íá(«¯m¥ åj‡´u®e˜àVËƵñ8¿.7¬'êuÉé.>Vçé|;ƵÂ~öêšÐSzv¸Æ¶Å…µ­K-»òzu]αsì<‘I´a¼ú=~WâÆl,ç´×uWL#?fë,ïÁ:φétð›_ì΂ú]¿†ugTFÝñu‹GüÜ&1»Ä”WßÍ¿áç­kÉ[ßY‘®JÑW?DÅ·V£1ž‘0½z‹‡ -V‡ñWÞO¿ìÞXMS×ç=ü«ótøÝÉí -ø]óï`µ;]òVxl:~3æ@lûÑOšs »mŒùöK9ÖVùöPò¡˜'Ú!ü?Yèô˜Ý ­6©xâü—ú·?²<%ehhO×®µô+~¦î0SÒid粞˜ç¥öj>¾’§qtyŒÕËõÑ¢‘^fäÒf96k»æŒŸ¥ý\¥žŸ½ÑcÖ·~-¶–¶CGØ^*^82ìYóa_?½f=:µõ2âŽp¤Ú7\‹õ̪ª/e†oÖõe.ÃGµ•SlÓxzš²¥·é,}°‹Ç=­ i±ƒžšóóu;ÁÒ£¦éu&×픾Wï„Ò¿[v¤´e‡ê}q—%3/¶Ñkm‚r&d¡íù½Í5’;²hœ‰³ÌòÝJ›|å¦ùsí+Ùãb/[úOç ‹íyùä~„Ö2¯l6™Ž)ª;gÄÿxf“fåÖ¼£<îšƼœ"ÍŒ®€ˆµÑkÚtoÓL,½\È*eÕÜQe׃0:¢ÙXçêÀë>ð+JÐkgŒ“’·?ÓU#àŸ–‡.GóôÂ)zlrfÏpnëøn‘eûú‰Ïõ¹Égú×åîD4Io[³éŒ8ÒåH(—Ø¿,¸¬ -y)S1¥¬¾0øÙõuØè¯]†·`6/÷¶yÏà83ww”ûÓ·¸vKiß3—†îº¼ÜÏRúpåÆ_O¡ÓÃýöSººM—Öçšåv¿¶RËkí½é†Þr0¿óŽ,å-ÿË –Žº ”WP©"N¦tñÛ‰^Aæ±s}UÚ“pù¨Z[N·E®Ê.Lã”Ç’Ö×G„³•ÐúúÑøÚªïk5z4¼Sµ-GŸO,Q3èk1õ^MzÓkÜÒd—£ÐLñ¡Ú aoÐñ²½Á^qW¬­bB-Tìt]l\µGÓk?ÚÐ….l¦ó¡ÓÌýµ¬‰Ì·„—NkGé›(¥—GÕ¦êèÕd–•›Ô×’Í!®ùI]N‚ðU›vpfÓ3¯Ñ+8faª@r­\®åÑå$–[ZóÍS±•J½j®#ßMéP·© ¼ »°h1Ò{)ÙQ¶~\‹)@i¾ÆÜqc®„—“wm&vñÛÉG¡´ï\¡|…ZÖn'ÕñÒ¥ôÄ¥ù¦f•Ñ èÿ™*|“ó”Ú5HÑKHúQ? ÍÍ&^—‡Æ:Níb/ˆKÇØ0ËÇK'%”'Òm¥Ûˆ­¤lȘ<æj‘T#µX7Ô51QXŸÆ•\¨ª8]ûå·•¸ÛéÛTØëÉ‚fp÷­Ý.;߸86kz£L³·µË0_…—²°¹QLÐOõ$]lT[íúɘ°RèâN£oE\gkc§òˆÑåcŸdÒŠ{9ýùT–9c½Éø¬¦¤ñ¨KŸÿe~ÄïÜùŸë9æuܨƦqëJÌW2zf:(¦×kVa›6Lh£ý.Ö©—õ m7†ñµëÕU'öZR7ÕMË…¾!›]£-CxF±2ïõM_°çC[;‡ÓXz—Kµ -¼;8L]gû’|fM∊ö%ZgXEðFqÈN˜»e+3 ü$mèÉ~Ç]aé\쀅th»Îõe–7]e¥¬B`ËxÃNó“æ•=‚ÑO¯wû}19Ô@ÒFíMúÆ¥­c$m„'Km9 ëöæØ3ÔÉÛG¨µeÙܳ-ÈéS£‡nuÀ1ʤ©W[ -x~RWe«“Ö…¢ÑdªÊZ‹±Ú–juXJ“8J±Å]úg>Òž{¥ ¢ç^ We©ÝºâµhɶÈs8ÇÞ;ÕK¶X2 ²Àk7©ë%m•]ŸÛ­Ï]WÛ3ë†ë†„™ª^Í_•|ˆÿ™;s! !•ª?%3¢S‡j§£5¶¼–\¥À!ŽÞ,]b©’»ëÜÎ\gHjî„Ÿ µ*jzÁ¼lÂy_Ášª/Ÿ—«e%vé¾RCæÔUf¨¼a¸\÷) ¢vi«H/·ô&zjTZ¾P@™½°JŸ”Ÿÿ×ËñE -endstream -endobj -534 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 533 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -535 0 obj -<< -/Filter /FlateDecode -/Length 4829 ->> -stream -xœÝ]K$¹q¾×¯¨³€Mñ|ÆÈ°×°`Áù`ø0]3-Áè5°òÁß_0“ÌŒ|TuϨVÛÛÓ•|D’?FYL}UøùAãŸHzˆ1O×ÛÏ—_.jNá¿œbv‘ÕÄopW­( N'ÝõgØ0„äLð×· þY\öÉß.ÿñ›ËÿÌóè«RòF»ë_¿²ŠìbÊ ª•ÒVP97„`œT^¸Å”$Ìp ­UfPŠNRÁ 2& -ª3,mת3LÐ$©`†N.*­`‡6J‰:¢ˆ¬tÚ î%уÉ$Q ÓÁH:kH;-éÒà½wQÒlqIiIç`‹ÓDJÒÁ²1H:[¬·JÔÁƒ•t¶´Nt¶]QÔÁå•–tÉ.E"Q— S1ĵÎ(7¸h­’tZØ´¢# -䃠3°Å+—DlqVIga áGÒ'œ 1 -£Õðè¶ÊjIç`‹1DlAçK `°ÀD‰ `à/ØH\à# )/qO -:¸|¢Î¸ve‰:ØB$.€c=$›¢ÄÁÀkŒÄÁÀ¸ À#’†÷-†°pã‚-ð%.“ 1I\œG<†V•tÞ 1€®E]„N‰ B S±–¸±Ô1è%.Áì.I\3 Ó$qAH°CEâLEC4ðÌ%†-p²%.€§ ÖD[à J\MD”é•Ä˜¡K¢©%)Ž3£Ä‘üÀ®¢Ä&ˆ4Á”¢¶€&$.@ÿp°í$.@ðƒ`aŽ¨ƒ-Ö‘Ä17£Ä1£ŒÄÀ&Ç›A₤` <>‰ ’ò»É€Æ¡SJ₤#âMC`\r¼%.HV!ÞDˆ'ŒÛd=Ç›Aâ‚D°ÅÁEu°NSÆ-8 ñ&ØIÒyØbI\¼çx3J\7ñ&’‡©©A‹Ó¢‰©ÓmºÖzn2,f›5œ™|g4«¡‚F_Y/Úzwž·•×50Ã{›×+y”øÐ:Ëÿ]׌X…z1kó²¢8Ñس™>Ðè5 ÷éæWýµÃ&èË€‡1@?ý|ùíïÿðoÿò§? ·>½^þó¡R.âFÑ þ">wŸoøûeÒ‡éšuYø_ñê_ë"û¬¸¶Sz7ýU£ÎMiœ›Ò…1oþœÆ´ô:Ú‘ÓùIgš]ËüYF£=,3¥ŒÏ“ü6–SäYgF½žòØé~(þø_×O?m´_êÛ›Œ‹Í¦úÑ .*›÷Òn;7ÅkkN›«“ä²'ü¥Wèëzv5“m|–¼ÿZ-¬xGšÙßc÷ë¾?GfQÿćf±tþíGíz;Q›!©hx x½çò<züÊ“+,µÅ»¨eïz´|¯9Û´å¼L>³àÓVO£›Õgë ÷Dr[ö–<‡QÝb›ïx±çò<bݾ¿ù4>à{cÞ{¢·ïàÝÜ3*féiŸk¾?†?™çé»ï£þ½­è|gOt´Ž¾ 4ÓýqÿÉÊ|Ë<}[ÜçÊ–£äèYÑЭ]žˆNæy:ôó7öÚIŠR–¾“´Š~?ÖùŠ¿>ž{ÏHÞ@ióá ‘uô4ÊÉ‹9óóÂmÕºëé—õ«àGOk„tÿ³F'ó<[ïÆ“>\\´êÆXÍÑîÍpÄàÛÌÂ+Ù1Ö½Œ×’Îúî;8“Þ²w~›Ê}éòQËß×U¿eѧý<ÖÁC-×O¶Nàâ>D|Å~·ù$¾Næy:|xXöq×Wwõ±qÁ¬òa}|æ>v,¯Ë·…j9Ó·Ô³m· Ó9â•+>ðtäÉuf]Vúf‰äÕõ{I5âêÖÊS7å\–GÖ…ïÚ9)ëµ<ÛšôýOcŸÌóth=ð¿¾c ÿÍpï³gVæîxº'¯O,Ó}Vëç#–{f³•´ ¤v+[g¿ou2ÏÓ!õ`5ìáuFõøÓ$¸òöë[5Û@äOžÌótˆ<÷M–w=|ÏŽÂ÷·¿ÿnüÀêÞÉ<φ`îÕoá ¸ÜõÖ‰jÓ¦SNã³@¼Â÷Ó‘¥Á¡§¿®…ÏñLÝ ¨³‡I Z3ZŸ•yÕ‹£>çç¡H~W‘W$¦ÀÇûnvd¾ŽÑm>ûÆOl9ûqzŠ=,ç+˜rBRŽQÔ¸S•c 5|øµÁ)Ÿ–äÇôùÀÅ4Êóa…~ü­ç}yÕΪÌð™êã“É8?{”Ý9—µürÎegÏìœÊ4EØùVÝøËÅçcªu~UòqІßetõ4p Ò•ÆŽÊ’.ݦsCëëFÎü¨_j*þ"Åï‰à3Âs·öSú_r‡ÿ|щnfñ.*‹£)Müváø &ÌI1 §ª–Å~ëBv ‡!-SZ7¨écª…óQOãGãÊÝp~W²ñIw¤J"›+„ÈéõZÌw¯=‰ù%Hq°Ó•¯¦ð¡†UØ -¤>m+°e<k«:¡[ UW]*öh>4¿6oÂjzßtºëþ’Ö„®;÷„· ªµKé›(åW¯”¢JëUe¶3*U©+)k‡Pí'At»ÂT)šÐ™Ußõ`? -cÕt©¤D·‹˜n*ÍÕž -5UlYSiùfJƒºµáYn£Iø­nÝQ¶|œ‹=÷@ék;ܘ•ðvqTGb¿]\R»ÆðEÒZh»r«8ª†—&åõäñ†f‘ññßüïH®J™yòMR|„»j•ðجây#õr_Y‡¤ÐZÚ®¹t³}{騄ôLº5um±™´k²NR1Iª’Ç\¬+ꪘ)¬´OåÊ^¨Š¨®‰]…òÛLÜìtu¨:U+󺃻«å6±¯ÜùÖ‹CíqÍïc¨öÖr;Ìá-Ol´3ôc©¤‰ª³]«¬6Ã@ -MÜhô-‹Ëh­ìÄï˜+Û “fÜÛå/—<Í!Ô0|b±·š_/Ô{]úúHó~ÿûB×-çÙó¸Q•-LåÖ™¸ŸÉøetñ¤˜Ïe/Â:l:¡¡Žö›XÇ–Ö4ÔyܘŽ¯©eWØKJ]TWm/t­ ;±©Ð5Úv-ãv„·E+VGæ½}Ó&ìñÒ–›ã˜ùMÅ*\ô·ƒËØt¶MÉ×®H\qÒ6¥CK¦Ëˆ‹¾P\v¦fÙÌLd_Imz¶Ÿú®°\Wwѹ|i›ŽÚ4Û]dù.º$pmÑLº¯4ÍìŒ~xx½»ß'“},­Ô^¥o½´ÞK+áÉR›/ýü²Î96^\ok¡Z–íÆž­NN͵ ÙEÑN[¶)ë+¥"›UZ&ŠJ©"«%†b“Ÿ²•fÉwÅV -Õ§hÒ¿ô-íú^©èú^ñ«´\n™ñª·d«äz8‡vwª¥¬¾dd¾Ï]¥ÔRÚ"[×MóºËl{ínƒš!¾y¦ªes«”ñß#cG|É…”ªüä•Û`0Q“ÖØüR_½‡¿—-Pì–Jîγ¿v²^!)k'}M莬UAóë™eÞ HÇŠ®¨òêf9[Râ-Ý×ÂÒP£¹õ+Iòû9óg^ ª—CE~¯e§7ò[ƒ’_Q’@³å“üóÿjé  -endstream -endobj -536 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 535 0 R -/Resources 4 0 R -/Annots [ 537 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -537 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 728.673057 101.433071 709.923057 ] -/BS << -/W 0 ->> -/Dest (cb39-1) ->> -endobj -538 0 obj -<< -/Filter /FlateDecode -/Length 4874 ->> -stream -xœí]M$¹q½×¯¨ó›â÷`è`@‚´†/<°‚Ó5ÓZ½vuðß÷ f’ŒdFfe÷ôì– O£§+#ø >>™™,}UøùVã¿äô”RŽÁ]o?^~º¨)z…%Åꢨ¿ÇoôW­\œ¼Î!ùë$°qŠÙ›®/ü7\òä/—ÿþæò÷u}5SÎÁhýù3©œbŠQyA•¡RÚ -*蓼*è MÌYRÁ q[U„.'/©`†3& ª3¬‹ÚnUf˜¨¤‚:û(¨´‚Ú(%ê`ˆrÎA§ýàô 錞BÊ&‹ºŽFÒY;…è´×’.O!Ÿ$ƒ->+-é‹:Øâ­2’·Ižð6¦$ŒVC£Û*«%‡-ÆD'ê` :_b`‹ŠA¢Œ ‰xIâãä²q ˜d'—\’XÀ¤<¹­D&ûÉ…%°JCg´DVÁï‚ÄVÇ‘+ê`‹ÍNâk` H\`-l1ÎJ\`Á¶h‘¸À‚nÊZâ ¾uJ‰ ,f*‰ ,צà$.° \@)K\`Á¹Ü)qéb¸G‰ ,X×ú`$.° ]ëR¸À‚w­ÓJâÞµ9El€%.;NV'+qïZ­¢Ä¼‹ad$.@¯NÀa¸X™LJJâÞ5I9‰ x×DL¢.NƒVâÞ5Mfnð®ñÊH\àÀ»Æ™ q€2” €wA!^` VâÌ÷Ð+q -› ‰ ¯ëjå!‘̶σžÊу½U§æ¿XJ•¼Å¦£6ԺþOš. míýí_®¾»üîÃ`ee4“ -ÑwˆÉsY¾“_Š9Bq€Uû›ä.2ªaðëu1«¯–ýqNÓÚ§gÙ.|IÎm{^§¡vÓMž–'®í+º;úù@ åÔëVž [º£TAˆé=«d(<ÄíÉ<\¬ê;"¶öØ™žøU×é6(ÔïC®÷Ú>"{eã0Y´<Âä²Is‡pµeôIHq™Ö#ÇÈ=—çáëŽ9×­=VÿŽ¾BÑM@Cè\enkŠäÖˆ <HRÏøœ–á­ùŸØˆk¤ñ¼Áâ2úà óÒP¶{bˆý¼ vÚƒÏÓ±ÁÉ<‡Ô;êG!p¬^´Œ_áuŽRû4ç·~Ëi­¾¡JoNصâÄaŽó¸liù¼°Ó6jÓ -Áï|ï ö ÑìÉ<‡Ø;ñìެΗ/ç}y$ó°KÅ»Q‹Œfó†÷džGC³9Žq¿t5Uz£Æ›¶7C¹œ+â\ïašV#&à׿Un×´òÊóß?Æ5šx¤óõGòúìë¹ôdž‡Cß8õÿ"Ͻf›ê›•ÒÕéd_|½½‡$ó˜ôäŠëdž‡Cò—m¸þS"ù=ö -§·9@ÏålâðÑ<ÿ賧µŽ†qõßzY|JCc" wÑ{.Ïá÷8¦ÝôÖ°jièá3ã°Ò©{Ÿ #G=užYqXE›Ù)󵈿g»y‡v.#À}b#•¡[wë’QjYÜy¥'ó<Jíq¬º‹¸ºÃS=ýÄ2î¥Hªh-Èts\ùkÞeøg¾s`YŒªÜd´KÎÝCê¹<‡Ôã¸öÿïìD¬¼f«_ûHlO\—¹wO±É ·{­o؃=™çáÐz»¶ž{^£¤¬ÁÙÝÍÕ¾jwvÙ[Ï ÑÀˆZóÌÍbІܛÚîÕ¸îyƒŽ5eïwgo¡Ž,*ˆ×8ó†ÑVlŽ¬<îŸ5ûÂ߰'{2ÏÃ!ø8~ùkÜQZí&†¤êùGÞÔK‘ñçxtÜác@ÆW…DiÆ…ÌV -Z6+¤½º–`Þ[-ókãq~_n˜OÔ³Œd§^ÏÅ'ó<’ÝqŒk…õìæžÐCöìpm kY—Zvçus_α:ôPÿ£Š6Œw¿>?¥N»Í»bÓoØå=™çá0}g—w˜iN/~ ë<ΨŒz§¯[<âç2‰Ù%¦ë?êç½{É›±3ÚÂíÎÛ™ÀQñÑl4Æ3¦[šOëx¨`uð—8£ðvÊøeÈjzÁTÃÏ÷ð{.ÏÃá÷ÎÞ®€ß•ŸGžf±k{Ò%ï`…Ǧ¦ÎĶoÛiR»{)Ža·qe)§ì¿Š;`m–o¯FPOŠõD»dotü‚6©ôÄïþôÿö_bû”´CCkºv¯¿Oݦyx­ íäÝ9­'öyª-›¯7ò4z˜ÇY=]÷y{•K™åÚ¬íšw­øHíu•|~î‘γ¾µ+Î>åRË]:ã¹—ä -ÿpÌ,5…îU«eKíèi-UÌiΧn‹Õa17¬ìŒq -ÙÒ !‹ÖW[¨ŽÅN”£?mË –^Ÿ£#¶å”^­ž ¥mvÐÂ;v¨Þòẇçq-ØFGuåLÈBÙ3j{™kv_“Ÿ‰sè ¸¢‹M¾rËü¹¶•ìq±§-íOKß–Ím¹ÚQXÓ<³‘`–ºâœwÞÑZúÇ3›4K·ôaÝ7Üñ»}Ó0¤™Í±–¹­¿T»´iÇWz¹UÒª¹Ê®}0öC³)°¶U¿ëî÷ÕhÖ뾨~‘ÊŸ™æÐO~ôÓÌJ½¬bÿ.©¶›73ÐÚ^Ϩú% msÞÚÆ"Ëóç™OF¦]³¬[žíüù‡óN—k}ÚGñkùhÞûü¶¬}(¥qjù%bݺ¶Í8ÖþÛšãƨ,Z?[^´¢£DNEe'ó¼éu·w Ç|µ)OÉ{ mùf%¹~\ŽéåÆ¢eÿÜ »æ0©LÇD VZæÖD=õ6òn‰3­¸ˆB‰þù^n—Ê©*!ˆöÜËíÔ=úLÊͲmA¨½ë!SŽ+s>ØýR"Üm½³åäz‹ú ž§ósà:Æ[<ï¨ßÀÖ¼Ÿç]2eÉ!dØǦÏK/Ö1á2'ÑI¼Ä°»=ªÏ‚ˆU`g÷‚µm0DçPe:ñe¨´ŒìÒ£ÃÓ4öîë'ó<ÈR´q_"$ïsŸúx[d=õmµ<9OÅëQXÂù3e”—v"ªRÔG¨jˆ‰ËÔÌÂƆªMH! ÊM9{T6Txˆ¨+:¼5ç\;™çÑ•µ>BÔæQìaóµ°[²uËoœ¯EgQ|Ò|êë–EÍ@¶z?-ó6í/7׼ߣ;ÀGGÌÉÇ#Oæy”u³m8BÙkÝ9ÚâäéŒêì=þÂ_½‘`x¬GkÔööÌk9|$©.¾©çò<RÃ!þj'Œ/íÜÄÒ½­í;ýREIu[’x=°k;|6Kž¼3òtoGk7{ôèÌ.2cãÃÓG{œÌópÈL‡ú%¯ r„­n‘ñ¼ïÞYº§ß<®ô<ŽàöØÏy3)ï!æ…çò< -µ:0~½w¦·ä'Bkçɳõ_øma›öm]¥°m%œjðýrzXôè%O'§Ó1`™FÖðv7ÉxÕEÜöp¥«´Z¯óP$}m€MWåH'íí­òÌçy¡ÄüayÙä%öj·õ–yÅÔ•aÝ ¦¨P©¾1ý¹»µ¬—Mõr£"ÏrÓnö°}‰ Ø­4Õ6£ËËÞ”ÿ¦V›á­üºÎìYm†çe­RÚ°éÆŸ.¡œ©Ë©Á*¤IúZkp=ó•N©LÊ:]»MGëëNÎòe ?µTË÷3(:²™Žë,ÝÊ/–ô?•ÿñ¢³›ÈÿåNa9K]q2õ¢‹_.t–¾ÄÎõÛwÄ$\>ªV–Óíîe•Ý@ qÊcJ¬fÕò±ßâ¤%îüÑøÚÊïk6:ãЩšÈ–SþæŠ!r½SëÕ¤1}Ašìrš)´ùÚ„½@ÇÓö{Æ»bmú­P±êºØ¸j¦ók›ëB6Ó¹ë4ëþšÖDÖGÂÛÕÚQú"JéôZTõ®QMf™Q¹I}MÙ:ĵ~D·‹ üVÕ¢:³éY¯ÑY²³0U ¹–.×t‚èvÓ-¥ùÖS±¥J=k®žï¦t¨ÛÔ/Ènì1€H_°Âƈ²õãZLw¥[_«Äpc6ÂÛÅ»6»øåâ£Úw®P¾B -+·‰“êxéÒ˜ª«04«ŒNâ¤ÿgªðMJÌS>h× E§éö«^ Í&^;‰ËCc'y@»ØÓ2wéf¹¿tRBz"Ý–ºyl%e.cò˜«yDR<ÖbÝP×ÄDaÕ?+¹PU#P]ûå—•¸ÛéÛPõªU4ƒ»oåvqhÜùÂűõ¸¦£‘›½­\†ù*¼•‰Íb‚~ª•t±Qm¶ë•1a7 ¤ÐÅF_Š¸ŽÖÆNåüåcdÒŒ{»üp)Óœ±ÞÐÕ`5ôÏ£.}ý¤ù¿»¸ë¿×£eçyܨƦqëJÌg2ú^˜tRLßS…mØ0¡qŒö»X§žÖW4´yÜÆ×®gWØkJÝT7-úîC&6 ºF[æ ¼ ^lÌ—öMŸ°çK[GwŠéPâj.xsp™ºÎö)ùÊŠÄ%íS:´Î°Œ¸à…â’U˜»e+3 ¼’æz²ßñ®°T»`a]Ú®s}šåEWYiK‚Øò ^°Ó¼Ò¼²G0úÍÃë‹û}19Ô@ÒFíMúÂ¥­a$m„'Km¹ ëË6çØr“µÞî¡V–ec϶ §Z¸ÕÇ(“¦žmIày¥®ÊV•Ö‰¢ÑdªÊZ‰±Ú–lÕ-¥ÅIôRl1E—þÀ=íy¯4'zÞ+a“–Ê­3^‹–l €<‡sì­S=e‹%“ > -endobj -540 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 292.623057 101.433071 273.873057 ] -/BS << -/W 0 ->> -/Dest (cb42-1) ->> -endobj -541 0 obj -<< -/Filter /FlateDecode -/Length 4751 ->> -stream -xœí]K丑¾ç¯È³¡ù~‹9°a±Æ¶á=,öP3eè10öÁ¿PŠQ¡Wfu -p²3AŠ!òãÇ`ˆÕUâï…ÿ¢U"Ƽ½Þ~ºü|‘"8‰CŠÉÁ þŸà®JÚ œJ>ºëO$0A„ätð×· þëÛäo—ÿùÕåïÓ<êªEJ^+wýǤ²F„‚tŒ*A%•aTΉ´óŒÊ+KL‰SÁ ¬¶sU€6EÇ©`†Õ:2ª3Œ ÊÌU fè ,§‚*¹À¨”„JKÉê`ˆ´ÖhF§œð¨tÏé´>&X]€NÍéŒ>Xå§KÂ{ï"§³°Å%©8ƒ-NY+9l±&Nça‹ñF²:Ø¢c0œ.ÀÚIŒ. +²:Ø"½Tœ.áR´–Õ%èd q®ÓÒ ‘œN)á€MÃêУÐH>0: [¼t‰ÕÁg¤æt¶Xüq:ð„3!F¦·jêÝFÅélÑ:XV[Ðøh[dð  â%ŽtÂ&m9ÐÑmäX@Ç$l†£œ°>ŽŒTÐiÅ‘°ÅYÏ1Q°Å¢ç²:Øb’å¸ÀhØ‚[´5°­Z8.0 [+“â¸À€o­TžãÂ…™’ãÆ5Ñ[Ž (PJp®wr\`@ºèîãÖ5ÎkŽ h×Øè9.0à]c•ä¸À‚wANV[`Ž ÀŽÂ¨h8.°à]£dà¸À‚wÑ4ÇhUzŽ €¡c”Xð®ŽÒr\`Á»:``uA Ž ,xW;\7rƒwµ“šã ÞÕV{Ž þ‘¬7Þ…8Þ€- XŽ 0ÞC§ Ç8™ÐpK8.pà]•0ü1}l%TLžãÞUÍÇê’P5Îô[Ô²PÞ'Ž x•á¸ÀwAŸ‘ãp¼Àˆª9.pà]e0Rs:ð®ÒIr\àÀ»ðÇ€ƒPp8.Àø&”tY]2ÅÈqï‚–4Ç……Œ`V€¤8. ?”ãÞÅðž8.ðà]éŒá¸Àƒw¥…ÛÃê`‹‰šãø5СÛ2}ΪLÁéÀ»R¡…9xWÊ8.ðà]69.ð:r\¼`ÍqV¤<Ç>Ièàò±:/pì8.Êbu°ÅËqk‘LŠ [ŒÖ [à2p\@$ï›ÀÀ…XØO‘ã0™ˆÉZŽ ‚ó˜¡V9×"Ð5«‹Ð©ÀqAV`(V`.%":=Ç xAîÇ0:e9. ¶ «p\€¡HD ÏœÓ)Ø'›ãxºÐ)ÅqAÔ°Þ ÇQGÌ2½ä¸#4æ’¨jNg%Í3#ÇÑzA®"Çè&˜i‚)YlMp\€ö¡É¶ã¸“L61Íau°Å8ËqAŒš¦›‘ã‚a‹–šã`“æ›ã‚$a <>Ž ’ô‚ÜdŽ @ãÐIÉqARóMm9.@¿¤ùfä¸ ‰ù&¦xL¿MÆÓ|3p\,lqpQXlÓ”˜~ NÂ|ìÄéµ!*8Œ™1ÐE&t ï¾Ì9j2³ìûÇ_.¿~Áà{ýË?/¯¿"eùOÁAR[øWè:¡¹¼o…Ë7 ­Ä ´ƒ…0ð‘˜å –˜a´õHc’&väàWJ;Iü›Ou´â-‡ù/1¶Ú]?ýtùõ¾ûîw¿ÿoÀèÓëåÿCYß~£è;L¿ãxì§ß˜›JWê~¼ö[Ò±¼úò\jÊËtÙ–Û´ÌœŽ;Ï!»_qŒ“8ÝcÌcuW¾óªéµÌÊBÝ»¸P~.ãsSN ]=(ùíÿ]?}wùí§) /õH DIb–f60¼/Ë3þÐÅ”wt_§ß¹YÝK׬¡Â‡š?çw’o2‚Šýq”åstMÞB1Ãd ¶Þ ä›L—._ ãncY¾»æ[W†ªP›t»¬ÏPóó:±Köæ<©)ïušvèVš‡+Eõâugž³3«UÄ.´ÝÙBZi Åœ§C.¯'¾Üb{ÊÊ=d‰ 3¹Äçòåy_ž$õŠIz»N´ðGêÐOH±‰|ÂuäîËs:äÚu®Ýìû ÝïÆÙ_Ý­›½oÍÕ‘¥À¶µÊJ¿…æ}yN‡æu§wæŒnxÜè\³Ò3ìËÜû Þâ:gµGÌWçÏ,û<·­rä±ó–޺ĭKJ·ï¥ÂvëhÜ—çth\÷cgÈÊ5Ü ‹Z†c>ß[¸y¿/¨íGk¤×q»uW§iÙGîx²ðå­³AM¹«•ÏП½Œ×iL¾Éô2¦{j\â‘©ðWwæ92õ†¿úΣö» *~79ŸÁ½ÎùóyßðlÞÏj«ßiéV‡ŽJ»-ÔîËs:Ô®ûªOû†‡ý­f´^óoSd°á,?ý.È_Bkï±d.í®³„°ô>¸òKï”ýõ, ´ ¤îœMíÌs:„n]wŒnºõ9»²GÒÒw”ÁAŸóKn±Œh;¦ïÏŸ‘Ñ!´”Ó¡º T;ŽØ|…ïûëúÜÔeoÛM¾¹oeµÕç´É ø–n}­£v_žÓ¡vÃO•7û2µYùùmŠ¥X,ë Ü*ŠrÏÒu³Ë¾WÕòxäyœ/wæ9ò̺ÚÏog}iÙ½>·À?*9™ŸoFË{ĉ®Û$}؈Ú‚ÿ2D¡Œ ~+â´3Ïé¼?}§܃®#qËÉý­6&¦6tüpGÁðyâÖép7ò-ñô­»Î ”õ½¤Ž èkb—{gD;óœ}ûüÍ­í–›¥ô¾E?â5¾âÇã¹gzòJ«¯GHDBÔÖŠ”yN‡Ò ÿrﬣ½KÙÍ6zd£YQ?ÝÈ]Òùh“–‚o-Õ°òøz£yÎÖºv§»Z]è«ÃlצiÆàëÈB‘lš1hÒ}¾s:Ê“gYoÈ;¿çýÜä³5[Ö0O¦«Mûr/ƒ& å¼~´%så‰wä 3ž÷¸_íÝæ½øÚ—çtøÚð°m㦭µ±¿ã‚XåÝÚxÏutvôÇÃõ˜æ<ømôhÛmÄô0ã]`¬VHîÌs:DmÜ%Žµ,Å7>2û°¶Õ™ãk±wæ9Z7ü¯¯8‡ÿbH8º¶`OdîÀêž!>ѧ{‘óõý=³I$m©MdËi!õ„ªu¤îËs:¤nDÃŽ3ÊÇW“¼cäíãEÍùÀ -ÀyN‡È}O²<µùÈ…¯Ùú{m2îË#Ø?ÝÛ™çlö¾ê;­§çÐrhýÕ;?CµhÓ.Ÿñ,_@os§uïó;󜽾ë~Êï]zÍW]µ¸€ÆâŽ;óœþéÂjèÙS®rM™5tHø%צö«¸i&3pY·^êãpìrx{gžÓ!wß܇Ÿ9ýÚíÖ“qëÂÞƒ_Ÿñ·Wã}=õi687<kÝ™çlÈ ûü×£¯“˜ èÆ ¡‰{Rt}²~žã nÍè‘§í«œ=Ãu8»*§$5yûõügxåExà>÷Î<§CꆯúÂøŽ¹MÉ<«ùÔ†;ìZ{.«Ï³C-iÛqaáÚèš¾ì q±ø³;óœ±Ï­><ŸŸ÷¼'sÚÙâƒïø¸;óœÍë>î³³©Õ÷ª´-¾p×v2 -ÛÚÂKOµL>YN÷ì_îkèûðŠÈ/Ö“^xõ@œugž³¡/~Ý'²OÁsG"U+è\}CÇÚ*ö/{X@òoÚ™çtH~.æú!‘ü±‚†Ó'o͸1~x_mþ¾ÎÆ5ûžL\@oãŸî½c»3ÏéÐ{ì BO=«šQÑsT»*¤å°Œ6½pΣˆß²ýàŠÖ¦±ØšžÚ û±u^ (}`]ÁÎ<§Céƺ‚#OGo<+˽IbXÛÙ?9ýµß€ñï¤ÆG•V ¯ Øz·ÀÎ"”ýº×iþ:FÔ ±ß…ØBîY2?sp ÇézÛ`sh®³õ„ºûgÅþ…§PÒ1ÙyN‡àuÿõÈ›4艂¤\ó<ÔJAÎWeGÞžµ7÷´(d߬涒Ó2›!-•5öýÜjÚ7‚æklïËuã‰|]@r|€‹÷å9’×}\ÃÌgg÷„NÙ²Ý=¶%.Ìçê¸Ô4w^g÷ålSÆÆ™Xú»ßý³+½q(ÓÌóN˜&cúûqg‘àÐüŽvU¥½AR³QIòf’ Üη5É›ƒ\鯦éáÂÚRØÄ+\X›íÂC@üíŸþëþSDz¥Õ÷ÛôÄ/Ãr·;=Ñq~9›R÷Àûf¨üˆ~ÌàÆQEXª;Hßwª# ß)v¸ñJiýý3œkü=œ'æÁt,nÒR~rÂ]?9¿ËnìÎáškpù¾í›ñç‹v“RÃŽ‚ÒG¡4m9|õVÛ‡t¥¬"À«r³©¡¢Õu!ç°QóÏ%Õ¸w³¤íi+¯ûÆÎÍÁ˜þç¡Áº¨dÕ?QÊ}ŸU9ˆ£ÎUüv¡}v-#¶˜gí“pü)˹¬Ê ‹ìf"õ)rü™ÊÉË?µËWCù]ÎFûY™™a {ÁŒ9½š‹éê¥P£˜ö*ŽÂŒG¾˜â|¶ÂzBÛ¦­'¬7ÅÊÈFèæBÙWÅÚf{ímWªÎWa1½­:Õ4N«CÓœkÂÛÅš^úÆJi‡Ô|ª\»Z™iŒJEêrÊÒ ¶´#º]á72ŸÚ¢1‹¾i5Úgî.ŒH¶¤K9#º]ØtãÙ\i©PRÅš5嚯¦T¨›X*ž‘ u4Jm¾ÞôiòÏ©ØS 䶖±Áž ogKO¬â·‹ LjW¹Bº ½Vhšóq”/UJ·ß¡kfíÒEÿß©Â)1ÏðCÙ)Úi¯ÕB¨oñ´’Z¹/¬c¹P6Ô´Mu© -fÛúRQ2é‰tKêRciSe<¤l‘T!©XÔ1QX®ŸÂ•­Pf#P\»å·‰¸ÚéJWØsa^5pwå¼Uì w¾µâPZ\Ѷ‰ÅÞrÞóYx6Û‹ ú1RÅZ–Ѯ֫a …*®4ú6ˆso-ì4¼×~üY;7âÞ.½ Ãœ6N'üðFÑ.À­×¥®ÿBšïðùÛÅ^ÿ3o;wǵ,l¡ ·NÄíHF{ÆÇbÚC> K·i„Ú6´_Å*Ö´.£¡ŒãZ7|mkvY‰=§T…AUѶBWë°ë]­LS3nExëj±82϶M°ï‡&_Š1´aa¶ -íåà0V©Còµ9%Ž(iÒ¡µºÉˆƒö¤8l -LÕ²‰™ȶRõd¿m›ÂPYÍAãFС©:[‡ÙöÔY6\E“.°iÚ[Õš&ö0F?ܽžn÷ÑdŸ{I µé[+-FÒBx¼Ô ‡~zXÆs¥ƒÜyk •s™¦ï™âäÔ®Q] ;9h1ÚHcÍ6&pm¡6Ë&…æ¢Ðd2ËÊC¶ÉÙrµ WÙZ -ŧ¨Ò¿¶5íÚV)•èÚVñ³´tÞ<âoÉȵpõêdMY|ÉÈÈ|›»HmMi²l^¶–GÛks¶â«g*k67Kùÿ=Òwîyº(—*ÿ ‘ëF­¨­ -F›k"w'z±´}z°± •γ;™GHrì¤- Í!¬12(àmÁ„7(Ò¶¢9ÕÛ¸Ç-Ÿ-Iö’ŽUª4'g‘!#ÌøDå0ÐTÑ¥a³sÑÉ“ -R±¡¢a æ4|2üý?Ö-/ -endstream -endobj -542 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 541 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -543 0 obj -<< -/Filter /FlateDecode -/Length 4930 ->> -stream -xœÝ]Kä8r¾ç¯Èó£å#øŒ9XÃà /Ò”Bðø¤ ƒË'êü„k'qAP8P–¨ƒ-Hâ8ÖS²)J\ l±ÆH\ lË q<‚)ixßbx[1> ØOQâ0Ù‘ÄÁyÄcèUIçÍèZÔEèt¸ š°k‰ KM“^âüÄî’Ä0:M„[0U$.ÀR4EÏ\ÒiØ'[âxºÐi-qA4°Þ ÄÑDD™^I\€±$ºZÒ‘â83J\ÉOì*J\€i‚HL)ê` hBâŒÛNâ?6æˆ:ØbI\£áp3J\#l1ÊH\lr¼$.H -¶À㓸 )?±›,qh:¥$.H:"Þ4$qæ%Ç›Qâ‚dâM„x¼MÖs¼$.H[\Q[à4%aÞ‚“o‚$‡-&‘ÄÉ{Ž7£Äp3o£·"Ç›AÜ.ïºf’tà]x¦^â\ Þ„g+Åö -Äëü3Y9âŒâŽõ:¬­â–÷bµ -âžùrŒ$nÀLD–Ñ‹»XV¡ÔJÜ6Pà_øc´á„y÷©ß¢ò€CÀš72aZ¼ûs´dv'Ù¼?ö—?]~û‹ïõOÿsyýMÞ)+?BNMð¯0 LÂp;xßÍ·Îa¶ †=’–+ ©¥AƒË&…åŽÿ]·V–ÂP6¹yŽý9¬SK½`ž\:!F<`xl¦>œç®ÉAºÖZ¶µuQ_oë#ÉÖ‡ó|º­JBÝp0×õŠFÞKü¹ƒßañͶ^ŽˆŒÇ =›é“¶µþă”]2¬{Ì&q‚–þÎä³|¢Á -á;üA46^?AŠˆ|­ÿýÏPébżK_/;óáÑi,Æ]þåòÛúé§øÇ~½üÇß)E·ÐøëÂò÷†ì¯ðüÑ¢YVÓè–ÎêEf–4‹œâ"÷ó_ø¹Lã[Z.§¦ê¯×]ÚlíÊvë:j?”»Sgóë¢/éÔ:Û\ÒlúbIkݶÍ5Íצ+mûËú–†ü`·ó?¯?ÿtùÝÏkHæH*C’4oèhtóŸËòÿ5À›Ò£à]uòëz@j/ 7ŸÓP\ôPæu „ÑD늱˿µœ¸ü1ON[@YÚðe‘wÀ­ Ô=Øi8ý×nBÔÉôcSuDx €Õ D½ìVm ' N›61Äï~ÿ¯ÿüÇß·‘@°…à¿‹eùómîS{w˜¦æܳsZÇ´óRZ5_oäqìÝ®¬.]ë-îée:.eæk³¶‹Ëâ{mŠ¶ºr>7F£‹Y_ÛæÞ=Õ¾ïÎË­$ÊÄÓãe©É7l1>™\ ÍDÅ2õ2_÷½Q[©ºÖǹLu[,ö‹©¾·!œJË÷á­+vp‹(GÝ–ã-©|#d[NÑÒ«>·ëȬº;v¨Öî¿õèÎóY°oˆyEðà„²gĶ2×lˆà~f®1 Ê_lr…SæÏ¥­l…–6·?.c}›çwþëåvd–4¯Ý,0K]aΛ¯¿-ãã:›t—nCmûÝ}S1¤;› B)s[¥viÓN_1k¸2Žjn§²ë>Ç¡Ú件•~×­ßW3Y¯Ç¢ô‹TþÌ2‡ýÆ~š©••íße¡§•}Ööºž}J¿D¡­aÎ[Ú˜eiþõåþÞÉz9j{œ7ã奛•]HËóÉaŸŒ$¾Ûº¤Š’°,ÇkY‘´q;Ñ”’‹A¡ÈahD8k0j”ø&Âñæݹ<φ"gýŠ*ךáo¿ùÀ!¹[þòo˜¯E¶‹îËæëòw‘›ÅÉÔå÷ëò7mÓ~¿õå=›-;(£Ð£N¢ì\ž'AY3Ûë#”ímEm¶^ÔáÞ'&£Év(+£×£R¶è¨ßû6 ¡†ËÃ6__ŸÙ/{Q‘YѦ…r†ýÞì·úµ¬Øt¦®Ü§z=ØEj0#õ\ž§Cj<äC !º¬²vЩ-grÍ°y¼â®a´Ý€Œ b\—÷¶¶/ÛQQf–žg8“ʶ%óºï®íðÙ,yÒÎÌÓ­µÝ·.;¸3³‹ÌTùŸò„+Gwý½“yž ™^rhíÅqÅî‘u„’ÍþÀ}_žï>Yº¥¯³A­ë·çFúæû‘3“rä1‡(<™çéPxÎ_¬#ÓÝ$G·ŽÊK·{Rî~ uä>YãHö\ú@}õî2ƒàeοº«DmVT¤û¶®xRØ©¢;>¤ïýÁ“œÌótÈ»ãCŽ#Ö=½A_7²›•lç³äý×z„haÃ;ÒÊþ»_ý92Cý =x%õY»ƒÞÎGÔfJ*~>ð½çò<zïø•¥_×+¯|F¶‹ZŽø®GË÷Š‘³M{ÞÈËâ3 >mõ4„‡$Žäöì-yîFu;ˆm¾ãyÄžËólˆ ÇþæÓø€y‰Þ¾ƒwóȬX¥§c® æñþdž§Cî±úÿmGçÓ8û{¢» õîìÛA3=÷ŸÌóth>ö{7þèBZ+bfF¿;TF˜g‹üÕ1ß?‹ìek[ãÈÇÊ­³u[;Ÿ”Ï°P:¿»vŒÆsyžÇ~ìYÝSe/‹§ë=æƒÑ=ŒÔÆiGþ÷•¸C¶Aÿð@ðÙµòàíû×¥d¾Ã_=™çÙïø«Ÿ¼j -ªÚ{ü ßðÙ¼µ±Ûe¾ÉÏ¡Ý{íà\ž§CíýÔú†û[Ÿp¯ŠÝÈ{h=–Â¥C;ë.Ö;½©þÍKwîˆÆwÜ»?™çézgßõä}£êœxe&GEi¾›¸á—2bѤÖÏsqþˆbñݧÝ+>Øü(ǧGzw|ýfõ¬ÃøªÐwKcó9)¹ ~'ñûßǨ=—çéP{ÇOU2Zú•ðÝOÏ}ò YÒS0•cÇ{ö~{§bo/Vôú{OËÌÍé†èrœU÷îÆô¾<—çÙ—îܧâÛÍ\Fvuwp\]Ç'Rº»†¦‡÷vËGÄ>²»NHú›ÝQ“œ:ÿ2ÄI[âçï|2ÏÓ!øÎþé|Ê3èzdßru«ßk›*:¾Î(È¿¸{ZŸ?e¾ež¾ í¼ƒ²q–Ü{V4u{—g#¢“yž}çüÍ{÷ÚIŠRv^³~·?ÖùŠ{<÷‘™¼ƒÒæ+š"#êÞÓ('ó<Jïø—g£Žþ.åmŒÈÎã¨(¨ú,æÊÏ k´]ën¤.ëwÁï=­‘ÒãÏÌól£«ÕI'.ݺw8‰š:áóòAËóV6‡ †u/Ëûà‚Žó”£èí—ùp»ä­ù¨åï몯Yôi¿ÌupÄPËõ‹-…8Oœ¡Wlùp; -Àþ°œIÆÂñyÜ|ºTꎸª¨º›äˆÊ IÛC{®z8(iýΊäÃèm¼`%>¿mï%ómnp~Å/´ÌÓ²£‘¬Xž‘6å-§üë²ÚäÕHÍ/ks<¿ñ´¼Dž_^NËýNëU{Á|ùÜŽPõåk“•PóKõÝËßµüòòwgÏêåï´"·áÇq½ø|¡ÎgÑ*Ÿ×ðaõWOã&€ä#ŸahI—aÓ¹£õu'g>âÿךj9õ_ñAÀ|dÖþbIÿkð_.:ÑÄýŸOÅÈ't«,Ž¦\4ñÛ…Oh'ALÔŽÖ¸#fáòQÕ²Hד:Šìš SSZ7©åc;΃_ך?WZÃù]ÉÆ'ç‘*‰l>;n®X"§×[1·^Mzó)÷q²Ë•¯¦ðËÃUØ -¤>m+°e¼+ÖVuB·ª®º&6TìÑ|*jí:ß„Õô¾ët7ü%­ Ýp oTkGé›(å³µKQ¥wª2Û•ªÔ•”u@¨Ž“ º]áªM̪ïFO(…±‰jºTÒ ¢ÛEL·”æêH…š*¶¬©ô|3¥AOIٗݺ#omG7G”-×b>…¥ŽµŠnÌFx»8ª3±‰ß..©]ã -å -ôz¡íÊ­â¨^š”wæO˜šEÆç;òÿ3U¸*eæÉ4UHñ­íªUÂs³Š×ÔË}e’z@Shi»îÒ!TÌöýAHϤ[S×[I».ëä!ó˜¤*y¬Åº¢®Š™ÂJÿT®ì…ªêšØU(¿­ÄÍNW§ªSµ2¯;¸»ZnûÊo½8ÔçÚJ#Ú:à;Ìá-/l4Šú±TÒÄ|0RO­¬6Ã@ -MÜhô-‹Ël­ìÄ_"R>¶I&­¸·ËŸ/y™3Ö>Ä[ÍçÇ÷^—¾þ/Òü„ßÿºÐõ_Ê¥ó:nTe S¹u%îW2þ¶‘xRÌß>R„uÚtBCí7±Ž-­+h¨ë¸1_SË®±—”º2¨®Ú^èZvbS¡k´ízÆoC/VGæ£cÓìùÒ–ÆñI'|Ôm± -}sp›Î¶%ùÚ‰+NÚ–thÉtqÑŠË®ÂÔ,[™É€ì+©]ÏöS?–ëê.:7‚/mÓQ[fû¢‹,·¢KØö}Á¤ûJÓÊÁèwO¯ûb²/3€¥•Ú«ô­—Ö†±´ž,µùÒ¯/ëšcó!!eò¶ªeÙnîÙêä´©Ñ\ Z]ôí¤±e[¸¾R*²U¥e¡¨t™*²Zb(6ù%[é–Üâ(öR¨>E“þ¹ïi×JíD׊ߤårËŠW½%[ ×Ã9´Ö©–²ú’Qù>w•RKi‹l[7­ë.«íµk5C|óLUËæ6)ßÅï™;sžaBJU~òΈŽíˆo,Ô¤ƒ56k›ŠÞƒCˆ¿x#Pì¶JÎs¼w²Ý!){'}MŽ‰¬UAó÷ïÉ&¼A‘î+º¢ÊwóÉÙ’›ôX[CæÔfg(SÞ…ÌDõ2p¨Èß·fÙéü51AiùÓ|Ûhµ}’þ#‚Ó -endstream -endobj -544 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 543 0 R -/Resources 4 0 R -/Annots [ 545 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -545 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 573.873057 101.433071 555.123057 ] -/BS << -/W 0 ->> -/Dest (cb45-1) ->> -endobj -546 0 obj -<< -/Filter /FlateDecode -/Length 4939 ->> -stream -xœí]M$7r½×¯¨óÊå÷`è`` [ /¼ð`}0|è.©%-Zöïû3IF2#«²jzF¥…§ÑÓ•üƒÌ,¦>+ü|£ñ_rzJ)ÇàΗŸO¿œÔ½Â¿’buQÔÆoôg­\œ¼Î!ùóÏ$°qŠÙ›Îï'ü7\òäï§ÿøÝéÖyôÙL9£ýù¯?ÊÙ)¦•T*¥­ ò~ŠÑø ¨‚žÐÄœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚON’Îè)¤l²¨‹Ðéh$µSˆN{-éòBðIÒ9Øâ³Ò’ÎïS’¶8›¢¤ °Å«Dl1)ZIa‹w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔaD¡“Bt¶峨ƒ-Þ*#é,lqø‘tà ocJÂh54º­²ZÒyØbLt¢¶ ó%0¶¨$ -Àšˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.†{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»FFâôê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„1h%.pà]ãÑiæ﯌ļkœ (øG‰Ñxâåp¶€`%.À|± °É ,‘¸ÀƒwuÆô'Œi°Õ¤Sxð®Nè>Q—'áqaÜÂË“!K\àÁ»˜¨¬Ä¼ úL€ã'̨FâÞÕ3µ¤ïj“•Ä¼‹¸ÁK\8L€Ä˜ß&­]Q—'•S’¸ÀƒwAKFâÌ“J`Q'IK\2žâP‰ xÓ{–¸ €w•·Vâ‚ÞUa¨ƒ-6‰ ×@‡a+Œi«“2` -IÞU=,éÀ»JÅ,qAïÒ´)qAˆ$0Iâ8! -6„ä¦c¸ dB>Q&\{‰ ¢‚Àƒ²DlqÑI\€ÀzÊ6'‰ ¢-Ö‰ ¢-$.@D0eè[\ÀÀE\8Ø‚HQâ0Ù”²sD°ƒW%]0SŠ kQ— ÓQâ‚Ý„©XK\€µÔ”0è%.ÁO.I\3 ÓNₘa †ŠÄ˜Š¦d™K: [dK\€H:­%.H¶ ”¸ ™„UfP`†ÆZ®–tNÑ:3I\\˜(T”¸Ã+M0¥¨ƒ-  ‰ Ð?´Øö`ñƒÅ&–9¢¶Xï$.HÉÐr3I\l1ÊH\lÒz3J\lAÄ'qAVa¢0YâÐ8tJI\uÂzÓ8‰ 0.i½™$.ÈVa½‰%ž0n³ ´ÞŒd[’‡Œˆ¹©A‹Ë¦‰éþ·V–Ãp2¹±. -´1]©¥~0Q)ÝaQŒõ¡9³›|wž›&GDùÜ>hÙÖî*^o÷•dëÝy>ÊVÛº5SÒR-`ki‚v@ÂY> -‹ND1il6Äúʈו[%þÇO'Àbż·Ü.™ùˆC4Ýøó§ŸO¿ÿ—ï¾û§þwøéÓÛé?ÿA)g¾ýFã¯}]ðö›×.7nù›  ]®=~!Ó™¥¥2“f/7ÌåÕr@JãA“RoK}o벩.*Ç,¶Ðµ¤+e/åÞlÇ`Çx]ÚcY9ølÍbÊC 4Ûn¿ý¯ó§ïNø´I‰ÈïÃÕ±,Ÿƒ«/',ï¯À‰ ñH·ZgwîÁÒ-]ùz',œ¿¾ý2¤è.Ç Dc^ á¦æy6Pa¥w„¤~-Ò¹»w?Œl–Eýî Å2*¡žq™bÂëH9–çéâ®ò»Ìõp—Ko¥åïrí—kï×zò°·‹Î¬Óø¸ô¤š{¥÷ò/½ZóVVºjC\§©u“½n°·ÚOuzžîÖÆjçK—‰¶íÔ_Û%µÝ½ ¶Vÿ]–²3Ó½­m/~2;he‚׬’¡EÓu´Ëóth½|¥u/TÓmçÖ˵ç´6dj¡œA¥¼/…Ý?·:Ô:ß -‘;mvRýC›9âükE™î…¥ ëúšß.xµ‡hΛIaÉL¨ºŽÔcyž©×ãº[hÇ?GSëáEŒÓÄô#ÒGîÌ[D6#¡"åkŽ¸†¼¡ýGêÚC¤éñ§‡IJ„[3ýÁ<φHs#&Ü™uÇY¿õZÞÊwÙ!xëkŽ€ýåïÁöþ•òÁ/ì´ÚôeWˆ;ˆ} ž=˜çé{#ž½±ú|qÞçG2O»Z¼µÈhvĸó<šÝõ÷sWSüNçÈYGîÚ®fa×{¸Ü'â#¦Þsç¿UN÷ì_ægèïŠãM<Òùò#y}ì³Ìót軧þ=òÜ=;UWйY)]X;÷Ò¾ÜÞÃ’yLzpÅu0ÏÓ!ùóö\“Hþˆ½ÆémÐs9›8|ôÏ?úlyÆÀ±Ñ0Ž¢¾âÛA/‹OÞ±=˜çéÐ{ãÙб·†U‹ô$ʸҩ{Ÿ #Gñ§B8‡U´™2ïEü-Ûï|âF´iî{6Rº{ÎKF©โƒyž ¥þÆs{ˆ«;<ÕÓ¯ !ã^ꀤŠÖ‚L§6O~í=ÜßòÏbTå&£A–îRåy:¤^kÿÿÎÁN4ÀÊk¶úµÄöÄu™{÷›Üp»wÐúÈ÷~›{°þzìÚzîm’Õ³šZ­÷Uë ¸³ËÞzfˆFÔÒsõ«§Ó:]yvuܪqÝÛ:ÿ jÊÞïÎÞBYª~çàŽgmÅæÈÚÉ#¡áþY³ç[(þ=ÙƒyžÁ×ãב¿Æ¥ÕnR`Hªžxä¡^ŠjûTv’ퟗå|ÅQ¸A”f\Èl¥ e³BÚ«kæ¸Õ2¿6ç÷å†ùD½ÉHê~.>˜çٮǸVXÏnî =eÏ÷Øö¸°–5p©ew^7÷å«Cõ1ªhÃx÷{ü®Ä•ÑXê´Û¼+¦‘1ýÀ.ïÁ%íÐК®Ýk©»6ݦyy± ñäá9­'z­­›¯7ò%-éÅxÔê‹4‹®<Ðìqa+§òÉŽŽ ¥^;^¯À–|ŧ‡œh¹ÉoÍ'yn·cFàÒæTQÇÚ¹ø„·¹ØºjU¾IÍcQÖvµ®‡|©.3RtXšVíˆq -ÙÒ¹K;ìÒwž|š_¡ýý¶œ`é):¤t[Nóµ[Ê -×ìHÚîÙ¡z[Ü…µ¯`aé‚mtXmP΄,”]0œçüÔ¾ÒF*ë…c³ãÒü°ø¢Úä—Ù/u_SKÆ¥ÜÅÕþ™‘dû+öçµöýºß»MWýhǶ:f_©Ó3l,caÄbkËem_k‹­yé“—¥­þJûjÚ·¹~½È-óuJzÖç[,ýâæYÂ\Ÿy6}Çbé—xÕ~ô_ÁnµgñakK8ÞÞ2‹†™P÷*a«ÜÓ©ã[3;êX=ÝX¦®ùÇÈ~ÒË]Ã’VuÎìؼê»(ùNÆðRnÅâ8þjžÙÂýá—¶Ž÷ •yÄ3¬)inac¢òˆºÚ¾¼i_›Kø<2—[îèþ»ŽR:šÞ†²VÉ‘v­ÇmŸgûG=×ýÎH÷§¹ê§lòà§y¾ZçÊÙcLœ½Ÿ‚E r9¸øPL|0ÏCÇi}`0웽!OÉ{ UùV1u˸Ö XÍ°[a“Êt(íPaùíêâz·Dƒ¨Ç\D¡Dÿv+·Kå çD{nåöaÊ}&åæ8·%€½é!S^Žà|°;úZÜl½³åœR:³ñÏÓiÝp]ˆr;oå¦~¿XóqžwÉ`”%‡ðl›>/½pµŽq $r’F€ˆ'ˆ«žöM 6Ó¯¢h»o#O:ö>ÓÓc­elwÚûór`côÈééetäbfç?6®»™äµUÿlÏ<ëáÔÀµ Q$½©Å&Œ^´*ÒᦒÿÈ7%›™…å›$K$I]ÙV–K·šêO½DR¯,ÂñsS¡Püz´@tErÓV¬o‚ÚDÝ¥¾%J-3YdQ™býëÖö¬"ȼ<[Ú°éÆ_N¡Ò«ËAí*¤Iz“Ë9¸‰‚ܘÏt0pRÖéÚmº8ZŸwr–÷ßüÒR-¯ÄQtJ>\º•_,é)þ3²n"ÿ—¥ky}…*bŒ=?ŠßOôú'ˆëëßb.U+Ë鶜®² &ï8å1%&Hµ|ìknš5Õ2ÔÖP~_³Ñ±²NÕD¶¬:W,‘3è­˜Z¯&½ˆé0i²ËUh¦Ð Ô„½@ÇÓö{Æ›bmú­P±êºØ¸j¦#ÛëB6Ó¹ë4ëþšÖDÖׄ—ªµ£ô]”Ò‹'jQÕ»F5™eFå&õ5eë×úI]N‚ðU‹vè̦g½FÇwÏÂTäZº\Ó ¢ËIL·”æ[OÅ–*õ¬¹z¾›Ò¡nSs¼ »°}©Hï´bcDÙúq-¦mÖ×*1ܘðrò®Ä.~?ù(¤ö+”¯ÐãBËÊmâ¤:^º”Njœ?ahV~LÿÏTá›”˜§|ЮAŠ0ïW½›M¼v—‡Æ:Nò€v±§eîÒ16Ìr餄ôDº-uóØJÊ\Æä1Wóˆ¤y¬Åº¡®‰‰ÂªWr¡ªF º.ö Êï+q·Ó·¡J‡/ Ü}+·‹CãÎw.Ž­Ç5Fßìmå2ÌWá¥LlnôS­¤‹j³]¯Œ »a ….î4ú^Äu´6v*G†-û “fÜËé§S™æŒõ†–—a|\}¬ÏCšïðûß'wþ×zš÷<ÕØÂ4n]‰ùLF¯âJÅôj®*lÆ c´ßÅ:õ´¾¢¡ÍãÆ0¾v=»êÄ^SêÆ ºi¹Ðw2±iÐ5Ú2Ïø+ÂËàÅÈ|nßô {¾´µq´\¦sà«U¸àÍÁeê:Û§ä3+W”´OéÐ:Ã2â‚ŠKVaî–­Ì$@òJšëÉ~Ç»ÂR]ì‚…ti»Îõi–]e¥, B`Ë/xÁNóJóÊÁ臇×g÷ûbr¨#€¤Ú›ôK[ÃHÚO–ÚrÖ—mαe¡Yo÷P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«JëDÑè2Ue­ÄXm -K¶ê–Òâ$z)¶˜¢Kâžö¼Wš=ï•°IKåÖ¯EK¶@žÃ9öÖ©ž²Å’Iž»I]Oi«l[·[×]gÛ3k†ë†„™ªžÍoR>ÄŒ9Ï° !¥ª?egD§þþ LÔNGkly¥©J!€C½•*ºÄ¶JîÎs}ïd»CR÷NxMèŽÉY«¢¦—ÓÊ&¼Ÿâ<‡]W°¢ê‹kålY‰MºÏÂÖP§9µÙ*o',Ï‹” ¢vi©H/#µô&z‡ZTZ~À G¾Ú>)?ÿä8Vp -endstream -endobj -547 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 546 0 R -/Resources 4 0 R -/Annots [ 548 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -548 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 127.623057 101.433071 108.873057 ] -/BS << -/W 0 ->> -/Dest (cb48-1) ->> -endobj -549 0 obj -<< -/Filter /FlateDecode -/Length 4840 ->> -stream -xœÝ]K䶾÷¯èsË|?€À‡1bd‚f{wmãvùûùŠ¢Jî™]k½ƒÙiUñQ"?~,–¨¦¼ -ü|!ñ_0r!zg®·Ÿ.?_Äà­À¿”bv‘Ôßá×Û«ÆVFìõ'h?øh•w×ç þë.ÛäÏ—ïwùÏ<¼ª!F§¤½þòžTF>x/,£ŠP ©•µƒ÷Ê:Fåä€[Œ‘SÁ ë2K•‡&Ë©`†Q*0ª3´ñR/Uf(/ §‚2ZϨ¤€R Áê`ˆ0F+F'íàÐèŽÓ)9¸Udu:é§ÓzpÞH+9]œs6p:[l’ÓYØb¥1‚ÓÁ£ƒçt¶h§«ƒ-*xÍé,uJØÁ­§“r°À¦fuQè$ç‚-NØÈê`‹ÕBq: [ ~8xÂj3Zn-´ät¶(å «ƒ-è|Ž”ƒ-Â;Ž0‚â%Ž”÷ƒ‰Êp$ ‚L0câ`¼× ¨hã¢çx@ ’h[¬qh [ F.«ƒ-:Ž ´‚-HÀqÖ°EÍqÛ …ã º5"JŽ 4øÖé8.Ð \˜)8.Ð`\œá¸@ƒr¥Èqçjp'Ǥ‹áî9.Ð`]mâ¸@ƒvµ Žã ÞÕF -Ž xWkädu°æ¸ì8h4Ǽ«¥ðð.†‘⸽:‡Žã`eP!Ž xWa8.0à]å1°:?` jŽ xWYÜ7sƒw•ŠãÞUF9Ž ”ü#Xo¼ -±¼;[@°`¾‡NiŽ PØ à–p\`Á»2búcÆ4Øj!:Ž ,xWt«‹ƒôhqfÜ¢•é\ä¸À‚w1QiŽ ,xô8.ǘQǼ+5fjNÞ•* -Ž ,x~ƒå¸p$Ž 0¿ Rº¬."†Àqǘ…À$¬Î’ä¸d<ø¡8ð.¦÷Èqï -«5Ǽ+ ÜV[tPÀ¯ÖÓpV¡Àœ¼+$z˜Ów…ð‘ãÞ¥i“ãçI Ç0p€¬8.pÁ Ñ{Çq‹:¸|¬Î ¸¶xe±:Øb¼á¸Žõu x[´Rx[à2p\`ˆÞ7»<€-€ »>0°ž"Ç`²!Dc8.ðÖa=†VåtN Áƒ®Y]€NzŽ ¼7¦bÉqÖRCÀ ç¸?»ÄqÌ€NŽ |„-*`*‚‚gÎé$l“Íq<]è¤ä¸ (Øoã‚ V™Np\€kI45§3‚Ö™ã‚`Ü@®"Ç&Xi‚)YlMp\€þ¡Å¶å¸‹,6±Ìau°E[ÃqAŠ–›ã‚`‹Šã`“Ö›žã‚(` <>Ž ¢p¹É€Æ¡‚ã‚(Ö›Êp\€qIëÍÀqAÔëM,ñ˜qµ£õ¦ç¸ Øbᢰ:ا)2㜄õ&؉Ó9Ø¢¢á¸ :GëÍÀqÜ ¬7áѳ!@ëMφ À»6‚™8xž©ã¸Xo³åÖöÄk=ü3^hÅ؈õZÌ­lÈ@€{1[y6f @¾´Fbƒ0+Ëàب¦U(¥`Ãü Ì,8aŒ>µ!*8xÌ™ÁÓMF ﾬ9j2½’lŒýòÃåË'L¾×þ{ùð»)Ë?BJmà_a¨ˆî¶ð¾%n_Ù*•ó=,»+1Uëc5K‚§0™… þ]—f¶ÂÔïæõ*Üõ²bOÓ9 kìÑL¯l´ÎõÃñÁ`JÕƒ»áR¦9&`•B˜ÉwfyEƒÖpp -Ò計D12àþ -3Kü‡7Œ§ÉŠ1T[.¥¶Ù|P?ÖìFÙ뛟._þù›oþø§¿ío>\þù{$}‚«'¿úBâ³1ã_+¦ë0]»é¯ž§3nžN}ÀçÛ$‹UžÓÙ[“çÃ<¯ø0Ï_lÈ×~ü‹Å_µ#Ì<5vÚZ–vK¹}½íý=e›Õô7Ô:³-ÉfßÜgll óû,ö»ú¹”m»vmîI¹¯þu}óÍåë7sPÂéÊ $ÿòŽey Ž_¾ÅjL[ø-8Êíîæê#_û¦ÇißW9OÁ©ª8i1¸Àa×/m…ÿV±æwêšð_°›ËëÇN×&¬­ æL¾Ç·MšÜï[›¶,ít›Û2³E2Üõ»¡|0Ïé°¬6¹ø4ýjîïy0—Õñ¨6MÕô}ƒ…T‡ìê÷]9œ ¾«»ãò­±˜êÔ˼ îæš³R^ß`ý¶Še}?-Ìs:,ÛM^nçɽ¾Îý«ìØÞÊñ<Ù÷ÍV?/æþ~Œô˜aæwâ·~(Øî|$²¹Ÿ‹z_†ÃtIónî %¬víÅÎ'ýxdð;+«åiÃÕßÕ†B–2-Ç·1|,Ïé0¼í·~kò#ÂäCrXiýÒSGüZòÃiò'nî}™ä<}ìú‹ŸYªÔŠnj>G½5hãè¹/=VVQÓczj·¯¿ýÛ_þñmm·çT6á“°9ã@XïgôcØšêo*ĺ+r¼ì*¤:ä;Þ/FgV6UÈd"E6Ñ{0ÏIÐ[vÊúMÎÌ×Íô¥ÇÑ …J;ý¥_?^³:ú¬'ÝS—æÝôw’+5éóï»éo\¦Íž‡í½”éšH½ [wèí¼ÙJ¯_걬Yy¹Î•FŠ”9_#¢ìXž“ ¬šÔ‘õW™_žÆ.<“[úíöœG€IhÒ Êroõë!7ïµ”æ}‡„Û´ÖË>b·ŽKõ©õ²“n™m’)§›ç©¼…¿þáx]©M庵ŠÔ¨îGê±sÞ©‡Y-,x‡›Ù_b÷‡mΨ®þ‰•ì¼’>jWÐÛøˆEP´‘`½Çòœ ½fǯ쟀t+"ûÔõl³jÙâ»-ŸjœlZóFÞN>3ãÓOƒ{JzïJnÍÞœgwUÇ#ÖTßñ0bæ9b·ýÍÓø€/]óÞ³zûÞÍ=£b–Þls­1÷¯áæ9r·}ÔßZDçÕ8ûS¢;£uwô­ ÙÝ¿î?˜çthÞö{þèŽÁÍÎ1#£å¦ÑÒ?OïóÉù3ËÞ.m«y_¹e´®qkã“ÒË®B¦MîÛh<–çlh´Û~ìY¹…dQϼd=ž`îôîæJí0k²ú»'äG#k)Ý‹æ%™öõ`žÓ!sÇ_}åYûUPuWìñ5|óy?+¨mb£ôb -RÙ=ÔËs:ÔîÄS_êÞío½Â³ªvA§|½ÇÒí*,ùrëA±³e牨}àÙýÁ<§CèNÜõàs£âp{ÈÚrnÓª(ŽOüÒíMOS~·/ú‘=o÷Ø|/ûÝ#­¿»ºŸô]“痢¶úœ&Ú~§¡ŶQ{,ÏÙPëvüTÁ£¥ ÷vœæ]δã4ﲦœíZòßÖ.ö-1=ŸïžT¬ÅbYO ß=ž=†nuÙª½'¤NÞÏ—óœy;Ïéû}èÞß™=ìg×~GJóÔPµëáµhyØ{¢ëfIŸmDmÁéà µñn/ât0Ïé¼?}Oy]÷Ä-gÏ·Ú˜€ŸÛTÐñnDAú}ÁÓÓ²ÿ”ø–xúÖÝçÊo„í<çwMìòèŠè`žÓ¡ï˜¿¹÷¬Ýp«”•½íûc¯øùñÜKFò -J«¯Gh„¨Ý£å9JýŽytÕÑ>¥ìV=²ÂhUäEÙ‹9óóü5jÝôtÇem|o·†—÷ï5:˜çt½{Ї ]«®½“&ÆwÿT~§|êaŠdÓŠÞ-VoÇkNGyÊ{œ“žÞÉT·©Ü·M>Só·u•·,Ú´Oc´`(åºÉ–Ì ”'ŒÈËï0¾ø>x|µO›âëXžÓákÇÃz´›¾º«Ýˆ b•Wëã#÷ÑÙÑ_ç·…J9ôΗšl»M˜N+ÞÆz`wäÁ<§CÔÎSâðXÏR|ãsfŸ—Ù¿‚ªxÿJð`ž³¡*ììZü•yçîÞ}5¾™FÔŽ?ˆzÌs:¤ì<}mâŠÍ7^Ù¡Ýï‹:—åÞ,ἺöYRYq51…¼ëÆÊÛÄ…ïzr’ãµìm æþÝØóœ­;þ×'\Ã4$Ü»·àHdîŽÝ=)>ѧ{Ëýý3³Y$mí{«jdëèûVóœ©;Ñ°‡ãŒâñÝ$¯yûü¢f+ˆ|`àÁ…+[¡ÈF º*¶ÊÏ3qµÓ–¡ -°çÊœlànK¹Uì -w>·b_z\Ò¹^ÅÞRnƒù,¼¥‰Íôb‚~È•T±e¶«•5ÂjH¡Š+>'q­…è¬âü±2nƽ]~¼¤iNi«">8-é˜ÊÖë’×ÿ!Í7øý÷Å\ÿšÏEçq% -[¨Â­3q;“Ñ¡Æá ˜9ÎÂ2l¡2 íW± 5­Íh(ó¸R _›š]TbÏ)eaPY´­ÐÖ6lĪ@WIÝ´ŒÝÞºV,ŽÌKû¦NØã¥Î7‡j4¨•­ÂE{;¸ U§ë”|mŠÄ%­Sº¤oên2â¢-—M…±Z63“ÙVRšžì7mWhª«¹hܺÔUgê4Ûeé.š$pu{Ñld[iœÙÃýððzq¿O&»<HZ¨½HŸ[i¹1’Âã¥:]ºùe™st:G,ÞÚB¥,ÝŒ=]œœ:4ªkaf-Fi¨Ù¦¶­ÔdÙ¬ÒE•þض´m{¥4¢m{Å-ÒR¹yÆ+Þ’.máìë݉š²ø’‘¹6w‘ššRgÙ²n3¯;϶×æ6L5ÄUÏTÔlv‘ò!þ{dìŒyº(—*ÿ¤Èˆ õ$ALÔFz­ô5’»œ‡:ßכЄJîγ;YFHr줭 Ý1­…—ÀÛŠ ÏPÄ}ESÔót#Ÿ- -ö–îk&4TiN,"Céœ÷ßL¢réi©hc:W„@§Q{Á‘¶ Þfá“ôó+þ -endstream -endobj -550 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 549 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -551 0 obj -<< -/Filter /FlateDecode -/Length 4902 ->> -stream -xœí]M$¹q½×¯¨³€Mñût Ã^ÂìƒàÃtͶ£×ÀÊÿ}¿`&ÉHfdVVOϺ í4zº2‚ÁàãcÌÌÒW…Ÿï4þKNO)åÜõöã始š¢WøWR¬.Šúøþª•‹“×9$ý‘6N1{Ãõí‚ÿ†Kžüíò¿ºü÷:¾š)ç`´¿þõR9;Å£ò‚*C¥´TÞO1UК˜³¤‚>:㶪3\N^RÁ gLT fXµÝª2Ì0Q;I3töQPi;´QJÔÁåœ5‚Nû)ÀéAÒ=…”Mu:¤³v -Ñi¯%]žB>I:[|VZÒyØâµsJÒÁgS”t¶Ø`•¨ƒ-&E+é"l1ðNt ¶]IÔÁ”–tÙN>'çD]†N¥˜¶:£ü䓵JÒi=y`ÓŠ:Œ(tRˆ‚ÎÀ– |u°Å[e$…-?’<ámLI­†F·UVK:[Œ‰NÔÁt¾Ä&ÀƒDAñ’Ä&ÆÉeã$0ÉN.¹$±€Iyr1Z‰Lö“ 9J<`•†Îh‰¬‚-Þ‰ ¬†-#WÔÁ›ÄÖÀ$¸ÀZØbœ•¸À‚mÐ"qÝ:•µÄ|ë”X.ÌTX0®MÁI\`A¹€R–¸À‚s-¸Sâ ÒÅpX°®õÁH\`A»Ö¥ qïZ§•Ä¼k-rŠ:ØK\vœ¬NVâÞµZE‰ xÃÈH\€^€Ã q°2™””ļk’r8𮉘D]œ0­Ä¼k<š ÍÜà]ã•‘¸Àw3Aâeÿ(1ï‚B¼À¬Ä˜ï¡3Vâ6„%xð®Î˜þ„1 ¶štÊAâÞÕ Ý'êò¤#<.Œ[xyÒ!d‰ ">“•‰VœIÜ1P ^¹UÜ2Pà^ÌVQÜ3P _Z#‰›0+ËÄ]L«Pj%n(ð/â1·á„y÷‰oQÀ!bÎL‘™1,¢û¶æèÉìN²y쯾üú3&ßëŸÿçòú«²SV4„’Ú!¾Â00Ýí}k4ßÂoŠi°ì¡ÄTmÌÝ, "\¶ÙÈ,Lxôïºý°²¦’±È•P Õ 0–ŠÁ=¥t‡e0V†fÉnëÃyîšäkû e[»x½ÝI’­çùp[#H ‹f„˜¼^ ά¼›úc»¿WLü¸­Á€ Y4ödž6Ù¶‘’©J‡bRgb¢4AKS?³øÁ,h0U‚ˆ0 ͆fPÐ"Ö>Ê­ÿîÓdºX1ïÓ·Kf>b:ÉÑøë§/¿þ§ï¿ÿ‡ü7 ðÓëåO¿Q`¿ß~§éo\ÿõ~¹NËuXÿ³!Yd7üZ9½A:CzÝÓ·4K¤kv¼.ùÇ"’Q¯øœæå+òS^3´#nózµ.K®ÒÎÒÖÑð³O;>ªv¾tÝÆÏC´úí^?}ùý§5øʪi-®R ˆñz.Ë×àõ[À4çC˜~fÝ]»²ºÐvH>ârQû2ç·ž¥SC}C9”Þœ°‹ÃÈ…5LÇ<ÕÖ9;Ø[Ó":v·ã¶Q›VðÝ+ëe¾’m­ŽZ6Â{p¥S¦Gñz2ϳ+ýCĹg<ëaÇ{òužzŽòZþÚÓ•€I÷Àž‘¤8AŽå ¤Eå$_m:SWiO%R»FßóE–ˆð Uv #\Ù4ÛN¥`³J†–JÇh>—çéÐìù·ñÈQOÖ[d”Þ02g­zÜ år>¬ˆs½‡i^X˜€_;üV9¸]#½Îóß?Æ5šx˜óíGòúü;¸ô\ž§Cß õo‘çîrÒ9tŽ\ÙlÉÌNaÄÕv¶zoßÉ<$=¹ê:™çé|'Žý[Dòš@8çô6蹜M>úç}ö2£Ö±Ñ0Ž¢¾Ü“ÑkX|J7Ca" ÷Ð{2ϳ¡×Ç´›ÞV- =|fV:4csÞÚpÔK癇U´™2Eü=ÛÍ´sî © Ýâ¸[×JYÜy¥çò<JcÕ]ÄÕíêé†Ê •$U´dº9®\ÍÐ7õŽ(×Þßjöþèùi©,FUn2Ú%çî!õ\ž§Cêq\ûµ³÷Ϻ¶iZGÖˆBýAÑ+¯Ùê×>Û×eŽÑLó×mh¯>àÕwìÀžÌóth=Ž][Ͻ®QRÖà7†¾¯ZgÀ-öÖ3C40¢Ö¼2D³´!÷¦¶;B5®{]çß cAMÙûÝÙ[¨#‹Ê²á±gÞ1ÚŠÍ‘µ“GBiÝÎflß±'{2ϳ!Øǯ#;J«Ý¤ÀT=?ðÈ»z)2þºÙác@ÆW…DiÆ…ÌV -Z6+¤½º–`>€[-ókãq~(7Ì'êuÉöq.>™çé|ãZa=»9zÊžÎØö¸°–5p©eÇ®›s9ÇêÐCýCŒ*Ú0}|~4Kv›wÅ42¦ß±Ë{2ÏÓaúÎ.ï0Óœ^üÖyœQõN_·xÄÏe³KL9ÖÔÏ{gÉ›±3ÚÂíÎÛ™ÀQñÑl4Æ3¦[š/ëx¨`uð—8£ðvÊøí±®Óôx‰†Ÿïá÷\ž§Ãï½]¿+?<Íb×v›KÞÁ -ML‰mß·Ó¤v÷RÃnãþÊRNÙwÀÚ,ßnŒ¤ž ë‰vÉî!tÎÑ×ڤÒ¿ÿÿþó¿ÿíSÒ ­éÚYË"s³'Lóð0ZÚÉ»sZOìóR[6_oäKZÒ;Šï¨Å7i]µ¾õŒ [9•Ovtô,õÚùózõµ.ϸ%Ígf7³ÇŒvƹ'N¹>p×ÿé7ë– >n Ý[U¦^fkzTÊò©îqÊC«ÛbiXL Ü6¯èÞqKÏ/¶Ù¥'=y8-^A9ú˶œ`éÆzzxs[Nó¼[Ê -‡v`RÞ±Cõ¶ßZû -2æ1/ØFñåLÈBÙ3¢{™k„vt’Ÿ‰èÖ¸¹?›|åùsm+ÙãbO[ÚŸf´Ûóò7Èí(È®i^»óä’>ÔÝ®¥<³I³tKÖ=Å¿ûÑ7 CšÙ\ñk™ÛúuÍg+¾e_é匪¤Ul”2ŒýÐl -¬mÕïºû³Ê§,ש÷s-·åg8óõ%ú,n|6ØÛwå;Üâ§×µ¯ÖÌ·øŒãZqöâÌ5§]1Ï|š?qûËÕGÃ8ð¦û²Èòbsµ% }å+Ê~Ë£ßÜROÅïÏ•]z3µnÖ×¹9kKŒ]vTì X÷®í›yvÍ•kƨ.ÐS*¶Ü¥M"ŸŠêNæy×ÍòÎùf/=íæ=†¿|ØI]9.çôr0iÙÄ>wÂn…9L*ÓC¦C…•ºù†7ÑS=†Þ-ÑØ<ù€‹(”è_ïåv©<“‚hϽÜ>L٣ϤÜü&ÝÄÚ»2åe'λ㡟ëF†»­w¶h¬‚?»Ðm&z‹E¦çŇJËÈÞ!½èt%0ïÔ¹­˜“yžd)Û¸/zÄ}êó/G7óBi³£›þùÜáÄ‚éÒg7Oæyw³Ëóè»þåèæÿqƒÿÑà ËY?Žåsyž ËI²ñÓôëßëÁ0ãìNÈOñéÇyùdž§Ã²=äå_n¶ÑÌ7?¸ÙÁïîáÄΓ¨[]L“¶ŽÖ÷E=•çé0|ÿ¬7ŸùFÒ ³jÙ¬Zä̆0ð¹¢â´ ô6ôc;óÊ`“5sûj]ï»}oç¹ç•š”¦´¼açmçò<ÚîD²rs£zøö½ÚËc=GhÜ<Œ4²Ú8BÎïÀÏG{m_€bôá¡íl6}…}7åìSÔC…GûÙÅ>S›s7Ìó$Xmû9èÃÙ}|`WÀH9ˆõý@VÇùZÔyv«ýç!Í—þHgÙ:_¶øÛcŸ_–¿y›öçÛQü¸<Ê  *bN>Dw2Ï“ ¬›Mï“»¿¶?ó€ÇQ<ÅæèØ{H‚¿ AºÍý¹Àf‡G18|p{©9>ŽÔsyž ©ZéCBüÚ'!Þý„Çøž‘%³ø,çmm_±ã̳÷u(-í+Äص>›%OÞzš…Ú¾û¯Ë=Í?.oX‹½èéíòôª´Ì^ØÖðx7ÉøÕ fûª«^úµŽsP$}µ‚MW”åHo#Ü‹rÌóŠ£ÌyayÓQ=nÎìæ§Å­¦FFõØ™XQ©~ÌþCw‰’–£ôr¼Ÿg¹i·½¨~úT?ž×ªq—Wâ,·(ð£íV~=Úgö¬naÈË\]Ú°éÆŸ.¡¼US—7+«€U¥¡¯^¸7ÑfL¤àŸÞÈi®Ý¦‹£õu'gùŠŸZªå;,½Öš^iZº•_,é*þãEg7‘ÿË}Rå}󪈓©]üv¡ïp‚ع~³Õ1 —ª•…•¶d7lœò˜ÑœZ>ö¼(Ä›?_[Cù}ÍFïtª&²åMˆsÅ‚9ƒÞŠ©õjÒ‹˜¾³!Mv¹ -Í:bnÂ^ ãi{=ã]±¶Š ýV¨Xu]l\µGÓ;~›ëB6Ó¹ë4ëþšÖDÖGÂÛÕÚQú&JéMñµ¨ê]£šÌ2£r“úš²uˆký$ˆnAøªE;tfÓ³^£÷íÎÂTäZº\Ó ¢ÛEL·”æ[OÅ–*õ¬¹z¾›Ò¡N÷ÏíËnì&ÈH_BÃƈ²õãZL÷çµ¾V‰áÆl„·‹wm$vñÛÅG!µï\¡|…ZVn'ÕñÒ¥´ÿ6ÂЬ2z[)ý?S…oRbžòA»)zãp¿ê•ÐØlⵓ¸<4Öq’´‹=-s—Ž±a–ûK'%¤'Òm©›ÇVRæ2&¹šG$ÕÈc-Ö uMLVýÓ¸’ U5Õu±oP~[‰»¾ U¯ZeA3¸ûVn‡Æo\[kz}t³·•Ë0_…·2±¹QLÐOµ’.6ªÍv½2&솺¸Óè[×ÑÚØ©¼OeùØ™4ãÞ.¹”iÎXoèþ±`5}ºôõ‘æ{üþ×Å]ÿ¥¾~wžÇjla·®Ä|&£ïÎI'Åô]:U؆ Çh¿‹uêi}EC›Ça|ízvÕ‰½¦ÔAuÓr¡ï>dbÓ k´ežñÂÛàÅÈ|mßô {¾´µqt?½¸¹Z… Þ\¦®³}J¾²"qEIû”­3,#.x¡¸dænÙÊL$¯¤¹žìw¼+,ÕÅ.XA—¶ë\ŸfyÑUVZÁ’ ¶ü‚ì4¯4¯ìŒ~÷ðúê~_Lu´Q{“¾qikIáÉR[.Ãú²Í9¶ÜJVo÷P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«JëDÑè2Ue­ÄXm -K¶ê–Òâ$z)¶˜¢KÿÂ=íy¯4'zÞ+a“–Ê­3^‹–l €<‡sì­S=e‹%“ )?ÿQéu% -endstream -endobj -552 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 551 0 R -/Resources 4 0 R -/Annots [ 553 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -553 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.873057 101.433071 330.123057 ] -/BS << -/W 0 ->> -/Dest (cb51-1) ->> -endobj -554 0 obj -<< -/Filter /FlateDecode -/Length 4706 ->> -stream -xœí]K䶾÷¯èsË|_@àC‰ƒ1²HA»íÁl€uùûù(‰Q¥W÷ìXd½Ýª"©ùñc±D‰ò*ð÷•Äždç}p–®·O—ÏÑ9#ð¯O19èÕ?àãÌU -r‘ÁzsýÚu.åìõù‚ÿšÃ:ùóåü{šG^U‚UÒ\ùU¤;ç†Q¨„ԌʘÎ9e,£²²Ã%†À©`†q¤h®r0ƒ‚7œ -fRžQy˜¡ÉI=W˜¡œ$N3d0ŽQI;¤‚ÕÁA¤£“¦³¨tËé”ì¬*°:tŠÓiÝYGÒHN:k­ñœŽ`‹ Br:[Œ$œ¶öŽÓYØ¢­¬¶(ï4§s°E¡v£ó°èò¬¶+$§ º3Á±ºðÎÏuJ˜Îx­§“²3À¦fuèQh$ë‚-V˜Àê`‹ÑBq: [œÇÊÂá,GèA]ä%Ž”sE (¯;òä9P>täœæh@Ó‘ Žã-$tJrD l1d9&жz.«ƒ-:ÇZÁ$à¸@kØ¢Hs\ Á¶´p\ A·$‚ä¸@ƒoIHËqáÂLÁqãjo‰ã ʔǜ«Áh.º»ã¸@ƒuµ±Šã ÚÕä-Ǽ«I -Ž ¼«5r²:Øs\vì´ôšãïj)ÇÞE7R U;àÐr\¬tÊ{Áqw•Äqw•ÃÀê\‡>¨9. ð®2¸näï*#ÇÞU¤,ÇJþ¬7Þ…Þ€- XŽ 0ÞC§4Ç(¬SpK8.0à]0ü1}lÕI,Ǽ+=šÕ…N:Ô8ÓoQË´6p\`À»¨4Ǽ úô€ã;Œ¨ŠãÞ•#5§ïJǼ ¿Áp\8tÇß:)]V:¼ç¸À€wAKŠãŒÂð`Vç:Ir\2îüPŽ ,xÃ{à¸À‚w…Ñšã Þ·‡ÕÁíÇðk C·eú4œÕN(0§ï -‰ætà]!\à¸À‚wã°ÉquQ <Ç0°ƒ¬8.°žºàœå¸À\>Vg;Ž œ€À€²Xl!GÀ±î‚žã§`‹VŠã§` \Ž àtAÂûf§°paç[à)r\&ë| â¸À‹ùj•ÓYÕyºfu:é8.pŽ: Å’ãÌ¥:NÏq¾‹îÇ0:I¸[ÐU8.ÀPÔyÏœÓIØ'›ãxºÐIÉqW°Þ Ç^yÌ2­à¸#4æ’¨jNG"Î3=Çžl]EŽ ÐM0ÓS²:Øšà¸í'Û†ãL~0ÙÄ4‡ÕÁmˆãïUœnzŽ ¼‡-J(Ž €Í8ßt[àñq\„í¢›Ìqh:!8.Òc¾©ˆãôË8ßô-0ßÄé·AÛ8ßt‚-. -«ƒ-pšÓoÁI˜o‚8…-*ÇÁÚ8ßôÀÍÀ|=ðq¾éØpx×0§ïÂ3µàóMx¶ÜÜ^€xƒÆ+}œqz6b @½c+2à^ŒVŽoœ#±A˜‰™¥·lÔÃ*”R°aþ…?F3N¢OuˆÊc¦wñ"ºÁ»ÏsŽ’L/$âc¿ütùú=ßëOÿ¹<ý¦”¥? ¡OMð¯Ð T@sxß—¯-Zv½z aà=y¢.#%hq ºE#1üÅ×ù‰å0ü‡þô:Ÿ>`ïO{ [$Ð=~õ±ÁÊâƒY^Ð`ÉF[‹4:¨ÈN€üJA“Ä¿{wPG+†h>¬ÌÇx‰É0)s}÷éòõ¿ûî÷ø+`ôîéòß -xß|%ã·¿Õø z£Ûð›Üøí§iA¶É!Õyߣ"]Œøåü©¼1o¯û8êÆ4døsöå·å¤ãª¼ô;}ÓSu._•e›òoU¤òoók”²¤'‹é¹à÷u$Å7ÿ¼¾ûîòí»)°zosZâˆÀYÅâ¾,`ñK@S×5¶MM š¦ÍMò¡èRõ¯ÁÔ4å°°j›ÑW0?p¾tŽ{ýaȯM•N4próói¿lkUÕMnÕu¸T»eAd¢ÓÏ*ŽW«¸Û™çlÀÃLg y³–tÓšž¡¯jY© ¬ýž´Vs¾žd[ô´¤cçèxÈî§% }-ŠI5çÉPÉéµ|ù^»€^)ÐÀ «è®£w_žÓ¡—Vy3×àÓô;óÊû¦e]AÐßÕhÙ–k4&¤,!7#œA}oÓ’+òafkw#_ó­9‡,h›ô¼×£®Z²7å©Ýš§iÚÁÅY@lq ÷#v_žÓ!vÝÙ<¸Õk™?Ýœ_Ì‘÷ÞÍ‘^1IO\[ÜM£#R(Ä9ñ:r÷å9r×}Ôí¾ÿ¶ÐýbœýšèNhÝì}<š•8>÷ß™çlhVë~ïÌÝð ¸Ñ9#f¥gÄÉë}ÄÞbµEÌ«óg’}˜ÛV8òX¹¹·.p«ª|Ò¸|IÈþ¶Å:÷å9×ýزR WÈŠ-óÈ|ZùíÖ]©%¹áÉÌ—\ˆh!<6Cò2ž*¤í«õé—y‡¿º3Ïé¹á¯¾ð¨ý"¨:x| ßðlÞÏj«Ðh¼Õ«¼Tf µûòœµñÔG}ÃÃþV5Z¯ù·)2؈–~gä/¡µõX—6×™£XwzÜùsïœÅ‹y„ê:†ºs6µ3ÏÙª7â®;oeÏ ![$õÑ!5  úœ_R‹%DÓ˜¾-?!£Ah>OƒêŒWì8bóQ4f¾o¯ëCU—­m?VùÖnh-¡¶øœL¿“â­ÿuÔîËs:Ônø©‚GK=j¹žF< ¾«ŠŸ±U”]oej[m…ÿ’_˜9)•õ¡âØ÷S›¥ß©XŠÅ²ž@}ïiì¹}ºfvÙöª­Û£ÚÜÁ—ûòœy7é›ùí¬¯3-;¹;ØŽ®~¬îªz>¼-o{$ºN+Hz³µWþ¥óÔäìVÄigžÓ!x#~ú€O¹]Gâ–“û[uLÀMmÊèøq@Aÿyàîi_Žù6òô­¹Î ”µ½¤Œ<ú¨Š]îíÌs6ôÑ>së^;q³”Öwâ¢èGü±ÊW|{<÷HO^@iñáu>"jk5ÊÎ<§C醹wÖQߥlf-²{„ÅY‘?ÍÈ‘Òøh“–n¸¬Ž‚o­Ö s|­ÑÎ<§kÝ>œoju¡¯ö³ \›Š3[F–ÉŽ3u†cNó¤FÒëèßÆr?Tù¨ä¯ÏÕÏ“ãˆU§}?œ#Nr¹v´%qBÌãäõ3ž—¸_õÝæ½øÚ—çtøÚð°îm㪭µ±pYåÅÚxÏu4v´ÇýõèªüÖj´í6bºŸñòŒeîX¹3ÏÙe6îûûZ6Æ7Þ2ûrGá5{@{¯íMÆ}|GtogžÓ!xÃW}¡õôZ­¿zág¨mÚå3žá è­î´î}`gžÓ¡wÃw}ÃOù½H¯yÕU‹<ÝqÇyΆF·áŸ.¬†ž=õa -×äYCƒ„_smj»Š;Îdz.kÖK½Ž]@îOdïÌs:ä{÷3§¯Ðf=·.ì%øõ{5~ÐÖS›f‹sîÌs:äîó_¾Qb‚¢ƒ†*î£ë“õó5kFûˆ|ŒÑ>‰Ù3\‡ó׫rÚHR•·]φ·^¸;îsïÌs:¤nøªïß1Õ¢®8ñ•ßØ£vصö\V›g-†zä%]ñš¾ì qáåVwø³;óœ ±þ±Õ‡çóó÷dN;[¼óÝþwgžÓ¡yÝÇ}t6µú^•ºÅîÚNFa*-¼ôTËä“äñžýûaíAü>¼"ò‹õäôÝgÝ™çtè{Ý'²OÁsG"U+è\}CÇÚ*ö/{X@òoÚ™çtH~,æú&‘ü±‚ŠÓ'o͸1~x[uþ¶ÎÆ5ûžLäÑ*ÿtïÛyΆÞpì B=«šPÑrT½*¤æ°„6µPæQÄoÙ~pÅ kÓØèǪ§Vè¾o×JïXW°3ÏéPº±®àÈÓÑÏÊro’è×v¶ON¿ö0ÞðƒPù¨‚ºþ5[ïØ™çtHÝùtÐÿïð+ ëØ®™Ö{=½·k­wÄ`wæ9Z7Þ0¤§-‘Y¯Õ”bWM#àÆ[‡[o Em\W?Y5è§éúµ«mD(ùuOÓü3tŒ¨éc¿ ±…üöôÌÁ§îèm½Í®ºÎÚjîŸeûËS(?Œ{w8ƒÆ6qßÒ¸ûF¨¶É°ÝL²ÒùÆ!iûkükahGüY8]Ü´Wû+œN -.îsa÷í÷ùÓß¾/°ë_œòq¸I¢ã64Ca}'UÜÔ÷j©‹O®¸p{Dy¡I¦f“}EËëBÎ~+äÏ9Õ¸;²ˆ&ÆͲ†­“«ƒ1ýç¾Á?]d .Ö$a'SÑ‹½JEü|‰;Ù#&Œä;ÅQ8þ¹,’)a–ÝÀî mJm:1þ ¹pmÒOeÒÕÄü&e‹; ‘H‰t¿ÇÎpbFˆœVÎÅñêE'GqÜ Øwz<²Ùc“Í–©N[ -,7ÅR‹JhæBQ®ˆ%{dÜ=.W-Âlz]u²jþ”V¹ª9ׄ· N«[é3+{¦¢Rí*‘eº2*d©I)sƒPn'Ft»0¯D*šÐ˜Y_µZÜÉmú$ÊéBJLjn6ÝXšÉ-år*_²†TóÅ”uísÅ3²¾ŽF©‹Û›W}Dèôs*¶±R[ _áFÍ„·‹¡Ü‹øùb“Ú®&A¯êªÜ,ö¢à¥Hã”Ã/tÍ$‹û`Åÿª0Y™§ÿ!)C*îeWŽÊIbßÌâi%Õr›Y‡¸äJÚªº¤s³u}I/˜ô‘tsê\ciUe•Ü…d^$©LS±Ì¨ËâHa©~2WÖB‘ŒÀéŠØd(?OÄÅN“»*ÀžNfew“Ë-b›¹ó¹»Üâ2nL˜íÍåV˜OÂ[?°Q+ŽÐ÷é$E¬DíÊÉ*a1 ¤PÄ…FŸ{qê­™ú·Ò?K'ãFÜÛåçK?Ì)mTÀ«eÜg·öºäõ¿Hó>ÿºÐõÏic·aW"³…ÊÜ:×#YÜ•ÝïÇ]Ú“0w›J¨¨¢ý"–¾¤5 yWªâk*ÙE!ö”Rf•Y[ M©ÃJ¬2t•ÔU͘á­©ÅìÈ<Ú6eÀuº8œFÇ-“U8¨/‡¾èt’¯U‘8ŠIË-©*#êBqX0Ë&fF@Ö'ÉUí§º)t)%Ùä¤i Èt™H²\¢K6Ù1[ª–þŠ=[K.ûEús]Ó¦n•\‰¦n;KËM#^ö–tv€L gW®N””Ù—ôŒÌÖ¹³”JJdósÓôÜi´½V—AÅ[[ì%«&4ThNÌ"CºÓc˜³åC§Š&ôÛ‰ N¤’ õï:£Iø¤ÿûl# f -endstream -endobj -555 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 554 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -556 0 obj -<< -/Filter /FlateDecode -/Length 4245 ->> -stream -xœí\K·¾Ï¯˜s·ù(¾€@‡1bDHA«‘×F° - ç¿Ÿ¯ØM²º»æµ»rÄZ¬vºŠÅâÇ*NwÛ£ÁÏWÿe²SÎ%E:ž>>Ì”‚Á¿ZbuQÕßá7…£5”¦`KÌáø‘>M©—âñé€ÿ6—²øÓ᯿:üs]ÇÝTJt6úžU䧔S2AQ¨ŒõŠ*„)%¢¢ŠvÂKÑT€9Ú«`PÉAS9—U OÉú½ª†K–4`Ø’¢²8¬3FÕˆ!òNÑÙ0E=j:g§˜‹+ª.Ag“ÓtÞO1‘ VÓ•)Ʋ¦#` ÅXM€%X"£é€…|Nš.‹Þ¨:`q9yM—€ÅÁ:EÑe`weU,&«éŠŸBÉDª®@grÊ{3a -Ù{£é¬|Ó«:¬(LRLŠÎK4¡¨:` Þ8Mç…ð£éÀÁ§œ•Õêxu{ã­¦ Àâ\"U,˜|\“¢FXAó’Æ.¥‰Š#\öeÊ ¸\&JÉk4àJ˜(–¤ñ€7:g5"ðXE ¼ÂÊUuÀâ i\à° €ÆÞ‹#¯qÛ¼Eãº%S¬Æ|KÆF <0ÆŒës$ <(®T4.ðà\îÔ¸Àƒt±Ü“ƬëCtxЮ§5.ðà]OÖh\@à]ïQSÕ Xã°ãämöx×[“4. ð.–‘Ó¸³:Á£Æð•Éål4. ð®Ë†4. ð®KØT]š°½ÆÞuCÐvnð® Æi\@à]G.j\G™À?FÀ»  ‡À‚Õ¸û=tÎk\€Æ&‡°Dã‚ÞµÛŸ²¦ÁV“Í%j\À»6cúT]™l‚Å•u +O6Æ¢qAïb£òð.è3k\ŽŸ°£: x×zìÔš¼k]1ð.↠qÜa²4.Àþ6Y×Uue2%g x´ä4.À.<™ &Qui‚#Y @Æ“AªqAïb{/Dð® Þk\Á»†ö¨:`ñÙi\€¸:,[eM#XŒSh:𮱘aMÞ5& "x—·M bbËà„(Øi\3M%¥¨qA,:„|ª.N¸$Ae©:`¡D °žŠ/Yã‚ä€Å;§qArÀ‚AãDS±ˆ¾ÕôXà.j~@À‚HQã0Ù” ‘Æ)Däc°ª¦‹nÊ t­ê2t6i\MØŠ­ÆÈ¥¦ŒE¯q~âpIãÀ€Î’Æ© –ŠÆØŠ¦ì™k: ,²5.@¤ µd,ˆ5.È.#ËŒFãìÐÈ%ajMG†ó̬qA¦8q¨¨q– 2M0¥ªЄÆ˜N¶ƒÆH~l"ÍQuÀâi\³ãt3k\3°8ã4.€or¾™4.(Xñi\PLœ8LÖ¸41›‘o:Ò¸ë’óͬqAñù&RÓ•™3άžPoÀÞªp/v«¤ž/çHê¡`"³ÌQ=5À¶ -¥5ê±ÿ"£'̧Oòˆ*ÂöÌœxË‚Ý÷œcógŠÍçc?ýpøú›ïñ‡UOÊÚE€PKâ+,W0ÝÑ·Åð=Ÿ9Þ˜™¤!>§ƒHe€´ ÅåÐAbûãÇý‡rg証(òYöZ„asÿ`¢Ú:!)F~àxÏï®srB„PŽýƒÕ±SÉ~‡­4¬w×y%¬ÃF’¤pÞn×뼺]e¿·ÚõÆ:¯…Õ÷åR¸hNа 2·ä ÚÍ -»³Ê+.0ƒdÑaD_裂HäA†V…óîb]PÌgöýRÀG|g±Qºp|÷ñðõïß¾ýíïþ ;½{<üí×1Å›¯,ÿuËß0ÿ%Zþ>à7ÏŸ"%z\ëC\ÿ5(—F*¢l“-m´¾±köþ{ûYÇÓêÐiƒ´ë£è7îõ”öX8u\½ís}Ùٮ٦µg6å66Q± -»Rã{Q¦Ùãû†õÍßïÞ¾y·vΚaÝçÏ·Uy‰?7.å’{áfÝ…Nëiú2§•Oª…»oÝv» Zß‹Ü“(ã6ã#чÝôŸ6íhÒ¦ïÓÃ¥¥Xûôûº+šQš¿³º×£o¬ó¥¹´u©¹Û¬ÍÃi±k¾.|¸Ó镹nóëÂÜ&ÓºF“Ûþ/Íó–®wkdë3YÁ]öÛ@÷m³®§mE½/sÞ§{™C×}uc/u;‘ãÔý×wz%ËGïv¾æ¿·Õùâü—.r²æ¿+;oy:Žr5ŒÈø\ÎøJPø¼ùÆãÞ¶Xxßg÷åß]xrÆÿkÙæ—m ‹\øn_­ï NÇå?(\oûß“Fž 8„3Ñ/Eäo ñÓÖå:ß|û§?üåÛ1S‡ÛØYýL㚭ẕ7+¶{<[x.˜Þ·ÑÍ×;ùR–õÄú¤í¢+ t<÷rnŸq Zúõóç>ƒK»¶­Ò[Œè¬4"ÛÍÑÒCõæ<°ð¯;-c¥<‹€Ó¯mP±Ça¯fGóžÿˆ>íz.hÁeN³Çظ +®ÆøTÍó]Ëx|hx¸­elèÓ~Ø·=9ò×Úûv*î‡[ž{GÎçp˜ù/ûÛ¥ùÒìóŠW°ñí ÑòD¥íÙ—G›kß~ÉsËóÇó5ÏÂ)4Ö™?7ÿb<”FÙêsyöÓŠ½,£>Ž:÷­ÌãÀÁ·î´¹çºõúûe~‚ÀdE¹e­»dwo¶¶i~YÛj˜›?¤Öæ¾ÛêuÿÕmżÚ<±>… ¶óÐ1E1¶fw;ì.ùdŽR6óvfžg–¿h'·µSmÏ.ë,ŒùjvXóÙ‚Aú¬‘œ$ùh.Û9kY?Ý^Y±AšÛíÜakm Û ¾’\ÕxêGÍów£Íè綛 î[Ëo^8^nc´yq¼Hš×ãu$ìZóè6&$k¦èëaßâqSLxcg½b0:^$39Ї VZÙ&ƒv–/B‚yÎvXâd -}¿é°Qu7qödü›Ë-:_¦q‘”ÃãµÚX|·KŒ*žkµCœJÀœiµÙQ{úÜ‚0ÕB®ÞFJ!ú3jGa{L‘E˜K¢?%Û¥{e/»:zòõ]þvë–çûš`º˜ôq^«ÍóNðîõ,OÙa•eŠå‚o†²ÌÂÅ>ž‘€‡&—Bvt_ - ÿiÀ¦ŠÐ¼â‘¶X(€2°ÖmæýüÙµë¦?Ýž´P?¯*nǸN¼MUÏâØ"õ9Þ¨Ô-ðÍÍVço¬ü:ÉNÀ‚ö(ãË’};÷%;¦YË<3ÙÙ·ýK²ÓìmlóK²£ÚÉmíô¿šìø(Yï+/8βñ€mF;ßj6{>%C7v¾Œ±—=ËÈb}4}îórZÛJÌÒÿ:±{9¿h¯¸³×‰ÝëÎí­I*npß“äñ¢®doèö$ïÆ:_L’—µmÊ6þLIÞºÃ×Hòö-Þ“äixnOòöµ_žäéú“¼gX^$yÏ°¼Hò^Íò"É;-ÉK9L…ï.÷%y©…ŠÿïI^6Ò€Û$¯‡x-´ÍËcÜ`ÝÚQ$j·|·ãä]âæ§.[X û.¦=¡‰±™Œ{YÚ³og¶Õà"ŽlÎáxqÚ³o»úr¡ÓãÒÖƒÓVöpB„@µì¹f~×ú"kó$ÃÑë>4ÂÇ.Ù”ï¦_»Žûÿ £´W!· ­O¢ïEÖm°à×Ý"Ûب…^ضÝÒÚúàyá[6øÙ9O¶M›­†¶Ç35ë«e>õRËÛf ?€Îί¢KùOuÂ?ê­Q-¬o†0UŒ8>lÅO~3)b„GîF1 —¦·E¶Ç¦Mv:XxpÙ–D²m–#€å |þèB ×­?±JwíŠ×Àܱ"DÍh÷b½™ì"æ·«äÉ/W±Cál¶ Gƒ$ËŽGÅ«b놽Јî†ØQÃcùiÜnº8„º4Óßʺ$¦ó’ðtàcÔ­ôI•ò;ZSͺˆZšÌ P¥KC+Ù'„ú<)¢ÓA~eZÓ„Éìz1küdì,ÌÍ‘¨—+­œ":ÔrKk¡ÏTê¥ò¨Zšå”áê>wÃ+²“Hò¿.J¬ãÛǵ˜s‰>×& ¿q;á騯Ä!~:„¤”ƒ+8­Ü ½h·‹³þ2¤)7Sai6?WÈÿÏTº”™§~°Ô]ŠŸ W£^›]¼6’”ÇÎ:¤YÀRe…¹lJÝg¥½l6Jy&Ý^º[l%&òT<&©Nk±í^×ÅLaÍ>+¥Ð4ènˆCw姕xà }©Ó;‹V¸{èíqìÜù$ũϸå½;ÞÞ®ðù&<Õ¶bvýÜ:bgún7: ¤0ăFŸª¸­ÖÎNüòªöq,2mÇ=~<ÔmÎùàø¨:zËï-‘Q—=þeÞâ÷:þ±=(;ïãÎt¶p[Wb¹“ñ[®òb~ëUöe#„Ží±Í£lhÞÐ÷qç_Ó¨n±·’¶3¨íZ) ÆBìºë:ë…eÂáicÅȼtnƆ=_ú68>zçG¬*\Èáà2[òQ4‰+.:¶thɉŠ¸âRtX²LvHÙI7=ã'9žû"ŒàK?t4¶YÙt“ÕQˆ"½¼ “•–ô³—׋ç}Û -`i§ö.}’Ò>0–vÂÓ¥¾^Æõeßsü‘/Úâêmy±ö|rÆÒ¡­.¤ -iÕ–AvJM¶ê´m. 3MÖ[L S\ª5³ÔgÕJ©ÇCú£´t³Òä¬Ä]Yn·íx=Zò= -ÒÓ%{,™Y”µ»”FIßdû¾iÝwÛmb4€Ä™šQ-ìJ>‹ÿž³væ:›S­Tû©'#6WK`£&›¼óõm¡&Çá£û(‹£’»ë\>;ÙŸ´³Ù¦c"ïM²üÞWÂåºB4ÕÞ «W+FÒ}PŽ†Í™ÝÉP}ñ_}À®õËÄ©"¿çÓsЛùõdÉXý›ºT¿¥“Ç'õç?À‘“Í -endstream -endobj -557 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 556 0 R -/Resources 4 0 R -/Annots [ 558 0 R 559 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -558 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 536.373057 101.433071 517.623057 ] -/BS << -/W 0 ->> -/Dest (cb54-1) ->> -endobj -559 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 299.626036 101.433071 280.876036 ] -/BS << -/W 0 ->> -/Dest (cb55-1) ->> -endobj -560 0 obj -<< -/Filter /FlateDecode -/Length 4816 ->> -stream -xœÝ]ÉŽäHr½ÇWÄy€æøb¾BŒ µ *HA‡Ê¬ÊÙztÐïëI_è4.]Õ•ÈÊ ™/F÷çÏÍŒ R_~~Ðø/’bLÁÓõõçË/5§ðo,±8ÕÂopW­( N'ÝõgØ0„äLð×÷ þëÛâï—ÿøÝå–uôÕ )y£Ýõ¯_YEv1åU‚Ji+¨œB0Î *¯œbJ’ -f¸@†Öª3(E'©`U„–‚¶kU‚&h’T0C'•V°C¥D QDÖ:íA÷’ÎèÁÇd’¨ Ðé`$µƒ¤–tiðÞ»(鶸¤´¤s°Åi"%é` Ù$‡-Ö[%ê`‹‰ÁJº[ F' º[€®(ê`‹òJKºd—"‘¨KЩâZg”\´VI:­lZQ‡…IòAÐØâ•K¢¶8«Œ¤³°…ð#éÀΆ…Õjxu[eµ¤s°Å˜@¢¶`ò%0¶¨à% -À -˜—$0! ” I$`¢(R”XÀÄ4PV¢“Ü@>‰¬ÒÐ-U°Å‘—˜ÀjØBX¹¢¶ØDX[P@âka‹!+qÛÐ"qÝ’JZâ ¾%¥½Ä„ 3•ÄŒk£'‰ ,(PJXp®wJ\`AºXîAâ ֵΉ ,h×RôXð®%­$. 𮵨)ê` ,qØq°:Z‰ ¼kµ -xËÈH\€Y€C/q°2˜•ÄÞ5Q‘ÄÞ5[€¨ Ö •¸€À»Æ᤼kœ2x×ñ(øG‰Þxâdw¶€`%.À~± ±ÁÀ-‘¸ÀwuÂö'¬i°Õ cò8𮎘>Q—0âºÅ(Úû$qïb£²8ð.è3J\Ž°£‰ xW[ìÔ’¼«MR8ð.ü'qà0h8`´tE]TŠQâÞ-‰ ° *‚ID]$-qÈxPðC%.ðà]lïIâÞUÎZ‰ Qç;‰ ‚‚À²Dl¡@À±’MQâ‚``‹5Fâ‚`` \‰ à IÃûÃظˆñÁxŠ€É†˜ˆ$.Î#èJ:o†@×¢.B§ƒÄ!Ѐ­XK\€XjˆXô€àv—$.€Ði’¸ $Ø‚¥"q¶¢!xæ’NÃ8ÙÀÓ…Nk‰ ¢-ð%.ˆ&"ÊôJâìЈ%1Ô’ŽÇ™Qâ‚H~`WQâ,Dš`JQ[@`~8Øv øA°‰0GÔÁëHâ‚ ‡›Qâ‚a‹QFâ`“ãÍ qAR°ŸÄIùÝd‰ @ãÐ)%qAÒñ¦!‰ °.9ÞŒ$«o"ÄÖm²žãÍ qA"Øâ࢈:ا) 뜄xì$éÉ„eAðîKÌQ‹ÙbS~쯾üþ36ßëŸÿ÷òö»1S–4ÀoÉs`íx‰˜„é] cs„¾¶áý‡ „}wTaBª&jâœrc±c³M×òA/ †½l±†+3žµÝ"NИ(ëEKo­òpK5& »0<·¶_¬DÉƣ‡ÖYþw]80q¹ÐoÀ2†#ŽN4öl¥msÿp8”q÷·bÓFhw[CË;jcòU…€–G)› ïH ÄŠ…ÿþÓä4w?å½Ë¡¶.Û}”0ÆF]?ý|ùý?ýôÓ?üã¿¡ÛOo—ÿü;l[FÁÃÿñÏô:ýuz’;;{üý¯ë§ŸvúûªÄ¡É²?î‘€B‹ŠâÜMbÙû „þû• -ëÝÛQeìuÇ{/YsT‹Ñž6BeúŒÞóhͧ3ŽÒA“czœœ·òèÐ×¹©we¾Ìg¹1³>ÿ~™ÿ¦¦ìË·ö¯†¤®Ïž1Ã>#š@1ê$ÊÎÕy”U³ÁÞ{Œø¶DÍûPaÆ<Ò/+~©³Ä€Ñd”åÙŠËY!¿œµ±Ì× ¯S,“ûê÷º±?³Ýö¨;@fA›ÚéØv ÙúÝáí|_ã˜6LO¡×o 5¥Û‘z®Î³!u¼¹a©B´îx%ëÔš3v¹æu‰žwu³í:d¬㚺¯KûF;22òÊÒ³ß ­¤ùüF^÷ͱí>›¹NÚXyºžG9ï×ÆÇèùsáïÈÈ´¦ð!_¾'‚þ™'ë<2í.‡öžZ½Y{(ñëQ_pßç'ä»G K×òe5¨e_Í(¬¾93(Gž³Âsuž…çüÅ23Ô a‹³^ª®$¤öÜ'"«ŸÉ–Koè/÷1º¢/Sý)2Y¶ßûÅm6nÛºàI!IK>¤mýA¾Õ!Ž—§÷‘w®ÎÓ!ïÀ‡ìg2,Gz…¾ffW;ÙÆgÉû/ýÑŠw¤ý#v¿íûsdºþg>4ºóJ~õU»ÞÆGÔæ\ÆòdgC/ø•yß– ¯|îf¶‰Zöø®EË·Š‘ÛÜÔÊy™}fÁ§-žÆF¦ò¦HnËÞ\ç0ª“KÕw<Ø“už±ûþæÓø€yo‰Þ¾ws˪X”§}®%º=†?Yçé»ï£þÖ2:ãìo‰îŒÖÃÕ·æp{ܲÎÓ¡yßï]ù£„´;Ä쬌6;”g˜W‹ëüÕ1ßœ?³ìem[åÈÛÚ-«u‹[Ÿ”¿œ¨ôxSò>ÏÕy64º}?vëza˹<3‰§Ë};³»©Ýy½UʭП½Œ·i'2kc¹íK22ÝþêÉ:O‡ÌõÁ»öCPuSîñ¾á³y?¨mr£üEŽñVÌ#Ôž«ót¨=ȧ~Ô7¼ÙßzÀµ*êt=ÿm¡µ÷X2—vçY²XwzRÿeu®òŽãÚýÉ:O‡Ðƒ¼ëÉëFÅ3èvÈIcvÈL(㫉+~É3–Mjy+sç÷(.ýt¨îïÚX\?:aó­hìïiýÝ2–½m_šzw\-uÕç¤äøÄ_ìÙGí¹:φZà§*-íNhõ~õ6ù®†çY1~–·ïZóßÞ]0…cûkö~}¥b++zíµ§yåŽåºè²_UGWH½¹/OÖy:ä\§ïâÛÕZfvqu°ß]û;Rš«†¦‡·²å=boɮӒ¾ÛŒÚ‚ÿ2ÄA[â/Ÿ ø\§CðAþô>åtÝ’·\\ßjsaiSAÇ— ãﮞ–ûO™o™§_»ó<@Y¿JŽîõMîòlDt²Îӡyt­¤(¥÷¤,ú-þXã+~<÷‘•¼Òê+Â"#êèn”“už ¥áÀ¿<u´W)»h£Göˆ0ŽŠ‚*÷b.ü¼°DAÍZ73ÝqY›?º[#˜Ûï5:Yçéf÷¤»QÝX«c4s31øº³p&›#ú—éXÒqad½eïüun÷¥©Gµ~ÛWù–E[öóÔ ¥]?Û’9ëÄ ycÄóˆóñÕ^m>‹¯suž_Ö½sÜÌÕMsì'\0«t7ò-W¾å -¾ýý[Apº#»w²ÎÓ!øÀW}Ðýô~VÀƒ¿CµiÓ)ŸñY¾ÞæJëÙótè=ð]¿ãoù=dÕ|Ó»7ÐxGÞñd§Cãºq7ôê[®rM‰:$ü-ïMíïâŸ&©Õê~©ï‡c7{Ç7²OÖy6äjuîîÝ_:ýÖín(“n {Á~ÄáÞM ôãÔ—Y“îŸæG•‡Yvüš6~†wjž|^ðzXäžùq†ëGN_u÷ˆçåÑ$¿£ÐÆ+œeJë¿õ¼CóuÊoO¿ós{¾ÊŸï‡ÖZ•',™üŒÄ1K©¦{UF©ñy‰ôµNÝø¼D?•çç%ò³ÜpY?ý–'Óú¹˜a6÷ǬÇõ9§4?ÙvѾ›ûnì¡ùÙå\>‡Õ4þrñãë)ôøŠ"åã  ¿ÃðêiàT~àÇ€ò«-,é…+[¡ÊF »*vÊï qµÓ•¥êTéÌëî®´[žpç{+eÆ5¿‡©Ø[Úm0Ÿ…¯ãÆF½˜¡s'UlTÙíjg°R¨âJ£ï£8¯ÖÂNünÙü±.2iÇ}½üå2ns3 ¿ZÃ[ͯl½.}ý?”ù ¿ÿ}¡ë¿ä÷ØLû¸Q…-LáÖ…¸ÝÉøAÑñ¤˜_J›…eÙ4BC íW±Žµ¬Ëh(û¸1 _S­®*±ç’º0¨.ÚVèê6bS k´mFÆí_»Q,ŽÌGç¦nØÓ¡Í'Çïá7 e«pОcÕÙº%_›&qÄEë–-™¦"ÚFqØt˜ªe 3m'eèÙ~j§Âr_ÍAãFð¡­:ªÛlÛt–gÑ lÛƒ¶aÒm§ia`ôÝËëÃó>›ìó -`i¡ö"}o¥åÄXZO–ÚñÐ/ËžcÇ×läÅ[G¨´e›µg‹“S—Fu-hqÐb´‘ÆZm.àÚN)Ëæ¢Ðd*ËJ‹!ÛäçjyXÆ3Žâ(…âSTé_Ú‘ví¬”Atí¬øUYn7ïxÅ[²År-œC=;UK_2 -2ßÖ.Rª%m–­û¦eßy·½6§AÕ_=SU«¹UÉ»øïžµ3Õé²R©ü3fFt¬o~ÃFM:Xc¯ü¶"½‡¿5PlR%7×ÙϬ3$9wÒö„éÈZ4ð¶aÂ;éXÑ4õ>¿4O®–”xJ· €ª4§V™¡ñ½Üc~sL•ÃÀ¡¢KãÛSUŒüöà ´˜*š¾ü±HŸŒ?ÿHÛ -endstream -endobj -561 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 560 0 R -/Resources 4 0 R -/Annots [ 562 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -562 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb56-1) ->> -endobj -563 0 obj -<< -/Filter /FlateDecode -/Length 4959 ->> -stream -xœÝ]Mä8r½ç¯Èó£å÷°Øƒ5ì1¼ð û`øЕ=µ £ÆÀ¬þû~A‰dˆ -)•ÕÕ½ééBu¥"ø >>)J©¯ -??hü—œžRÊ1¸ëíçË/5E¯ð¯¤X]õŸðýU+'¯sHþú3 lœbö&†ëÛÿ —<ùÛåßsùïu}5SÎÁhýëO¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS€Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbà,èlº’¨ƒ-*(-é²|NΉº J1muFùÉ'k•¤ÓzòÀ¦uQè¤-Aù,ê`‹·ÊH: [~$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØ_ÿ|ùígL¾×?ÿÏåõ7e§¬þh%µC|…a`2ºÛ#úÖh¾…-ÞÓ`ÙC‰©Ú˜»YD¸l³‘Y˜ðèßuûae+L%c‘+¡@«ÿ`,ƒ{JéË`¬ Í’ÝÖ‡óÜ59"&È×öA˶vñz»“$[Îóá¶FÍ1y½  ÉÈ{‰?¶ó{½ Ãa[¯F,`Æ@=›éƒ¶m¤dê„Ò¡˜ÀÙ˜(MÐÒÔÏL~0ËL• " Hc³¡´ˆµr«Ä÷é2]¬˜÷éÛ%31ÆähüõÓÏ—ßþã?þý?ü+øéõò¿S`¿ßÿ éo\ÿõ~¹NËuXÿ³!Yd7üZ9½A:CzÝÓ·4K¤kv¼.ùÇ"’Q¯øœæå+òS^3´#nózµ.K®ÒÎÒÖÑð³O;>ªv¾tÝÆÏC´úý^?ýxùç5øʪi-®R ˆñz.Ë×àõ[À4çC˜~fÝ]»²ºÐvH>ârQû2ç·ž¥SC}C9”Þœ°‹ÃÈ…5LÇ<ÕÖ9;Ø[Ó":v·ã¶Q›VðÝ+ëe¾’m­ŽZ6Â{p¥»Lâõdžg,Vú‡ˆ rÏxÖÃŽ÷äë:=õ ÝÊkùkOW&ÝOzF’â9–3•7’|µéL]¥=•HíA~ÏY"Âo€V=Ø5ŒpewÐl;•"€Í*Z*£ù\ž§C³;äßÆ#G=Y{ l‘QzÃÈœµêq3”Ëù°"Îõ¦ya5b~íð[åàvô:ÏWü×hâaηÉ;èóïàÒsyž}w‚Ô_#ÏÝå¤sè¹²Ù’™Âˆ«ílõÞ¾!’yHzrÕu2ÏÓ!ùNûkDòš@8çô6蹜M>úç}ö2£Ö±Ñ0Ž¢¾Ü“ÑkX|J‡¡0‘„{è=™çÙÐkŽcÚMo «–†>3+š±9om8ê¥óÌŠÃ*ÚÌN™"þžíæÚ¹Œ÷…T†nqÜ­k¥,î<Òsyž¥Ç±ê.âêöNõô CHå†Ê ’*Z 2ÝW®fèwÆÅ›zG”ˆkïo5{ôü´ƒT£*7í’s÷z.ÏÓ!õ8®ýÚÙû{£®mšÖ‘5¢PP4ÀÊk¶úµÄöÄu™c4ÓüuÚ«xõ;°'ó<Zc×Ös¯k””5ø!†ï«Öpg‹½õÌ Œ¨5¯ Ñ,mȽ©íŽPë^×ù7èXPSö~wöêÈ¢²lxlÄ™wŒ¶bsdíä‘PZ·³ÙdÛwìÉžÌól¶ÇñëÈ_ãŽÒj7)0$UÏ<ò®^ŠŒ?¤nv¸ÆñGáQšq!³•‚–Í -i¯®e˜àVËüÚxœß”æõºƒdû8ŸÌótH>Žq­°žÝÜzÊžî±íqa-kàRËn»nîË9V‡êbTцñÖ÷ÀçG£±Ôi·yWL#cú»¼'ó<¦ïìòó1Íéů‘aÇ•Qïôu‹Gü\&1»Ä”cýGý¼w/y3vF[¸Ýy;ø!*>šÆxFÂtKóe¬þgÞN¿=Öuš/Ñðó=üžËótø½³·+àwå瑧YìÚŽ¹ä¬ðØtÀÔ™Øö};Mjw/Å1ì¶10î¯,å”ýWq¬Íòí`$õ¡XO´Kv†Ð9G_j“JOüáÿòOÿöG¶OI;4´¦k÷Z;Øcš—‡ÛOžÓzb —Úºùz#_Ò’ÞQŒG­¾I³èÊͶr*ŸìèZêµóçõ -lÉW|zʉ;±DziŸšÛÓWgK»Â,Ÿ·Ä»i±ý¶è_™/Xû‹Ý¡ûªúPÑ~/ŸÕY|\ìXü]ê¡<·5:,M ¼M^ÑéqKO×6ùÚªcñÊÑ_¶åKGëéñÍm9Íïn)+ÚiyÇÕÛR|XÛWp1zÁ6zŒ7(gBÊžñÜË\ã³÷ù™‰ÇÍý±Øä+óÌŸk[É{ÚÒþ¥¿[ÿ×~ÚQ0PÓ0\Ì»KúP÷»–þñÌ&ÍÒ-}XwwüîGß4 é5fK{b-s[¿®ùŽe_éå.U7uŒ2ŒýÐl -¬mÕïºûsÊ© ý¶ÓÏ3Óú)Ž~jØYú²øáuí‹5¯-i9nç&ÎKsÚÕò׌~ˆs¹jÁ\-ç57s¼»%Oí_îÏ–f±§r•¯ã&ú+oÆó†+ßÇ“ZÕ°z]×;såz¬W¾c³@ÏšØrØš'>›Ìó®#ï”ùf/=³æ=†°|Ë’à0.Êôr{Ѳ©yî„Ý -s˜T¦GE‡ -+ýòmkêîz3y·Dcóä.¢P¢½—Û¥òdu¢=÷rû0e>“ró£¶-µw=dÊ+KœvÇCßë8ÂÝÖ;[ž¤'©Þáyz†® Qnç½ÜÔoà k>Îó.Œ²äìcÓç¥ëCq‘“¢ö@x'ˆÁw;­Ï‚…Ug÷‚²mÐCï¢ÈôÔ÷PiÙ;¤®æé9ß3‡6Oæy’iã¾èý÷©ÏlÑ7.òêˆún·×ÔÃ7Ôç:e¯ËïÓúv‘»97nˆH7[‘fFeY’|ˆßvÐIxÎH3)Miyrøçò< :»Ùå‰ñ]tþªQužM‚¬6mL{è[—EMóvÖpvÊ–“>Ù§¨‡ -˜4¹ØXÑšsÇ6Oæy¬6&MAauó ‚€‘²Áä—¿ôçkQçÙ¢ÏCš/ý¨zY´/‹ vœýËò7³´/ß;Æú¸ƒk‰l¯ˆ9y8ødž'AY7›Þ“qÀˆ\;Úàç‡Ôƃj{‡¿øƒgÒñç:X&Ì:| e©9>ŽÔsyž ©Yòá×ðz÷ÁµññÉ[¸âõÛÚ¾ÓÕ‘´´¯ðz`×vøl–k8½›ä,ë¦ÙöENW=¼H“]®B3…nò6a/Ðñ´½Àžñ®X[Å„~+T¬º.6®Ú£é]¹Íu¡ ›éÜušuMk"ëÎ#áí‚jí(}¥ôÆõZTõ®QMf™Q¹I}MÙ:ĵ~D·‹ üAÕ¢:³éY¯Ñ{kgaª@r-]®éÑí"¦[Jó­§bK•zÖ\=ßMéP§Shû²;‚éË\ØQ¶~\‹é”[ëk•nÌFx»x×Fb¿]|RûÎÊWèq¡eå6qR/]Su†f•Ñ[?éÿ™*|“ó”Ú5HÑ›{ûU¯„Æf¯Ä塱Ž“< ]ìi™»tŒ ³Ü_:)!=‘nKÝ<¶’2—1yÌÕ<"©Fk±n¨kb¢°êŸÆ•\¨ª¨®‹}ƒòÛJÜíôm¨zÕ* šÁÝ·r»84î|ãâØz\Ók˜›½­\†ù*¼•‰Íb‚~ª•t±Qm¶ë•1a7 ¤ÐÅFߊ¸ŽÖÆNå½$ËÇ>Ȥ÷vùË¥LsÆzC'¸‚Õô­<êÒ×ÿEšñû_wýçúÛy7ª±…iܺ󙌾ƒ&ÓwÒTa6Lh£ý.Ö©§õ m7†ñµëÙU'öšR7ÕMË…¾û‰Mƒ®Ñ–yÆoƒ[ óµ}Ó'ìùÒÖÆщ4zrµ -¼9¸L]gû”|eE⊒ö)ZgXF\ðBqÉ*Ìݲ•™H^Is=ÙïxWXª‹]°0‚.m×¹>Íò¢«¬´‚%Alù/Øi^i^Ù#ýîáõÕý¾˜ê i£ö&}ãÒÖ0’6“¥¶\†õe›sl9ÌUo÷P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«JëDÑè2Ue­ÄXm -K¶ê–Òâ$z)¶˜¢KÿÂ=íy¯4'zÞ+a“–Ê­3^‹–l €<‡sì­S=e‹%“ > -endobj -565 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.873057 101.433071 330.123057 ] -/BS << -/W 0 ->> -/Dest (cb59-1) ->> -endobj -566 0 obj -<< -/Filter /FlateDecode -/Length 4805 ->> -stream -xœí]ËŽ,·‘Ý×WÔÚ€Ò|_ÀÀ xdŒaÁö˜Eß’ZÆ e@ž…Nd%ÉŠ|TUßv^Àºhug‘äáa0’™Ôg…ßhü/’bLÁÓùòóé—“‚SøoL1»Õßã'¸³V§“îü3 lBr&øóÛ ÿë.Ûäo§¿üêô÷y}6CJÞhwþǬ";„‚r‚*A¥´TÎ !ç•×n1%I3\ C·ª3(E'©`U„–‚¶·ª3LÐ$©`†N.*­`‡6J‰:¢ˆ¬tÚ î%уÉ$Q ÓÁH:kH;-éÒà½wQÒlqIiIç`‹ÓDJÒÁ²1H:[¬·JÔÁƒ•t¶´Nt¶]QÔÁå•–tÉ.E"Q— S1Ä[QnpÑZ%é´°iEF:ÉAg`‹W.‰:Øâ¬2’ÎÂÂ?Ižp6Ä(ŒVãÛ*«%ƒ-Æu°/1€ñ°E/QFÐÀ¼$q€ a dH"í@‘¢Ä&¦B° ˜äò)H<`•†Îh‰¬‚-Ž¼ÄVÃÂÈu°Å&’¸ÀØ‚X [ Y‰ ,Ø–€‰ ,è–TÒXð-)í%.° \˜©$.°`\=I\`A¹€R’¸À‚s-¸Sâ ÒÅpX°®uÞH\`A»–¢—¸À‚w-i%qw­ENQ[`‰ ÀŽƒÕÑJ\@à]«U¸€À»FFâôêz‰ €•ÁĨ$. 𮉊$. ð® ˜D]0­ÄÞ5· ÍÜà]㔑¸€À»†Œ—¸@À?JôÀ» '»°+qæ{茕¸… n‰Ä¼«¦?aLƒ­“—¸ÀwuD÷‰º4è€Æ-ZyÐÞ'‰ x••¸ÀwAŸQâpü€ÕH\àÀ»Úb¦–tà]m’’¸Àwá78‰ ‡AøóÛ  +êÒ RŒ8ð.hÉH\€YxPL"ê i‰ @ƃ‚*qïbzOxð®rÖJ\àÁ»Šàöˆ:Øb£‘¸~ t¶Â˜†³:(¦tà]¥ÑÃ’¼«THxð.O›øÀ%.€¼`#q4¤¼Ä>)èàò‰:?àÚI\”%ê` ’¸ŽõlŠ[¬1[à2H\`HÞ·¸<€-€‹¸> ØOQâ0Ù‘ÄÁy¬ÇЪ’Λ!е¨‹Ðé qA4`*Ö`-5D z‰ @ð»KÀ è4I\lÁP‘¸SÑ ‰ ’ò»É€Æ¡SJ₤#Ö›†$.À¸äõf”¸ Y…õ&–x¸MÖóz3H\¶8¸(¢¶ÀiJ¸'a½ v’t¶˜D$ïy½%.€›õ&ßÚV ò¾rËh] Vm+Mòã$¥Çeä:÷å9i•[o•[¸A÷ #Ç~¾ö„u·ã¾ ¶Ÿª‘ÞÄíÞmQ×÷n®£çÉ——Î=ç®V~ƒþìb¼6HòÍæ —)ÝSóÒ2ðYwæ927œÕwžµßUyö»4³¸š#`†ä§ãy? ¨­n'qèÍDmÜj÷å9j×}Õ§}ûý­f¶^ó/sdHþhÑõü·„ÖÞcÉ\ÚÝg¶ýQïCª¿ŒNÕߌPS}ÉÝk©yŽ†P³îî™ÝLësv3d$æÂqUÄ1Rø%÷XF4Méûò32:„–z:T„jÇ=6ß‹ÆÂ÷ý}}nÚ²·í‡&_Ü™·²€ÚêsRrüNâPì:j÷å9j7üT%£¥ ­^O£^¯¾«áŸ©WŒ_ïeê{m…ÿ²_X8)—õ¹áØ—¹ÍõkÛñ^ç“—ò%OàRQ”G[]ö£ªÖ·€<÷_îËs8ä­û¡ýúöf¬ =;¢£×çø±ãG­fëó%_.§Ñ=b·Ò ^ű|Êg½¦7þeˆ–ïÁoEœvæ9‚7â§Oø”{ÐuOÜ2§5SD§Œª0·© ã‡+ -ÆŸWµúX€²ü2/Ëè©7ñ-óô¥»Ï ”õ£¤Î2úl»Ü»"Ú™çhè³ûüÍ$t3+I«”Þw’¢è÷øc¯øõñÜ3#y¥ÕW„#4DF”ÞBé¾<‡C醹wÕÑ>¢ìV=²G„ñª(L?ÝÌ]Òùh³žî¸¬‚×(úBï¶þo„‹f»w÷å9\ïîôábת cu\MàÞ ¯|Y8’Í+úÏ×kIÇyò -#ë-{ç—©ÜÏM>ªùÛºÆu2ÏXmÚ—k¼`(åúÉ–Ì œ'^‘7®xÞã>d|µ›÷âk_žÃákÃÃz´›¾º«ýÌ*ïÖÇ{£¿ïÇ6åàok&Û.¦Ç¯ÌX¤îg¬yŽ†(ÚxJëYŽo|Íìóœý ¨²÷¯wæ9ªÖ½œ5ïÜÝ»ïÆ7ÓˆÚð‡é¨×Î<‡CÊÆÓ×&®øÅ|ã.î¹´/jO\vMëWœW×>K*+®&¦wÝ8½`ÛŽ¸ð]ONr¼v5·€ÖÆ—Ú»W`gžÃ¡uÃÿúÀ5üC½{ öDæîØÝ3Æ'út/êvDÿÌlI“‘êšÈïþväUë;±÷å9RÝF4ìá8£z|7É;FÞ¾¾¨Ù"ظ3Ïá¹á¾Çnä{ž(|ä蟵}•qß?ÝÛ™çpÞðUßi?½„–»ö_-<·÷¾^ÞÁÇÛ¸†ðô6OZ÷¾°3Ïáлá»~ä#…ÐÃîZ”Ñèˆ;îÌs44ú ÿta7ôÍ[®rMY5tHøWîMíwqóJfä²n¿Ô×ñ ȵ÷Çvæ9r÷=Á}ø…ÓFh·ŸLÚöüúŒ¿½?èÛ©O³Å¹ÄZwæ9r÷ù¯%’Ô¿'ÕqA»O@Úý,Å=9º>Û?/qP·gtŒÈsŒöUݼÃuwþvWNIjòöûù?ömĤ>ðœ{gžÃ!uÃW}|ÇÜŠ¶áÄÞÕ|ê Ãv­½—ÕçY‹¡–´í¼°po|O_v…(#6<àÏîÌs4ĆçvÏÏ{Þ“9ìjñÁo„|Üy‡æu÷ÙÕÔêGUÚ_xj;›…©öðÒ[-³Ÿ,çgö/×½üûî‘_l$/ ï8ëÎ<‡CßǾ‘}ž»'Rµ‚ÎÕ/t¬íbÿ"±‡$?ð=¡y‡äçb®_%’ß#VÐpúì«ÁïÛ¡Íß·Ù´Ç`ß›‰ ÃjüÓ½Olwæ9zã}_zê]ÕŒŠž£Ú]!-‡e´™…2ïEü–íwî¸mšFýÐŒÔÝíóZ@éû -væ9J7öÜóvôÆ»²Ò—$ƽý›ÓýŒ¯øÉAl|TEÃø™€­o ìÌs8¤î|;èßOä†ml×ÍÛH¼Ÿ§¾Ûµ€Öb°;ó­_²ó(Èl÷jj5«æp!Ê^z¦ózÔò¾úÙ®Á8O7î]í#BÙ¯{ç¿AÇ„š1ö»[È#KåwîqæÑ6Úšûl=¡îùY±á-”ô@Lvgž£!8­û¯÷|Iƒßø(HÊ-ßñÈC½Ôí®ì(Û³öåž…◕­­ì´Ü¬–êšF€ynµíAó=¶ÏåºùD½. ÙÞÏÅ;óÉë>®Ö³7Ï„Ù³Ý3¶%.Ìeu\j›'¯7Ï娩cã‹L¢ ýÓïþ]‰•Ñ8ÖioóΘFÆôQÞy‡éo~5; ò»~ë­Ÿ‘u£¯‹?â®e2³KLyónþJ?/=K^zgEz*Åc¸Ÿ \ç¯ÍF½?#azö=¸Æ±Úµ—8£´÷)ã·Ù«ùP5vÞÂï¾<‡ÃïFlWÀï¬WÞÁ*;]ÒVZß´3f‡oûÞ_š£»e ôñ•æK9Vfù麟?‚Cã;>÷”OïHÍQ"F›I6Ps{ðH>¾ãÌÿzXø ŽÄÀ‡þÚx†“I)ð99 ƒoÿðÇßÿùÍÔÌùûñÚÜìã«Ã—ëðâëü¹J­¯"Ç4ãÐèÈOSèØUܼ<}Ö.äßסÊÝsíŠq+ -§õן±¬éﱜ˜á4ÕÇÛV8?/›ÂU?+ßMu7öŒe¸æ\¾‡›nüåäÇóžôxæŸòqІ>{˜ÍC:óSÓ¹ÎݦdžÖç…œãQÊ¿”TÓéÊŠ\äö®G/7Sú_Æÿù¤ Üþ< ¯'¡ªQM¾¨â·Ÿ„K‚˜h0;Å,œþT¥,Ò9a‘]À‹aH}JëòI5ÌU8ýi\¾Îïr6>¡ˆTNdÇ3z® BäôúVÌw¯=‰ù4á8ØéÊSœÏ6CX ¤6m-°fÜk«¡»ª¦º*6”íÑ|ú\i:_…Åô¶étÓý9­ Mw® /'Tk{é›(å3LsQ¹u*2Û•ŠÔ唥C¨ô“ ºœá7*MèÌ¢ozO‚» -c•t)§D—“˜n*Í•ž -%U¬YSnùjJ…º¥áÙØF“4ðñèÍQ6ÿ9{îÜ×*6¸17ÂËÉQ‰UüvrAHí*W(—¡× -mSnGUñR¥üÁë_šYÆçhñÿ¯Tኔ™güCSŸ…W¯j%<6‹xÞH­ÜÖ!©4…š¶i.BÁlÛ^:*!=“nI]Zl&mš¬‘‡”Íc’*ä1낺"f -ËíS¸²ªlª«bW ü6W;]ª{®Ìëî®”[žpç[+¥Ç5lXì-å6˜ÏÂË8±Q/fèÇ\IUf»ZY#¬†ª¸ÒèÛ(Σµ°ÓøeúéÏ:Ȥ÷rúÛiœæŒu&áo5ŸÓÛz]úüO¤ù?ÿ{¢óçƒá®ó¸Q…-LáÖ™¸ÉøT÷¸Ş¼ga6ÐPCûU¬cMë2ÊÄŒkž. -!¥ÊÿÆȈŽõ(ULÔ¤ƒ5öœØ݉ރCˆ8›PÉÝyÖc'·’;ikBw d­ -x[0á Š´­hŠz›N¡•³%%ÞÒ} „†*Í©›ÈìvDå2ðRÑ¥ñ8r1È“J‹¡¢ñÛ¼q>ÿý?íh -endstream -endobj -567 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 566 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -568 0 obj -<< -/Filter /FlateDecode -/Length 5029 ->> -stream -xœÝ]K$9n¾ç¯Èó«÷XÌÁÀö^xáÁú`øÐݵ £ÆÀ¬þûþ¨I ãQÕµ´§QS¤E}"©(¥¾+üûAãÉé)¥ƒ»?~¹ýzSSô -ÿ•«‡Âþ#~¢¿kåâäuÉß!‚SÌÞÄp½áÃ#/þzû·ßÜþk]GßÍ”s0Úßÿú•XÎN1Ũ¼ÀÊ`)m–÷SŒÆô„!æ,± †Î¸-+B —“—XÓV‚ÖEm·¬ 1LÔNbA }XZAm”yD9gÀÓ~ -PzxFO!e“E^OG#ñ¬BtÚk‰—§‚OÏAŸ•–x²x휒xÅÙ%^€,6X%ò ‹IÑJ¼Y ´“^‚,°®$ò ‹ -JK¼l'Ÿ“s"/ƒ§RL[žQ~òÉZ%ñ´ž ² -¹ÉÆÁSJ‚¬âMã$,Àº¤x3IX­B¼‰OX·ÙŠ7£„ÙAEäA8MYX·À$Ä›@'‰ ‹ÉN‚Å›I¸ˆ7áÑ‹)DñfÓÀ]ŸL¸ Ï4HX€Ä›ðl¥Ø^x}„&3EœIÌ(@¯ÇÞ*¦ °»Us -àK1’˜4€˜ˆ,S³ØVÁÔJL(à/ü1·Á„9ûÄSTæ±g¦HƒÌXÞ}‹9z1»SlÎýõÏ·ß~Âæ{ÿóß^~S2eõŸ†ñ[(°¶ð)í‚ù^M¥=‡ζ¡ ˆ$„€ï©CBÄÜ…Ô€Å%éFBb+Æv›ïíƒ^‹ ‰If g¦ŒÌ­úE¨ 1W6ˆ²¾¹Î‡Ë -‡¾°‡÷Æû…'+JyZúT>KÿÝ·NÄ6 -ÃOŸ\€ÉÒ^­ôBoMúï~¾Á=6ªåƒèÌV¾ÃÑÐ&ÝþåöÛßÿá_þéOÀìýürû÷ßý~°z´ÿñý»å3Ñ2ù¥€Ÿ4Ó½^~‡åw¥{¥\šËb)(÷y¦COåyC_ÊP (kä¬Ýåw¡™uߥ^ØÒ©}’£ÒÝËÒ¯?WYݧ¥]ª÷÷Ÿº¤¿ÌõG*³–u…®mèC+âqÕ<ñC½—™WÊ?–¡15ñY»U•ê3¦Ä±>"S‡êj/²PÇó@Ã2ÂÀ‡FpRÀulËtú2ŽE}hGÙ¶,ùG%·i§©ß-m…C9BÜ“Cõ±}Õñó ©e£\lPø&´]Ì:ÏõË<¼,m}âæÊL5.eT™¨ïRV©š8}v‘™î2.>OÄ›m£—µÛÓÖ–VuV¶t¨ç4ê¢Ô§¶¿°þâò"o•# ãf[l•¯Øc-ÏlgĘ3|‘±…°ö£u}¨§ vÍ ©¯¸/ËáÈGŒ™ÚYµ+a–íØÞì{±«Øew×ä‘Ž¬²ƒŽfÿ`uüýÏÅ‘µ=8 ƒ­âÈÒ9ˆIÚxx?i*F¨¸óûÖ:ï -(_w2”©Ãx'› e6®ªœ”Û8À®ö:«¦=j뛼Üt£Šü?ýô÷ÿð¯Ì.[`õ:«g¹À­e^é< »"ŒW™rÜC‡Õ嘗ËÒOñ®fPaýñ ƒNó.¬²äàïÛ¦_"¾ã> -¥õ'cR¢Ô)p'ˆ1§!`û¼vªVA‹Ý D¶Ž>¢g:®:-+{ôœVÀ¼þ¤T’߇ w±Î·ü ìs”¬ÝÇ>…¹¶ºFì5Œæ> +n)ç†g^újtlÕÕrÅ­¬u^Öui‹åõ› õ9ο‹UT9õ⌫û¥n¥x8³aß=]z-TMÔc¾XçÙlØ{ÇÜs-~DâIn+Ü3lêŠg«–Ç9±7øvñÔ¿‡MŒãþôãõ¸^U<ˆûZLUKÀÕDw‹û6IO!æsSÎ>E=txóù¬;ÊX‘ËôfıU_«ó$VÝb¾ ü!2WD<€f‰v9öËoú‰ó³È£Ïvá}Ê|Y~/t³¤¸uýù²üάìçï béì12ØÙyjÚz´² C·uÍÊ.Öy+ëbÓ«^çqYØOK–©â_Õôçã½°$õ]·˜õáÀ·a=k¥Ì×ÁÚáÝ€}¼?³ßö|¸vl™ÍÚ´Ðΰÿ—,óèÇ¿\ï«èTïûV»–êôÛ-õZ§³Tˆ‡’…èê±Ú§¶˜qˆ5;ù¦b™ÃlûÁ26ãYÝÇZ¾"ǘ™òc«•´Œ¯àz`ÏvølÖomVžfÞ‚ïúkç&žú®e††‡ô§+ÎA€pf™×ê ³¿§uWk=]}²5'ýö¸ÿb§³æc¿wãžxÒîÜ,æ`eðìPaZ-ã9ûh1ß?+íóV¶Ž‘ok·­ÖlMÌ'¥‹¹”.l×ê<5û±˪f–E3ó-ñt{#ô`v#µw¼³—!ÛXÿpJz5³VÊ}Ó¾´c™ïðW/Öy:Ë<ñW?x×þ«zSîñ#|Ãgó~v¬–åFé“òW#gV{­Î³Ym>ɧ~«oøfëΪÞñ~t©7z,ÃÛ†­^Íb½Óûúß¼qsr"šßqv±ÎÓYèIÞõâ¹Qó .¼GT¢¢<Ÿ&nðex?´œ8¡ýá}é÷¼÷ô™ßjãÛ#ÜßÝ}Ïô «÷ŽÓÒÜ}N—ý¿Ó¥³·õ.Öy:«=ñS•l-|'<{µ¾ýLo¢Ö·¯M8žåýw„¶øwôŒø÷j9ŸN*ör±¢'0¾U^=†!ºWÕÙ iïÀËkužÎòNÎéÇ÷Ó/üeÏêtpÜ]Ç7RØ©¡áñð^¶|´Ø·d×Ý%ýŸÍ¨íX0ó/cš´uôײ'|­Î³Y0ùEW¶ü÷8•WÌë-‰ËÕO -ĵLÍ<¾ÌfP~¾áø´½€J€K@ýÆybf›?Ûôÿq¹„,zÌ”§ ØC69³;ÍšÍ91±ÍuQíî«».ïZ¿Ï麰H×XRŽtaßÞÛÜæ뜻)ïö†ù*[¯ÈX¼½rmB½Mª¾^ÞîY¦·ì©j¾>ákWùꜗ‘J®ˆÊÖ«$Rÿ<^/Sú£¿e¦ú³«EZûõú&ÏêZ’¼˜DÃf½…rñ¤.—«<0ôí÷à&úƒ¡˜ïtÙeRÖé:mº(Zßwj–ïtøµ•Z¾æAÑÍÏtëçüìa)ÿk™ð_n:»‰ô_®°*W²«BN¦>tòë®äwÙ¹~Ö ™ˆËGÕÚ‚iÚ §<–´~RËÇ~÷½Ê>4¾Ž†êûZ®Jtª²å²À¹cˆšAoÉ4z5é…L_k&»<…& -]ƒÐˆ½AÇËö{ÅS²¶Šý–¨Xwl\•GÓ5¸Mu¡›è\ušM-k"›Î#âã†níH}©t™zmªjרF³L¨Ü¨¾–lâÚ< ¤ÇM þ jÓ“ÙølÖèJÚ™˜ª!¹V.×réqË-­ù6S±•J½j®šï¢tS·©)^ =Øýt‘¾§…­eëÇ5™î>ks­³³!>nÞµ•Øɯ7…Ò¾c|‰¼%ZÖn#'Õí¥SÉsš?aiV]èIÿŸ¡Â7*!Où ]3)º”·?õNhm6òZIœê8IÚÅ^–©KÇØl–ëK'%”'Ðm¥›ÆVT¦2F¹ŠG ÕÀcMÖÍê™ ¬ê§a%'ª*ºëdßLùuEîrú¶T½jÍÌÝ·v;94ì|åäØf\Ó ËMÞÖ.³ùJ|”Íd2ýT;éd£Ún×;cÄ.@¡“;Œ¾r]­ è[cêǾȤ÷qûË­lsÆzCw«é ¸×¥ïÿƒ2?áç?oîþÏõ†Úy7ª¡…iغ"óŒ¾^&]$Ó×ÍTb[6ŒhƒýNÖ©—õÕÚ>n Ãk׫«쵤nª—}×!#›fºF[¦@| ZlŽÌ·ÎMß°çG[Gw6ÑÝÆU*<ðáà1uží[ò5‰'*Ú·tpañÀÅ#ë0wÉVb’AòNšêI~ǧÂR_ì¹ôh;Ïõm–7]ie¬\`ËxÃNóNóJAèw/¯ož÷EäPWQ´7ê+§¶µžLµå1¬ÛžcËuGuñv µ¶,[{¶99}it×­¸2jêÕ–žwê*mÕiÝ(\€¦*­µ«La©VÕRFœD-ÅæStê_¸¦=Ÿ•¦DÏg%lÊR»uÇkÞ’mçæûèT/Ù|É$Яݨ®—´•¶íÛ­û®»í ÃuAB÷LU¯æ7%ß…ïY;â¥ÕR©ú¯dFtêwºS¶XGklùš>•B†8ú¦•èK•¼¹Îqîd›!©¹Þ¦crÖª¨é e^ÁÈç ÖTý2F¹ZVâÞ¦!5Ôan{ÅxùÆ­’£, ¢ö)T¤/سäô&ú^ ¨´|ÉxܤOÊ¿ÿñø=¹ -endstream -endobj -569 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 568 0 R -/Resources 4 0 R -/Annots [ 570 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -570 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 597.273057 101.433071 578.523057 ] -/BS << -/W 0 ->> -/Dest (cb62-1) ->> -endobj -571 0 obj -<< -/Filter /FlateDecode -/Length 4815 ->> -stream -xœí]M丑½ç¯È³‘ùüŒ9ðbwŒ5v°ÝƒáCUN—EÍã=øïï#%’!*”©ÊªngîBu¥"H*|| †”’>+ü|§ñ_$=Ř‚§óåçÓ/'5§ð¯”Xõø Ééä£;ÿœ6L!9üùõ„ÿ†C^üõôß¿:ýﺎ>›)%o´;ÿõsV‘B A9A• RÚ -*禌ó‚Êë ]LIRÁ ÈÐV`¥è$Ì c¢ Š0ÃRÐv«J0ÃM’ -fèä‚ Ò -vh£”¨ƒ!ŠÈA§Ýäát/錞|L&‰ºFÒY;ù@ÚiI—&ｋ’Ž`‹KJK:[œ&R’¶AÒyØb½U¢¶˜¬¤ °ÅÀ;IÐEØtEQ[”WZÒ%;¹‰D]‚NÅ·:£Ü䢵JÒi=9`ÓŠ:Ì( ’‚ÎÀ¯\u°ÅYe$…-„Ižp6Ä(ÌV“g·UVK:[Œ $ê` _bãa‹ -^¢Ì )ó’Ä&„‰’!‰L´EŠ ˜˜& -ÁJ4`’›È§ ñ€U:£%"° -¶8òX [3WÔÁ›Hâk` -H\`-l1d%.°`[Z$.° [RIK\`Á·¤´—¸À‚pa¦’¸À‚qmô$qåJIâ εàN‰ ,HÓ=H\`ÁºÖy#qíZŠ^â Þµ¤•ÄÞµ5El€%.;NVG+qw­VAâïb‰ 0ªpè%.V&£’¸€À»&*’¸€À»&` ua´x×8tAZ¹Á»Æ)#qw /q€2” €wA!N` Vâ¬÷Ð+q› ‰ xW',Âœ[M:&/qïêˆáuiÒæ-¼ñ•ÖÌr'¦!ºo{Ž^Ìî›ócýóé×OX|Ïþ¿Ó˯J¦¬þh¥4!¾Â40 Ãí}ktßú²à©ò¯Xï©“©©A‹KÒ-‰å/ÿ;o?¬,‡á?–ÓÛvú„U¼œžò‚ê69‚íëhñ«| Á -›#¬¶el2™9Ä•ŠV…ûé .VÌ9ÐvÈÌÇz‰Í0ÁæO?Ÿ~ýo?üð/ÿúŸ€Ñ§—Ó£ùï¿Óùoœÿ:·ü ‹ü²üMìs­CCÙ¥ ªëâPæŸÍú\µÝZÆ]0wÑFÎÒX9wÑ}^ŸƒÜN_´ÐN=fíÕÏõ/½?Wéóà­—:v8§šÿ"\.õ´úþOçO?œ~÷i ¼àrÌÀÒ7°z¬Ê{°ú% Š­íˆº¢ÕÍnf>Õå#Ôêðxå<,¿žƒÉË>Ì—axŸ·ÐÛÚœé^ÊåÀ;FsslÖy´ÁÅnãÈ趉5Á8QóÈ!lQæ1j´Œ°Øye²îy>–t¹ŽY&hÕÛ'È.K»Ï¬õúü\ܱeÅ//û4ŸÃ*Ö®_l©„ëÄyêåƒú!ãËÒÛñu¬ÎÃá‹®²ÇÝcÌÆêMcìg\dVù°1>ÒÁŽñ¸ôDzvðٚŶ˂él»Ýa,wc«ópˆº2eTÜ3²Ö}Ûìó>ûwPÕ¼¿…ªcuU×£œ¿7ï¼yt?Œo–u#6<úÉ#C)ïϯ"å`GCŠ¹1µIÁØØ®ãᶫ±îe«GãÖ1v{7ÛMÕ9^î3ëcµó©ËDÛvÎ_û%õ½Æ÷ãÖ6oAKÛ|Ûû²¶}ޢÅRÚLIE“X×Ñz¬ÎáõFüõ7ð_ ºnçPëz+Dîô™¤ó}æˆsÏ=²)÷ÄÊùõùšß.x•¥·œ™”#ŸQu©Çê<Ro¤Ân qœÿMäwPÄ8M,ÿi·o/e¶ƒÈß¹|cB s¥?Vçáy#&ÜYuÇU¿Z2P‡“_y|ôßdÒWF°½#»w°Î£!ØÞˆU?Á;hy ²ÇնŔÏ,Öû‹á;èíqh¾Ž[µ[{òƒu½7b×#}>á_ ¡o™5×ú0F%‚OšÎ}íÝAãyǃu7âÓ1Ú¯œ £TöÔ±þ~£ÌÎWÛ~Z¸Œå5²ìÛáØäÆ·çÖy8仂{ï…õ¯ŽÐ°.·A¡þ~}O¼}50úi,sƒséŽ\ëÁ:†\:¿¶LR=:"|…¢‹€–÷ÌÙuŽ@‘ƒhˆ’‘Ï9Ú—9‹_¢„{ëó[rÆL«Û2^Ò2úƒ„uih›ß/±ñóÁû(èŽëÜë<RoĪOBìX½h'¾Áë«{.žçúù:ÑÈií|Â`æ€]+NÖˆ±Îµj+Ë×…¾å>}ÙâbïˆgÖy8ľïÖÃÇ‹óÞÉ<ìnñfÔ²ƒæ;b܃uÍ×cÜ÷î¦ø•Î‘³Ž\µ]­ÂÔG¸\'â3¦^sç¿Už¯Ù?Í÷ä¿o¾#ò‹Íd}îŽ<ëÁ:†>w#NýGä¹·dª® s³Sº°s^»…ý‹ävÌcÒƒ;®ƒuÉï˹~“Hþˆ\ãô¶è¹M>ú×}¶Üc@l6Œ³¨ïøvÐËâÓ£WlÖy8ôÞ¸7t­a×"݉2îtjbä(~Wç°Š6³Óæ[Ëö7Þq#Ú´Ìú‰ÍT†îûîóÚAé÷¬óp(½q_Áâj†§zú™!dÌ¥Hªh-È$µ¹ƒðkçp¿å+žÅ¨Š&£±e¢H=XçÑê~;èŸWä; yn×­}$ö'¬ÛÜ»¦Øä†Û½ƒÖ;r°ë<Z¯Ç®mä^Ö(YÝ«©Õ:¯ZWÀ,{™!Q›ï«_Ý5×åʽ«cF¨Æu/ëút,¨)¹ßÜBYª~çà 3ÎÜ1ÛŠÍõ“GBÃõ³fÿηPü9ÙƒuÁ×ãב¿ÆŒÒ*›ä’ªç¹k”‚ÚÞ•e{Æûe9_qn¥2[sвÙ!ík™æ¸Õ2¿6ç×å†õD½ì 9ÞÁÅÇê<’¯Ç¸VØÏn® =äÈ×Øö¸°¶5p©eW^7×åˆCçbTцñê÷ø]‰+³±œÓn뮘FÄt¸#Ë{°Î£a:ü滳 ~ׯaÇ•QoŒu‹GÜÜffv‰)7ßÍ¿2Î{×’÷¾³"]•Êsx\ Ü_[ÆxFÂt+óÓ:*Xü%®(¼Ÿ2~Ù½±:?ÜRÃÏ·ð{¬ÎÃá÷FnWÀïÊÏW¾ƒÕîtI;Xá±éø͘±í½ß(ÜË¥Ãn›c~…}ãR΀µU¾=–)¡ØH´CŒÿdÉçg‡DùÑÏÚÄ2¿ûÃüþ¿þÀò”9C“÷tíZË"[®ú™æáa¶6´gïÎe]fŸçÚ³ùx#_Êf=åø.÷ø"­ «Þ·‘!¿•çö³=Ëyíüy½ûZêq`ÔÜ%¢X]¡ûd?t6[|sYlWúÄú_ìöÝWÕ‡ª|£šÇ¤¬-Õýëd›ÔeFŒöK×üªO.?·Îæç–×>5ûó9¿åçáü´mÇÛüP¿üàèm;Íï´´å¯Ú㞪÷¥ø¸ç/Ø– ¶ žÓ\?÷¯ô1·õÄqÚ1j>/¾¨6¹eŒÝ×ny^PÁ²YÆšÙ?3“lóÊÊñ½ÈÒÒ÷§¥ÍyÕºâϤ6þÔ‹]œ^Ãh·¯Ï!Æh¦ç}üU|¼ø*ŸO/å,ósJ}6Þkî`cBóJa.u®°±Iýsµ}îûUŸ™ÑgÅ7Õ¿ø'u?íŽe-óÒí³ÈKy_ó•ÇpU®ëÔ¹­™|üvÚÔµ^ãÙOz¹rXÊ*Ʀ¯:;~£ß†±j¶{Ö¯:6.¥¹ÐlÞÁBÏ.õhéÿËÚëufi—óˆÚâ¼b¼ÎïÆiŽùŠ—»ê+/ùÊ™ÞïrŽ´Ø[íˆC¿ÙšZí+x¬åNzÏܯsõã||Õ?®¾6åêŒî¿ó.ö<÷ÂÛk‘ÖËÓ.ƒƒÁ.¿é#?¯2±‡g¶€ýf‘ñùöQ›õ•çü3à݇h2¿æÆÆ36Œ”B~2¬æewäåÌTõË­ß¾C¯…‚i)ãØ°û‚mJ»™r*D -Ü<£ý4Ë 18Äþy\Ëù–e® £…Ö~zÌž¥¤åƵ҇Í0þròå Ǻ<å^aFj“_ƒsö4å)¤s~ªrT–t6]­Ï;5Ë˃~i¥–÷ ©üŠüxéùeCì`)ÿKðŸ}"²¬ñfy÷‡*âhêA¿žò»_Hõ õ†8 —ªµEºÅÀUvÁ4Li,i]}6+ ”­««½Éõ]­–ŸÉKª²å©´ó‰!jz½çÞ«I/âüþœ8ÙåÈ7Sœ¯6CØ$^¶7Ø+Þk«˜Ðm…Š®‹ U{t~ÞzsïÂf:wfÃ_ËšÀ†óšðrÂií(}¥ù­µ©ê]£šÌ2£R“ºZ² µqD—“ üNÕ¦ ƒÙôlÔò³Ïga¬@¢V.Õr‚èrË-­¹6R¡•Š½jªžï¦t¨ÛØ/È.l3ò ÁØQ¶~\‹ó~¥5B÷Ž³^NŽÚLìâד Bi×¹B¹ -=.´¬Ý&Žªã¥Kó£ÕæO˜šU–ŸÿŸ©Â5ifžòASƒT~ú{?ê'És³‰×NârßX‡$h -½,s—¡a–ûKG%”ϤÛJ7­¤ÌeLR5/“T#µX7Ô5q¦°êŸÆ•\¨ª8]»åו¸ÛéÚTØëɼfpw­Ý.ö;_¹8´×ùQþÍÞÖ.Ã|^ÊÂF£8C?Ö“t±Qmµë'cÂnH¡‹;¾q­ÊSö–}’I+îåô—SYæŒu&ჷ:¿™†G]úü7”ù¿ÿs¢ó¿×G¡Ïë¸Q-LãÖ•˜¯dù=fñ 8¿×¬ -Û´aBCŒö»XÇ^ÖU4´uÜÆ×Ô««N쵤n ª›– ]÷!›]£-óŒ»"¼ ^lÌ{Ǧ/Øó¡­Ãil~ˆ~µ -¼;8Œ]gû’|fMâ(íK:´dXEðFqÈN˜ºe+33 ùIšë³ýćÂæs±FäCÛuÔ—YÞt••^°"-?à “æ'M+{£ïž^ï÷Åd_g@–6joÒW.mËÒFx²Ô–C¿>lkŽ=çƒ:y»‡Z[–Í=Û‚œ>5zhA«ŽQ&½ÚRÀñ“R•­NZŠF©*k-†j“_ªU·”GÑK¡Å]úîiÇG¥9ÑñQñ›²¹ÝºâµhɶÈq8‡Þ;ÕK¶X2 -2Ïk7)õ’¶Ê¶ç¦õ¹ëj{fÝ nˆï‘©êÕܦä]üwÏÜ™ë Y©Tý)™ûËC°P“ÖØò>X½‡P~¥W ÈR%o®s=w²ÍÔÜ ?†c"kUÐù;² ¯P¤Û -ÖT}ë¯\-)±Kos€ê4§6™¡òjÇr·$ˆÚaÈ[Åü&W›ƒÞ˜_@”–¯æ«>O«ôIùùþS˜K -endstream -endobj -572 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 571 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -573 0 obj -<< -/Filter /FlateDecode -/Length 4943 ->> -stream -xœÝ]ÉŽäƽ×WÔY€èÜÀÐÁ€ [† ØÇîši FË€äƒß/’Ì…ÉàRÕ­1åiôt1"—`æË—A)¯?_JüŒBˆÞ™ëí‡Ë1x+ð/•˜$õ·øõö*…ñƒ•Ñ{ýÚ>ZåÝõõ‚ÿºÃ¶øëåo_\þ5¯#¯jˆÑ)i¯?}"•ÑƒÞ ˨"TBjFeíིŽQ99àcäT0Ãz£ÌRåa†‰Ár*˜a” -Œ*À m¼ÔKU„ÊKé`†ŒÖ3*)`‡TB°:"ŒÑŠÑI;8 ºãtJ.DY‡NzÅé´œ7ÒJNçœ œÎÀ…ät¶XiŒàt°Åèà9ƒ-ÚiÁê`‹ -^s:[F'2º[€®Àê`‹pBrº¨ƒ1¬.B'‚Kv°AkÁé¤,°©YV&ÉyF§`‹6²:ØbµPœNÃNž°Ú‡À¬VE«[ -9…-JyÃê` &Ÿcå`‹ðŽ£¬ x‰ãåý`¢2 ¨ LàX@…8ï5G*ÚÁ¸è9ÐBB§$GZÀkÇZƒ•Ëê`‹Ž†ã­` -p\ 5lQFs\ Á¶há¸@ƒnˆ’ã ¾5B:Ž 4f -Ž 4Wg8.Р\@)r\ Á¹ÜÉqéb¹{Ž 4XW[§8.Р]m‚ã¸@ƒwµ‘‚ãÞÕ5Yl€9.;ZÍqïj)<Ǽ‹e¤8.À¬À¡ã¸XT‚ãÞUAŽ xWyl¬ÎXƒšãÞU§ÀíÜà]e…â¸À€w•QŽãeÿÖï‚B,ïÀ,ÇØï¡Sšã46(¸%Xð®ŒØþ˜5 ¶dˆŽã Þ•ÓÇêâ =FœY·åA:9.°à]lTšã Þ}Ž ÀñvTÅqïJšÓw¥Š‚ã Þ…ß`9. €ãìoƒ€.«‹ƒˆ!p\`Á» %ÅqváA0 «ó€$9.~(Ǽ‹í=r\àÀ»ÂjÍqï -·‡ÕÁÇðk Ã²eÖ4œÕA(0§ï -‰ætà]!|ä¸ÀwiÛä¸Ày¨Àq à+Ž \0CôÞq\ࢀ.«sŽ-Ç^@`AY¬¶o8.€c=DÇ^Á­Ç^Á¸ À#¢„÷͆°paã[à)r\&B4†ãoâ1Œ*§sjtÍêtÒs\཰KŽ K ‹žãü@îÇ0:i8.ð¶`©p\€­h -ž9§“°N6Çðt¡“’ã‚ ` ¼AŽ ‚ -ˆ2à¸;4bI 5§3‚âÌÀqA0n W‘ã,Dš`JV[@`~(ض øA°‰0‡ÕÁm Ç!( -7Ç!À%ÇÀ&Å›žã‚(` <>Ž ¢p¹É€Æ¡‚ã‚(âMe8.Àº¤x3p\µ@¼‰Y·Q;Š7=ÇÑÀ …ÕÁ8M‘Y·à$Ä›`'Nç`‹Š†ã‚èś㸈7áѳ)@ñ¦gÓà]ÁLœ¼ ÏÔq\€Ä›ðl¹Ø^€x­‡Æ+EœÍP¯ÅÞʦ ¸»•gsäK1›4€™ˆ,ƒc³ØV¡”‚Mð/ü1³à„1ûÔ¦¨àà±gO'±, ¼ûsÔbz¥Ø˜ûé»Ë¯ž°ù^¿û÷åå‹”)Ë?à×ÆQ`i¨ˆé] ©9ƒ¾¶¢ý‡ „}T!|¬&Jâ”r#±c³×òAÎ †½d±„+“ÎË´Ý"N˜(íXKï­òî–bÀ_°ðÜÚ~áŲFî–ÞµOÓ¿ëòÃŽ™`i¦cð%ÍñÖ­ôŽF/áü›ðö˜3vך /ÆòüðÃåW_ÿéÏøëŸ0_^.ÿ5ÈÄaƒ@”…ß>ã¯üøÕ?®¾¹|ý!§.Ð þÑiR„ ÷Aäû´´w7Csg•‡Ð6 N.Î|ÐQÑ–C°"ÌbtLîu¤r(µ-¸Ã°Ì¡i°~ÿÍ7¿ýÝ_ê`Q~×د¾”¿¦ÁÿZ9Ê­žŽþ¦á[ïü."?]‡Ô‚ &… S?‘d_m·¨tµãÀ3-Ú—½ÚØO)WàkÏ^mxÃ)¥âj›'ôŸGl:£4R;m¦$¼±N¯Œù4µ•G©ë# iúkgÌuöLum\ÊvÏ.ùÃÉ7¸ä)+„¡sž?ϽÚ4oÂ&?á½FÞÀ…Oƒ@k›6N³°Ùè£ÐÔ*;IÊ=[°Žãé ÔdŸ©Uê¿n¤(3QY¡íxlÝDe/Tf»Ú©¢ìj¤7eòx|jlmƲŒÓmnËÌvË*ÞåcuN‡e³ÉƧ™WË°Ï„¹­ŽIµiʨfî,¤>d׿ïÚálð]ß›o­ÅÔ§^Ö]°p·ãЮ•êúë·U,ÛxùXÓaÙmòr»SîÍuž_„‘i¼•ãy²Ÿ›­y^ìþýé1ÃìðÄoý>P°ÝyIds¿õÞ ‡éRæãÜJXíÆ‹ÝOúõÈàwÖVËÓ<†«§K÷ xm4åõ¶1|¬Îé0¼í·žkò#BO¶Xi=ÓSG<[òÄSôõ¼ôe’Sðô?à̧¯ŽÇ|Z›­˜¯Äs~Œç¬Övó%bŠõB:—e¼g†mð²ëp+Þú© K‰3)]¾‰èƒuN‚èïio6YÙv³ÜíÐ)€F¥þÒ¯Y}Ö“î©+óqú;É•šôù÷ãô76eŸ?w&hlkÖ^èVW·R¥XAY°1â ÊŽÕ9 ʪÙ1‰É -O=M¦Ì}y¤Ÿ·÷ALB“nP–g«‘Ü|ÖR™OnSü—9°‹íRj½í¤ÛAfA›dÚé¸9e˜{þåx_iLåú~°†T#ÅÝH=XçlH5j“9„ȼËêN'–œ±É5+¹¦„Ìn¶íʮݷ›êÞæö%;ú¬D—›­¤éü¯»æXwŸÕT'®¬<Ùx¶Ž_¹f²áY¬"S>¤ûn™Çꜙf“CË(ö;v‹¬-”pù¦¶îÓ ùî=%kùEFû¥_Á+(¬¾Ÿ±jÖ8BÌ6 -Õ9 -ù‹efšìÎZ¤‘"˜\¦Ë`qHí¹EÖʵ‰„ô;ú+™ÁóX5‰Q‹åú­3žd®)›Ò´þàÁüÑÁ:§CÞŽÙÏdÇöèkfv±“­|æ¼ÿÒ-,x‡ÛÙßb÷˶?gT×ÿćJv^ÉϾjyôÚÆG”jˆ"(ºn½ëœ ½vǯ쯊t‘}êf¶‰Z¶ø®EË犑“MkÞÈóä33>mñ4¸k§÷Frköæ:»QÝ -b«ïx±ÇꜱÛþæi|À·Æ¼÷DoŸÁ»¹gUÌÊ›®u÷Çð뜹Û>êÿ[FçÝ8ûs¢;£uwõ­ 9Ü÷¬s:4oû½ tǃàv炘•Ñf‡ò Ójé¯õˆùìü™eÏKÛ*GÞ×nY­+Ü꟔žÖ dú–Ö&Ö9ݶ»@VáY43o‰§ËÝ ³»©=pWÌZ†lþîªùÑÌZ*÷¦}i™ø«ëœ™;þê;ïÚ»rïážÍûYAm“¥o¶¦oŒì¡öXÓ¡v'ŸúVßðnë®U=potª×{,݆¥^Îb=è}pý/î¶Ù¹"ê¸v°Î麓w=xݨxÜ}em;·)*ŠãÕÄ¿t÷†¦+ŽŠi¿»Wú‘ûàî±ù^4öw´þîê=¦›z\-õÕç4Ñð; }Óyµëœ µ~ÇO}PÀPÚu“-™¨N‘—¿×øæóàñÕ^m>Š¯cuN‡¯ëÑ9næê®9v#.ˆUÞmŽœGgGœ¿-TÚ¡ï|©É¶Û„éñ®0ÖwG¬s:Dí\%Í,å7~Éìó6ûW€%ïÖ9ªâÎ]‹ÿcÞ¹{vßo¦µãDz^ëœ);W_›¼âÏæ¯Ü¡Ýßu$/Ë}³„óêÚkI%âjr -ù®+Wl;¾ëÊIÎ×>pokl|©£÷ -¬s:´îø_Ÿ1†ÿÙpï½G2swÜÝ“ò}¹'±¼?¢¿f6ˤ­=‚²f¶Ž~ßê`Ó!u'öpžQ<~7É;fÞ~yY³‚Èo§{‹É³ôÒ$z¢nlžC\`¸[duùYËgÖ^e÷ÐÝùã6Ð$½1L‡+9rÑÓC¶×¶¡>ÎUzô‚›¨)Å”/ÆK)Ê×{U~@GÚ"ÇT’M[›Hë0ŸêBNëpcyzXA$ÝÊGeÝø[Þè¦vB†àÔ=f’ê¡Mœµo§¾{Ìôàr6ŸÃb¼¸ô°x™^"œtEo»:3éã•P„62O›L-¯+5Ó{Ø~,¥èˆ½­…žÔŸ¦µ=˜Êÿ˜&ü‡‹Œf ñ'B_£$’8¨|Půz–aÄÆ ê ˜„ÓGQÚ22,²xÕ±/ ÇULciœ¼Ùñ£²ùl¨¾ÍÕè±¥FäB:=à{옢¦“K1½ä$¦W‘…AOG®˜BO¨-ÂÚ iËÖkÅ]±Ô¢Ú¥P4ÝU±2ÙI¯®(C窰˜Þl¦?—U¾™Î-áí‚nu/}e¥ô¤ÜT]%ŠL7FÅ"µ¹d™Sæ‰Ý.ŒðK‘›6˜Ì¢of^#1 -C’)åb.Ljn¶ÜÔš-3åK©P«Æ<òÕ” -uÊÀ3²4F“ÔÓ»›5"tþ8;š<×"4¸Q áíbMY‰Uüz±ž)m+W›¡× -uÓnQñR¥”Î?aif=„Ÿþ©Â)1Oú M½H£ÕNhmñ|Z¹+¬c¸ÆײÍpIï fÛñB\Ï”'Ò-¥ËˆÍ¤Í5r³yDR…<æbYPWÄDay| -W¶B‘@wUl ”_gâj§-KÕŠÒ™“ Ümi·Š]áÎ×VìËŒKz+J±·´Û`> oic3½˜ r'U¬DÙíjg°R¨âJ£¯IœWka'zÓcþX·ãÞ.ß_Ò6‡èAÑãç–ô’¯Öë’×ÿ Ì7øýçÅ\ÿ˜ß*1îãJ¶P…[gâv'£WB†ƒbzªi–eÓ•ih¿Še¨emFCÙÇ•jøÚÔê¢{.) ƒÊ¢m…¶Ža#VºJêfdì†ðÖbqdÞ:7uÃu>9zœ>½$[…ƒötpªN×-ùÚ4‰#*Z·thj*â m‡M‡±Z63“ÙvR†žì7íThê«9hÜ:ÔUgê6Û6eé,š"pu{Ð6ldÛiœÙÃýðòzó¼O&»¼HZ¨½H_[i91’Âã¥:ºùaÙstz}^¼u„J[ºY{º89uiT×ÂÌZŒ6ÒP«Ml۩ɲY§y£(t™È²Ò¢Ï6¹©Z–tÆ%_|Š*ý¾iÛÎJDÛΊ[”¥vóŽW¼%] ÛÂÙ׳µdñ%#smí"5µ¤Î²eßfÞwÞm¯Íi˜jˆ«ž©¨Õì¢äCü÷ÈÚa_6ÕÊ?)3"C}6j#½V:½Z[çÀ!†ÞŽèMhR%w×ÙÎ,3$9wÒö„éŒÖÂKzI:oÂ+q_Ñ4•_ ÎW‹‚=¥û€I Uš[¾(½%7¥-S‚¨z -é¥ØšœÞ@ïòô‚UPºóèy–>I?ÿ$O¨D -endstream -endobj -574 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 573 0 R -/Resources 4 0 R -/Annots [ 575 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -575 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb65-1) ->> -endobj -576 0 obj -<< -/Filter /FlateDecode -/Length 4848 ->> -stream -xœí]K$9¾×¯¨3Ò&~?$Ä ‹@ FpXq˜®™¡^¤…Ÿ/œi;ÒY•]ݳ[‹˜VMUFøþü9lg¹ôYáï+ÿ’ÓSJ9w¾|{úèþ•«‹¢þ#^ÑŸµrqò:‡äÏß’ÀÆ)fob8¿œðßpÉ“¿œþò“Ó?×yôÙL9£ýù_ŸIåìSŒÊ ª •ÒVPy?Åh|TAO¸Åœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚON’Îè)¤l²¨‹Ðéh$µSˆN{-éòBðIÒ9Øâ³Ò’ÎïS’¶8›¢¤ °Å«Dl1)ZIa‹w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔ¡G¡‘Bt¶峨ƒ-Þ*#é,lqø“tà ocJBo5Ô»­²ZÒyØbLt¢¶ ñ%0¶¨$ -@šˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lqè¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.º{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»èFFâ´ê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„>h%.pà]ãq ÒÈ Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\€ñ:c%.@a“AX"qïêŒáOèÓ`«I§$.ðà]Ð|¢.O:ÂãB¿…—'B–¸Àƒw1PY‰ `>¯Jº`¦A×¢.A§£Ä1º C±–¸s©)¡ÓK\‚Ÿ(\’¸f@§Ä1Ãt‰ 0MÉ 2—t¶ È–¸‘.tZK\ lA4(qA2 ³Ì $.À¹$\-霢yf’¸ ¹0Q¨(qº fš`JQ[@ }h²í%.Àä“MLsDl±ÞI\’¡éf’¸ %Øb”‘¸Ø¤ùf”¸ +Ø‚ˆO€ÂDa²Ä qè”’¸ ë„ù¦q _Ò|3I\­Â|S<¡ßfh¾%.ȶx„(¢¶ hÊB¿'a¾ v’t¶˜ì$.È!Ð|3I\€0óMDôâ’@¢ùf— À»>ƒ™$x‘i¸˜o"²•æö -Äë#â3Y™hÆ™Äêõ[Å%îÅhÅ5ò¥9’¸h31³LA\5À° -¥Vâ²ÿ"sN˜WŸøU"ÆÌé&3º…Ctßæ=™ÝI6¯ýëo§Ÿ~Äà{þÛ¿OÏ?)+eõO#@(©â+t“ÑÜÑ·ÆíÛ€À¸ ÌDRd! ¼'s7Rƒ—E72Ãý;o?¬,‡ád:rc^h-“p„asý`¢RºÃ¤óCcf7ùÕynš!äsû e[»«x½ÝW’­¯Îóî¶ÒÒ+¦Ð8×õŠFÞJü¾ßëÍ(g[/¢yx=B6öh¦w6Ú¶“©JƒÒ2'beb´4A;ô±WfyGƒ¦óˆÒØlh<Ib&¤Ü*ñ/>œ@­‹óª}»dæ#ÂÓ*?øöôÓß|ýõ¯~ý' ðÃó雟)páÏ¿Òx÷v~w—å:,×i¹öË{ÞÊ´ʨz5¿c"£À‹åå>/º%óë<îy(#.uPÞ0¤¹ iõþó ¿`#;̶üZvÑÝ°±ùB åÔkV^ýìûÔ¥ÕÏÿzþðõé—Ö ,s«”4Õ@§%J¸7ÿëa4ž·"XCF8a\ÊvO ‘£Ÿ7’ŒTÓãÎÃÑÁÁ<†Ts#Vý(ÄŽÕ‹–qâ+¼ÎQjŸæüÖo9­Õ7”CéÍ»Vœ8Œcw…[Z>.ìÜÝÓ—!î öŽxö`ž‡CìxvoTç3˜‡ŠóÞÉ<ìlñfÔ²ƒæ;b܃yÍ×cܷΦJkÔxSàÑÖâf(—óaEœë-LãªÇ¼ìðªrp»¦™WžßWü×hâ‘ΗïÉ;è»c•õ`ž‡Cß8õ‘ç^³Ru›™Ò…Õéd_|¹µɖǤg\ó<’íÛÖ\”H~µÆém Ðs9›8|ôÏ?úìiF­c½aìE}Æ·ƒ^Ÿݵ=˜çáÐ{=¦Ý´Ö0kièá#ã0Ó©kŸ #G=užYqXE›Ù)󵈿e»y‡û\z€ûÄz*C·ØnÖµƒÒ;ž-8˜çáPzã¡‚=ÄÕžêé'†q-u@REkA¦›ãÊr—áǼs`YŒªÜd´KÎÝBê±<‡Ôëqíÿwv¢V^³Õ¯}$ÞO\—¹·§Øä†Û-£Õݱ{0Ï£¡Õ]][Ë=¯QRæàlwsµ®ZGÀUöÖ2C40¢Ö<3D³´!÷¢¶+B5®{^çß cAMYûÝY[¨=‹Ê²áu=ÎÜÑÛŠÍ‘Ý'„†ý³fØAðk²ó<‚¯Ç¯#+J«Õ¤ÀT=?ðÈ]­Ž; ã -×2¾â(Ü J3.d¶Rв™!íÕµôóÜj™_ó}¹aEüzöl¬¦¯ûkøùÖwŽåy4üúk»~W~yšÅ®íI—¼ƒ›˜:ÛÞ·Ò¤v×RÃnëãúÊRNYWÀÚ(ß¾¨F-@(Öí’}‹ËÓ!:Új“JKüò÷øíŸÏÖ)i…†ætm¯e‘=uo˜æå¡Ç6Ä“‡ç´žè©ÞÝ|½‘§ÁË—mٔƅm%½_çq±¶Öü™^5ý&µ‹]~n¡Î"KújÇbw©'Ô}Èá‰;üî7³.›ßk•)ZÓå#7‹½ê>-þ¡<—:,&nK S ²¥›[ló ÕA¨ËÓŸ¶åK_g¦#s¶åû«/C¹—kvÐ)O²ªß ùºÝùÝÌ=[°ŽN -Ê™…²gÌö2×ìø#?ëÐ3ps{,6ùÊ.óçz¯d‹=m¹ÿ§Åö¼¼ù> -žjšgÖLÇå×´–öñÌ&ÍÒ-mXWwüžFß4 ifsÅC¬enë¯ýË·>!ûJ/;Q%­šïSÙµÆvh6voÕïºû½¦oö׶`Xò¦Û#Õ5sÎ5ŸE5úÌÕç2ç¥=NºÅGókÕ<óWZû@뫶Òim+[gîXc¿öŸ1‰ÁOÁ–¯xÒ‘F‡â‘ƒyîú¢í;"¾Ù󔼤åm:‚Ö8ÑË–šeCÇÜ»æ0©LÇÕ V:âKµÔåêên‰-ë.¢P¢¾•Û¥rºS¢=·rû0e6“róÇK[øeozÈ”cvÇCß×üÍ»w¶œ`B§9Üáy:Ç ® Q¾Ï[¹©ÝÀÖ¼Ÿç]2èeÉa¨ÜǦÏK+\­c ?ENJtJï1àl©³ÁsÐؽ eÐyx™Nž*-={‡ôèà—…À¬×tʧ¥³&n|!÷Pž™„5îKA]ã>õ‘‡àl"5ô&q‚;öLCùÚ÷~}B}¬aø6Œ_=Ã&o{_ˆÙ°D4Ç6ç¶ncjÐÖ°—ÀàyÁvpí¦œ}Šz¨ð®3…è3F½5Ç;˜çÑpé¼ã}\o…0R¦¸~y§Wœ¯Eg1|Ò|êË–)…YôõõiyÏ,íÓ÷=â½ß£3Ù›Ž˜ƒ'Ìó (ëf‡p e¯ytæÚ#Lf|Tfïñ“³ -<Ö£-[VõÃW‰ßAjŒ¯Gê±<‡Ô|•°/ÿ_àÚÙD’½¬í;ü¥†Ú“–û+¼ص>›%OÞéyšÅ?¾û¯ÅW6@v¿TKG´Õ9ôñs5Žez4lj¥¯Òè[¾¹ÇA¶Ú¥ây?> 彸tO¿ybèyìÄ ˆ\δÃôE=çO§ÒevD^ßÍ$7 Vƒéí!_g=¬¶Ž·Q$ý˜…MgD“­ß¶ÍçyFYb¯°|¹.¯e¶½±ôoS#t=Ï<˼bËpŸ»ÛJ´^—üžgX‘Ü´%o6K Šm!¨¶ä\¾ôšæ¥8¾„ÙʯKÌžÕòg^bÆr›füîÊ9¦ºœe­Bš´¡»87Ñ^pÌg:;5)ëtm6]­Ï;9ËO„|×R-¿¢è q:D¶4+¿XÒWüÛ“În"ÿ—=‘r¿*âdêE¿œèœ v®o¬Ü“pù¨ZY˜ ˜Av›Æ))1«PËǾ™CSù£ñõn(¿¯ÙèäM§j"[Ξœ+„ÈôVLw¯&½ˆéW2Òd—«ÐL¡¥¸&ì:ž¶Ø3Þk«˜Ðo…ŠU×ÅÆU{4ªÜ\º°™Î]§Yó×´˜}šCÂË ÕÚQú"JélþZTõ®QMf™Q¹I}MÙĵvD—“ üJÕ¢³éY«Ñ dz0U ¹–.×t‚èrÓ-¥ùÖR±¥J=k®žï¦t¨ÛÔ/È.lÃ3ÒÏþ°>¢lý¸ÓÞ\kk•nÌFx9y×zb¿œ|RûÎÊWèq¡eå6qR/]Suºf•Ñù°ôÿL¾I‰yÊí¤èŒç~Õ+¡¾ÙÄk'qyh¬ã$h{Zæ.cÃ,÷—NJHO¤ÛR7­¤ÌeLs5Hª‘ÇZ¬Ꚙ(¬ú§q%ªjªëbß ü²w;}ëª^µÊ‚fp÷­Ü.;_¸8¶×t`w³·•Ë0_…—2°¹QLÐOµ’.6ªv½2&솺¸ÓèK×ÞÚØ©œQ³|ìLq/§¿ŸÊ0g¬7´Ï¬¦ßŸàQ—>ÿi¾Æë'wþ]=ðxÇjla·®Ä|$£_+JÅôëEUغ Çh¿‹uêi}ECÇa|ízvÕ‰½¦ÔAuÓr¡ï>dbÓ k´ežñW„—Á‹-ykÛô{¾´õæhߎʮVá‚ß.S×Ù>$ŸY‘¸¢¤}H‡Ö–¼P\² -s·le&’WÒ\Oö;Þ–êb,Œ KÛu®³¼è*+wÁ’ ¶ü‚ì4¯4¯ìŒ¾»{½¹Ý“Cí$mÔÞ¤/\ÚnŒ¤ðd©-—a}ÙÆ[¶ÜjçíjeYÖ÷l rz×è¡…[]pŒ2iêÙ–žWêªlUi(]@¦ª¬•«MaÉVÝRî8‰^Š-¦èÒ¿sO{Þ*͉ž·Jؤ¥rëˆ×¢%Û ÏáûÝ©ž²Å’Iž»I]Oi«l[·[×]GÛ3» × =2U=›ß¤¼‹ÿîé;sžaBJUÿÊʈNý'0P;­±åWU -âè‡{¢Kl©äÕy®¯lWHêÚ ¯ Í19kUÔôû² /PäÛ -VTýmO9[Vâ-½ÎÂÒP§9µY*?àVÖ*ËQ»Œ4U¤ßk´ô&ú™©¨´ü”+-_VË'åï¿oº( -endstream -endobj -577 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 576 0 R -/Resources 4 0 R -/Annots [ 578 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -578 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 270.123057 101.433071 251.373057 ] -/BS << -/W 0 ->> -/Dest (cb68-1) ->> -endobj -579 0 obj -<< -/Filter /FlateDecode -/Length 4736 ->> -stream -xœí][ì¸q~ï_ÑÏ–æ¥x?pàl#‹ØFæôîØf ¬ó¿Ÿjñ"ªtëž3Ö>ƒ>ݪ"©ùñc±D‰ê*ñ÷”!zG×ÛÏ—_.Rx+ñoH19Ô?àãíUIòª肽þœÆ ­öîúvÁÝa›üíò§_]þ6Í£®ZÄ贲׿ÿ”Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ì°ž4ÍUfP –SÁ Ò:0ª3 yeæª3´WÄ©`†ŠÖ3*%a‡ÒR²:"‰ŒftÊ -‡JwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¶XE$9l!<§s°Å8#YlÑÁNça‹FíDF` ÐXl‘N*N°1±º >ÌuZZaƒ1’Ó)%,°iXzÉyF§a‹“6²:ØbÔœÎÀ§OXãC`z«N½ÛH£8…-Z{bu°Ï1€v°EzÇQzH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHØbÉqL`l!ô\V[L$Ž Œ†-HÀq1°E“á¸À€m há¸À€nIFÅqß’TŽãÂ…™’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]twÏqëë4Ç´k(8Ž x×’x×ädu°æ¸ì(Œ -†ãï%=ÇÞE7Ò Upè8.V„Ar\@à]$q\@à]í1°:/Ð ÇÞÕ—ÀÜà]m¥æ¸€À»š´ã¸@àÉzà]PˆåÝØ‚å¸ã=tÚp\€Â„†[Âq愈áéÓ`+¡BtXð® -h>V…ò¨q¦ß¢–…r.r\`Á»¨ Ǽ ú €ãFTÍqï*ƒ‘šÓw•Ž’ã Þ…ß`9.„‚ÀqÆ7¡$ Ëê¢1Ž ,x´¤9.À(,d“°:/$ÅqÈXHø¡8ð.†÷ÈqïJk Ǽ+ n«ƒ-&hŽ à×@‡nËôi8«Bj0§ïJ…ætà])}ä¸ÀwÓ°ÉqóI Ç0PÀ Ö¸@"zï8.pQB—Õ9cËq—XP«ƒ-ä‰ã8Ö"š8.ð¶­9.ð¶Àeจ -Þ7;=€-€ ;? ØO‘ã0™‘ˆãoæc¨UNç´tÍêtÊs\à= ÅŠãÌ¥D@§ç¸/’»ÄqÌ€NÇ>ÂtŽ 0‰ á™s:[àds\O:¥8.¶Àä¸ è€Y¦“`„Æ\UÍéH¦yfภÉUä¸Ý3M0%«ƒ-  Ž Ð>i²m9.Àä“MLsXl1–8.A§éfภØ¢¥æ¸ØLóMÏqA”°ÇQ:‘ÜdŽ @ãÐIÉqATóMM _¦ùfภ‰ù&¦xL¿Æ¥ù¦ç¸ l±pQXlÓ™~ NÂ|ìÄélÑ‘8.ˆÎ¥ùfà¸næ›ðèÙ@HóMφ À»6‚™8xž©ã¸˜o³åæöÄk=ü3^ÒŒ3° êµ[Ù÷b´òlÌ@‚|Ó‰ ÀLÌ,ƒc£V¡T’ Hð/ü1šqÂ=úÔ†¨àà1fŸ.2¢[¼û2ç¨ÉÌB²{|ìï¹üúƒïõ/ÿ{yýÕ)Ë -šà_¡èˆæ¶ð¾.ß84´ƒ aà#y’>V#hq º%#1ü¥×ù‰å0ü‡áô¦œ>bNO 7‰ÆJ¥L_‡Ø`cñÁ,ïh°Ä䣭Cub'@~¥¤Iâß~¹¨£÷h9lÌÇx‰É0i{ýòóå×ÿöý÷ÿúûÿŒ¾¼^þü/RZû›ï¾)Ü¿-òÛÐÉÜøíGùת#¿}—g,è*åårú4VÕr¬œ¦Iùœ/ŸC'ßðë=?fb5ÝX¾ÕÝ55ç3aÙV¸¸CšÁ®\w·æ:|.ç7ÿ}ýòýåw_¦`<Ì;ü“Ã…Q-qÅ*þöeyßv˜®®ÀnÖŒ~ZÍ3è5ͪR¨±šW~Ošª;Ÿ t|לn§ì~½C$C¯‡0éîüfÌ«¦×òí»,ÝÏ@„eÐiP^ÅîΣÍÍë„–ìÍybs¾×iÚ¡géÄ:ŽØ}yN‡XZçÛ…VH7â¶6¦ûr:ä¦òzîË-¶ç\¹‡,qdæ÷‚ønXÿXž<Ö+&éiƒk«ÓiMB -Å4YGî¾<§CºÝ÷?ºß³?Ý­›½oÍÕ…M·TˆI·…æ}yN‡æu¿wænxÜè\³Ò3èeî}¤Þb;µĠóg–}ÛV9òX¹¥·.p«n|Ò´pDª!`¼ŠÆyΆF½îÇΕk¸AVj™g&Ó:l·îêL-ûÈO¾¼u6¨)wµòú³—ñÚ É7ƒ^ÆtOK È|À_Ý™çtÈÜðWßyÔ~TåÑï&ç3¸×9>ïžÍûY@m M7ÙtPÚn¡v_žÓ¡v#˜ú¬oxØßjFë5ÿñ6EÑrÓï‚ü%´öKæÒî:KëAïƒ;é³`ñBÛêÎÙÔÎ<§CèFÜuÇè¦[Ÿ³!{$ Ñ!}Gô9¿äˈ¦1}_~FF‡ÐržÕ¾ÚqÄæ£h,|ß_×צ.{Û~lòõÈx+áSîAב¸åäþVðS› -:~¼£`øÚ¤¥;.k£à[«5È_i´3ÏéZw§ºZ]è«ÃlצӌÁÕ‘%E²ÓŒA'Ý×û1§Kyò #ëMòÎoc¹_›|Tó·çæÉiÄjÓ¾ÜÏ‘& ¥\7Ú’9!å wä 3ž÷¸_íÝæ½øÚ—çtøÚð°m㦭µ±»ã"±Ê»µñžëèìè‡ë1M9ømôhÛmÄô0ã]`¬ÖFîÌs:DmÜ%µlŠo|föyÎ~UVŸ îÌs6TÙU‹ÿ`Þ9ܺïÆ7cÚð‡íQ¯yN‡”»¯M\ñ›ùÆ +´ûuQ{ⲓhZ?ãl¼ºö^R™q51…¼êƪÛvÄ…Ý9ÉñÚÖ¶Z{|5öÎ<§Cë†ÿõsøo†„£k öDæ¬îâ}º9_Ñß3›DÒÚD¶v?sµ/Ïéº {8Î(_MòŽ‘·Ï5ãéX¸3ÏÙéö=ÉòÔjä#w>²ô÷Ú>eÜwÁD÷væ9‚7|ÕwZOÏ¡åÐú«w~†jѦ]>ãY¾€ÞæNëÞçvæ9z7|×Oü”ß»ôš]µ¸€ÆâŽ;óœþéÂjèÙS¶rM™5tHøG®MíWq§™ÌÀeÝz©Ïñão¯ÆúzêÓlp® Öº3Ïé»Ï=úF‰ Šn š¸gŠ®OÖÏsÔ­"ò)Fû*gÏpÎß®Êé#IMÞ~=ÿÞzá¸Ï½3Ïéºá«¾0¾c®EÓpâ¿®Gï°kí¹¬>ÏZ µ¤mÇ……kK×ômgˆ ˆ}ÀŸÝ™çtˆ}nõáùü¼ç=™ÓÎ|w@xÀÇÝ™çlhë>î³³©Õ÷ª´-¾p×v2 -SmᥧZ&Ÿ,O÷ì_îkÒ÷á‘߬'/ ï8ëÎ<§CßÇ>‘} -ž;©ZAçê:ÖV±“ØÃ’x£ÐÎ<§Còs1×O‰ä÷ˆ4œ>ykÆñÃûzhó÷u6®1Ø÷dâzÿtïÛyN‡ÞcozêYÕŒŠž£ÚU!-‡e´é…2"~Ëöƒ+nX›Æ@?6=µA÷cë¼x”ÆÖìÌs6”ÆuGžŽÞxV–{“Ä°¶³rú£ß€ñ‰ïÄÆG•$†×l½[`gžÓ!uçÓAÿ¼sÀ¯0lc»vZGìõ<õÞ®´>ƒÝ™çthÝxÙ¶@Af»VSÉi\5€oî½µi]ýdÕ`˜¦Ö®ö¡ì×½NóÏÐ1¢fˆý.ÄÊ+Øó3zœ~ · 6ûæ:[O¨»Vì_x -%>“Ý™çt^÷_¼I#=ñQ”k¾ã‘‡ZÉËùªìÀÛ³öæž…웕üÜÖä´ÌfHKç{€~n5íAó5¶÷åºñD¾$ÿ0îÿá-ݦ½OÓ±ÙN¤Àw3ÉZç›ä-<®é¯‡£qèàœˆ´ñ¯ W8¦}Ú+'ÁïwøÏÿã*ü†Wýt¿¥™Úbx¨èvoÊtœ_d¥Ô=H9¤nHÍáÆj†¼—TeuèLßwX$hÝá8ܤJiÝý3”5þÊ ™xÆó¥Z)"T×OÊ·ã¹{†2ls 6_칸aÏ'5ìû']J§¯ŽDê>^Ó>SAR¹ÙÔPÑêºsØNù—’jÜaY¦MÓ†[÷í—›ƒ1ý/Cƒÿ|Q‘DªÿD$÷ÝPå :TñÛ%í†KŒ˜à“î'áøS–²Hå„Ev{û”Æ -9þŒ¥pcóOmóÕ¤ü6gK»‘̰̉OÏýÄŒ9š‹ÓÕK¡FqÚQ83¹bŠuÙfkÔ¦­ÖŒ›bed#´s¡lNWÅš²=*í@WªÎUa1½­:Õ4N«}ÓœkÂÛ§5½ô•¦}LsQ¹vµ,2Ó‹Ô攥A¨´#º]áw2MhÌ¢oZ-íw† $*ébNLjn6ÝXš--åKªP³Æ\óÕ” -uJÅ3²¡ŽF©O[¤7}Dšüs*v©r[ËÐàFÏ„·‹¥Ò«øíb=“ÚV®6C¯š¦Ü"²â¥JÓ£À÷_èšY–öÒJÿß©Âibžá‡¢©´^=ª'I}³ˆ§•ÔÊ]aâj@‘¯i›êRÞ̶õ¥‚dÒ'Ò-©KM¤M•5r³y‰¤ -yLŪ ®ˆ…åú)\Ù -e6§«b[ ü6W;méª{>™S Üm)·Š]áηVìK‹«´¹a±·”Û`> oÃÀF½8A?ä“T±–e´«'k„Õ0BW}Ĺ·vÞH?þ¬Œqo—¿^†aN«#~8£Ò^½­×¥®ÿ‡4ßãó?ºþGÞî>ŽkYØBnˆÛ‘,íìvŠÓNïYXºM#ÔÔÐ~«PÓÚŒ†2ŽkÝð5Õì²{N© -ƒª¢m…¶Öa#ÖºZ™¦fìŠðÖÕbqdžm›:`ßM¾8œÆ¤m³U8h/‡¡êL’¯M‘8JIë-é&#ÚBqØœ0VË&f&@¶')UŸì§¶)L:WsиéÐTÕa¶-:ˆ«h’À6íA[0©ö¤qbcôÃÝëévMv¹$i¡ö"}k¥åÂ’´/5á›–1Ç\ÓAî¼µ†JY¦é{¦89µkTׂ&-Fi¨Ùƶ=)eÙä¤y (t™Ì²R¢Ï6¹1[®–áŠ[K¾øUú׶¦mÛ*¥mÛ*n–6•›G¼â-™âÙξ^¬)‹/™ks)Õ”&Ëæç¦é¹óh{m.ƒª!®z¦²f³³”ñß#}瞧‹Bp©òßQ¡n§Šš”7Ú\crw‚sàJ›œ{ -M¨äpžõØÉ> -endobj -581 0 obj -<< -/Filter /FlateDecode -/Length 4971 ->> -stream -xœÝ]ËŽì8rÝçWäz€Öð|F/ Œa·ánŒ†·òÞšQm Ç ÿ¾OPâCT¤¤¬ª¹Èq_Tg*‚yxA‰L}Uø÷ƒÆÿ"é)Æ<]o¿\~½¨)8…ÿrŠÕEVÿÁ]µ¢09|t×_X`Ã’3Á_ß.øßpÙ'»üûo.ÿ½Î£¯fJÉí®ùÆ*²Sˆ!('¨TJ[AåÜ‚q^Py=áS’T0Ã2´U˜A):I3Ș(¨"Ì°´ÝªÌ0A“¤‚:¹ ¨´‚Ú(%ê`ˆ"²FÐi7y4º—tFO>&“D]€N#é¬| í´¤K“÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ é£Äàø 3ª‘¸ÀwµÅL-éÀ»Ú$%qïÂop“† qæ·I+@WÔ¥I¥%.pà]Ð’‘¸³ð¤"˜DÔ… @Ò€Œ'?TâÞÅôž$.ðà]嬕¸ÀƒwÁíu°ÅF#qüè0l…1 guRL!éÀ»J£‡%xW©$.ðà]ž6%.ð&J\'xÁFâiJ!x‰ |RÐÁåu~µ“¸ ((KÔÁ -$që)Ù%.¶Xc$.¶Àe¸Á”4¼o1<€-€‹l§(q˜lŠ‰Hâ‚à<â1´ª¤ófŠt-ê"t:H\M˜ŠµÄˆ¥¦ˆA/q~bwIâ˜&‰ B‚-*`*š¢g.é4l“-q<]è´–¸ ØoPâ‚h"¢L¯$.À XM-éHqœ%.ˆä'v%.À0A¤ ¦u°4!qú‡ƒm'q‚›sDl±Ž$.ˆÑp¸%.ˆ¶e$.69Þ $[àñI\”ŸØM–¸4R$o’¸ã’ãÍ(qA² -ñ&B7·zc†9_-¿¤½µº²}]½½Í¥žl¯-£úT£Ç¾Ñ¹Õ »m]ùÙÎ¥½ò½³ ·¹Çµ_ªñ}ù†ŸO#øGT¸”o—6r¹Ýsyúë¶oy¡…æmËÉ÷^ÚÓç¶Ù³ƒŸ?Ëv¨v/ÜÞõþ¸íÍ•]·ÁØÕ&ßÝ[iwÝÚ½¤¯ö‡¡ßîôs¹‡Œu¶ãË^›Yµi³ž7Ê}ŵ­ZK|Õl£e¼m9ªñóøcÏ6~odeÛÌk¬—ñ2úÖ»ÉÛnòÃÕS~ÅÉ<ï -ú?Ñ¡pÕÞ¦ˆ`Ú(Ñ¡ÈУ =Ëí¦—¹îV˜ü¤?8*,ô“!PœÄ²÷K4èYçq„ÝëQnŠù9³÷¢=G¹Ÿ’CŸI¹óDYZ¬LJö°…L~‹œ·wZ¨Ä®nŒscç*QWŸ -lB†´•Þ=Ùü,…וßÑòüFšÎù>rs¿O¬ù¼–§h0Ê"aj¼M—–^Ø­ct#EN"~^èÀ;^t³ þ²ž,WŒ½ç”l'}~3'ñ3ð¡Ò<²ï‘/Æ.®ýéÌó$ÁTå>4í÷)4ìü9»·ëѤú ¼sADZyŠ]ÊöåËAˆˆ§ôz*2B›>‹TÑ“æi9£&æ{Ø"‡¦”\ z¨p9ŽÞÎô%~h³¿”¢Ëâ‘tjË»\3,e®¸kèm7 cƒ×å½­íËvd”‘µ<ÃGÒr™×}wm‡ïfÉ“îŒ<Ýî£Þ÷­‹¾vÜC¦W•ù­Z"ày2ϳ!Óë]­­8ÎØ=²öP²YP¸ïËòÝg K·ôu4¨u] ÍwPØ|? Ú3böQx.ÏÓ¡ðœ¿(F÷8ë¥[1ž¡KH¹ODÖØ“=—>P_}ÜÉ x™ó¯ ªQ›éã}[W<)¬NÑé{ðäãî“yžy>äØ“ãÛ#úºžÝÌdw¾KÞ­Gˆ6¼#Íì±ûuߟ#3Ô¿ð¡–¬ÿú£öz;Q›)©hø}Ì}ôžËótè=ð+Çw†ˆÈ}z¶‹Zöø®GË÷Š‘çCºr/‹Ï,ø´ÕÓÙ?Éݳ·ä9ŒêdĆæ;žFìÉ<φذïo>øј÷‘èí;x7ŒŠUzÚçÚ`áOæy:äîû¨ÿßVt>³¿'º ZGß4»Çãþ“yžÍû~ïÆ=ð ¤Ù¹"fgdô«C¥‡y´ŒoùŽˆùîüYd/[ÛG>Vn­÷¸µóIùÌ¥ó^Á}4žËóthÜ÷c7ÈêÞ„¨({ùX<]Ÿ+ïôîn¤öŽ÷òï­mÐ?¼žzve­¼úþyIFf|‡¿z2ϳ!3ø«Ÿìo}³*t÷ö$h=–a¯SÍWV±Þé}Hõo^ù?x"ßñìþdž§CèÁºëÉçFÕ38±#GEi~š¸á—awZ~âh„ò 2„Š›qztN±ùQ4Žoôþî¸dõ®Ã½]ˆ'ž–ÆæsRrüNâýöû¨=—çéP{à§*-ýLx´®ì½ä­peï'o-ûìíAÒ[0•cÇgö~û¤âÞZ¬è Œ{Z‹Ç0D—ã¨:zBšÔã|y2ϳ!/<§wÇŽc]èÙÕÓÁqvßHéžš>¾·Z>"ö‘ÕuÚAÒßìŠÚwþeˆ“¶ÄïÜ ø\ž§CðÁúé|Ê3èzdÝrõ|«_k›*:¾Î(ÈxzZß?e¾ež¾ ÷y€²q”½+šºµË³ÑÉýWyx½†àêibÜÐ|äS#-éÒm:7´¾ÞÉ™TáךjùÅG/ó±›¹[û‹%ý¯¹Ã¹èD·>!Ÿ‰®²8šrÑÄoÞõG‚˜¨âp fáòUÕ²àR›AvO†))­+§ÖuGð†­ù«qån8¿+Ùø¬BR%‘ͧõÍ Bäôz+æ»W“^Äü»q²Ë•¯¦ð–á*lRŸ¶Ø2ŠµUÐm…ª«®‰ {4ŸC[›Î7a5½o:ÝuI‹xÍœÞ.¨ÖŽÒ7Qʧ™—¢JëUe¶3*U©+)k‡Pí'At»ÂT)šÐ™UßõŸ ; cÕt©¤D·‹˜n)ÍÕž -5UlYSiùfJƒºµáÙ­;\%ð¥tcDÙòu-æ3Cj_«ØáÆl„·‹£:›øíâ‚Ú5®P®@¯Ú®Ü*Žªá¥Iy}`þ†¡Yd|¢&ÿ¦ -W¥Ì<ù‹¦ -)>·]µJxlVñº‘z¹¯¬CR h --m×\:„ŠÙ¾½à/é™tkêÚb+i×d<¤b“T%µXWÔU1SXiŸÊ•½P#P]» -å·•¸ÙéêPuªVæuwWËmb_¹ó­‡Úãš8®öÖr;Ìá-Ol4Šú±TÒÄFÕÙ®UÖ ›a …&n4ú–Åe´VvâŸm)_Û “fÜÛåÏ—<Íë Ÿâ­æû{¯K_ÿi~Âß]èú/åˆØy7ª²…©Üº÷3ÿ¾K<)æß{)Â:l:¡¡Žö›XÇ–Ö4ÔyܘŽ¯©eWØKJ]TWm/t­ ;±©Ð5Úv-ãv„·¡«#óѾiö|iËÍñù&|¸p± -ýíà26mSòµ+Wœ´MéÐ’é2â¢/—]…©Y¶2“ÙWR›ží§¾+,×Õ]tn_Ú¦£6ÍöEY¾‹. \`Û_ô“î+M+{£ß=¼>Üï‹É¾Œ–Vj¯Ò·^ZoŒ¥•ðd©Í—~}Yç›)ƒ·µP-ËvcÏV'§ æZÐê¢Çh'-Û’Àõ•R‘­*-E¥ ÈT‘ÕC±É/ÙJ³ä;Žb+…êS4éŸû–v}¯ÔFt}¯øMZ.·ÌxÕ[²Õr=œC»;ÕRV_2 -2ßç®Rj)m‘më¦uÝe¶½v·AÍß> -endobj -583 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 570.123057 101.433071 551.373057 ] -/BS << -/W 0 ->> -/Dest (cb71-1) ->> -endobj -584 0 obj -<< -/Filter /FlateDecode -/Length 4858 ->> -stream -xœí]]$9±}¯_QÏH›øûCB< `¯@Ý<¬x˜®Ý¡^¤…‡û÷9áLÛ‘ÎȪ¬šžÙZÄ´zº2ÂáðñqØ™åÔg…Ÿ¯4þKNO)åÜùòý釓š¢WøWR¬.Šúøþ¬•‹“×9$þž6N1{Ãùí„ÿ†KžüíôçŸþ±Î£ÏfÊ9íÏÿüŽTÎN1Ũ¼ ÊP)m•÷SŒÆAô„&æ,©`†Î¸­* —“—T0ÓU‚ÖEm·ª 3LÔNRÁ }TZÁm”u0D9g Ó~ -pztFO!e“E]„NG#é¬BtÚkI—§‚O’ÎÁŸ•–t¶x휒t°ÅÙ%]€-6X%ê`‹IÑJº[ ¼“]‚-@Wu°E¥%]¶“ÏÉ9Q—¡S)¦­Î(?ùd­’tZOØ´¢# -¢ 3°%(ŸElñVIga‹Ã¤OxSF«¡Ñm•Õ’ÎÃc¢u°/1€ °EÅ QFÐD¼$q€‰qrÙ8‰L²“K.I,`Rž\ŒV¢“ýäBŽX¥¡3Z"«`‹wAb«a‹ÃÈu°Åf'q5° $.°¶g%.°`[´H\`A·Ne-qß:¥ƒÄ„ 3•ÄŒkSpXP. ”%.°à\ À‚t1ܣĬk}0XЮu)H\`Á»Öi%qïZ‹œ¢¶À€'«“•¸Àw­VQâÞÅ02 W'à0H\¬L&%%qœÄ¼k"¦Q'ŒA+qï&H37x×xe$.pà]ãL¸@™À?JŒÀ» /‡°+qæ{茕¸…Ma‰Ä¼«3¦?aLƒ­&r¸ÀƒwuB÷‰º<é ã^žtYâÞÅDe%.ðà]Ðg’¸?aF5x𮶘©%xW›¬$.ðà]Ä ^âÀaÒ$.Àü6i芺<©œ’ļ Z2`žT“ˆº8HZâñ¤‡J\À»˜Þ³Ä¼«¼µð®r{Dl±ÉH\€¸: [aL#X”SH:ð®ÒèaIÞU*f‰ x—¦M‰ B$IÀÀ Q°‘¸ $7åƒÄ!+èò‰º0áÚK\”%ê`‹‹NâÖS¶9I\ l±ÆH\ lAÈ q"‚)kDßâò¶.âúÀÁDŠ€É¦”“¸ ú€õ¼*é‚™R]‹ºŽÄè&LÅZ⬥¦„A/q~¢pIâ˜vÄ [0T$.ÀT4%ƒÈ\ÒiØ‚ [âDºÐi-qA2°Ñ ÄÉ$¬2ƒ’¸34Ö’pµ¤sŠÖ™Iâ‚äÂD¡¢Ä&Xi‚)ElMH\€þ¡Å¶—¸‹,6±Ìu°Åz'qAJ†–›Iâ‚”`‹QFâ`“Ö›Q€` ">‰ ² -…ɀơSJ€Ö›ÆI\€qIëÍ$qA¶ -ëM,ñ„q›m õf”¸ ;Ø⢈:Ø‚ ) 㜄õ&ØIÒØb²“¸ ‡@ëÍ$q ¬7Ñ‹[‰Ö›QÜ.ïú f’tà]D¦Aâ\`½‰ÈVZÛ+¯ˆÏde¢gw ¨×cn· ¸³U÷ È—ÖHâ¦ÌÄÊ2q×Ó*”Z‰Û -ü‹xÌm8aÞ}â[Tpˆ˜3S¤Ff ‡è¾­9z2»“lÞûç_O?ÿˆÉ÷ü×^VvÊêF€PR;ÄW&£»=¢oæ[mÊÄL$EÂÀGò1w#5hqÙt##1ýÑ¿óöÃÊrN¦#7ÖEöh˜©¥~0Q)ÝaQŒõ¡9³›|wž›&GDùÜ>hÙÖî*^o÷•dëÝyÞËVÛº5SÒR-`ki‚v@ÂYÞ -‹ND1il6Äúʈו[%þÕ‡`±bÞ[n—Ì|Ä!„nüùÃ÷§Ÿÿîë¯óÛÿƒŸ>¼ž¾ù…RÎüò+¿ö#xè‚¿°ß¼t¹qËß]èríñ ™Î,-•4˜4{¹a.¯–‚Tך”z]ê{]—MuQ9f±…®%]){)÷f;;ÆëÒËÊÁgkÛPb ÙvûË¿œ?|}úõ‡5HJD~®Žeù\}8ayN‰GºÕú;»s–néÊ—;aÉàüåí—!Ew€8%ój70u0ϳ -+½#$õc‘Îݽûnd³Œ(ú«èw)–Q õŒË^Gʱ²ta]_óÛå¯öÍy3),™ Uבz,ÏÓ!õz\w ãøçhj=<¢ˆqš˜~DúÈy‹È†Àa$T¤|É×7´ÿH]{ˆ4=¾óô0 B‰pk¦?˜çÙinÄ„;³î8ë·^Ë[Yã.;äQo}ÉðÝ ¿ü!ØÞ¿R>˜çé|#V}ï åd³m‹)_X¬÷>3> ÂwÐÛãPzèÂ9,Õn­Éæy:ôÞˆ]oŽÿ÷CøCè=£æZƨDðIÓ…¡M¢½;h|`×ñ`ž§CãøtŒö‡µþØKeM]; áÇëeV_-ûãÂel_ƒd?Ž•‘kÕý{ó<ríõ8öÓb¬¡qnƒBý>üú)ñöÕýƒÑOcšœkØk=˜çé{,~m;IQöèˆðŠ.ؾ'í®sŠäÖˆ(;ò´Gû:ïâ—(áÑü/lDŒ;I,oÛñ’æÑN˜—†²Ý CäèçM„´ƒÔîuÌótH½«~bÇêEË8ñ¯s”Ú—9?Ý'9­Õ7”CéÍ»Vœ8Ìcžk{¨--ŸvÚFmú¼+ÄÄ>ÏÌótˆ½ÏÞØ}¾8ïÓ#™§]-ÞŒZd4»b܃yž ÍîzŒû©«)~§sä¬#wmW³°ë=\îñSï¹óß*§{öçgèïŠãM<Òùü#y}ì³Ìót軧þ'òÜ=;UWйY)]X;÷Ò>ßÞÃ’yLzpÅu0ÏÓ!ùÓö\’H~½ÆémÐs9›8|ôÏ?úlyÆÀ±Ñ0Ž¢¾âÛA/‹OÞ±=˜çéÐ{ãÙб·†U‹ô$ʸҩ{Ÿ #Gñ§B8‡U´™2ïEü-Ûï|âF´iî[6Rº{ÎKF©โƒyž ¥þÆs{ˆ«;<ÕÓ/ !ã^ꀤŠÖ‚L§6O~é=ÜŸòÏbTå&£A–îRåy:¤^kÿ{ç`'`å5[ýÚGb{âºÌ½{ŠMn¸Ý;h}äûF?Í=X=vm=÷ºFÉêYM­ÖûªuÜÙeo=3D#jé¹úÕSƒi®<»:îÕ¸îuƒŽ5eïwgo¡Ž,U¿spLj3Œ¶bsdíä‘Ðpÿ¬Ù¿ó-ÿÀžìÁ%íÐК®ÝkaŸÙS¦yzµ õäå9­'z©-œ¯7ò¤vv…¨··åÎû Ü“½ÜR‡Ÿ=ÞYaÎ×ì­i/,γLoÖé¸=Üþ’®ôÅ!ç[îüoŸªò-ig2;T÷]ñ Ùp™Q ÃReXÕã²¥óo—ºìâ;_üIËÓßnË –‡¢H·å”¶W?‡â›+v$m÷ìP½-îÂÚG}bæQ,ØFÑåLÈBÙ36{™k¬uœ‘Ÿ‰aÌ¥öïb“¯L2®m%{\ìiKûlÛóò7Èí(X«i^ÞMÇå÷¯–þñÌ&ÍÒ-}Xw wünGß4 ifsÅC¬enë×5_/²¯ôrש¤Us;•]û`ì‡fS`m«~×Ýï5}³¿ŽßÔû¹–Ûò3œùzO$]õ™ßøl°·óç&‰—Öœä9/Uÿ$¡Í†}jÅ7#ž½é>)ë8ʬo«tÏKØ}©G n¶ÞÙrÖ%û÷€çéÄg¸.D¹·rS¿ó¬y?Ï»d0Ê’C°MŸ—^¸ZÇFËœDgËzðNçö°= VÁšÝ À¶œžéŒâ¡Ò2²;éýq9ò/zdôôº:´/³ÓÝLrƒØªw¶§ËõpîÜÚ(’ÞõaÆ.éxLÉ}äóÝìÆŸ…å»a™ï2[›,jØÜVâ®Oø9Ž©@(î¯söëLVå)ôò® l~fófyb}‰7xLÒʯs;³g5·çåIÊÒ†M7þp -å˜W]ŽúV!MÚл@ÎÁM´‘󙎖MÊ:]»MGëóNÎò•Zªå¥*ŠÎY§3vK·ò‹%ý¥Ã¿Ç’ÆM¡.bÊ TcäùQüv¢`8Aì\_ Ý“pù¨ZYN·…U•]0uÇ))1=ªåc_}Ñœ©þ¯­¡ü¾f£ƒIª‰l9šs®X"gÐ[1µ^MzÓKDÒd—«ÐL¡ù§ {Ž§íöŒ7ÅÚ*&ô[¡bÕu±qÕM‡N7×….l¦s×iÖý5­‰¬;¯ /'TkGé›(¥WÔ¢ªwj2ËŒÊMêkÊÖ!®õ“ ºœáWªíЙMÏz€ž…©ɵt¹¦D—“˜n)Í·žŠ-UêYsõ|7¥CݦæxAva;‘ÞŠÄƈ²õãZL‹íÖ×*1ܘðrò®Ä.~;ù(¤ö+”¯ÐãBËÊmâ¤:^º”Îú›?ahVŸKÿÏTá›”˜§|ЮAŠŽÀîW½›M¼v—‡Æ:Nò€v±§eîÒ16Ìr餄ôDº-uóØJÊ\Æä1Wóˆ¤y¬Åº¡®‰‰ÂªWr¡ªF º.ö Êo+q·Ó·¡êU«,hwßÊíâиó‹cëqMç™7{[¹ óUx)›ÅýT+éb£Úl×+cÂnH¡‹;¾q­Ê¡SËÇ>Ȥ÷rúÛ©LsÆzC‹Ë€ >®ÏÕçÿGš¯ñû÷“;ÿ¾ž=ÏãF5¶0[Wb>“ÑËœÒA1½Ü© -Û°aBãíw±N=­¯hhó¸1Œ¯]Ï®:±×”º1¨nZ.ô݇Llt¶Ì3þŠð2x±2ŸÚ7}ž/mm-–é$ñj.xsp™ºÎö)ùÌŠÄ%íS:´Î°Œ¸à…â’U˜»e+3 ¼’æz²ßñ®°T»`a]Ú®s}šåEWYiK‚Øò ^°Ó¼Ò¼²G0úááõÉý¾˜ê i£ö&}ãÒÖ0’6“¥¶\†õe›slYgÖÁÛ=ÔʲlìÙäô¡ÑC ·ºàeÒÔ³- <¯ÔUÙªÒ:Q4º€LUY+1V›Â’­º¥´8‰^Š-¦èÒ¿qO{Þ+͉ž÷Jؤ¥rëŒ×¢%Û Ïá{ëTOÙbÉ$ÈÏݤ®§´U¶­Û­ë®³í™5ÃuCBLUÏæ7)â¿GÆÎœgØ…RÕŸ²3¢Sƒ&j§£5¶¼S¥À!ŽÞk]b[%wç¹¾w²Ý!©{'¼&tÇä¬UQÓëMeÞNqžÃ®+XQõÕ§r¶¬Ä&Ýçak¨ÓœÚì •÷Û•'ÊQ»Œ´T¤×YZ -z½…+*-ߢNå–4ß>)?ÿDé÷¸ -endstream -endobj -585 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 584 0 R -/Resources 4 0 R -/Annots [ 586 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -586 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 142.623057 101.433071 123.873057 ] -/BS << -/W 0 ->> -/Dest (cb74-1) ->> -endobj -587 0 obj -<< -/Filter /FlateDecode -/Length 4741 ->> -stream -xœÝ]M¯äºqÝ÷¯èµ'óû0¼0àÀ~AŒÇÊÁáGèAñÇÊûÁDe8PA&˜À±€ -q0ÞkŽT´ƒqÑs< …„NIŽ´€-Ö8Ž ´„-=—ÕÁ ÇZÁ$à¸@kØ¢Œæ¸@ƒm ÐÂqÝ%Ç|k„th.Ìh0®Îp\ A¹€Rä¸@ƒs5¸“ã ÒEw÷h°®¶Nq\ A»ÚÇqïj#Ǽ«5r²:Øs\v´ šãÞÕRxŽ xÝHq\€V€CÇq°2¨Ç¼«‚0ð®òXÐ5Ǽ«,.¹Á»Ê -Åqï*£ÇÊþ¬7Þ…XÞ€- XŽ 0ÞC§4Ç8Ù à–p\`Á»2bøcú4Øj!:Ž ,xW4«‹ƒô¨q¦ß¢–é\ä¸À‚w1PiŽ ,xô8.ÇQǼ+5FjNÞ•* -Ž ,x~ƒå¸p$Ž 0¾ Rº¬."†Àqï‚–Ç…À$¬Î’ä¸d<ø¡8ð.†÷Èqï -«5Ǽ+ ÜV[tPÀ¯Ý–éÓpV¡Àœ¼+$Z˜Ów…ð‘ãÞ¥a“ãçI Ç0p€¬8.pÁ Ñ{Çq‹:¸|¬Î 8¶xe±:Øb¼á¸Žõu x[´Rx[à2p\`ˆÞ7;=€-€ ;?0°ž"Ç`²!Dc8.ðÖa>†ZåtN Áƒ®Y]€NzŽ ¼7†bÉqæRC@§ç¸?»ÄqÌ€NŽ |„-è*`(‚‚gÎé$l“Íq<]è¤ä¸ (Øoã‚ f™Np\€sIT5§3‚æ™ã‚`Ü@®"Çè&˜i‚)YlMp\€ö¡É¶å¸“L61Íau°E[ÃqAŠ¦›ã‚`‹Šã`“曞ã‚(` <>Ž ¢p¹É€Æ¡‚ã‚(æ›Êp\€~IóÍÀqAÔóMLñ˜~µ£ù¦ç¸ Øbᢰ:ا)2ýœ„ù&؉Ó9Ø¢¢á¸ :GóÍÀqÜ Ì7áѳ!@óMφ À»6‚™8xž©ã¸˜o³åæöÄk=ü3^hÆ؈õZŒ­lÈ@€{1Zy6f @¾4Gbƒ03Ëàب†U(¥`Ãü ̬8aŠ>Õ!*8xŒ™ÁÓEFt ï>Ï9J2½‘lŠýíÏ—_Æà{ýóß/¯¿#eéOÂASøWè*¢¹-¼o‰Ë×ÌÑ2vOZ*ÔÇb” ÎA62 -Ãý»®,,…¡?-‹•¸æu¹sÖÖÞLïl´NåÃíAW¢â ÊëKE̱ÇfeòYÞÑ`\‡4:*¢Pô 8¿Â,ÿîÓ½i¶b -ÔæC©m2Ļ͟~¾üú?þø/ø`ýÓëå¿ž%®õó‡†? æöÛ$tÖMߣì3ŽítlÂümæt~)Oé(_Ö½Té夓zúÖ²´ÓorHMŸT~.o>¶M9I?æѳN-Ó$;èü[×Hvå|¾’k¾¼Ö¾1?åûŸë§/¿ÿT:<5•›ÛÈ6mÜ?Ã4Qa|qQëüþOÿþ¯ÿù§Ò:T+&ÐYéªÉ‚©’²¦Ú‹T³ø¼Ni`ÍX~U ø Ìfá15ŽøòÛdïöðÙî-ècV$ÖÞí*yžé+ߢ‹Pðx§d ©æ»ÂNLµæo3÷'»¡³ûòs“æËü=Ë•*}eü|™¿c•öeÆô×eÿ0LÿÈ}pÆtÛÚ>l#߯SÍçKeúæ¼>•½2Ì53bD'ÊúòœeÅl¸Ù;(3¯Kt™™ ­hØö¥j­TË_J+`F4U ›[+,[%1ªñB¾6H¸áw,e%;å©ísºdf´Iæ< ÛÒùÒï\¯ýeuZ1½ñ­~©QÝÔ¾!ß½²dIŸ{ƒX–UмÂâû«É:!f…}yN‡Â>1·Œ©°ÅY/ëyÕR[îc‘Õ¶dÍ¥w”—Ê]Ñ—)ÿ43Yž¿õ‹ëòtضuÁ“©înÕuøªöéDÃÆûÈëËs:äømKúeM¯ÐWµìj$ÛøÍyÿ¹f¶°ândÆî×}Ψ¦ü™•\^Ë·ïµè­|D‰Ÿ"( -È/ÏÙЫüÊTƒ¯ËïÌ+Ÿ›–­f-{|W£å£æÈ‹XTë¼Ì>3ãÓfO£)µ<Ù3“Û²7å9œÕñˆÕÅwìFlgžÓ!vßß<øìœ÷žÙÛx7÷ôŠEz³ÏµÚÜ?‡ïÌs:äîû¨ÿlwãìDwBëaïÛ@³»Þß™çthÞ÷{WþèÁÎ1;=£Ž¥¦ÞbµĖóg’½¬m+yßysoÝâÖÊ'¥‡„ í£±/ÏÙÐhöýØ­û…5çRË<3ŸVá¸uwgjÉGnxrugal„l…þäe¼VH눬éž—xdšüÕÎ<§Cæ¿úΣö» ê®Øã{ø†gó~6P[ÅFieÏR•Î<§CíA<õYßðnëîU™F×òßZ[%qis9Šõ ÷Á•Ÿ{ç*^¼ÐîÝwæ9Bâ®÷ÚÕI+Kç¹Í³¢8ÝM\ñKj±„h3§oÏŸÑ»’ªYµ±¸Ôaó½hlWÔþn»‚k±Ö¡]yvÇÝRS|Ní¿ÓЂÛ}Ôöå9jíŸ*x´Ô#¡–ûiÄëä»*úÌ­¢Ü~+o¯ZóßÞ*˜Ì±í={·¾S±‹e=úÞÓÜsÇtÍì²íUGwH­¼Ÿ/;óœy÷é›ùíª¯3-»¸;ØŽ®íŠ”ꮡªçÃ[Ñò±÷D×Í’¾ÛˆÚ‚+ÿÒ‡AjãÝQÄ©3Ïé|?}§ìA×=qËÅý­:&à—6et|™P0~ž¸{š×ŸßOßšë<@YÛKŽÖŠÚ*vÙ;#êÌs:ôõù›G÷Ú 7KÙXµÿ°?VùŠßÏ=Ó“7PZ|E8BC D­FéÌs6”ºÿò<¿1"Œyf%ûy~‰‚µ®Zºá²: -~´ZÃÉû×uæ9]ëvúp¡©Õ¾:Î&pmŠf ®Œ,ɦƒ"ÝËtÌé(Oša$½&ïü6Ÿ÷¥ÊgJþº¬ü”EöóTMòyÝlKâÊ&ä3ž÷¸_õÝæ^|õå9¾<¬GÛ¸j«»ÚØM¸ Vy·6Ǝö8=-”Ï3?17Úv›1=Îx7ëÕ‘yN‡¨ƒ»Äá±–¥øÆ÷Ì>ÏÙ¿ªxÿL°3ÏÙPåV-þƒyçîÖ}7¾™{Ô?ìˆzuæ9Rî¾VqÅoæo¬Ðn×EõÄe¹'K8¯®¾—”g\UL!­ºÉÏ}·¶uÄ…ïºs’⵬mõæþÕØyN‡Öÿëçðß ÷®-è‰ÌݱºgŒO´é>‹õúˆöžÙ"’¶Ô*²Õû¼UgžÓ!õ öpœQ<¾šä#oß_Ôl‘¬ìÌs6D†¾'YžZ|Ï…ìÌÓßÿ,D÷:óœÁ¾ê;­§ú]ïü Õ¦M]>ãY¾ÞêNkïóyN‡Þßõ;~Êï]z͇®ZÜ@ãqÇÎ<§C㺱zõÔ‡-\“g þ‘kSÛUÜã;á¤X­—ú~8v¹<‘Ý™çlÈ}wp~æô£Ú¬'ãÖ…½¿>ãoïÆÚzjÓpn| ÖÚ™çtÈíó_ï}£ÄE7 UÜ“¢ë‹õó5kFLj<Åh_Åê®»ó׫rÚHR•·]φ·^Äîswæ9R|Õêͪ+~«ÞVöÑoìQví=—ÕæÙ‹¡Þóž.º¦o;CÜ@ìþlgžÓ!ö¹Õ‡çóóž÷dN;[|ðÝñ·3ÏÙÐŒÚÚ%àg§Sû/‡·mÃðÞ«(ÓM÷ú“äó+ƒÇ¥‘é•Âéºz–D~³®œá÷Óüª{oÑR–¶ù£÷ÀÇêÍùs‡I ¶~Ï~zü•þZ •eã”´Ç¥W$EOÛBl½—[}<¸ñ-ÍnöÌæÕ¨é¹=)E~¨Jïòï¦Oã¹™EŒïõ6_K³ïõvSzz¯75Á8&SZ7}ÆsÍ¿Çó„Ä sy4~S~º÷é'ýâüv.»²ÇÌïÏ×`Ó5¬šñ—‹·7‘ãWÂ…A*ÚóêÌ@KN|¼Ò–*Ah#S³É±¢åu#ç¸sè/9Õ¼™¨ ýÅho™i§Ñê`NÿËØà?_d4Õ?õþiã?1Š1˜ÙVüv¡ #6fPbÎ?E>—‘)a–Ý.´ëAlSj;ˆùgÌ'§—’O?•MWCùmÊFr‘éqKŠ©`FˆœN®Åtõb³˜6Ï ƒž\6źd3„儦N[NX2Š¥•Ð®…¢*®ˆ•IöHÚl)W+Âlz]u²jþ”Vùª9÷„· ŠÕ­ô•Ò–}éT©v•È2]³Ô¦”¹ALn'Ft»0ÂD:µAcf}Õj´ñÑ$ H&§‹)#º]ØtóÙln)ŸS…’5¦š/¦¨ë+ž‘u4K=í\õ¡ÓÏ¥ØQ ¤¶¡ÂZ okrO,â·‹õLj[¸BؽZ¨«ófq/EJ+§_èšIFÛÆÐÿUØ,%æÐÎ -2 >*…PßÌâe%Õr—YÇp5 /i«ê’ÞgÌÖõ%ƒ`ÒéæÔ¹ÆÒªÊ*¹É<"©LK±Ì¨Ëb¢°T?™+k¡HF ¸"¶Êo q±Óæ® -°§Âœ¬ànóy‹Øeî|«Å>·¸¤}¼²½ù¼æ“ð6l¦ôC*¤ˆ•È£])¬Ã@ -E\hôm§ÞšÙ‰ö&N?K'ãFÜÛå/—q˜SÚªˆNKÚ–²öºäõÿæG|þ÷b®ÿ–öAšÆq%2[¨Ì­ q=’Ñ&Æ¡SL›'aî6•P™Šö‹X†’Ö&4äq\©Š¯MÉ. -±§”23¨ÌÚZhKVb•¡«¤®jÆîoM-fGæÙ¶)öt¨ÓÅ¡M;h%«pP_CÑé2$_«S−–!]Ò«Œ8¨OŠÃªÀX,[˜I€¬ ÉUOö›º)4•UTnê¢3e˜­OdãUTIàëú >±‘u¡qacôÃÝëévŸMv©4S{–¾ÕÒ|a$Í„ÇKõxè–‡yÌÑW:H·ÔP>—®úžÎNNéŵ0‹ƒ£•4”ls[j’lQh(2]@&’,ŸÑ'›Üœ-UËxÅ­%Ÿ}Š"ýK]Ó¶n•\‰¶n·JKçM#^ö–tv€l g_®N””Ù— ŒÌÕ¹³Ô””:ÉÖe›eÙi´½V—aŠ!®x¦¢d³«”ñß#}gÊÓD!¸TéoŒŒÈPvÄ@m¤×J_#¹;Á9pˆ¡ý|½ U¨äî<û±“u„$ÅNê’ЃÑZx ¼m˜ðE> -endobj -589 0 obj -<< -/Filter /FlateDecode -/Length 4902 ->> -stream -xœå]]äºq}ï_ÑÏ®ÌïÀðCÎ bÄÈ"y0ü°Ó»c#˜kà:ùû9E‰d‰*©Õ³s g³ÓªâG±xxX¤(µ¾*üü ñ_rzJ)Çà®·Ÿ.?_Խ¿’buQÔÄoôW­\œ¼Î!ùëO$°qŠÙ›®oü7\òäo—ÿúÕåoë<új¦œƒÑþú÷¯¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS€Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbà,èlº’¨ƒ-*(-é²|NΉº J1muFùÉ'k•¤ÓzòÀ¦uQè¤-Aù,ê`‹·ÊH: [~$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØßÿrùõgL¾×¿üÏåõWe§¬þh%µC|…a`2ºÛ#úÖh¾ X›b,{(1Us7Kƒ—m62 ý»n?¬l…©d,rc%hõO©Z*÷”Ò–ÁXš%»­ç¹krDL¯íƒ–me>bõ2' ¶>œçÃm ˜Ä°hFˆ¹®W4ò^âí|V/­ˆ7õÒÞ‚ ;ÆžÌôÁFÛÖ£™:¡t(e˜ùˆOÒ-MýÌä³| Á - xD„il64ƒ‚±öQn•øŸ>]@¦‹ó>}»dæ#¦Ó˜¿~úéòëùñÇþýŸ^/úRîëoÐøëÓü×ùåïrí—k¯™,iÂü—vžëçú×½vݽºPØxIcÝm(o´+oeZeT½šÿb)Uê¢ß֖ס-ªç¯å6[2³3 -mø:Ô{[ä¹—Që«iŒZ|4ú¸ùö·¾~úñò»Okp–UÕNÂË4³âù\–oÁó/ãœÿßÁxJÀ»Ù oØç[Oßä£xþÑg/3d -ãªv)+C—îHU ÒM&¥Ëâò»'ó<xµ9$áMoUdÅ=‘õÌëº÷Üç5im꥓̊À*ÚÌN™"þžíæÚ¹Œ÷…T†nqÜ­k¥Ö=ŽÒsyž¥î˜c÷§Ľ0„Tn¨œ0 ©¢µ i;LÏG|yÊÐØt#JRGË -m¿ÈÔýÑóÓRY ªÜd´KÎÝCê¹™çé|ãZa=Ûøç©{váÙ‘ÿG.¬e \jKc†ö9V‡êbTц8Ô=ðùÑh,uÚmÞÓȘ~ÇNïÉû¡ÙXÛªßu÷{MßìC¿íôsmCÁ:ÙñùÐgqã3Î$µ]im«îîˆJ¤Çð+bN<™çIPƳê#”=rDåh+G¤ìóp|{G¸Qÿ\GHúçw’`G -Ç­á]¤zó8RÏåy:¤†C>üÖ£ï>¢2ôöxèsƒ~õ¶¶¯Ø1ÞZnð¯FÒÒ¾Âë]Ûá³Yò䑧{;Z»olõvp£a™±ñ!=™î ÷y.ÏÓ!3rèxê½y#ë%ÒMsž÷óòÝG K÷ô›c9,.žÑ¼sš¿Ç~´‡;bŽóŸËól(LçâEqµ±ÇY/lÇe¸ /!uä>Y;¬ -Ò¨ouxëeοº±8Æž+±ißÖO -»[îN ™x}ݯÇñœ3CýõØö¸åý‹Úô²Q›)«dîîðœÌótè½WŽ‡—†‘ÿ<ô,?†|Àw-ßó¨ÝhäEõÃùãÕÛP?úèJnÏÞšçîªn±=v<Øsyž±ÇñæÓĀߺæ}dõö¢›GFÅ*½;æÚ¬_ßÌólÈÍÇ1ê?ڎ·qö÷DwEëÝÑ·ƒfóøºÿdž§CóqÜ»‰GïDÒì¼zB~gdðÝ¡ÚÃ4ZÆcÂ#b¾;VÙËֶΑ•Û­ÞA#‹IÏ>lz2ÏÓ¡ñ8ŽÝ ‹¤h({ù¶õt»/}л‡+µw=§Ä² ú‡Ã­gwÖê!Ò~ÏD~G¼z2ÏÓ!óN¼úÁ³ö‡ ê¡½Çˆ Ÿ-úÙ{ÅÛ¥—–Ãkwß1q.Ó³áV«;[ªß>r}Àíª÷>Ç?-ÃóRÒûÞ€HõožØÞýãòÖ·èÑ›žÞxO¯oËì%r ˜w“Üa=>³})ÖU/"[Ÿ°A‘ôu6] Ð.·~÷|ù:Ϧå´E˜SÓc/åPVýÁ厞©grÊý–9†jG€I÷µ»»œÏYŽ÷–ã³y™½Û±sÕOŽÅ÷«vØ”Ãÿj>‚ËŽ·òë±^fÏê2Õék6Ýøó%”7}êò¶gÒ¤ }Ä5¸‰ž²ŠùJoMÊ:]»MGëëNÎò%?·TË÷j(zÕ6½fµt+¿XÒÿ\:ü§‹În"ÿ—g Ê;ðU'S/ºøíBßà±sý…;b.U+ 3Èn`Ú8å1%½goùØ’ ÃEóGãkk(¿¯ÙèÝ”NÕD¶¼q®X"gÐ[1µ^MzÓ÷H¤É.W¡™BÇc›°èxÚ^`ÏxW¬­bB¿*V]WíÑôÞáæºÐ…Ítî:ͺ¿¦ÅjÖœÞ.¨ÖŽÒ7QJo¯¯EUïÕd–•›Ô×”­C\ë'At»ÂT-Ú¡3›žõ½x¦ -$×ÒåšNÝ.bº¥4ßz*¶T©gÍÕóÝ”uz~e_vcEúb6F”­×bz>¦õµJ 7f#¼]¼k#±‹ß.> -©}ç -å+ô¸Ð²r›8©Ž—.©º -C³Êè ªôÿL¾I‰yÊí¤è-ÈýªWBc³‰×NâòÐXÇIÐ.ö´Ì]:ƆYî/”žH·¥n[I™Ë˜<æj‘T#µX7Ô51QXõOãJ.TÕTמAùm%îvú6T½j•Íàî[¹]w¾qql=®é•ÖÍÞV.Ã|ÞÊÄæF1A?ÕJºØ¨6Ûõʘ°RèâN£oE\Gkc§ò>—åcdÒŒ{»üõR¦9c½¡g_‚Õô <êÒ×ÿEšñûßwý·úJày7ª±…iܺ󙌾Ï'Ó÷ûTa6Lh£ý.Ö©§õ m7†ñµëÙU'öšR7ÕMË…¾û‰Mƒ®Ñ–yÆoƒ[ ó­}Ó'ìùÒÖÆѳ<ô2éj.xsp™ºÎö)ùÊŠÄ%íS:´Î°Œ¸à…â’U˜»e+3 ¼’æz²ßñ®°T»`a]Ú®s}šåEWYiK‚Øò ^°Ó¼Ò¼²G0úÝÃë›û}19Ô@ÒFíMúÆ¥­a$m„'Km¹ ëË6çØòL¼ÝC­,ËÆžmAN=´p« ŽQ&M=Û’ÀóJ]•­*­E£ ÈT•µcµ),Ùª[J‹“è¥ØbŠ.ý+÷´ç½Òœèy¯„MZ*·Îx-Z²-òα·Nõ”-–L‚,ðÜMêzJ[eۺݺî:Û^Y3\7$ôÈTõl~“ò]ü÷ž±3çv!¤Tõ§ìŒèÔ_¢‰Úéh-ß‹¨RàG_m]b[%ç9Þ;ÙîÔ½^ºcrÖª¨é.eÞ È÷¬¨úí—r¶¬Ä&=æak¨ÓœÚì •¯8+û˜eƒ¨]Ò“$†¾ÑÐRЛ苘¢Òòû#è)ò¸Ú>)?ÿ.4‹T -endstream -endobj -590 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 589 0 R -/Resources 4 0 R -/Annots [ 591 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -591 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 438.873057 101.433071 420.123057 ] -/BS << -/W 0 ->> -/Dest (cb77-1) ->> -endobj -592 0 obj -<< -/Filter /FlateDecode -/Length 4876 ->> -stream -xœí]Mä8r½ç¯Èó£å÷°Øƒ5ì1¼ðÀ û`øЕӵ £ÆÀ¬þû~A‰dˆJ)³ª{³îBu¥"øb<>CJIŸ~~Ðø/9=¥”cpçË/§_OjŠ^á_)±:(êŸðýY+'¯sHþü lœbö&†óÛ ÿ ‡¼øÛéßsúïu}6SÎÁhþËR9;Å£ò‚*C¥´TÞO1UÐN1gI3|tÆ]«"Ìp9yI3œ1IP%˜a]ÔöZ•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚOƒ$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ƒÑÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓµÎ(?ùd­’tZOØ´¢3 -N -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ³ÕÐì¶ÊjIça‹1щ:ØçK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0sEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ]L÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö¢¦¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒÄðê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãq -ÒÊ Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\€õ:c%.@c“AX"qïêŒåO˜Ó`«I§$.ðà]à>Q—'1â¼Å(O:„,qïb¡²xð.è3I\ŽŸ°¢‰ `?†Q•tÁL)‚®E]‚NG‰ bt–b-qöRS¤—¸?Q¸$qÌ€N;‰ b†-˜*`)š’Ad.é4lA-q"]è´–¸ Ø‚hPâ‚dv™AI\€{I µ¤sŠö™Iâ‚äÂD¡¢Ä˜&Øi‚)ElMH\ÿÐfÛK\€Í6›Øæˆ:Øb½“¸ %CÛÍ$qAJ°Å(#q°IûÍ(qAV°ŸÄY…‰Âd‰ @ãÐ)%qAÖ ûMã$.À¼¤ýf’¸ […ý&¶x¼Í6Ð~3J\lñQDlAД…y NÂ~ì$él1ÙI\C ýf’¸aö›ˆèÅ”@¢ýfÓà]ŸÁL’¼‹È4H\€ì7ÙJ{{âõñ™¬L´ãLbÆ@z=ÖV1e À½X­¢˜3P _Ú#‰I˜‰e -bÖË*”Z‰iþE<æ®8aÎ>ñU"ÖÌé$3¦…Ctßö½˜Ý(6çÇþò§Óo?cñ=ÿéN¯¿)™²ú£ ”Òñ¦Ép·Gô­qú6€ -ÌDRd! |¤s7Rƒ—¤‰åþ¯?¬,‡á?•îmë>cŸ»Ç„Æ3y9aû:Z|g•4˜:ÁjPÆfCìÈ!®TnUøï>ÔÅŠ9Ú™ùX/±vÆŸ?ýrúí?þøãßÿÿFŸ^Oÿñ;¥\øý½YþÔæ.ó±ûŒy„½]—s¯ËßZ®¶s-¢‚'z„-Î/ú´èãrìæ¿T¦”Û_Êù°®ßú©íùµµ}²ã›Ë9Æu›µÚ7Â[…á)¿Õ~?ž× ËѶŸY½8èØøkõûÿ<úñô‡Ok –è´Ña3ÎwDÂ7±{¬Ê{°û5 ‹­î Èz%C¥º‰\iõí2ê•2n(K¿‹KL¸íb7ºl9.e_‡þ>Ïòjkk륦2Üf¬qJÛµ Â~hŸOÑÖe -/Ó¶”sërã”êýÉ°£¬ü½œy°Î³;£›È kÏ_MtÁ³£¾zàË@Žº£¬xo$—Z¯"oDì^yÅdî’8*Ív»E÷e˜%#á{vnc;õ˜µ×Æ8¬m:Ò×&‚m§A„¡8Œ!ì!øX§C°»É£÷uåI;xD KÞtÜÒ¼ŸY`Ha³*®mjèøyFAù}µÅï®Ê/붌^Úñ ßO_†óÜAÙ8Kú:°¾@:JB˜¤ßCß±:O‡¾cÁ憕uÅIbGîx8câ÷Çsï™É(í¡"¡)¢ôJÕy:”îÄ—G·ÌãVcDvAm‰âò;¬Ü )CŒ¶òôÀe„î}[Þ5<£x2»Þ=XçÙ¼kÆpiÕ¹Zv87C;†ÐW“æƒ!ÝË|,é¨NÝaT½¥èü²´ûÂê¹^Ÿ÷U6É´bñ²Ÿç>hÃÐÚ ‹-•¨Nš‘Wv<q2¾z´t_Çê<¾v"¬G}Ì|u—ÃŒ b•óñ‘óìËùXÖ>[³ØvY0]v¼Œå`¬cužQ·£&BÅ#ž¥üÆ÷Ì>ï³UéþàÁ:O‡ªÛQÎ_›wîöî‡ñÍ2£vâaû@Öë`gCŠ½1ñ¼âW‹‡¼gÛÑÕX÷²½Ûó²«lÚ¸ãdQçå¾°s¬v~î²GóÂw]6©ùÚ›Ù¸ ´²XJ›)«dè‚ém´«óth݉¿¾áþ«!A÷Ï­µ®wwfn¸’Ðf0C]¨¹«rŸY¹1»¼Ê2[ÞLÊ»@¨ºÔcuž©;Ù°‡óŒÌÃ#Š§‰å?0óöýeÍ6Ùã;O_$A(vWúcuž‘;1áƪ{OVÿ®+ -ßrŒ×ھ˼¯Œ`÷@vï`gC°Û‰U?Áh¹Ù[×íi…m±Þ øXÌø,ß@/»Ò2|Ž­ÚÞžü`§CïNìzäºÏ!ü›!ôžYsëƨD“¦ojíÝ@ãyǃuž;ñéíWN/•=uE쀄¿ž—Yì–ÆÂeÃýRßÇn 7ÝŸ8Xçé{ì -î£×Ö¿9B‡ûɤûÂ>‚_ßoßÌŒã4–Ùá\ÿ@®õ`gC®?¿¶LR”GtDø -E ,ïIÙuŽ@‘ƒ†{FKFžr´¯sß¿¼£>¿+gÌ$±º-ã%­!ãx8a]Úæ÷K\óÁû(ü×¹Öy:¤îĪŸ…رŽ¢eœxǨ¯î¹x™ëÓu¢‘ÓZ½`æ€]+NÖˆ±Î­j+Ë×…s£súº;Ä Ä>Ϭótˆ}ß݇Ïç½?’yÚÝânÔ²æb܃užÍ·cÜ÷î¦nÝ=}äªíjvÝÃ[ßjYýV9]³ÿ<ß{@ï¾#ò«Íd}á<ëÁ:φ¾°§þ-òÜ=™ªè¼Ú)]XŸ·îbÿ*¹‡ $ó˜ôàŽë`§Còûr®ß%’?"WÀ89µì.Ç8|^³åƒcßLÜ@/‹O^±=Xçéлsoèè­a×r×wU+*FŽâw…p«h3mÞ‹ø=Ûï¼ãF´i™îg6Sº»Ïk¥ÜWp°ÎÓ¡t羂{¾½ó]Ùq/_éÔõ7§¿q÷{¾rYŒªÜTž°÷dƒuž ©ñà·ƒþÿÊ|‡!Ïíúõ‰ç×mn]S¼ç1ñìÁ:O‡ÖÛ±kóÜë%«{5µZçUë -¸‘eož¢µt_ýê®Á´.Wî]3B5®{]׿BÇ‚š’ûÝÈ-Ô™¥êwî˜qæÙVlŽì“=Xçé|;~½çIô†¤:ò<䥨®ïÊN²=·ÛÃQ(>V)^ÛJAËÕi«¯e˜àVËƵñ8¿.7¬'êuÉé.>Vçé|;ƵÂ~öêšÐSzv¸Æ¶Å…µ­K-»òzu]α>vžÈ$Ú0^ý¿+qc6–>íuÝÓÈÙz Ë{°Î³a:ü滳 ~ׯaÇ•Qw|Ýâ?·IÌ.1åÕwóoøyëZòÖwV¤«R4‡Ç•ÀQñ­ÕhŒg$L¯Çâ¡‚Õa¼Ä…Ÿ§Œ_vo¬¦‡©kŒó~Õy:üîävü®ÆùÆw°Ú.y+<6¿s ¶ýè'Í9†Ý6Æü -ûÆ¥œk«|{ (y€PÌíþŸ¬ ôŽ zÌnÐV›T<ñ‡?þË?ýÛYž’24´§k×ZØgßGÄ´‘fmC=ò\Ö ½Ô3œ¯äii>Ê4Âsùyd¯GÕÛÞvmSU™ŸËu†˜ûk¶/ö”>B¯ÛsÅ#eÄ qÖ|ˆiTUùþ3 ™/³<Íg«.Koaé&¬Ú÷ôTcKoµYÚ·Ëh{âç´ŒÖÏ×íK|¦×Š\·SκŽZ(#pËŽ”¶ìPý\Ü…°™ç§`½^&(gBÚžQ·FCGQG3q‡¹T/.6ùÊóçz®d‹½l9ê',¶çåoÏ£ §–yeH69sÝ93µøÇ3›4+·ø°æÿäq×ôPäõà4iftD¬^ЦZƒ¿ÓCöö5ººM—Öçšå]r¿¶RËëå½q†Þ60¿{Ž,å-ÿÔZ¯d_^¥Š8™zÐÅo'z˜ÄÎõcGLÂå£jm9Ý *» @ŒSKZ_ÕÍV)ëëGãëÙP}_«Ñ#Úª…lyHùܱ DÍ ¯ÅtöjÒ‹˜^§–&»…fŠÕf{ƒŽ—í öŠ»bmúk¡bÝu±qÕM¯ßhCº°™Î‡N3÷ײ&2wÞ^NèÖŽÒ7QJ/qªMÕÑ5ªÉ,3*7©¯%›C\ó“ ºœáª6íà̦g^£WaÌÂTäZ¹\Ë ¢ËI,·´æ›§b+•zÕ\G¾›Ò¡nSxAva‘\¤÷C²9¢lý¸S€Ò|%¸ãÆ\ /'ïÚLìâ·“Biß¹Bù -=.´¬Ý&Nªã¥KéÉGó'LÍ*£ Ðÿ3Uø&%æ)´k¢—ô£Þ ÍÍ&^—‡Æ:Níb/ˆKÇØ0ËÇK'%”'Òm¥Ûˆ­¤lȘ<æj‘T#µX7Ô51QXŸÆ•\¨ª讋}ƒòÛJÜíômªìµ³ Ü}k·‹CãÎ7.ŽÍãšÞìÒìmí2ÌWá¥,lnôSí¤‹j«]ïŒ »a ….î4úVÄu¶6v*ú\>öI&­¸—ÓŸOe™3Ö›ŒÁjzQºôùQæGüþ×Éÿ¹¾c^Çjla·®Ä|%£×Z¦ƒbzÍe¶iÄÆ1ÚïbzY_ÑÐÖqc_»^]ub¯%ucPÝ´\èû2±iÐ5Ú²‘ñ7„—a[ ó^ßô{>´õäÐ¥wªT«pÀO‡©ël_’ϬIQѾ¤Cë «ˆÞ(Y‡¹[¶2“É;iCOö;î -K}±FСí:×—YÞt••³`E[~ÀvšwšWöF?<½Þí÷ÅäPgIµ7é—¶#i#B­-ËæžmANŸ=´p«ŽQ&M½ÚRÀóN]•­:­ E£ ÈT•µcµ),Õê°”3Nâ(ÅStéŸùH{î•6ˆž{%\•¥vëŠ×¢%Û ÏáûÙ©^²Å’I^»I]/i«ìºo·î»®¶gv®zdªz5Uò!þ{dîÌu†,„Tªþ”̈Ný]RX¨ŽÖØòzp•B‡8zÃct‰¥Jî®s;wr!©¹ÞÜ19kUÔô¢wÙ„7(ò¾‚5U_/WËJ<¥û@H ušSW™¡ò¦ßrý¥$ˆÚa¤­"½ØÛRЛè}¤Qi9aOY¼´JŸ”ŸÿçØ -endstream -endobj -593 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 592 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -594 0 obj -<< -/Filter /FlateDecode -/Length 4808 ->> -stream -xœÝ]Kä8r¾ç¯Èó£å#øŒ9XÃà /<°†UÙ]»0j Ìúà¿ï/(ñ!)ôȬšv¶»P]©R ‘?F„””¾*üü ñ_$=Ę‚§ëí—˯5§ð/—˜dõŸðÜU+ -ƒÓÉGwý…6 !9üõý‚ÿ‡}ñ÷Ë¿ýîò_ó:új†”¼Ñîúׯ¬";„‚r‚*A¥´TÎ !ç•×.1%I3\ CkU€”¢“T0ƒŒ‰‚* KAÛµ*Á 4I*˜¡“ ‚J+Ø¡R¢†("kvƒG§{Igôàc2IÔèt0’ÎÚÁÒNKº4xï]”t[\RZÒ9Øâ4‘’t°…l ’ÎÃë­u°ÅÄ`%]€-½“]„-@Wu°Ey¥%]²ƒK‘HÔ%èT q­3Ê .Z«$Öƒ6­¨ÃŒÂ ù è lñÊ%Q[œUFÒYØBø‘tà gCŒÂl5<»­²ZÒ9ØbL Q[0ø[Tð` ÌK˜J†$0Ñ)J,`b(+Ñ€In Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!Ì\Q[l"‰ ¬-( qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ]L÷ qëZçÄ´k)z‰ ,x×’Vx×ZÔu°–¸ì8X­ÄÞµZ‰ ¼‹id$.À¨À¡—¸XLŒJâHâ%@Ô…sÐJ\@à]ãp ÒÊ Þ5N‰ ¼kÈx‰ ”ü£Do¼ -q²;[@°`½‡ÎX‰ p²ÁÀ-‘¸ÀwuÂò'Ìi°Õ cò8ð®Ž>Q—Ðã¼E/Úû$qïb¡²8ð.è3J\Ž°¢‰ xW[¬Ô’¼«MR8ð.ü'qà0h8`}´tE]TŠQâÞ-‰ ° -*‚ID]$-qÈxPðC%.ðà],ïIâÞUÎZ‰ Qç;‰ ‚‚À²Dl¡@À±’MQâ‚``‹5Fâ‚`` \‰ à IÃûÃظˆñÁxŠ€É†˜ˆ$.Î#C¯J:o†@×¢.B§ƒÄ!Ѐ¥XK\€Xjˆ˜ô€àv—$.€Ði’¸ $Ø‚©"q–¢!xæ’NÃ8ÙÀÓ…Nk‰ ¢-ð%.ˆ&"ÊôJâ¬Ðˆ%ÑÕ’ŽÇ™Qâ‚H~`WQâLDš`JQ[@`|8Øv øA°‰0GÔÁëHâ‚ ‡›Qâ‚a‹QFâ`“ãÍ qAR°ŸÄIùÝd‰ @ãÐ)%qAÒñ¦!‰ 0/9ÞŒ$«o"Äæm²žãÍ qA"Øâ࢈:ا) óœ„xì$éE净53¾È„iAðîkÌÑŠÙbc~쯾üþ‹ïõÏÿ}yû]Δ• ð[ò9°OûdÆ|5äó"L8Û† ¶>R‡©©A‹SÒÄRŒå6]ë=7³ÍÎL¾2šµ‹PAc¬¬m½»Î§Û - >ƒƒ÷6oW4ò¨ð¡u–ÿ]׌´ ¬u» LN›!Š=[é^úo¾€¹Ç¬±¿vØ}ð0&èÏ¿\~ÿ‡?þó?þë1Z?¿]þýo&¡R.â/Œ¢>ã/&¢7|F¬N/ã1Üñ±,—{eµ“¹é/׋S™8Ês¹0žKMå³ÌOíNm²œÜØ.׿k3ëÑÞ|œÆsÌê½Œå‹ U~íp]¹rœë‡ÿãúóOý˜ú~Ì]÷65ýµ5!ug–wÝÉ—¾ê77?›=Õ¯ÝÉãðÖ.;›>uqÖ¿¶ap¶u‰þ2–áêyhr6•sÜ.µaçãY=³×…üqч4µsû¥ Yn#vmH6ë¾íÝvá2ÌÛ5Òù¾ŒçøÃÏyzÛJ˜pÎÍÓ›sCpŒÃš‡ŒeÕS½u"Ù‰pEˆ^p½ƒM†½=,áˆÓ­hJ«c×ÔCm]µÎ&¼ŒÊ,ñ?ýôwÿ/%ò¸Ðo.ËãmðŽ×e3º›È|[ÊÚg§E£®¥L†ë5Ìð…Ä)¼E£yfožq®ã\« »¤w²ÎGÜ ß‚ûàõîqŸzé—ÎÅì ‹ºYø6ÉÌT¦.«Ó1ÍëdçeÂ×bÆŽÞÐ|†VÜ-gµžÎy‹Ñö°XqFœåZ/°89ƒ1[³Æ!!Ês1èEƒ{8´ÖL9ËÞ¥Cž¬ól8D7ïá°²µYü #'ÕnúË¿a<uüÙNº—E™/ÓßIn&7U—ß/ÓßÔ•-ú7[¡™—(óº!FDÙ¹:O‚²fvp{(Ûd-µ`­×n´J/i£”ƒjˆ™Vœ -ùù¨å2_H¸•Xo’¿Íõ%8Ù:wÖ ³¢M çY°mö|ýµoçÛÊ}ª»~KýR£¿©çê<R!ØEª€­¼RtjÍ»\s›£gÆ]‹Ñv d¬㺺·¹}ÙŽ‚Œ2³ô8ëÄ™4]_æußÛÅg3ÕI3O·ë¨×}ë|Œ%šVo ™¤+ò#D0À ód§C¦ÙåÐ¥§V{¯GÖJüº×gÜ÷ò„|÷ÈÒ­| jÞVCó -›ïGÎ Ê‘gÄì£ð\§Cá9±Ž uHØâ¬×.ÿBÇH]rŸˆ¬åHö\zG{¥ìŠ¾ŽõÇÈd~þ¥_Ü·g㶭3žr]tàCRïòã1ßBßGÞ¹:O‡¼r9’aÞÓ+ôu#»ZÉ6>KÞmGˆV¼#­ì±ûmߟ#³hâC£^Éo>k7ÐÛùˆÚ IEÃ7§÷Ñ{®Î³¡×ø•¥ßæ+¯¼,F¶‹Zöø®GË·Š‘û|ÓÊy|fÁ§­žÆ2§´äÉ3‘Ü–½¥ÎaT'#Ö5ßñ4bOÖy:Äîû›Oã~4æ½'zûÞÍ=³bVžö¹ÖÙûcø“už¹û>êÿ·ŒÎ§qö·DwAëáìÛ@³¿?î?Yçéмï÷®üÑBZ+bvfFŸ*#̳Å-üÕ%b¾9ÙëڶƑ÷·ÎÖ-ní|Rþ¥ÒùÁé}4ž«ólhôû~ìÖýžsÝëÇâéz—zgtw#µâ#/xruga–Tb†l…þâe¼uH;‘YËå>´.ÉÈôø«'ë<2üÕO^µ?Uwå?Ã7|6ïgµ]n”¿l’Ÿd;Bí¹:O‡Úƒ|êG}ûý­O¸WE Ý’ÿ¶ÐºôX -—.®³f±ô>¤öëì\å‹7úÀ½û“už¡yד÷ªg°X!—HÊÙ¡é_M¿”+ˆ&5"tç/Q\ÛY zùÔÆìþÑ ›ïEãòé‘Þß­}¹´íKWﻥ¾ùœ”Ü¿“øËGû¨=WçÙPüT%£¥_ ­Þ/Ãųïjøwã÷Gù¡g÷„§`*Ç.ïÙûõŠ­\¬è ô÷ž¦™›Ë-¢Ëå¬:ºCôý|y²ÎÓ!ïà>ý"¾]Íuadgw—«ëò‰”éãá­lù±÷d×iIßmFmÁâ -Oðï"ø\§CðAþô>åtÝ“·œÝßêsanSEÇ—ù÷wOëó§Ì·ÌÓ·Åu l9KŽž ]îòlDt²Îӡyt¯¤(eé;IYô{ü±ÎWüþxî#3y¥ÍW„#4DFÔÑÓ('ë<Jãy6êèïR.¢%²3Â8* -ª>‹9óóÂ-kÝô‚Ëú,øÑÓQßÿ¬ÑÉ:O7º'}¸¸èÕ¹š£ \›áˆÁ·•…3Ù1Ö½ŽÇ’Žë”£è-{ç·é¼¯]=jõû¶ê·,ú²/c0ÔóúÉ–Â \'ŽÈËÏg\‡Œ¯þnóY|«ótø:ð°ãn¬îc?â‚YåÓÆøÌu,ìX—o Õóðw¾ÌdÛmÂtŽx7ë§#OÖy:DÜ%Ž,ç7¾göù˜ý¨Š÷G‚'ë<ªÒÁS‹ÿǼs÷è~ßL3êÀNd½NÖy:¤Ü}íòŠ¿™o¼ñ„öò¹¨3yYé›%’W×ßKªW—S(OÝ8½aÛ‰¼ð]wNJ¾ög[“½ÿiì“už­þ×7Œá3$ÜûlÁ™ÌÜO÷äüIJ܋Z?±¼g6ˤm µËlý¾ÕÉ:O‡ÔƒlØÃyFõøÓ$Ÿ˜yûþ²fˆ|à À“už ‘ …3_eùÐãÈ÷ÜRø–S@øú÷w á?MÛQ‡Ñvü*Þ£1u»[VÜ9€iÙf½âU/¶qœïƒSò{hl¼ 1Þºuk¿óuŒòî!~ŠÊÆwÓó$¼[ù†º){Ìd/O¹þì©q3¼¯ jy¿™i³¸¼É]åyS7¯ÚFrÓçº/a†ÐÔïà4í?HÓ¾J³ó—= ;{f{¦)FÉ×°Æ_/>oA¬ó6ôÊ#Î4üžš«§C¡®¼íqT–t6;Z_7jæ·ûüZKñÿ)~ïÿœ‡µ?˜Êÿšü—‹N4pÿ3ƒŒ/çPYM9hâ÷ ¿œ…1Ñ`NŠY8}Tõ\¤KÁ*»ˆÃ–%­Ôô1Õ“óf9ãGÄ8¾Õw¥ïFª²yÛرaAˆš^¯Å|õjГ˜_p;ùj -oþV…í„Ô—m'lÅÚªNèÖBÕ5×ĆŠ=š7D¯]ç›°šÞw”5¡Î=áí‚fíRú.JùµåT¥wª2Û•ªÔ•’u@¨Ž“ º]᪜š0˜UßoN> -cÕr©”D·‹Xn:›«#j©Øª¦ÒóÍ”ukÇ ²ÜG“4ð»º9¢lù8{2Ö*v¸1+áíâ¨ÎÄ&~¿¸ ”v+”+Ðë…¶;oGÕðÒ¤œ‘?ajoíÌÿT᪔™'ÐT!ÅÛ³·£ÖÏÍ*žwR/÷•uHêM¡•íºK‡P1Û÷—ŽJ(Ϥ[K×›I».ëä!ó˜¤*yÌź¢®Š™ÂJÿT®ì…ªæšØU(¿ÏÄÍNW§ªSµ1¯;¸»zÞ&ö•;ß{q¨#®y¯ýjo=o‡ù"¼å…–b†~,4±QuµkuÂfH¡‰¾gq™­•øýaåc›dÒŠ{»üå’—9„†wvõVó«cz¯K_ÿe~Âï^èúOe¯òq7ª²…©Ü:÷+¿h,žóæEX§M'4ÔÑ~ëØʺ‚†ºŽÓñ5µêª{)©+ƒêªí…®õa'6ºFÛ®gÜŽð¶èÅêÈ|tlÚ‚=Úrq¼S-ïr_¬ÂA98ŒMgÛ’|íN‰#.Ú–thÉtqП‡]ƒ©Y63“Ù7R»ží§~(,·ÕtnÚ¦£¶Ìö§.²|]¸À¶?èOLºo4ÍìŒ~xz}xÜ'“}™,­Ô^¥ï½´^K+áÉR›ýü°®96oòZ&oë¡z.ÛÍ=[œ65škA³ƒ£4¶jS×7JE6k´,•. SEVÏŠM~ªVº%_q{)TŸ¢IÿÒ÷´ëG¥v¢ëGůÊòyËŠW½%[ ×Ã9´«S­dõ%£ ó}í*¥VÒÙºmš·]VÛkwÔ ñÍ3U­š[•|ˆÿ™;â ¤Rå'gFtlo÷ÀBM:Xcó [UôBüέ@±K•Ü]g?w²Î”ÜIߒ欜µ*h~õ®lÂ;éXѪ¼–W®–”xI÷u€j4·~ÝD~÷bÎsæQ= *ò«V-;½‘ß”üú‰ñVõ,}’þ½ux¬ -endstream -endobj -595 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 594 0 R -/Resources 4 0 R -/Annots [ 596 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -596 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb80-1) ->> -endobj -597 0 obj -<< -/Filter /FlateDecode -/Length 4869 ->> -stream -xœí]M$¹q½×¯¨³€Mñû0t0 CZÂäƒàÃtͶ£WÀJÿ}¿`&ÉHfdVvMïn­áiÔTe?‚ÁÇÇ 3‹¥¯ -ßhü—œžRÊ1¸ëíûË5E¯ð¯¤X]õñŠþª•‹“×9$ýž6N1{Ãõí‚ÿ†KžüíòŸ¿ºümG_Í”s0Ú_ÿþ©œbŠQyA•¡RÚ -*蓼*è MÌYRÁ q[U„.'/©`†3& ª3¬‹ÚnUf˜¨¤‚:û(¨´‚Ú(%ê`ˆrÎA§ýàô 錞BÊ&‹ºŽFÒY;…è´×’.O!Ÿ$ƒ->+-é‹:Øâ­2’·?Ižð6¦$ŒVC£Û*«%‡-ÆD'ê` :_b`‹ŠA¢Œ ‰xIâãä²q ˜d'—\’XÀ¤<¹­D&ûÉ…%°JCg´DVÁï‚ÄVÇ‘+ê`‹ÍNâk` H\`-l1ÎJ\`Á¶h‘¸À‚nÊZâ ¾uJ‰ ,f*‰ ,צà$.° \@)K\`Á¹Ü)qéb¸G‰ ,X×ú`$.° ]ëR¸À‚w­ÓJâÞµ9El€%.;NV'+qïZ­¢Ä¼‹ad$.@¯NÀa¸X™LJJâÞ5I9‰ x×DL¢.NƒVâÞ5Mfnð®ñÊH\àÀ»Æ™ q€2” €wA!^` VâÌ÷Ð+q -› ‰ I´4õ3“ß™å VXÀ#" Hc³¡´ˆµr«Äÿüé2]¬˜÷éÛ%31ÆähüõÓ÷—_ÿþÛoÿåwÿ~z½üùŸØï7ßh¼{;¿»Ûr–ë´\ûå=oe`9å¾Òß ×CÙU§æw,iJ^zÕ4­³¼¿,eQզ׵­­\$òñŽM$Ï,ïë:!{ ˳”Wë.º¥\¿¤q~ÇWZ(§^³òêg?´O›ßü×õÓ·—ß~Z²¬¤ - i˧ ŸËò5þ1 ›ó!tïtCéê‚÷OÏ÷ ™£6ԺþOš. mí•¡Hw•Þ˧'ó<±²?D〬öžä^"¢©ŸG$ü|½Ìê«e^ˆìÖÓ“ì—C°;ȵ=‚Ó¬’¡eÐ1rÏåy:äºCÝŸ~ÎqìOŽÐ¸N·A¡þ~½×öÙ+‡ù¢åæ—Mš{œËRBŠË´š>Fî¹°{2ÏÓ¡õ8vm=÷ºFIYƒ³»›«}Õ:îì²·ž¢µæ•!šÅ  ¹7µÝªqÝë:ÿ jÊÞïÎÞBYT– ïqæÑVlŽ¬<îŸ5ûƒŒ`÷ÀžìÉ<φ`w¿Žü5î(­v“CRõüÀ#õRdü9Þw¸ÆñGáQšq!³•‚–Í -i¯®e˜àVËüÚxœß—æõºƒdû~.>™çé|ãZa=»¹'ô”=;ÜcÛãÂZÖÀ¥–ÝyÝÜ—s¬=Ô?Ĩ¢ ãÝïÏFc©Ónó®˜FÆô»¼'ó<¦ïìòó1Íéů‘aÇ•Qïôu‹Gü\&1»Ä”cýGý¼w/y3vF[¸Ýy;ø!*>šÆxFÂtKóe¬þgÞN¿ìÑXM_Öðó=üžËótø½³·+àwå瑧YìÚžtÉ;Xá±é€©3±íc;Mjw/Å1ì¶10î¯,å”ýWq¬Íòí‹=Ô„b=Ñ.Ùw`¼stxˆ6©ôÄoÿðïÿú§?°}JÚ¡¡5]»×Â>‡Ù¦yy± ñäá9­'z©­›¯7ò4z™{˜¼;§Ÿ½ºõ¨¯y^æ÷9Ë,r?Ë:CÌúfÿbS©'ô^ï{¥GŠÇO¹8pÿy©¡Z]ZZîµ²šL÷\³šYR®íòò,ýrM–WïÖ–+Ú æs>³¡ylIO^V·¥…aiZàm -Š¾iélœ¥MvéeOsBZz†zé˶œ`é‹£t8ɶµ´knsi÷‘˜´wìP½-+P¯š™Ûèš œ Y({Fû…½Ý×ägâ+zznFÎb“¯¼Ôû¶ô™Y|¾¤-í§zÂb{^ރ܎‚‰šæ• SÑ:çwÖþñÌ&ÍÒ-}X÷wüîGß4 ifsÅC¬enëo#¼8ÙWz¹‡UÒ.#_ÙµÆ~h6Ö¶êwÝý¾b½î‹ê©ü™¡ýG?Íl¶ÇdçX¬Ïü‘„6ƹÌÎ1Ìg+nY·_æ˜c~)þ¬ãÎvP»ò¡ŸòÆOq©cÁ„þ"Í -û±?ãrdWÄšwm—‘êý"¯²#}ÃÚ–¯Ò!:§"º“yú¢ç†r¾ÙK'5x¡-ß褮—rz¹)iYÀ0wÂn…9L*Ó)C…•–ùf7QO½½[¢±yÂÌìTJô¯÷r»TÎ -A´ç^n¦ìÑgRnþ€n `í]™rPŸóÁîxè§zˆánë-gfÐùxžNŽ‚ëB”Ûy/7õ8Ášó¼K£,9„ ûØôyé…Ã:Æ^䤤=ÐÞ bÈÞógAÄ*°³{ÁÚ6¢Ø2u4TZFöéÑñœ Ñ){å ž÷nŸŸÌó$ËØÆ}èêCîcSî8’ö°°·4í£Km–‹Šo£ðÅÒ°­9‡ë¥#[~¼tÒ>ºâ°³!0/Óñë‚À$ ÏM9ûõPáú2 ± É[syž }t^Ìú6|›¼¥çÝò0¯[^q¾už=¬ñyHóEµ‡‚˨õõeyÏ,íËO=/}Ü#B$Õsò1Ì“yžeÝì PöžG„Ž¶Rùã@ã#A{Ùð¯øHJ<×#<ýóé>ú¿ƒÔhÞÔsyž©é¶CÆ/ªíÜ,¾­í;ýå:’–ö^ìÚŸÍ’'ïŒ<ÝÛÑÚ;®zt£g™¹ñáéÃCNæy6dj8ûpªþŠï'rˆ­îÅñ¼ŸŸð>Zº§ß<Å‚^¾Oþq9é,zô˜§SÞéȲÌNkØ»›äÔj(½=ꪇ÷ÖÑ6Š¤Ÿ8° "¬Á" -¸k›ïæU_‰¼Âò¥íeK Ônâ,£ÛÔø\Ï«Ãò˜R}Kñ»î¶«/Û ek9ÏrÓ¶çÙJ2(v3EµmÓòÕÞ4o—ñíÖV~ÝÆdö¬¶ó1–6lºñ‡K(§[êr± -iÒ†~áÜDw¼#•‰NÆ´N×nÓÅÑúº“³üpÄ-Õò[ŠŽ—¦£EK·ò‹%ý¥Ã¿¿èì&ò¹TÎ}WEœL½èâ· ûï±sýfÒ1 —ª•…5µd7iœò˜k -µ|ì7°h¡14¾¶†òûšÎctª&²åD¹bAˆœAoÅÔz5éEL¿&»\…f -m—5a/Ðñ´½Àžñ®X[Å„~+T¬º.6®Ú£é¬ÝæºÐ…Ítî:ͺ¿¦5‘uç‘ðvAµv”¾‰R:±½U½kT“YfTnR_S¶q­ŸÑí"¿Qµh‡ÎlzÖktîí,LH®¥Ë5 º]ÄtKi¾õTl©RÏš«ç»)êtŸo_vc7y#ý #ÊÖk1ÝGl}­ÃÙoïÚHìâ·‹Bjß¹Bù -=.´¬Ü&Nªã¥Kcª®ÂЬ2:5”þŸ©Â7)1Où ]ƒüÛ¯z%46›xí$.uœäíbOËÜ¥cl˜åþÒI é‰t[ê汕”¹ŒÉc®æI5òX‹uC]…Uÿ4®äBU@u]ì”ßVân§oCÕ«VYРÛÅ¡qçÇÖ㚎qnö¶ræ«ðV&67Š ú©VÒÅFµÙ®WÆ„Ý0Bw}+â:Z;•óM–}I3îíò×K™æŒõ†î…«éW xÔ¥¯ÿƒ4ßâõßwý·z î<ÕØÂ4n]‰ùLF¿a“NŠé7mª° &4ŽÑ~ëÔÓúŠ†6ÃøÚõìª{M©ƒê¦åBß}ÈĦA×hË<ã„·Á‹-ùÚ¾éö|ikãèÞ \­Âo.S×Ù>%_Y‘¸¢¤}J‡Ö–¼P\² -s·le&’WÒ\Oö;Þ–êb,Œ KÛu®O³¼è*+­`I[~Á všWšWöF?<¼¾ºß“C$mÔÞ¤o\ÚFÒFx²Ô–Ë°¾lsŽ-·ÅêàíjeY6öl rúÐè¡…[]pŒ2iêÙ–žWêªlUi(]@¦ª¬•«MaÉVÝRZœD/ÅSté_¹§=ï•æDÏ{%lÒR¹uÆkÑ’mçpŽ½uª§l±ddçnR×SÚ*ÛÖíÖu×ÙöÊšáº!¡G¦ªgó›”ñß#cgÎ3ìBH©ê_ÙÑ©‰Úéh-¿¨RàG?ç]b[%ïÎs¼w²Ý!©{'¼&tÇä¬UQÓ¯:Ê&¼A‘ï+XQõålY‰MzŸ„­¡Nsj³3T~Ö«ìU– ¢vi©H¿âg)èMôãCQiùY^zÚîójû¤üý/Ù¡TÖ -endstream -endobj -598 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 597 0 R -/Resources 4 0 R -/Annots [ 599 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -599 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 273.873057 101.433071 255.123057 ] -/BS << -/W 0 ->> -/Dest (cb83-1) ->> -endobj -600 0 obj -<< -/Filter /FlateDecode -/Length 4737 ->> -stream -xœí][ì¸q~ï_ÑÏ–æ¥x?pàl#‹ØFæôîØf ¬ó¿Ÿjñ"ªtëž3Ö>ƒ>ݪ"©ùñc±D‰ê*ñ÷”!zG×ÛÏ—_.Rx+ñoH19Ô?àãíUIòª肽þœÆ ­öîúvÁÝa›üíò§_]þ6Í£®ZÄ贲׿ÿ”Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ì°ž4ÍUfP –SÁ Ò:0ª3 yeæª3´WÄ©`†ŠÖ3*%a‡ÒR²:"‰ŒftÊ -‡JwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¶XE$9l!<§s°Å8#YlÑÁNça‹FíDF` ÐXl‘N*N°1±º >ÌuZZaƒ1’Ó)%,°iXzÉyF§a‹“6²:ØbÔœÎÀ§OXãC`z«N½ÛH£8…-Z{bu°Ï1€v°EzÇQzH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHØbÉqL`l!ô\V[L$Ž Œ†-HÀq1°E“á¸À€m há¸À€nIFÅqß’TŽãÂ…™’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]twÏqëë4Ç´k(8Ž x×’x×ädu°æ¸ì(Œ -†ãï%=ÇÞE7Ò Upè8.V„Ar\@à]$q\@à]í1°:/Ð ÇÞÕ—ÀÜà]m¥æ¸€À»š´ã¸@àÉzà]PˆåÝØ‚å¸ã=tÚp\€Â„†[Âq愈áéÓ`+¡BtXð® -h>V…ò¨q¦ß¢–…r.r\`Á»¨ Ǽ ú €ãFTÍqï*ƒ‘šÓw•Ž’ã Þ…ß`9.„‚ÀqÆ7¡$ Ëê¢1Ž ,x´¤9.À(,d“°:/$ÅqÈXHø¡8ð.†÷ÈqïJk Ǽ+ n«ƒ-&hŽ à×@‡nËôi8«Bj0§ïJ…ætà])}ä¸ÀwÓ°ÉqóI Ç0PÀ Ö¸@"zï8.pQB—Õ9cËq—XP«ƒ-ä‰ã8Ö"š8.ð¶­9.ð¶Àeจ -Þ7;=€-€ ;? ØO‘ã0™‘ˆãoæc¨UNç´tÍêtÊs\à= ÅŠãÌ¥D@§ç¸/’»ÄqÌ€NÇ>ÂtŽ 0‰ á™s:[àds\O:¥8.¶Àä¸ è€Y¦“`„Æ\UÍéH¦yfภÉUä¸Ý3M0%«ƒ-  Ž Ð>i²m9.Àä“MLsXl1–8.A§éfภØ¢¥æ¸ØLóMÏqA”°ÇQ:‘ÜdŽ @ãÐIÉqATóMM _¦ùfภ‰ù&¦xL¿Æ¥ù¦ç¸ l±pQXlÓ™~ NÂ|ìÄélÑ‘8.ˆÎ¥ùfà¸næ›ðèÙ@HóMφ À»6‚™8xž©ã¸˜o³åæöÄk=ü3^ÒŒ3° êµ[Ù÷b´òlÌ@‚|Ó‰ ÀLÌ,ƒc£V¡T’ Hð/ü1šqÂ=úÔ†¨àà1fŸ.2¢[¼û2ç¨ÉÌB²{|ìï¹üúƒïõ/ÿ{yýÕ)Ë -šà_¡èˆæ¶ð¾.ß84´ƒ aà#y’>V#hq º%#1ü¥×ù‰å0ü‡áô¦œ>bNO 7‰ÆJ¥L_‡Ø`cñÁ,ïh°Ä䣭Cub'@~¥¤Iâß~¹¨£÷h9lÌÇx‰É0i{ýòóå×ÿöý÷ÿúûÿŒ¾¼^þü/RZû›ï¾)Ü¿-òÛÐÉÜøíGùת#¿}—g,è*åårú4VÕr¬œ¦Iùœ/ŸC'ßðë=?fb5ÝX¾ÕÝ55ç3aÙV¸¸CšÁ®\w·æ:|.ç7ÿ}ýòýåw_¦`<Ì;ü“Ã…Q-qÅ*þöeyßv˜®®ÀnÖŒ~ZÍ3è5ͪR¨±šW~Ošª;Ÿ t|לn§ì~½C$C¯‡0éîüfÌ«¦×òí»,ÝÏ@„eÐiP^ÅîΣÍÍë„–ìÍybs¾×iÚ¡géÄ:ŽØ}yN‡XZçÛ…VH7â¶6¦ûr:ä¦òzîË-¶ç\¹‡,qdæ÷‚ønXÿXž<Ö+&éiƒk«ÓiMB -Å4YGî¾<§CºÝ÷?ºß³?Ý­›½oÍÕ…M·TˆI·…æ}yN‡æu¿wænxÜè\³Ò3èeî}¤Þb;µĠóg–}ÛV9òX¹¥·.p«n|Ò´pDª!`¼ŠÆyΆF½îÇΕk¸AVj™g&Ó:l·îêL-ûÈO¾¼u6¨)wµòú³—ñÚ É7ƒ^ÆtOK È|À_Ý™çtÈÜðWßyÔ~TåÑï&ç3¸×9>ïžÍûY@m M7ÙtPÚn¡v_žÓ¡v#˜ú¬oxØßjFë5ÿñ6EÑrÓï‚ü%´öKæÒî:KëAïƒ;é³`ñBÛêÎÙÔÎ<§CèFÜuÇè¦[Ÿ³!{$ Ñ!}Gô9¿äˈ¦1}_~FF‡ÐržÕ¾ÚqÄæ£h,|ß_×צ.{Û~lòõÈx+áSîAב¸åäþVðS› -:~¼£`øÚ¤¥;.k£à[«5È_i´3ÏéZw§ºZ]è«ÃlצӌÁÕ‘%E²ÓŒA'Ý×û1§Kyò #ëMòÎoc¹_›|Tó·çæÉiÄjÓ¾ÜÏ‘& ¥\7Ú’9!å wä 3ž÷¸_íÝæ½øÚ—çtøÚð°m㦭µ±»ã"±Ê»µñžëèìè‡ë1M9ømôhÛmÄô0ã]`¬ÖFîÌs:DmÜ%µlŠo|föyÎ~UVŸ îÌs6TÙU‹ÿ`Þ9ܺïÆ7cÚð‡íQ¯yN‡”»¯M\ñ›ùÆ +´ûuQ{ⲓhZ?ãl¼ºö^R™q51…¼êƪÛvÄ…Ý9ÉñÚÖ¶Z{|5öÎ<§Cë†ÿõsøo†„£k öDæ¬îâ}º9_Ñß3›DÒÚD¶v?sµ/Ïéº {8Î(_MòŽ‘·Ï5ãéX¸3ÏÙéö=ÉòÔjä#w>²ô÷Ú>eÜwÁD÷væ9‚7|ÕwZOÏ¡åÐú«w~†jѦ]>ãY¾€ÞæNëÞçvæ9z7|×Oü”ß»ôš]µ¸€ÆâŽ;óœþéÂjèÙS¶rM™5tHøG®MíWq§™ÌÀeÝz©Ïñão¯ÆúzêÓlp® Öº3Ïé»Ï=úF‰ Šn š¸gŠ®OÖÏsÔ­"ò)Fû*gÏpÎß®Êé#IMÞ~=ÿÞzá¸Ï½3Ïéºá«¾0¾c®EÓpâ¿®Gï°kí¹¬>ÏZ µ¤mÇ……kK×ômgˆ ˆ}ÀŸÝ™çtˆ}nõáùü¼ç=™ÓÎ|w@xÀÇÝ™çlhë>î³³©Õ÷ª´-¾p×v2 -SmᥧZ&Ÿ,O÷ì_îkÒ÷á‘߬'/ ï8ëÎ<§CßÇ>‘} -ž;©ZAçê:ÖV±“ØÃ’x£ÐÎ<§Còs1×O‰ä÷ˆ4œ>ykÆñÃûzhó÷u6®1Ø÷dâzÿtïÛyN‡ÞcozêYÕŒŠž£ÚU!-‡e´é…2"~Ëöƒ+nX›Æ@?6=µA÷cë¼x”ÆÖìÌs6”ÆuGžŽÞxV–{“Ä°¶³rú£ß€ñ‰ïÄÆG•$†×l½[`gžÓ!uçÓAÿ¼sÀ¯0lc»vZGìõ<õÞ®´>ƒÝ™çthÝxÙ¶@Af»VSÉi\5€oî½µi]ýdÕ`˜¦Ö®ö¡ì×½NóÏÐ1¢fˆý.ÄÊ+Øó3zœ~ · 6ûæ:[O¨»Vì_x -%>“Ý™çt^÷_¼I#=ñQ”k¾ã‘‡ZÉËùªìÀÛ³öæž…웕üÜÖä´ÌfHKç{€~n5íAó5¶÷åºñD¾$ÿ0îÿá-ݦ½OÓ±ÙN¤Àw3ÉZç›ä-<®é¯‡£qèàœˆ´ñ¯ W8¦}Ú+'ÁïwøÏÿã*ü†Wýt¿¥™Úbx¨èvoÊtœ_d¥Ô=H9¤nHÍáÆj†¼—TeuèLßwX$hÝá8ܤJiÝý3”5þÊ ™xÆó¥Z)"T×OÊ·ã¹{†2ls 6_칸aÏ'5ìû']J§¯ŽDê>^Ó>SAR¹ÙÔPÑêºsØNù—’jÜaY¦MÓ†[÷í—›ƒ1ý/Cƒÿ|Q‘DªÿD$÷ÝPå :TñÛ%í†KŒ˜à“î'áøS–²Hå„Ev{û”Æ -9þŒ¥pcóOmóÕ¤ü6gK»‘̰̉OÏýÄŒ9š‹ÓÕK¡FqÚQ83¹bŠuÙfkÔ¦­ÖŒ›bed#´s¡lNWÅš²=*í@WªÎUa1½­:Õ4N«}ÓœkÂÛ§5½ô•¦}LsQ¹vµ,2Ó‹Ô攥A¨´#º]áw2MhÌ¢oZ-íw† $*ébNLjn6ÝXš--åKªP³Æ\óÕ” -uJÅ3²¡ŽF©O[¤7}Dšüs*v©r[ËÐàFÏ„·‹¥Ò«øíb=“ÚV®6C¯š¦Ü"²â¥JÓ£À÷_èšY–öÒJÿß©Âibžá‡¢©´^=ª'I}³ˆ§•ÔÊ]aâj@‘¯i›êRÞ̶õ¥‚dÒ'Ò-©KM¤M•5r³y‰¤ -yLŪ ®ˆ…åú)\Ù -e6§«b[ ü6W;méª{>™S Üm)·Š]áηVìK‹«´¹a±·”Û`> oÃÀF½8A?ä“T±–e´«'k„Õ0BW}Ĺ·vÞH?þ¬Œqo—¿^†aN«#~8£Ò^½­×¥®ÿ‡4ßãó?ºþGÞî>ŽkYØBnˆÛ‘,íìvŠÓNïYXºM#ÔÔÐ~«PÓÚŒ†2ŽkÝð5Õì²{N© -ƒª¢m…¶Öa#ÖºZ™¦fìŠðÖÕbqdžm›:`ßM¾8œÆ¤m³U8h/‡¡êL’¯M‘8JIë-é&#ÚBqØœ0VË&f&@¶')UŸì§¶)L:WsиéÐTÕa¶-:ˆ«h’À6íA[0©ö¤qbcôÃÝëévMv¹$i¡ö"}k¥åÂ’´/5á›–1Ç\ÓAî¼µ†JY¦é{¦89µkTׂ&-Fi¨Ùƶ=)eÙä¤y (t™Ì²R¢Ï6¹1[®–áŠ[K¾øUú׶¦mÛ*¥mÛ*n–6•›G¼â-™âÙξ^¬)‹/™ks)Õ”&Ëæç¦é¹óh{m.ƒª!®z¦²f³³”ñß#}瞧‹Bp©òßQ¡n§Šš”7Ú\crw‚sàJ›œ{ -M¨äpžõØÉ> -endobj -602 0 obj -<< -/Filter /FlateDecode -/Length 4927 ->> -stream -xœÝ]K$9¾×¯¨óJëõû!¡= `+VŒà€8L×LƒP/Ò¿ÏÎô#‘êî쨷*#ìt8üùsØÎt©«Ä¿¯þ­1¦àíõöã始ÁIü—S,.²úüwUÒáTòÑ]$ "$§ƒ¿¾\ð¿á²OþrùóW—.ó¨«)y­Üõ_ŸIe1éU‚J*èœ!hç•WUL‰SÁ ¬¶kU€6EÇ©`†Õ:2ª3Œ ʬU fè ,§‚*¹À¨”„JKÉê`ˆ´ÖhF§œðpºçtZ “N¬.@§‚ætƬrŠÓ%á½w‘ÓYØâ’TœÎÁ§¬•œ¶X§ó°Åx#YlÑ1N`‹†w£‹°芬¶H/§KF¸­eu :C\ë´tÂEc$§SJ8`Ó°:ô(4’ŒNÃ/]bu°Å©9-ÿ8x™#Ó[5õn#ât¶h,«ƒ-h|Ž´‡-2xŽЃñÇ:a“¶ èh„6r, c6ÃÑ€NNXŸÇF*è´âˆÀHØâ¬ç˜À(ØbÑsYl1Ér\`4lAŽ Œ-ÚŽ ØÖ-Э•Iq\`À·V*ÏqáÂLÉqãšè-Ç” (%Ž 8×€;9.0 ]t÷Àqëç5Ç´klôð®±Jr\`Á»Æ '«ƒ-0Ç`GaT4Xð®Q2p\`Á»èFšã´ª=ÇÀŠÐ1JŽ ,xWGi9.°à]0°º РǼ«ªÀÜà]í¤æ¸À‚wµÕžãE€$ €wA!Ž` –ãŒ÷ÐiÃqn&4ÂŽ xW% LŸ[ “ç¸ÀwUDó±º$T€Ç™~ / å}â¸Àw1PŽ xô9.Ç Œ¨šãÞU#5§ï*$Ǽ‹¸Áq\8…€ãŒoBI@—Õ%!SŒ8ð.hIs\€QXÈ&auAHŠã±ˆC9.ðà] ï‰ãÞ•ÎŽ ÷±qÖ»ùó©K3ÚÏÓ§|¦%¾–§–QÒy¹W){–Û¥ÑCýlW†ÊÃ}8ÂPömiÃÊr™f·¦!ù_¯¾»üêæy®u²Ïey ²@§´èê°Ò·Ù©¡zà’Kãj7ÝSûeÃÙ±QO4²@ºê #`"cwêl~À/—ùÈæÚÉG_Èm@×4Ÿš®uð—ñ]Göƒ=›à¥ªŠVÑ‚¥‚ŸÐ{2Ï£ÁWé]Bæð»ðóHÒ¾¥£6ÑßÓVCæÏk,Œ¶HØAð¥¿zŸ¸lÿ1ON[pYêðq–wØ­} ”=Ø©)ý'†èÕ·Q5Ô¦– d×õ²‹Dó6 bsKüêû?üîOß·–Ph:Ä'RÍ–-¾‡Éºzyè±ñäá)­#z*µ›®Wò8z¹÷0ywJ?yuíQWò<Ñ0:}·Ô#?w6™©ŒœÎMycL6ÔúÌ6ær}齧œ{çþ¥g“¸¬{©C®7ùܴ놎ÎfßôùÚÌ®K?_“ÝÅ×Å·ò‰B–®Î Õszò¹¼MS~®®ïë©i?<Ú»žëiæ6w4BŨÍ>­ïã -ìÐæáú>r®×Tç\ï=;h¿›·C¶º,üAmª'†`l£Md/-æ9̽'ì/1Ù°Ü|M~&öÒ·Yïg›\a©Ö¶¹Íôìó9m®œ1|›#z¾%ÍsןtÃåÍןçöqMªK7·¡Ò»~£o*†TgsÁC(÷\—_û{ío¼¯ˆ‡\iÇ™¤Yú`l‡j“ïêVü®šßKújÚm£'¾Úó“‘£Ÿ&nÛâµ³œÖø¬ö×ù&2õ ÓýßtþcÒ_ð|³Ï5¹Ýì\§8·³:í3ýsúŒª7óíž ˜þ.mÐœ Ÿ¾eã:Úy÷&O÷isûT\w2Ï«]Þ1 sÕ^LH¢sèÒl@—»ú8›S“Ü™.l˜a³Àä…L´q9Xè8à„ -‰dßîßQ›$œÇE`îèžrÛ˜÷ù½gí9Êí¼HmÆåÎIñX Z=¤ótÖy³á¡²vàÆu†Ø…ª¶+™Š­¦li-;¬½5y/‹Öõ_áyz¢®ó¯çQnj7ðƒÑïçy5zY´¶±éÒÜ -»eŒa<ËI(èïx6pÏS §eð°èÌV¶‚èɨDÏ …æž½Az–¶t&£§ß,H–6MvIïdž™ÌVî³y‡x›ûºáuìI[XØš ¶Þ%W“FÙ/¦ôS¦aesÚ—ÈnÚqÓ+ºÂ<Üv¡eEà*4`ÐgEJ.5¸‡>zðgF’3­m“>BßÉ<†>çÕú*GkÈ‹å jy7Úib¯Ü†Î54«CšOóç,×%À,ŸæÏÔ¥}úÒãÒk–o6PF[Ó1ò$ÊÎåy”5³éI—m”m-n­²žäî‚j Ç;”•ÖŠËV©»ý"Ûç uº<,öåéí{OSÔ}dV´)æ>Ã"rŽwÇ çóeeŸ*¹¹@¿‰ÔîGê¹<†T¯vùCˆ* }fÐÉ5gìrÍ°½à®¡µÝ€Œ­‘>ç½-íËvd”ž5ïC²=i®_æuß]›á»žó¤ž§Z=j½oÝ ng»g ™^W>¤'£múy2ÏÃ!Óìrhõâ8b÷ÈÚCÉjS`à¾Èwï,ÕÒ×Þ —eKM+¶ØÏ:-?{BÌ> -Ïåy8ž‹Ù™Äg=­g.{H¹EÖØ’=—ÞQ^ݲ&<ùÈÂÉ<‡¼ƒrlÉñ ’}]Ë®F²ï\ô_Ëaf +ÞáFö·Øý¼ÏY=”?ó¡V˺üü½v½]Œ¨´H2jz¦v½çò<zÃA\9>?6̈ÜÇ¡e»YËßõhùRsälÓV4ò4ÇÌLL[# 汋»gr[ö–<‡³:±¡ÅŽ§{2ÏÃ!v?Þ|˜ð­sÞ{fo_ º¹§W,ÒÛ}® öþ9üÉ<‡ÜýõÿmEçÝ8ûK¢» õ°÷m 9Ü?ï?™çáм÷®âу‚+bvzF¿:TZ˜zËø¤öˆ˜/ΟEö´¶­qä}÷­½u‹[»˜”Î}‘ÊîVžÌóhhŒûqì -YÝÓeOo›O×½éÖÝ©½âÝŠ­²ú‡GŒÏ®¬•Gy_?.ñÈŒ¯ˆWOæy8dÄ«ïX?}CLy]÷¬[.ö·ú5°´©¢ãÓ„‚ü÷†ÝÓúü)ñ-ñôm¨çÊÆ^rô¬hêÖ.ÏΈNæy8ô‹7öÚ-7KÙx.þÕñX+þïñÜ[zòJ[¬ˆ@HDBÔÑÓ('ó<J•<0ÏN;úmÊaº1B;CŒ¦EAÖ‡1^X -[wM=Y¿ Î<®ñÃ|ÎVpð„£3Æ騬ÔÛUÛô0ÉA–FÖG]ÕpÜÓòÜ’Ø7ñªÑR)Йt[o”èÏÓúq~¿ÀO/U›ÙeÆ™)˜ŸaÕå-”ü„áÌ™-äôÂêçÖù”ù%ßüâtš×«)­—íàù{;(@Ö—‚u>H@N/Âv/ÁÖû—s;{/æ¦y\ÊuX5ãOŸÏVTù|]é“h:€ÿê­ Ó]:a¤sU¥ÙTv´ºnäÌ?[ðSM5ÿ’¤Ãé`ËܬýÅœþ§Üà?^T²‚üŸO>ȧŽË,Žº\4ñË…Ž›°ŒØÚv|˜„óWYïeU=¡Èn © Ò˜Ò¸r.\wd½N3}Õ®Ô†ò»’N´²$2ù<¼©`Fˆœ^­ÅT{)Ô,¦“û£0󕯦ÐK¡UØnhû´í†-ã¡XÙ ÝZ(»âšXÛb¢“^«ë|VÓ{ש®ùKZºæÜÞ.(ÖŒÒVJç…—[ïjYe¦3*U©+)kƒØÚNŒèva„_Ërk‹Æ¬ú®ÕèÔÕI lM—J:Ft»°é滹ÚR¡¦Š-k*žo¦4¨›XÏÈnݱ&~Š¤ë#Ò”¯K1’QÛZÆ7z%¼]œ­=±‰_..0©]ã -é -ôz¡éî[ÅQ6¼4)ÍÞ¦oèšEFgVÒÿ'ªpUJÌ“¿([!Eçζ«VõÍ*^:©—ûÊ:–󀲡¥íÜ¥B¨˜íý¥¢dÒéÖÔÕc iç²NR1Hª’ÇR¬*ꪘ(¬ø§re/”Å×Ä®Bùe!nvºÚU¬…yÕÁÝÕû6±¯ÜùÒ‹CmqE‡W{ë};Ìá-lvôc)¤‰µ¬£]+¬6Ã@ -MÜhô%‹Ko­ìD?ŒR¾¶NƸ·Ëß/y˜ÓÆi:ñÁEgâ÷Q—ºþi¾Ãß?.öúûrë4ŽkYÙBWn]ˆû‘Œ~A%žÓ/ªaí6PÛŽö›XÅ–Ö4Ôq\뎯mË.±—”ª2¨ªÚ^èš;±®ÐÕÊtžq;ÂÛàÅȼµmÚ€=]šR9:Á‚Žï-V᢯.cÓ™6$_»[⊒¶!Z«»Œ¸èoŠË®ÀÔ,[˜I€ì ©®'ûm߆Êê.º0‚.MÓÙ6Ìö·.²\‹. B`Ó_ô7¶ª/4-ìaŒ~u÷zs»Ï&ûÒHZ©½J_zi­I+áñR“/ýò²Ž9&þP:oóP½—éúž©ANë-´°‹‹£4¶ls×j‹lQh(*]@&‹¬Þ1›üœ­¸%×8²^ -5¦hÒ¿÷žv}«T'º¾Uü*-Ý·Œx5Z25r=œC«l)k,™ïsW©m)M‘­Ë¶Ë²Ëh{íªa›!¾E¦²es«”¯â¿×ô)Ï° -Á¥*ÿòʈŠíØr ÔV£Mþ%:½‡Xú1‘`c·Trwžýµ“õ -IY;éKBskŒ Š~S7áŠt¬ènU~oÏ–$[¥ûÀ, 5š“«•¡ü£Ry 0/ÕË@SEú 9CAo¤Ÿ¾ RñçVÒc·ÅòIþ÷_H­þ7 -endstream -endobj -603 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 602 0 R -/Resources 4 0 R -/Annots [ 604 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -604 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 555.123057 101.433071 536.373057 ] -/BS << -/W 0 ->> -/Dest (cb86-1) ->> -endobj -605 0 obj -<< -/Filter /FlateDecode -/Length 4924 ->> -stream -xœí]M$¹q½×¯¨³€Mñû0t0 ÃZC‚ìƒàÃtͶ£×ÀJÿ}½`&ÉHfdUVuÏl­àtwe?‚ÁÇÇ 3‹©Ï -ÿ¿Óø•œžRÊ1¸óåÇÓO'5E¯ð¯¤X]õñýY+'¯sHþü# lœbö&†óÛ ¿†Kžüíô_¿:ýï:>›)ç`´?ÿõR9;Å£ò‚*C¥´TÞO1UК˜³¤‚>:㶪3\N^RÁ gLT fXµÝª2Ì0Q;I3töQPi;´QJÔÁåœ5‚Nû)ÀéAÒ=…”Mu:¤³v -Ñi¯%]žB>I:[|VZÒyØâµsJÒÁgS”t¶Ø`•¨ƒ-&E+é"l1ðNt ¶]IÔÁ”–tÙN>'çD]†N¥˜¶:£ü䓵JÒi=y`ÓŠ:Œ(tRˆ‚ÎÀ– |u°Å[e$…-ÿ%xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØ_ÿ|úõgL¾ç?ÿíôú«²SVÿk%µC|…a`2ºÛ#úÖh¾EÑ Uþ aà#yȈ˜»‘´¸lº‘‘˜þèßyûae9 'Ó‘ë¢@{™Â¥~0Q)ÝaQŒõ¡9³›|wž›&GDùÜ>hÙÖî*^o÷•dëÝy>ÊVÛº5SÒR-`ki‚v@ÂY> -‹ND1il6Äúʈו[%þçO'Àbż·Ü.™ùˆC4Ýøó§O¿þÝ÷ßÿË¿þüôéõô§Rʇß|§éošÿºËr—ëE^ÓŠeÑF󊿘áYä ?¸6¤{™¯%å1n){ÑÛÏ]–r_X>×óóº ÇOûy®v/7,¶,å”<(KcJT¯ÔŽÿ>úþôÛOkÈ”øü>”Ëò”} pa±\w0먻:8Ì @Dþq|¤ƒãuieåà³5‹m—Ðd»ý'ºßp/žæy6@aÍw Q„ŠGzÖú_6õ¼ÏþTÙF9A/.c·Pu,ÏÓ¡Êâ©Ÿ‹wîîÝã›eDÑ_E?;Há!õŒË´æ¸Ž”cyž)×Ã¥éÕÉ ¡”÷k=yØÛEgÖij¸EáõJïä_zµæ­6¬tÕ†¸NÓÂ7Ýí“B:ÏÓýÀÚXíüÜe¢m;õ×vImw¯ƒ­Õ—¥ìÌt¯kÛ‹ŸÌZY(…ÅQVÉТü:Zåy:´Þˆ¿Òºª‡é±†Ö˵ç´6dj¡œA¥¼¯…Ý?·:Ô:ß -‘;mvRýC›9âüKE™î3KÖõ5¿]nóªé1š£ï¡ê*Ræy6¤šëqÝ-4ŽãŸ£©õðˆ"Æibúé#wæ-"‡‘P‘ò-G\CÞÐþ#uí"²ÇwžVB(nÍôó<"oÄ„;³î8ë·^Ë[Yã.;äQo}Ëðà¿ü!ø¾ƒyžÁ7bÕ@ðZîAö8Û¶˜ò…Åz€àc1ã³ |½=¥‡zœÃRíÖšü`ž§CïØõæøÿ8„3„Þ3j®µaŒJŸ4]Ú$Ú+£Ñ>°ïx0ϳ¡ÑÞˆOÇh¼m2ôRYSWÄHøùz™ÕWËþ¼pÛ× Ù/‡cwkïß8˜çé{=Ž}_Œõ3 4®ÓmP¨?†_ßo_Ý?ý4¦¹Å¹ìµÌótÈ=¿¶¤({tDø -E lß“v×9ErkD”yÚ£}wñK”ðhþ6"Æ$–·íxIsÈè'ÌKCÙî…!rôó&BÚAêw¹æy:¤ÞˆU? ±cõ¢eœx‡×W\¼Ìùé>ÑÈi­¾¡JoصâÄaŽó\ÛCmiù¼°Ó6jÓ×]!ʈuijó<bÝxöÆèóÅyïdžvµx3jÙAó1îÁ•d{Æçe9_qn¥2[)hÙ¬öêZF€ùnµÌ¯Çù}¹a>Q¯;H¶÷sñÁ%íÐК®ÝkaŸÙó=¦yzµ õäå9­'z©-œ¯7ò4zš{™<<§Ÿ=»õª¯y^ø®£w.»èýœ§³Å¬oíXl+yCooß/(½S¼ÈÝ»ûOK ÕúÒâ²'¶x˜=÷Ò1¬g•k»üx–~¹v—îíêU¾‡Í#Y–O­Ó“×ÕeiiXšxÛ’¢¼,༴Í.½îižHKOQ¯}Ù–,oFGènËQK»æ6—v_³ùŽª·eåê]3ó„`¥”3! eÏè_£²£¹ûšüLf.A‹M¾rUïÛÒgfñù’¶´Ÿê ‹íyùävLÔ4¯lD™ŠÚ9ï¼C¶ôg6i–néú¹ãw?ú¦aH3›+b-s[ñmäɾÒË}­’vae×>û¡ÙXÛªßu÷ûŠ%ôº/ª_¤ògƺê§8úif·=fÛcµ-£µ1â™O’ÐÎ8—ËÛ'sÈuþlp—^QŒYú©Œ¼”é¯ú'oü³<¹ZÛTÚY1ýºmÓØG|\Ö¾ï\ÛïA4{¿H³Ïûú‡ßï¨gçÈíÏXg¯Ûo¤ú¿È+ûrΠEí¹%}(Š<˜ç¡Î>0|ôÍ^:¯Ô{P‡|s•ºd\>êåF¨eÊÜ »æ0©LÇVÚçìDmõ¶÷n‰ÆæÉ\D¡Dÿz+·KåTíD{nåöaÊ}&åæ· ÙÞô)¯«p>Ø}«'n¶ÞÙrr,¢ù€çéüt¸.D¹·rS¿¬ù8Ï»d0Ê’CH²MŸ—^¸ZǸh9I#ê|@ïä,o$ú©¥¢ß)zoY]º•_,é*þ#t˜ˆÕ<Ì/QEŒ±çGñÛ‰^(ã1Øæ ˜„ËGÕÊrº-+«ì‚É;NyL‰ R-ûÚ“fMµÌµ5”ß×ltЯS5‘-GÝÎ Bä z+¦Ö«I/bz)Ošìrš)45a/Ðñ´½Àžñ¦X[Å„~+T¬º.6®Ú£é÷æºÐ…Ítî:ͺ¿¦5‘uç5áå„jí(}¥ô*ZTõ®QMf™Q¹I}MÙ:ĵ~D—“ üNÕ¢:³éY¯Ñê³0U ¹–.×t‚èrÓ-¥ùÖS±¥J=k®žï¦t¨ÓÒ|_vaû3‘Þ2Æƈ²õãZLKÿÖ×*1ܘðrò®Ä.~;ù(¤ö+”¯ÐãBËÊmâ¤:^º”Î6œ?ahVGM¿gªðMJÌS>h× EGÊ÷«^ Í&^;‰ËCc'y@»ØÓ2wéf¹¿tRBz"Ý–ºyl%e.cò˜«yDR<ÖbÝP×ÄDaÕ?+¹PU#P]ûå·•¸ÛéÛPõªU4ƒ»oåvqhÜùÆűõ¸¦÷4{[¹ óUx)›ÅýT+éb£Úl×+cÂnH¡‹;¾q­ÊqpËÇ>Ȥ÷rúË©LsÆzCËË€0>®£ÖçÿCšïñó?'wþ}=_}žÇjla·®Ä|&£—£¥ƒbzYZ¶aÄÆ1ÚïbzZ_ÑÐæqc_»ž]ub¯)ucPÝ´\è»™Ø4èm™güáeðb dÞÛ7}ž/mm-—édþj.xsp™ºÎö)ùÌŠÄ%íS:´Î°Œ¸à…â’U˜»e+3 ¼’æz²ßñ®°T»`a]Ú®s}šåEWYiK‚Øò ^°Ó¼Ò¼²G0úááõî~_Lu´Q{“¾qikIáÉR[.Ãú²Í9¶,4ëàíjeY6öl rúÐè¡…[]pŒ2iêÙ–žWêªlUi(]@¦ª¬•«MaÉVÝRZœD/ÅSté_¸§=ï•æDÏ{%lÒR¹uÆkÑ’mçpŽ½uª§l±ddçnR×SÚ*ÛÖíÖu×ÙöÌšáº!¡G¦ªgó›”ñß#cgÎ3ìBH©êÿ²3¢S# &j§£5¶¼dV¥À!ŽÞ]b[%wç¹¾w²Ý!©{'¼&tÇä¬UQÓë‚eÞ È·¬¨ú*a9[Vb“îs€°5ÔiNmv†Êû"Ëeƒ¨]FZ*Òëa-½‰Þj•–oÉgÅßo=þwѦ’ -endstream -endobj -606 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 605 0 R -/Resources 4 0 R -/Annots [ 607 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -607 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 123.873057 101.433071 105.123057 ] -/BS << -/W 0 ->> -/Dest (cb89-1) ->> -endobj -608 0 obj -<< -/Filter /FlateDecode -/Length 4708 ->> -stream -xœÝ]KäH¾×¯¨3Òš|?$Ä ‹@¬Áq˜©™ÙêEZ8ð÷ùÂv>œÛYU=‡iõt9"áÌ/¿Œ g9åUàç‰ÿ‚‘CÑ;s½ýxùé"oþ)£ú;üz{•ÂøÁÊ肽þHí­òîúrÁÍeüåòן]þ¹Ì#¯jˆÑ)i¯ÿúD*£¼–QE¨„ÔŒÊÚÁ{e£rrÀ-ÆÈ©`†õF™µÊà ƒåT0Ã(U€Úx©×ª3”—†SÁ ­gTRÀ©„`u0D££“vphtÇé”\ˆ*²:ôŠÓi=8o¤•œ.Î98-6 -Éé,l±ÒÁé`‹ÑÁs:[´Ó‚ÕÁ¼æt¶(´Ndt¶]ÕÁá„ätQ6cX]„NÖ:%ì`ƒÖ‚ÓI9X`S³:Œ(t’óŒNÁ'ldu°Åj¡8†-?œÇÊÁáGAñÇÊûÁDe8PA&˜À±€ -q0ÞkŽT´ƒqÑs< …„NIŽ´€-Ö8Ž ´„-#—ÕÁ ÇZÁ$à¸@kØ¢Œæ¸@ƒm ÐÂqÝ%Ç|k„th.Ìh0®Îp\ A¹€Rä¸@ƒs5¸“ã ÒÅp÷h°®¶Nq\ A»ÚÇqïj#Ǽ«5r²:Øs\v´ šãÞÕRxŽ xÃHq\€^€CÇq°2¨Ç¼«‚0ð®ò˜X05Ǽ«,n›¹Á»Ê -Åqï*£ÇÊþ¬7Þ…XÞ€- XŽ 0ßC§4Ç(lPpK8.°à]1ý1cl5ÈǼ+ºÕÅAz´83nÑʃt.r\`Á»˜¨4Ǽ ú €ą̃Šã Þ•35§ïJǼ ¿Ár\8 ǘß)]VCà¸À‚wAKŠã̃`VçIr\2üPŽ xÓ{ä¸Àw…ÕšãÞn«ƒ-:(Ž à×@‡aËŒi8«ƒP` -NÞ=ÌéÀ»BøÈqïÒ´Éqó$Pã8À V¸`†è½ã¸ÀE\>Vç\[Ž ¼€À‚²Xl1Þp\Çzˆ:Ž ¼‚-Z)Ž ¼‚-p8.€G0D ï›]ÀÀ…]ØO‘ã0Ù¢1xë°C«r:§†àA׬.@'=ÇÞ›S±ä¸k©!`Ðs\‚È]â¸f@' Ç> Ž 0 AÁ3çt¶ÀÉ渞.tRr\l7ÈqAP«L'8.À µ$ššÓAëÌÀqA0n W‘ã ¬4Á”¬¶€&8.@ÿÐbÛr\€Å›Xæ°:Ø¢­á¸ EËÍÀqA°E Åq°IëMÏqA°ÇQ¸ÜdŽ @ãÐ ÁqA”ëMe8.À¸¤õfภjõ&–x̸ÚÑzÓs\ l±pQXlÓ™q NÂzìÄélQÑp\£õfà¸nÖ›ðèÙ@ õ¦gÃà]ÁLœ¼ ÏÔq\€ ¬7áÙrk{âµþ¯ ´â lÄ@€z-æV6d À½˜­<3 _Z#±A˜‰•eplÔÓ*”R°aþ…?fVœ0EŸê•<æÌàé&#†…wŸ×%™ÞH6ÅÇþõýåçï1ù^¿ÿ÷åóÏÆHYú‘pÆÔþ†Šèn ï[âöµÃs´ †Ý“–*õ±%AƒsŒÂtGÿ®ë KaèwËj%îy]o Éœ„†µµ7Ó+­Sýp{0”¨z¬/0 t`&`=0+“ïÌòŠ ¬àà8¤ÑQ…b\Àùf‘øWï.M³S 6_Jm“ù ~¬Ø²×w?^~þ»o¿ýÍoÿ ¬¿û|ùÛ/À³H/õô S˜Û/¿‘[7ýeïqm§kæ¿fNç—ò”ŽòYµ–åt¨×6e™ÏUÞ¹ÜTÉŠ­¿üûõÝ·—_¿+CŠÃÍ­à¨õ±Zwc„ - 1…Ô@÷ÿë?þé÷ùc¹,%aÕGö­ø•“ ¤0Ö«#ÙHöMipcýU…`p‡…OÒT8¶ñÇlïXðŠ², ³B$^ÜcgžgÐø%@HáÙ&„dĨ%ºrïÛù/ýúéšÕÙ‚hù¾Ióqþ;Ë•šõé÷ãü7Vi?Ìèý4Û•ÛŒ -§Œ =ëšÕŽùÑCe-ÊKuú¦\ŸêÞ@Vs1¢e}yN‚²b6Ù”%~Iè"^£¶¢á´Uo¥VþXz‰Óòfî­°ìã–½6¦ùÔ á†Ï±Ô•ì\Ô§¶ËuÈÌh“L9éº*/}Îí𹿮±MeÕξÕo 5ªû‘Ú—çlHUb—9„HÙðJÒ‰5gìrÍm‰žw5½mdlÍöcÞÛҾю„Œ4²ä4êØ‘4ßßÈ뮺ÖÍg5ç‰#O–ûÈ÷}+vÙ–?UÉ·…LzŠ6£Œ×ÆÀw€ÌÎ<§C¦ÞåÐÜŠíŒ]#k%nÝê î{B¾{ dÉ’>±¬« y…Å÷3V ð¡!f…}yN‡Â>‘]MlqÖ‡õêe©-÷±Èj{²æÒ;êKuŒ®è‡)ÿ´2Y–ßúÅu}:lÛºàÉÔv·ê>|HUûƒäêpÙÜ™çtÈ;ð!ÛžôË–^¡¯êÙÕL¶ñ™óþs=ÌjaÅ;ÜÌþŒÝŸ÷ý9£šúg>T²ñJ¾ø¨Ý@oå#J|AQÈs½}yΆ^}àW6‘–vEdß7=[­Zöø®FË[­‘G›¶¼‘³ÏÌø´ÙÓ¨fõEœáž•Ü–½)Ï᪎G¬.¾c7b;óœ±ûþæi|Àg×¼÷¬ÞÞÀ»¹gT,Ò›}®Õæþ5|gžÓ!wßGý‹è¼g¿%ºZGßšÝýëþÎ<§Có¾ß»òG<nvΈÙut(õ0Ûø«-bÞœ?“ìÃڶ‘÷•›Gë·V>)mËrÜŽ³Æ¾rÓ«' ‹ø£`#d+ô'/ãs…´ŽÈÚ˜î©y‰G¦yÀ_íÌs:dø«¯x|ÕO›{ñÕ—çtø:ð°í㪯îêc7á‚XåÕú¸ç>;Úëôm¡\}çKͶÝfL+Þ Æz`wdgžÓ!êà)qx¬g)¾ñ5³Ïsöo *Þ¿ìÌs6Tùƒ]‹ÿcÞ¹»w_oæuàû¢^yN‡”ƒ§¯U\ñ‹ùÆ;´Û}Q=qYî›%œWW?KÊ+®*¦vÝX¹a[G\ø®'')^ûÀÞVoîßÝ™çth=ð¿Þp ÿÅpïÞ‚žÈÜ»{ÆøD›î½XïhŸ™-"iH­"[½ß·êÌs:¤DÃŽ3ŠÇw“¼bäíë‹šm ò€yΆÈÐ÷M–§v#ßóDá-Góíïÿ‡¢{yN‡à_õ•öÓ?ý®€WþÕ¦M]>ãY¾ÞêIkï÷:󜽾ëWü-¿W5oºkqÄ;óœþéÆnèÕ·>láš¼jhð¿Ü›Úîâß¼&Åj¿Ô×ñÈ}àÙyΆÜØ÷÷á5B›ýdܾ°×à×güíÝøAÛNmšÎÄZ;óœ¹}þë½o”X èÆ ¡Š{Rt}±žã fÏ葧íg±ú×Ýùë]9m$©ÊÛîç?Ã[/âϹ;󜩾jõþÒ¿Uo+{ë7ö¨»ö¾—ÕæÙ‹¡Þóž.º§/»BÜ@ìþlgžÓ!ö¹Ý‡çóóž÷dN»Z|ðÝñ·3ÏÙÐŒÖÚ%àg—Sû/‡mÓðÞ«(ÓC÷ú7ÉçW[#Ó+…Ó}õl‰übC9Ãï»ùeòÞ¢§,¤GoZÕ»é3æ“@lý&ûôªõ+ý´*/ÊF‘tŠ¤W$EO/l½—[}š<¸ñ-ÍnöÌæݨé{{RŠü&P•Þå=>MŸæs;2‹ßëm>•nßëí¦ôô^oê‚qN¦´núËš?å„Ä s}4S~zöé'ý¢|;×]ÙcæwŒç{°éVÝøÓňÈñ)á 2yuf -'>^éÐ’ ´‘©ÛäØÐòº‘s<›ó§œj>®SÐ ^tzËt–gu1§ÿiìð/2šÚŸFÿt´žŘÌl+~¹ÐÑŠ†3¨N1 ç"—edJ˜e· +Û”ÚbþsáôRò飲én(¿MÙèÈ #R"=ú0UÌ‘Óɵ˜î^ rÓñ”aÐó•Ë¦X—l†°hê´¥À’ñP,µ¨„v-UuE¬L²GÒqF¹é\fÓ릓U÷§´ÊWݹ'¼]P­n¥/¬”ÅKE¥ÖU"ËteTÌR›Ræ1¹ŸÑí¿©hƒÎÌúª×èh¡ILNS:Ft»°éæÒlî)ŸS…’5¦–/¦¨ëž‘m4K=·[¡ÓÇ¥ØQ¤¾¡ÂZ okòH,â—‹õLj[¸BؽZ¨«r³8ˆ‚—"¥Ó' Í$£ƒYèÿ‰*l–óŒèd™ -¨¯J%46³xÙHµÜeÖ1\ HãKÚª¹¤÷³u{É ˜ôDº9un±…´j²Jîc2H*“ÇR,3겘(,µOæÊZ(’¨®ˆm†òËB\ì´y¨ì©2'+¸Û\n»Ì/µØç—tRV¶7—[a> oãÄfZ1A?¤JŠX‰<Û•Ê*a1 ¤PÄ…F_Fq­™èôßô± 2nƽ]~¸ŒÓœÒVE|pZÒÁµ×%¯ÿAšoñû‹¹þ!44ÍãJd¶P™[âz&£c‚C§˜Ž NÂÙäæl©YÆ;l+ùìSéuKÛºWr#ÚºWÜ*-•›f¼ì-éìÙξÜ()³/™«sg©))u’­ë6˺Ól{­nÃC\ñLEÉfW)â¿GÆΔ§‰Bp©ÒÏ‘¡œÍ‡‰ÚH¯•¾Frw‚sàC'æzªPÉÝyöc'ëIŠÔ5¡;£µðxÛ0áŠx¬¨Šz™5ä³EÁÞÒ} À„† -͉Udh<9}ŒQŽ¢|éi©hãx¾­Îwö‚?ÂmŒÈ™Eødüù/£æ  -endstream -endobj -609 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 608 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -610 0 obj -<< -/Filter /FlateDecode -/Length 4919 ->> -stream -xœå]M$¹q½×¯¨³€Mñû0ö @†½† ÈÁ‡éši F¯•þû~ÁL’‘ÌȬ¬žÞAÁÚAoUFð#|| 2™Yúªðïÿ%§§”r îzûùòËEMÑ+üWR¬.Šúø‹þª•‹“×9$ý™6N1{Ãõí‚ÿ —<ùÛå?~sùïu}5SÎÁhýÛWR9;Å£ò‚*C¥´TÞO1UК˜³¤‚>:㶪3\N^RÁ gLT fXµÝª2Ì0Q;I3töQPi;´QJÔÁåœ5‚Nû)ÀéAÒ=…”Mu:¤³v -Ñi¯%]žB>I:[|VZÒyØâµsJÒÁgS”t¶Ø`•¨ƒ-&E+é"l1ðNt ¶]IÔÁ”–tÙN>'çD]†N¥˜¶:£ü䓵JÒi=y`ÓŠ:Œ(tRˆ‚ÎÀ– |u°Å[e$…-ÿ$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØßþrùígL¾×¿üÏåõ7e§¬þÓJj‡ø -ÃÀdt·Gô­Ñ|°6Å4XöPbª6æn–.Ûld&<úïºý²²¦’±È•P Õ?¤j©ÜSJwXcE`h–ì¶>œç®É1A¾¶/Z¶•ùˆÕËœ$Øúpž·5`â!&¯”!y/ñÇv~¯ë¡^„©ðÆ@=›éƒ¶­G3uBéP -Ê0óŸ¤ Zšú™Éfù@ƒðˆÒØlh-bí£Ü*ñï>]@¦‹ó>}»dæ#¦Ó˜¿~úùòÛþé§ü§?½^þüJ¹¯?þ ñéÓüéüò¹\ûåÚk&‹Cš0ÒÎsý^?Ýk×Ý« U€—4vÑ݆òF»òV¦õPFÕ«ùK©Rýµ¶¼mQ=-·Ù’™QhÃסÞÛ"ϽŒZ_McÔâ£ÑÇÍ·?þçõÓO—ßZƒ³¬ªpn\¦™õÏç²| ž çüwã=(=ïf.¼aßo=}“~àùGŸ½Ìul(ŒC¨Ú¥¬ ]º#UH7™”.‹ËCìžÌólàÕæ„7½U‘ôDÖ3¯ëÞsŸ×¤µ!¨—N2+«h3;e>Šø{¶›hç2Ü6RºÅp·®”Z÷8JÏåy:”ºcŽÝCœ÷ÂR¹¡r€¤ŠÖ‚L¤í0=ñåm([@cÓ(I-+´ý*S÷GÏO;Heªr“Ñ.9w©çò<RƒÚo½¿7êê÷6²FêŠXyÍV¿ö‘Øž¸.sŒfš¿nC{õ¯ò0ôäJìdž§CëqìÚzîuâ×æQݽL|cë 膞¸bŒFÔšW†hƒ6äÞXž!êuƒŽ5Ö¯ãÐÒ®adQY6<6âÌ;F[±9²vòH(­ÛÙì2‚z|/ádžgC°9Ž_GþòãìÏz܆¤êùGÞÕK‘ñç€ÔÑ?Æ€Œ¯8 -7ˆÒŒ ™­´lVH{u-#À|·Zæ×Æã/,Í0Ÿ¨×$Ûǹødž§CòqŒk…õl㟧îÙ…gGþ¹°–5p©u,ÚçXz¨ˆQEâP÷ÀçG£±Ôi·yWL#cú;½'ó<¦ïlñó1Íéů‘aÇ•Qïôu‹Gü\&1»Ä”cýGý¼™ÿÇ12bF˜ãi 3¢â£ÙhŒg$L·4_ÖñPÁêà/qFáí”ñÛc]§éØž†Ÿïá÷\ž§Ãï½]¿+?<Íb×I$µÞ_åXá±é€©3±íûvšÔî^ŠcØmc`Ü_YÊ)û¯âX›åÛ gê B±žh—ìÞ¬uŽµk“JOüþÿö/úÛ§¤ZÓµ-ì{ž½aš—‡ÛOžÓzb —Úºùz#OÃŽÐ’ß³«\7f¨kjòƒÜŽ‚«šæ• Ó±Gyçý­¥<³I³tKÖ]Ä¿ûÑ7 CšÙ\ñk™ÛúuÍ×Æì+½Ü•*iÕÜÎ6žôÚ|¼}Së-ø$ÿ}0çYÜ'~5~|GßlÇëñXÛTýYì\úªa{ùÔ L^ʯö’í/½M¥#¯Gܹî?™3çt$/»ÜaÞ¡×öž<&úµL­“­:>ÇØöMÁ–C"ôÄ©ØçdžwÕùÀ Ç7{½›’÷2ò-AJã¢G/·ï,›ZçNØ­0‡Ie:â>TXéŽo Ïüñ¸Dcóä.¢P¢½—Û¥òDH¢=÷rû0e>“r— |¼­bïzÈ”G-vÇCßëvÿÝÖ;[N=[-Yz×óôì\¢ÜÎ{¹©ßÀ Ö|œç]2eÉ…|€M¿Ðâqc¨+sRö@x'ˆÁ­Yˆ”OΫ€ÉîAÛ ƒž¡Ëô´ÊPiÙ;¤èNñL`ÞšsGyNæy’_ã>˜|Ä}ê3Ÿ²†>_…ýò¦Àê\׸€7¹†m[õ¹NÉë²ëÔi¾,Ÿ‹Ü˜E_ÿ¾,Ÿ™¥}ùÞ‘ÍÇÇŠÞtÄœ<ðz2Ï“ ¬›ÂÊ9Žu´mÍ^ǯöŽ49¾•)Jy®ãRl¶|ï Æôãm]¤Æø8RÏåy:¤æC>üÖcKï>Ž5ôöxÀyƒ~ðú¶¶o—ífY¤¥}…×»¶Ãw³äÉ;#O÷v´vßXŒqpSm™I5>¤·08½‡Îåy6d–§fê!RkÞãÈ:B‰t@„çýü„|÷ÈÒ=ýæÚë8‚wPØc?‡ «œ@ˆ9Fá¹Ö³›™lç»ý·z„Õ†wŽZ¿Çî×ãxΙ¡þúˆÂð`ɯ?jwÐËbDm¦¬’Q÷¶_Næy:ôÞ‰+ǃzÊÈz–ï•ðGË÷|Øo7yQýA”ñ0öm¨cØc|h%·goÍswU'#6÷Øñ4bOæy6ÄæãxóibÀo]ó>²zûÑÍ#£b•Þsm6¯áOæy:äǨÿßvt>Œ³¿'º+Z4ûÇ×ý'ó<šãÞM“Ñ/¥“bú¥ *lÆ c´ßÅ:õ´¾¢¡ÍãÆ0¾v=»êÄ^SêÆ ºi¹Ðw2±iÐ5Ú2Ïøámðb d¾µoú„=_ÚÚ8zÞ†^K]­Âo.S×Ù>%_Y‘¸¢¤}J‡Ö–¼P\² -s·le&’WÒ\Oö;Þ–êb,Œ KÛu®O³¼è*+­`I[~Á všWšWöF¿{x}s¿/&‡:HÚ¨½I߸´5Œ¤ðd©-—a}Ùæ[U©ƒ·{¨•eÙس-ÈéC£‡nuÁ1ʤ©g[x^©«²U¥u¢ht™ª²Vb¬6…%[uKiq½[LÑ¥åžö¼Wš=ï•°IKåÖ¯EK¶@žÃ9öÖ©ž²Å’Iž»I]Oi«l[·[×]gÛ+k†ë†„™ªžÍoR¾‹ÿÞ3væ<Ã.„”ªþ+;#:õ×ñc¢v:ZcË/,ª8ÄÑäD—ØVÉÃyŽ÷N¶;$uï„ׄµ*jú­LÙ„7(ò}+ªþŽ¦œ-+±I9@Øê4§6;CåÇÒÊÞfÙ j—ô4ˆ¡ßF´ô&úI§¨´ü&Š²²Ú>)ÿþO—{ -endstream -endobj -611 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 610 0 R -/Resources 4 0 R -/Annots [ 612 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -612 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 438.873057 101.433071 420.123057 ] -/BS << -/W 0 ->> -/Dest (cb92-1) ->> -endobj -613 0 obj -<< -/Filter /FlateDecode -/Length 4784 ->> -stream -xœí]K䶾÷¯è³Ë|?€À‡1bd‘‚vÚÁ8€Cþ~¾’D²Ä.µÔ=³kmÌN«Š"ùñc±Ä–ôYáçsÿ’ÓCJ9w¾ütúù¤†èþ)£ú[üFÖÊÅÁë’?ÿD‡˜½‰áürÂÝ%OþrúÛg§-óè³rFûó/ß“ÊÙ!¦•T*¥­ ò~ˆÑø ¨‚ÐÄœ%ÌðÑw­Š0Ãåä%ÌpÆ$A•`†uQÛkU†&j'©`†Î> -*­`‡6J‰:¢œ³FÐi?tztF!e“E]„NG#é¬BtÚkI—‡‚O’ÎÁŸ•–t¶x휒t°ÅÙ%]€-6X%ê`‹IÑJº[ z' º[€®$ê`‹ -JKºlŸ“s¢.C§RL×:£üà“µJÒi=x`ÓŠ:Ì( Rˆ‚ÎÀ– |u°Å[e$…-?’<ámLI˜­†f·UVK:[Œ‰NÔÁ ¾Ä&ÀƒD˜Añ’Ä&ÆÁeã$0É.¹$±€Iyp1Z‰Löƒ 9J<`•†Îh‰¬‚-Þ‰ ¬†-3WÔÁ›ÄÖÀ$¸ÀZØbœ•¸À‚mÐ"qÝ:•µÄ|ë”X.ÌTX0®MÁI\`A¹€R–¸À‚s-¸Sâ ÒÅtX°®õÁH\`A»Ö¥ qïZ§•Ä¼k-rŠ:ØK\v¬NVâÞµZE‰ xÓÈH\€Q€Ã q°2˜””ļk’r8ð®‰XD]0­Ä¼k<š ­Üà]ã•‘¸Àw3Aâeÿ(Ñï‚B¼ìÀ¬ÄXï¡3Vâ6¸%xð®ÎXþ„9 ¶tÊAâÞÕ Ã'êò #z\˜·èåA‡%.ðà],TVâÞ}&‰ ÀñVT#qïj‹•ZÒwµÉJâÞ…ßà%. @â¬oƒV€®¨ËƒÊ)I\àÁ» %#qVáA%0‰¨‹€¤%. -~¨Ä¼‹å=K\À»Ê[+qAï*·GÔÁ›ŒÄðk Ã´æ4œÕA0…¤ï*–tà]¥b–¸ €wiÙ”¸ D˜$q à‰ BrCŽ1H\²‚.Ÿ¨ ®½ÄQAàAY¢¶¸è$.€c=d›“ÄÑÀkŒÄÑÀ¸ À#²†÷-n` à"îl§(q˜lHÙ9‰ ¢Ø¡W%]0CŠ kQ— ÓQâ‚Ý€¥XK\€½Ô0é%.Áä.I\3 ÓNₘa ¦ŠÄXŠ†dà™K: [àdK\O:­%.H¶À”¸ ™„]fP`…Æ^]-霢}f’¸ ¹0«(q¦ vš`JQ[@`|h³í%.Àæ›MlsDl±ÞI\’¡íf’¸ %Øb”‘¸Ø¤ýf”¸ +ØO€Â@n²Ä qè”’¸ ë„ý¦q`^Ò~3I\­Â~[’‡Œˆ¹©A‹sÐŒÄòGÿÎ×–ÃðoÇêm­>c«w´ €º ÅB°}í-¾3ˬ°9ÂjÆfCìÈÁ¯Tn‘ø·ïNêlÅ­—Ì|¬—Ø ;Øüî§Óøúëßýþ/€Ñ»çÓߣ”_~®Ù_÷<ý¥û~Ö¥Yçç¿ó5£\Éçf™žóØeZ¯¦¿pÇ|ô[ë,iæò=¨Õ]f]êt®´Á,íõHì#Ë÷Ü¥›ÿöí,¶ÕòWÛÒÒžE{üzý¥=¥Z{¾üÇùÝק¯Þ-A7z¢Ó4±„—‰nât_–×àôCÀÛÚð¼Zt©ãðx?“í†ôyÙíµœËm‚ܯ+H×á*pvsú¾ü‹žµžÒuøc³ã›ï…b±ß÷ízb}ÙÛöË×Öõÿd)z_ˆ›]ø$Žœ„›˜Ý™çh Åê&©*-e¤h4­¾F=SLiéwn²ëGíùÑÌI«R)ë‰ìû¥Íð”¶éÙ%šjù|–vÈgñó - ÝÊê¤-Jï; [–»ü1æ+~z<÷š™,£Ô4_ŽÐQz¥;ó ¥fÿܻë`£Ñï6zd£]Qœ»•»"¥óÑ#Ýq¡»GßêèrŒnÑ$³=ºûòntwúp©ëÕ•¹:î&Ð6C;†ÐV“¦ƒ!ÝÓt-é(OÙa½%ïü2—ûÄò¹–Ÿ×5î“iÅâißOuІ¡–f[ -'Pž4!oÜñ¼E;d|5oi?¾öå9¾6<¬GǘÕ]c&\«¼ÙïiGgG=¶Ç²rðٚٶˌéqÇ»ÂXéÆÚ—çpˆºí5*YŠo|Êìó:ûeTYuÿNpgž£¡ÊÞör~mÞ¹{tߌoæµáÛ¢^;ó)·=&Wü`¾q÷¬;ºâë^Öw{}\vMëwœÌ«ã7’ꎋÅüû&{4.|ד¯½[A+ó¥´²J†néßFë¾<‡Cë†ÿõ÷ð º}®u¨e¾»#sÝ„:ƒâèîD‰…\¥{ÏÒõqpßìÝäUÙòfPÞBÕm¤îËs8¤nDÃŽ3²îQ´vsþDÞ>½¨™ŒH×ü;O_u‚+¶VúyŽ†H·á®¬º÷Dõﺣð1g@¯í“Œû® øèÞÎ<‡Cð†¯ú^AË]‡¯VîÛÓ -[}½7@ð>Ÿñ(_A/»Ó2Æ[µ­=ùÎ<‡Cï†ïºç¾Ï!ü£!ô°GWÐø@ÜqgžÃ¡qÃ?í½ýþÎI7J㞺 ¶C¯y0µÖÇN5Ž\Ö—út8VF®W÷Çvæ9rý¾;¸Þ[ÿèíΓIçÂÞ‚__ãoߌôýÔ§Ùà\ÿ@¬ugžÃ!wŸÿZ#IQîÑá ]4°¸'Eׇç%êÎŒŽyŠÑ>OQ|ÿôŠüüTNIbyûÃüÒ—jÝNX—º²ùy‰«~ÞyŽÂ?pŸ{gžÃ!uÃW}/øŽ¥-ãÄ;z}qæâiÊO÷‰zN«õ gÁÌ»œØ­}ž[1Ôš–¯ +m£6}Øâ -bðgwæ9b_wúðx~Þë=™Ãî7½Íáwgž£¡9Üöq_»›ºuzzÏ]ÛÅ*ìÚ¯}«eñ[ätÏþýtö€þÞ}"òƒÍäô=gÝ™çpèÛðSÿyîžHÕ t^í”.¬Î[§Ø?HìaÉÜ'ݹãÚ™çpH~]Ìõ“Dò[Ä -§ó硫»ËÞïûçïûl>c°ï›‰+èeþéÞ;¶;ó½gCûÑêv-w}Wµ ¢ç(~*„sXA›Y)ó^ÄoÙ~ç‰Ѧy¸ïØLeè~윗ŒÒøÀ¹‚yŽ†Ò¸q®àžoGo|WVzŒÄx¶³ÿæôÇ~üÅ'|ç 2U¹a|LÀÖ³væ9Rw~;èÿwä†<¶ë—}$¶'.Ë\»§xÏ“0â1Øy‡ÖÇ ÙåTdò³šZ-ãªe\‰²×‘é¼µt®~qj0-ÓgWûˆPñëž—ù¯Ð1£fŒý®ÄÊÌRå;wÌ8óÀlmŽ¬ÜêîŸUûW¾…ˆÉîÌs8ßö_ïy’}ã£"©ô|Ç#RTק²“lÏ­'÷pŠOVŠ×¶’ÓrµCZ«kžæ ¸Õ²~­<ÎïËuë‰z^y–ºŸ‹wæ9’Óm× -ûÙ«{B‡ÙîÛ–²:.µìÎëÕ}9ÇêØx"“hC÷»ÿ®ÄÙ8Öi¯ó.˜FÆôQÞy‡éßüb' Êwý*Ö¹ŸQuc¬«?â§2‰Ù%¦¼únþq^»—¼öé®Íá~%ðW|k5êý Ó‹çÁ1hÄj×_âŠÂÛ)ã—Õô¸~ÞÂï¾<‡ÃïFlWÀo|«žtÉ+Xá¾iÿ͘¾í[?iÎ1ìÖ9ÐÇWØ7.åX]åëƒji$ÅF¢^büë½&C´Õ&#ñÕ7þã_¿aqJŠÐО®ÞkaŸç;¦ör7c+⩇§´žè©´nº¾’'µšÊšv4ê“l‰ùš3RoW,#!­ª,ý‘íóÓH56™í¨eN=¿««-ïê çÌ«´]KYÏ+ëµg˜›{Kß©æ^)k¥j½Mé•}™-³ÉaakŒCÈ–Þå4ÛjçQôÔÃiîEêÑï®Ë –tN/Ó¹.glCéÝ0¶¹`÷Ûù‰ÊÑ£ Oo“¢g"gö€æJ›I6ïúqÎå¡Ègúé)­µ EÒ«Ôl:íthžõâÄRùýDEã$ óaºùBåQ«ã„ÊsšÒÅzó:?´L úkç @CA42£ªÝʆ+pà6hG®Ò<™ârâåû¹nfO™„µ ¾´áj>…ñ)úz|“Š -iІ^µvn O$æ3=¹?ÁÕeØôØÑú¼’s|AÝÏ5ÕüÎ:E¯±¡WL/´csúŸÇÿ ³Ô ¡ÌËñýRj'S.šøåDïs‚ع6¹7Ä$œ?ªZ–Ó•+Šì‚5=¹Oi}yþ7#ëËGãKk(¿/Ùè¹ïN•Dv|òùT± DΠ¯ÅÔz5èYLïhKƒ¯B5Ňb3„­@ÇÓ¶[ÆM±¶Š ýµP±êšØ¸b¦wzÔ® MXMç]§Ùð—´&²á¼%¼œP­í¥/¢”Þ UŠ*½kT•YfT®R_RÖquœÑå$?W¥h‡Á¬z6jô~I˜ -\M—K:At9‰éæÒ|©XS¥–5—žo¦4¨ÛT;^]Ø¢饓lŽ([>.ÅF ŒµJ 7æJx9yWgb¿œ|RûÆÊèq¡eåVqR /MJ«™>aj½€þŸ¨ÂW)1ÏøA» -)zÃH»j•Ðܬâe'qy¨¬ã¤Ð.¶´¬»tŒ³¼¿tRBz"ÝšºöØBʺŒÉc.æIUòXŠuE]…•þ©\É…ªêšØW(¿,ÄÍN_§*À^* šÁÝ×r›8Tî|áâXG\Óëbª½µ\†ù"¼Œ ›ëÅýT*ib£êj×*cÂfH¡‰¾Œâ2[+;Ï?¶I&­¸—Ó§q™3Ö›ŒÁjzû÷ºôù?Hó5~ÿyrç?•×mLë¸Q•-LåÖ…˜¯dô®Ì´SLïÎ,Â:m˜Ð8FûM¬SKë ê:n ãkײ«Fì%¥® ª«– }ëC&6ºF[Ö3þ†ðÒõbud^;6mÁž.miª±ô¢–b.xsp™šÎ¶%ùÌŠÄ%mK:´Î°Œ¸à…â’U˜›e 3 ¼’Úõd¿ãCa©.vÁܺ´MçÚ2Ë‹.²±, \`Ë/xÁNóJóÂÁ臧׫Ç}69”@ÒJíUúÂ¥µa$­„'Kíx–—uͱgº(“·õP-˲¹g«“Ó¦Fs-Üâ‚c”ISË6'ð¼RWd‹JËBQé2UdµÄXl -s¶Ò-c‹“ØK±úMú#ïiÏG¥v¢ç£®ÒR¹eÅ«Þ’­çpŽ­uª¥¬¾ddç®R×RÚ"»®Û-ë.«í™5Ã5CBóLUËæ¯R>ÄÌ)O…R•Ÿ12¢S{Aj§£5v|ç¸J!€C½62ºÄB%wç¹;¹Ž”Ø ¯ Ã18kUÔôöxÙ„(ò¶‚UÞ,/gËJlÒ} „†Í©«ÈÐøúà1d>ˆêe¤­"½-Ü’Ó›è%§Qi9Æ:¾3o>þ ~;êÏ -endstream -endobj -614 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 613 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -615 0 obj -<< -/Filter /FlateDecode -/Length 4953 ->> -stream -xœÝ]K$9¾×¯¨3ÒæúýÐÁ"V Fp@zzf¡^¤…Ÿ/œ~¥3òQÕ=C-Óª©Ì?"íÏŸ#œYNyøûJâ¿`äBôÎ\Ÿ¼üt“·ÿRŠÅIRÿo¯R?Y]°×I ýä£UÞ]_.øo8í“¿\þò‹Ë?—yäUM1:%íõ_Ieôäƒ÷Â2ª•šQY;y¯¬cTNN¸Ä9Ì°Þ(³Vy˜ab°œ -f¥£ -0C/õZa†òÒp*˜!£õŒJ -Ø!•¬†c´btÒNî8’“ QEVç¡“^q:­'ç´’ÓÅÉ9g§3°ÅF!9…-V#8l1:xNç`‹vZ°:Ø¢‚לÎÃ…Ö‰Œ.À +°:Ø"œœ.êÉÆ` «‹Ð‰àÃZ§„lÐZp:)' ljV‡…NržÑ)Øℬ¶X-§Ó°ÅàÓ'¬ö!0£UÑèÖBKNga‹RÞ°:Ø‚Îç@9Ø"¼ã(#h"^â8@y?™¨ G*èÉ8P!NÆ{ÍÑ€Šv2.zŽ´Ð)É°ÅÇ1–°Å`ä²:Ø¢£á¸@+Ø‚h [”Ñh°­Z8.Р[#¢ä¸@ƒoŽã Â…™‚ã ÆÕÁŽ 4(PŠhp®wr\ Aºîžã ÖÕÖ)Ž 4hW›à8.Ðà]m¤à¸À€wµFNV[`Ž ÀŽ“–As\`À»Z -Ïqïb)Ž Ыpè8.V&‚à¸À€wU†ãÞUS«óÆ æ¸À€w•Å%p37xWY¡8.0à]e”ã¸@™À?‚õÀ» Ë»°Ëqæ{è”清M -n Ǽ+#¦?fLƒ­&¢ã¸À‚we@÷±º8IgÆ-Zy’ÎEŽ ,x•æ¸À‚wAŸãpü„Uq\`Á»Rc¦ætà]©¢à¸À‚wá7XŽ ‡IÂà¸óÛ$ Ëêâ$bXð.hIq\€YxLÂêü IŽ @Æ“€Êqïbz8ð®°Zs\àÀ»ÂÀíau°EÅqüè0l™1 gu -LÁéÀ»B¢‡9xW9.pà]š69.pž*p\'xÁŠã̽w¸( ƒËÇêÜ„sËqXP«ƒ-ÆŽ àXOQÇÀqW°E+ÅqW°.Çð¦(á}³ál\ØøÀÀxŠ€É¦á¸À[‡x ­Ê霚‚]³ºôxo&LÅ’ãÄRSÀ ç¸?‘»ÄqÌ€NŽ |„-*`*š‚‚gÎé$l“Íq<]è¤ä¸ (Øoã‚ ¢L'8.À XMÍ錠83p\Œ›ÈUä¸Ã‘&˜’ÕÁÐÇè -¶-Ç~l"Ìau°E[ÃqAŠÂÍÀqA°E Åq°Iñ¦ç¸ -Øã‚(ÜDn2Ç qè„ภʀxSŽ 0.)Þ D-o"ÄcÆmÔŽâMÏqA4°ÅÂEau°NSdÆ-8 ñ&؉Ó9Ø¢¢á¸ :Gñfà¸nâMxôì’@ xÓ³Ëà]ÁLœ¼ ÏÔq\€Ä›ðl¹Ø^€x­‡Æ+Eœ]1 ^‹¹•]2à^ÌVž]3 _Š‘ØE˜‰È28vÕÓ*”R°Ëü ̬8a^}ê—¨àà1gO1, ¼ûs´dz#Ù¼>ö¯._?aò½þðï˧_¤•²ò'~mÖð1TDƒ¯¦TžA„ g[ÑDÂÀ{ò>6#%h1/º‘‘˜Š1ÝÆk=K“a1Ù,á̤+3‹z*Hô•v¬­7çy{[áGb&†÷Ö׋ÑÈyøÐ:Mÿ®ëƒ#á3õ:€Î8¢8Öس™ÞÐè5 õîæžWݵÃ&èK‡1@ßýxùúÛïÿð»?Þz÷éò×_Ò -&A«5ôá(Ì3>²|l³[Œ(ù᛿]ß}××C‹\N bŒËz¨h8ÎBuERq$KžŸ«KiP•¦ïç¬wÙ$Ødc;N:=›c|KK²dºË¦ÇüíøË |5ͧf­ß¦ºüœ7Ä9•m;›d—.Ì6Hµjš® âØ4©µM.ª˜œ‹¢bíFõ²äÓù’6š -¶ô¢˜/SèeŒÝPmrÝ¥•f—­ÙKúj¿ºm£›Ë5-ÉŽ§½&£Ã¡ÍJ¶»®°´Uæk£/ú¬Ú§À¢kËtî²M!_«Ïúbk×d‡¹ŸlîŸÊ)OgSj£†±k‚|é›çfCj¯_¹ÛNzl§ÒGڶ볱O>w;•!{ÔoeH¦úÕœfaoÆúÖеٮEžÔæ»mgW1[Ú2æòJ¿õ7ó5—ñ+t—§ôuSr¿/áñ/íQ¥ÎŽB û.ÍBºN™pð”N³-a"~S®U˜È@WÝÌukž»|wøž;a³Bxà"ÒòÔPa™ÕäC®'’ì›ý•Žp¾qâ™í§£Üˆxh5×9Öž£ÜÖÁ;AŸq¹Í º|%ùŠRK”™n“ëôF ™¹¬ÒJC3©tõõ=æ{rÞ™8—²Ã«GPN+½ÝÑò´n¦C{OËê7p"¹7ky*ù`àpmcÓÆÜ »u€@ª¹é=³CdÞq¬ûHþ}¿ôÁ -±Ç º˜®'е+I÷¿"­4•¦‘½Ezp½3Ù4šHî>éËóoýspŸFD»Ã}â©ŸÎwFPeÆmȪËßV-Gó<õwù> éò÷Èe¤“­ ŸÃˆo®f–ûN®—×R¯m¼V¹Ì§ÕŒ@:¦z‹®¶IXæß³­Öaº|¥Í>-iD*ì(¨ 82ˆÍPÏeyœ6«µÙÃimÕÚõ\¿|sžµ´·{¬UÉgWµ‹ê*ke—/±UrñÆ2SŒ6x9T¸ÇXFÈ›ëdžABe,ºË¾‡˳F?z% -•6ÓÇÏ笎ŽsÐ!Ÿ†4òw–«,Èòù¿c—öý—öeƒ×òJ~(·²ïÊ”kˆ'Qv.󠬙mÄÊƹÉäyÒŠ%'/Æ ­ü¡õ&¡Iw(+½–½RçÏ~Žü8 ¡®T-çE}j»ìyyh™m’)g˜?SŒä–²bÓ™ºR›vs·ñ£~©VÞŽÔsy©n—9„H9ðJщ5gÜíõ ½md¬c»¼ÏKû’edÉyÔ±#)__âu×ëáXå¢TSAÑÓ6ûè=—çáÐ{àW+T«Õº§¡g»¨eïz´|©9Ù´å¼Ï>3ãÓVOcc•ð¦HnËÞ’ç0ªÛ@lóÏ#ö\ž‡C쾿ù0>àkcÞ[¢·/àÝÜ2*éÍ>×:q{ 2Ï£!×íû¨ÿo+:oÆÙ_Ý­‡£oÍêö¸ÿdž‡Có¾ß»òG<nv®ˆÙýêPéáù«]ã=¡/ÍŸEö~m[ãÈÛÊ­£u‹[;Ÿ”~.dú%È>Ïåy84îû±[w€{Î¥žyM<]ŸgØéÝÝH­øÈO®î,,Ö»B¶Bñ2>uH;±²–Ò½j^Ú@æþêÉ<‡Ìõgí7AÕMkoá>š÷ãÖwk£ôë¹ôÌãjOæy4ÔúƒõÔ×ú†7û[op¯ê =¡t¯÷ÁÕ_Gçj½x¡wÜ»?™çáz°îzò¾Qõ †rDRZR3ÊènâŠ_JD±|vxˆóG×zTOm,î°ùV4ŽOôþnmËѶ]¾;î–úæsšh'ø&=àv2ÏáöÀO™çÑÖO_áSžA×-ë–‹û[ýš€_ÚTÑñaFAú¼âîi}þ”ø–xúy¸Î”£äèYÑЭ]žˆNæy8ôó7îµ.J}'ný¬ó~<÷š‘¼Òæ+š!êèi”“y¥þåÙ¨£¿K9D#²Â(*ò¢>‹¹ðóümÕºëéËúUð£§5‚¿ýY£“y®wOúpahÕ±š¢ \›¢ˆÁµ™…V²)bP¤{Ÿwb`t”§DE¯ŸæÝtÎ[ó™–¿¯«þÊ¢Oû4×AC-×e[ -'Pž0#/Eîúê¦>v3.ˆUÞ¬Ï\Ç`Çx^~-TËÉ¿L¶=gL§ˆ—g¬xÇÓ‘'ó<¢î‡ûz–Ö7~Îìó:û7PeoOæy8T<µø?æ›{÷Íø&¨8Þ±êu2ÏÃ!åàîk·®øÙ|ã'´Çç¢Î¬Ër¿,Ἲþ^R¸º5…òÔMÙÐéžuá›îœ”õÚ;žm¥e›8›éÑð*Å öÃøφ[/8³8wÃ>i‰bL÷$ÖHŒ·Í‹i¬Ì»Az‹^µô& Ú"1v›KV€&9€cÙ¼`½ áU»(.÷7@‘ô® -¨‹žvNÝÚÝ@}œg³ô[w—g¬Ó—»Ÿ´YZù=¥*;"$NÊ+S‰Kļq×ÇÖliw„¼9XÚ„+Îò´Y•m3±|\7üJ÷Äs}´ãå'øt”ÕòËfa=‹ ébžQÓ5¬ºñ§‹K;Ë´ ¼pðŠ½&æêÌD·WÚu8mdé6™Z^7r¦—ëüTSÑÿ Ú‚Ÿ¶_NÝÚŸäô?¥ÿñ"£™¨ý‰)æwcˆ$ªœ4ñË…Þb±1“:)&a>µ,#KÂ*{ãú)Ž)µD>ŒµpÚÚa>T¶\ å·%íY‹`A•3sÅŒ9\‹éêÅ$³˜Þ/&Ï\5…6µªÂV éÓ¶[ÆC±Ô¢ÚµPtÕ5±2ÅÚ‘¯ÆÚç´mG1½o:ÙuI«|×{Âç ªÕ£ô…•Ò[-JQ¥u•¨2Ý«Ô–”µCLí'Fô|a„_‰R´AgV}×k´7ø, H¦¦‹%#z¾°éri¶ö”¯©BËKË7SÔu¨ ÏÈRe©§fucDèr¸Ó^©µ¯Eèp£VÂç‹5u$6ñËÅz&µm\!l^/Ô]¹UDÃK“Rü8ahí¬LÿÏTa«”˜'HS!E»£·³V Í*^6R/w•u ×Òø–¶k.é}Ålß^¤˜ôDº5um±…´k²Nîc1Hª’ÇR,+ꪘ(¬´OåÊ^(Š¨®‰m…òËBÜì´u¨ZQ+s²ƒ»­å6±«ÜùÒ‹}íqI[ÝW{k¹æ‹ð9MlfôC©¤‰•¨³]«¬6Ã@ -MÜhô%‰Ëh­ìD¯ï*‡mq3îóåï—4Í!¬P´c¥Ó’ÞÜÒ{]òú¤ùŸ\Ìõ÷e«ðyW¢²…ªÜº÷3½ç+œÓ{¿Š°›N¨LGûM,CKk ê<®TÇצeØKJYTVm/´­ ;±ªÐURw-cw„ÏC+VGæµ}Ó&ìùT—‹£8i“ùbNúËÁih:ݦäkW$Î(i›Ò¡5ªËˆ“¾PœvÆfÙÂLd_Imz²ßô]¡©®î¤s#èT7iÓl_t‘¥«è’ÀÖýI_°‘}¥qacôÝÃëÕýžMve´R{•¾ôÒza$­„ÇKu:uËÓ:çè´ye¼­…jYº{º:9mh4×Â,NzŒvÒв嶯ÔÙ¢Ò2QTº€LY-Ñ›\ÎVš%]q`[ÉWŸ¢IÿÞ·´í{¥6¢í{Å­ÒR¹eÆ«Þ’®íáìÛÕ‰–²ú’‘¹>w•š–RÙºn³¬»Ì¶×î2L3Ä5ÏT´lv•ò.þ»gì°ïàR•¿´2"C{¹&j#½V:½/UçÀ!†^yåMè–Jnγ¿v²^!)k'}MèŽÉh-¼¤7ßò&¼@]Qå­¸|¶(ØKº­˜¥¡Fsë·=¤W¦õÌ´@TO=…Šô¦SMNo ´yÁ¿ýa~äc±|’þþ ‹åXÜ -endstream -endobj -616 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 615 0 R -/Resources 4 0 R -/Annots [ 617 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -617 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 683.673057 101.433071 664.923057 ] -/BS << -/W 0 ->> -/Dest (cb95-1) ->> -endobj -618 0 obj -<< -/Filter /FlateDecode -/Length 4799 ->> -stream -xœí]Mä8r½ç¯Èó£å÷`ìÁÀö^xáÆú`øЕ=µ £ÆÀ¬þû~A‰dˆ -)UÙÕ39 w¡ºR$ >>C™L}UøùNã¿äô”RŽÁ]o?^~º¨)z…¥Äꢨÿˆßè¯Z¹8yCò×I`ã³71\ß.øo¸äÅß.ÿþ›Ë¯ëè«™rFûë_ •³SL1*/¨2TJ[Aåý£ñAP=¡‹9K*˜á£3n«Š0Ãåä%ÌpÆ$A•`†uQÛ­*à µ“T0Cg•V°C¥D QÎY#è´Ÿœ$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ÂïdA—` ЕDlQAiI—íäsrNÔeèTŠi«3ÊO>Y«$Ö“6­¨ÃŒÂ …(è l ÊgQ[¼UFÒYØâð#éÀÞÆ”„Ùjhv[eµ¤ó°Å˜èDlÁàK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0sEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ]L÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö¢¦¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒÄÕ 8 +“III\àÀ»&)'q%@ÔÅ sÐJ\àÀ»Æ£ ÒÊ Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\€õ:c%.@c“AX"qïêŒåO˜Ó`«I§$.ðà]0|¢.O:Âã¼…—'B–¸Àƒw±PY‰ `?¯Jº`¦A×¢.A§£Ä1º K±–¸{©)aÒK\‚Ÿ(\’¸f@§Ä1ÃL‰ °MÉ 2—t¶ È–¸‘.tZK\ lA4(qA2 »Ì $.À -½$\-霢}f’¸ ¹0Q¨(q¦ vš`JQ[@`|h³í%.Àæ›MlsDl±ÞI\’¡íf’¸ %Øb”‘¸Ø¤ýf”¸ +Ø‚ˆO€ÂDa²Ä qè”’¸ ë„ý¦q`^Ò~3I\­Â~[R‡Œˆ¹©A‹KÒŒÄòGÿ®Û+Ëa8™ŽÚØÊ$EaØ|0QiÝaSŒý¡5³›üî:wMŽˆòµ½Ð²­ÝUü¾ÝW’­ï®óñ¶byÅçú¾²‘w -ìà÷ûfÚ«oî‹ ÓLÙÖ“u>ØdÛ¦K¦! átXŒÈ…ZO´Ã {g•4Xa3è0 ŒÍ†VSP$öAÊ­ -ÿý§ ˆu±bÎÙ·Kf>â;…Òøë§/¿ý§ï¿ÿ‡ü7àïÓëå?þN)÷Ãï¾ÓøëÓü×ùåo½~]_û8ÿË)†2·¡¬Þ)_õ~Ýf«ŸÙëZÇ e—6 Ú¥ì÷h_­WtwúØìÐB;õšµW_û¡ÿgî¥ÕïþóúéûËï?­AVvJ3ÍPò;8Zgqy®Ê×àò[À1çC8Öa¶kHø=èä­L롪Wó_ìª  $Nøÿ0èo;ð¥'MŒ´ñÅî‚b¶Cüž¬ólÆnÿ›#x-ïAv-Óîc–¿/K[„à"ç„=̘çBøzm£RJQ;§ -÷Ð{®ÎÓ¡×óïÝùÿqÿÙúžYsÔ‡1$|Òtaè“hïý\z®ÎÓ¡ñNp: «ýMò(×Ô×#~¹Qf÷«m^¸ìÖË“ì×ñ;Èe!)¶ûY%Ci¦cäž«ótÈ=Žc¿.Æú×å6(Ôï_oëE«#¬/›2w8×ðX”â²¹·ÿ:YçÙkÎůÕcõïèÑá+Ý4„ÎUæ¶F ÈAnªc$õŠ×i‰­ÿÂfDX#×­×ÑNX—†¶Ý CäèçM„´ƒÔwžŽNÖy:¤Þ‰U? ±cõ¢eœø¯s”Ú—¹¾õ[Nk÷Ú¡òæ„]+NÖˆ±Ž;àÀV–¯ ;}£>}ÛâbˆgOÖy:ÄÞ‰gï$@Ÿ/ÎûúHæiw‹w£–4?㞬óth>Žq¿v7UF£Æ›¶7C»œ+â\aZV3&à׿Un×´óÊóß?Æ5šx¤óíg²Œ>û@žõdgCŸ½§þ-òÜ{2UèÜì”nìž;Ò¾]îaÉ<&=¹ã:Yçéüu9×_%’?"WÀ8½­zng‡~àõGŸ½Ì¨ul6Œ³¨ïøvÐËâÓ³ÏkOÖy:ôÇ´›Ñv- =|ev:5÷ÙP1rÔK癇U´™6ß‹ø{¶›èç2Ü6SºÅp÷^;(}à]'ë<JＯ`q5ÃS=ýÂ2æR$U´dº9®ü%Ÿ2üšŸ8£*7í’swz²Î³!Õǵÿÿä`'`í5[ýÚGbâºÍ½gŠMn¸Ý;h} {²ÎÓ¡õ8vm#÷ºFIÙƒ³§›«¼j]w²ìmd†h`D­yeˆf1hCîMm3B5®{]×ß cAMÉýîäêÌ¢¶lxߌ3̶bsdýä‘Ððü¬Ùvü@Nöd§Cðqü:òטQZe“CRõüÀ#Rdü9>3\c ÈøŠ£pƒ(͸ÙJAËf‡´w¯e˜àVËüÚxœ?—ÖõºƒäôŸ«ótH>Žq­°ŸÝ<zÊ‘ž±íqamkàRËž¼nžË9v=܈QEƧߟÍÆrO»­»bÓþ,ïÉ:φi'Ë;¬Ç´¦¿F†ugTF½3Ö-ñs›ÄìSŽ÷?ç½gÉ›¹3ÚÂíÎÛ•ÀQñÑj4Æ3¦[™/ëx¨`u𗸢ð~ÊøeïÕtü„†Ÿïá÷\§ÃïÜ®€ß•ŸGžf±k{§KÞÁ -MÇÅœˆmË4©Ý\ŠcØms`̯,í”ü«˜k«|ûà$¡ØH´Kö©BŸΤM*#ñû?üë?ÿé,OIÚÓµg-ìõK÷ˆižfmC=yy.뉅^jçë<íe…æ¶æ]ü,›Gc¹æ¬4Úë¾zik•í¡Qê÷.¶ùy¤:›,õZ{³çϸ:hîêç,ª´C/#³‚•)×vùõ¬§ËuéÅâÕÚE™`¾Þ³ÈÙ«uyG÷½-½ -Kwªž>wnéܱ¥v]OžO³‹§¿lÛ –>”O?mÛQK¿æ>—~Ù‘Òžª÷eåò·™ù@° Ê™…¶g”÷6רí¾&?WÑ;çæ1P»¼®}%{\ìeKÿÓ‚äCfûQ0! wÎO.åCÍ„-ãã™Mš•[Æ°æe¿Óy!kß4 ifsÅC¬mnï_gméómßWzy~Uʪ¹ŸÊ®}0ŽC³)°¾U¿ëî÷Õl×ë±àóplf¦C?™ŸÆþ2Øì«yí:ÏZž3WõW|ç{ˆ¾³lœ^»ÅŎ=ìÍk»×n¿ýçFÿù§`ì˸j|[›ãñÇ~ymÿÌÁk©<´ùh«VS°åßtÀÙ©hðd‡>vÿa oöb“¼5ÈIiŠŽÛ@½<д,Иa÷†9L*ÓáUà +­óD9 q}|½Û¢±yòQhÑ¿Þ« \ÓYo!ˆöÜ«íÔ=ÆLªÍßÜÛ‚_{×C¦¢ê|°;ú¹Þq·÷ΖóŒèl—"À‚U`h÷‚½m0E§cf:‡n¸i™Ù{¤ .F'h*§ËéFǤw®Î“l÷eå¸O}þu=WËÛ@ÇY?‡k»7©•ÑŽóxÎ.á¹a5.‹; xžó¼.xÞ%å“ Ù§¨‡a¹C5ãÒ[sî­z'ë<–éT»},oÞ|>¤› ϹåmÅnùóµ¨óìm#Ÿ‡2_úÛ“Ëvl qÛ[˜¿,3+ûòs¯r÷f¥œcGÌÉ7„ž¬ó$(c'_h}³÷¼[é(«Ëß™4¾;iï?î}>×»‰úë‡ß/sø)„Õ?.g¶EQõt^=º–Ùp Ÿw‹Üc]*¶ÇX]õppØz5A“ôe 6!0GÄé|ýµÄü0ÇH…YÂòñÈecL3½¥K—ˆÍÔõG/Í–˜ðó³Â«¬EËæ´l0ó,7-Æâ®À6öº')ʇèÒ²IeÉÖ~M -0{VI¼0béÃfº„rN§.g5«&mèË®ÁMôl)æ+ š”uº›.ŽÖךå+0~j¥–oÅPtP6’Z†•_,å*þãESúZÍL1Ÿ`¯ŠaµÅoú'ˆëéÚ;b./UkËé–ý­²7Ny,‰5S-/{Š˜Òù¥ñµ7Tß×jt²¤Sµ-g+Î7„¨ôVL½W“^Äô-i²ËUh¦Ðæ² {ƒŽ—í öŠwÅÚ*&ô[¡b·ëbãª=šN n® ]ØLç®ÓløkYÙp oÜÖŽÒ7QJgÏצªwj2ËŒÊMêkÉ6 ®“ º]áwª6í0˜MÏFNð…©ɵr¹–D·‹XniÍ·‘Š­TêUsõ|7¥CݦæxAvcQ"}­ ›#ÊÖ—k1eíÛX«Äpc6ÂÛÅ»6»øíâ£PÚw®ÀV-o…–µÛÄIu¼tiLÕU˜šUFçŸÒÿ3Uø&%æ)/´k¢3ŒûU¿ ÍÍ&^;‰ËCc'y@»ØË2wéf¹¿tRBy"ÝVºyl%e.cò˜«yDR<ÖbÝP×ÄDaÕ?+¹PU#p».ö Êo+q·Ó·©êU»YÐ î¾µÛÅ¡qçÇ6⚤nö¶væ«ðV67Š ú©Þ¤‹j«]¿vÃ@ -]Üiô­ˆëlmìTNkY^öI&­¸·Ë_.e™3ÖÊ«éûxÔ¥¯ÿ‹2ßã÷¿.îú/õ@ßy7ª±…iܺ󕌾'Ó·óTa›6Lh£ý.Ö©—õ m7†ñµëÕU'öZR7ÕMË…¾û‰Mƒ®Ñ–yÆoƒ[ óµcÓìùÒÖÎQ&œŽ‚®Vá‚w—©ël_’¯¬I\QѾ¤Cë «ˆ Þ(.Ù s·le&’ߤ¹žìw|((›Ë/XA—¶ë\_fyÓUVzÁŠ ¶ü‚7ì4¿i^Ù#ýðôúêq_Lu´Q{“¾qiëIáÉR[.Ãú²­9¶$‘ëäíjmY6÷l rúÔè¡…[]pŒ2iêÕ–žßÔUÙê¦u¡ht™ª²Öb¬6…¥ZuKéq½[LÑ¥ážö|Tš=•°)KíÖ¯EK¶@žÃ9öÞ©^²Å’I^»I]/i«l{o·¾w]m¯¬®zdªz5¿)ùÿ=2wæ:CB*UJfD§~>j§£5¶|«¡J!€C}1Mt‰¥JÞ]ç8w²ÍÔÜ ¿†crÖª¨éû)eÞ È÷¬©úÝ•rµ¬Ä.½ÏBj¨ÓœÚd†Ê”•|fIµËH[Eú>BKAo¢¯QŠJË4JZ¥OÊÏÿÖ‡8 -endstream -endobj -619 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 618 0 R -/Resources 4 0 R -/Annots [ 620 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -620 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 236.373057 101.433071 217.623057 ] -/BS << -/W 0 ->> -/Dest (cb98-1) ->> -endobj -621 0 obj -<< -/Filter /FlateDecode -/Length 4672 ->> -stream -xœí]K丑¾ç¯È³¡ù¾Ã^Øc¬±ƒm؇źs¦l,j Œ}ðßßJñ!*ôʬ®QîBu¥"Rˆüø1bŠê*ñó”!zG×Û—Ÿ.Rx+ño(19Ôßá×Û«’ä…UÑ{ý1 Œ>ZíÝõõ‚ÿºÃ¶øëåÏ¿¸ümj£®ZÄ贲׿ÿTd„ÞK˨"TRFe­ð^[Ǩœ¸Å9Ü°ž4ÍUnP –SÁ Ò:0ª7 yeæª7´WÄ©à†ŠÖ3*%á‡ÒR²:8"‰ŒftÊ -‡JwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¾XE$9|!<§sðÅ8#Y|ÑÁNçá‹FíDFà ÐX|‘N*N°1±º >ÌuZZaƒ1’Ó)%,°iXzÉyF§á‹“6²:øbÔœÎÀ§OXãC`z«N½ÛH£8…/Z{buðÏ1€vðEzÇQzH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHøbÉqL`|!ô\V_L$Ž Œ†/(Àq1ðE“á¸À€m há¸À€nIFÅqß’TŽãÂ…›’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]twÏqëë4Ç´k(8Ž x×’x×X²:øs\vFÃqw’žãï¢iŽ Ъ8t+B‡ 9. ð®’8. ð®öX胆ãïj‹[àFnð®¶Rs\@à]MÚq\ ðd£ð.(Äòá|Ár\€ñ:m8.ÀÉ„FXÂq愈áéÓ`+¡BtXð® -h>V…ò¨q¦ß¢–…r.r\`Á»¨ Ǽ ú €ãFTÍqï*ƒ‘šÓw•Ž’ã ÞEÜ`9.„BÀqÆ7¡$ Ëê¢1Ž ,x´¤9.À(,d“°:/$ÅqÈXHÄ¡8ð.†÷ÈqïJk Ǽ+ a«ƒ/&hŽ ×@‡nËôi«Bj0§ïJ…ætà])}ä¸ÀwÓ°ÉqóI ÇpP -Ö¸@"zï8.pQB‡Õ9cËq—XP«ƒ/ä‰ãÖ"š8.ð¾­9.ð¾ dจ -Ñ7;=€/€ ;? ø‚H‘ã0™‘ˆãoæc¨UNç´tÍêtÊs\à= ÅŠãÌ¥D@§ç¸/R¸ÄqÜ€NÇ>ÂtŽ 0‰ ™s:_ds\€H:¥8.¾ ä¸ è€Y¦“`„Æ\UÍéH¦yfภ)Tä¸Ý3M0%«ƒ/  Ž Ð>i²m9.Àä“MLsX|1–8.A§éfภø¢¥æ¸ØLóMÏqA”ðÇQ:‘ÂdŽ @ãÐIÉqATóMM _¦ùfภ‰ù&¦xL¿Æ¥ù¦ç¸ |±QX|AЙ~ NÂ|ìÄé|Ñ‘8.ˆÎ¥ùfà¸a曈èÙ”@HóMϦ À»6‚™8x‘©ã¸˜o"²åæöÄk=â3^ÒŒ3° êµ[Ù”÷b´òlÎ@‚|Ó‰MÀMÌ,ƒc³V¡T’MHð/â1šqÂ=ûÔ¦¨àà1fŸn2¢[¢û2ç¨ÅÌB±{~ìï¹üò3ßë_þqyùÅ)Ë? -ÂPš_¡èˆæ¶ˆ¾nß84´ƒáà#6É «“ -´8&Ý’“þÒ¿ëüÃÄs8þÝpyS.1Šß/ŒÇÔÊÓ×!7Øx|Ðä NÁhëPÆDØ C\)iRø7Ÿ.êèÅ=Z÷1^b2LÚ^?ýxùåï¿ýö?~÷߀ѧ—ËÿüJJúá×ߨô7ÜÿÚhMŸM§“÷¿ó$P3üZו±ã_Ð#ÝF]W&ÙÙËX>Ûrëùó¶·©ƒ£žhÔAHŸ«½Nþ¢n”©÷‡Þ›î³mâôž‹OªÞG¹ï[õ«ÜCöWW;%ý¿×Oß^~ûi -¶!À–&Ÿ«Hº |î3yŸ_–˜Î®À²T¡íª®…ÕDܼʩµýßis6äêõu»ï,t¿g¿'º3Z7{ßšÍñYÿN›Ó¡y=îÅ£7:ĬôŒ65”[8õÛÅ«=bÞ?³ìËÜ·Ê‘ÇÎ[zë·61iZX'Õð@mûlN‡Æõ8v†¬\à ²RË<3ŸÖa»uWgj9Fîx²ð%›|”l†l†þe¼4HÛ‘YÊ=5.- óxu§Í鹯¾ñ¨ý&¨:”{|‹ØðlÑZÓäFÓ"”¶¨Ýis6Ôš|ê³±ááxë TQ§ëùo ­}Ä’¹´»Ï’Åz0úà®_zç,_¼€Ð6‡ºs6µÓætÝÈ»î|nT"ƒn„ì‘4d‡ôeéQâŒ_r‹eDÓX¾?FF‡ÐrÕ¾úqÄç£h,|ßß×—¦.{ß¾oìxTjjÌIÑ -Ä”¥¬£vŸÍéP»§J-íHhÔzùr]uú[E»õV¦¾ÕVø/Ç……“ò¹¾4Û?°wó'K¹X6hŸ==w(×Í.û^µõ„Ô„ørŸÍé·ñœ¾›ßÎú:Ó²“§ƒýèÚ/Gižêv>¼”-ï{$»N+Hú°5ÁÔÄ—>eÈ»­ŒÓN›³!˜6ò§OÄ”{Ðu$o9y¾ÕæüÔ§‚Žïï(~Ÿxz:œÇŽ|›xúÖÝçÊú^RÇô5¹Ë½3¢6§Cß¾xsëY;q³”>vâ²èGâ±&Vüx<÷LO^@i‰µµe§ÍéPº_îu´O)»ÙFìaiVäeYˆ9‰óü5kÝ´tÇem|kµ…ãkvÚœ®uwÆp¡«Õ…¾:Ì&po:Í\YR&;ÍtÒ}¹sºd“gYoRt~Ïû¥±£jß^k˜'§«-ûù~4a(çu£/™’M¸#o˜ñ¼Å}°ø²íÓæøÚis6|ÙëÑ6nÚêP»;.«¼Yï¹Îþx¸ÓœŸ}»˜f¼2û<çÿªìñ™àN›Ó¡jcÕâÏÌ;‡[÷ÍøfìQñ°} ëµÓætHÙxúÚä¿Zl¼°B»_µ'/Ë}³„‹êÚgIeÆÕäòª«|Û‘>ôä$çkXÛêäñÕØ;mΆV·½ãþ«!áèÚ‚=™¹«{†üD_¯èŸ™M2i Hm2[{¿oµÓætHÝȆ=œg”¯&yÃÌÛÇËš- ò€;mN‡È}ßdyj5ò‘' -ïÙ˜¯~ÿË øìÞN›Ó!x#V}£õôO¿(à¿CµèÓ®˜ñ,çÑë›'­{¿°Óælèõ±ëþ–ß›ôšw]µ¸€ÆòŽ;mN‡Æøta5ôì[¶rM™5tHø9צö«¸ÓLfà²n½ÔÇáØä>ðì6§Cî¾'¸çô½Ú­'ãÖ…½¿>o¯æúzêËlqî¹Ö6§Cî¾øõè%&(º1hhòž)»>Y?ÏqP·ftÈȧí‹œ}‡ë°}»*§Ï$5¶ýzþ3¼õ"<ðœ{§ÍÙ6bÕÏLì˜k±yUÙ{¿±Gïðkí{Y½ÍZõÈ{ºÒ=}ÝâbˆgwÚœ±Ï­><_œ÷|$sÚÙâƒïĸ;mN‡æõ÷ÙÙÔê{UÚ_xj;…×^C™Ÿ¹·¿YžžÙ¾¯=H¯ˆüj=y}äYwÚœ}ïûìSðÜ‘LÕ -:Wßб¶Šý«äx$ÇÞ(´ÓælHŽÏå\?$’ß"WÐpúä­7&ï롵ïël\c°ï›‰ èmâÓ½OlwÚœ½ÇÞ ôÔwU3*zŽjW…´–ѦÎyñ[¾\qÃú4öú¾é© º[çµ€ÒÖì´9J7ÖùvôÆwe¹7IäWÿ¬oÀøÀOb£JÃk¶Þ-°ÓætHÝùí ?9XÞ€ºûY¹Ÿ§ÞÛUÐúݸ'‡·hX›ö#M»jÄf‹ÑÍ"ˆœo’·Õ¸¦ŸrnÄšC€!Òf¼&\pRôiÿš±ßþñ¿þð§?Vˆ ¯øážFOU<,d¿Ýçãüò¥dÙ‹AIбúÝ}H¶C5'ˆ¥æ­Í•þ‹ðÓbû—; ‰ÑTÖ݇sŸ‡ó„ ­ñz)‰šìÓT×OÎoÇk7þ ç°Í=Ø|³füéâ†}˜Ô°ŸtA(6ë½:iݿ״÷S†Tn65T´º.X[ÿTJ»Ë´bÚë¾%rs0–ÿihð/*’HõŸÈâ¾C©ÄAçƒ*~½¤j‰xp§8 Dzœ‹T.Xd7p®±/i¬ãÇXNnlþ¨m¾›do³YÚ9ˆd.d†½sîf„°tj.Nw/…Åi—ß ÌxäŠ+ÖeŸ!¬'¤¶l=a5Ü+#¡ es¹*Ö”ýQiW¸Ru® -‹ëmÕ©¦ùsYí›æ\Þ.¸¬é¥¯¬4í-šO•kWË"3S±Hm.Y„J;1¢Û…~#ó© YôM«¥ÚîÂD¥\ÌåÑí–ÏfKKùR*TÓ˜k¾ºR¡nB©xF6ÔÑ(õiÛò¦H“?NÅ.µ@nkÜè™ðv±Tzb¿^¬gJÛÊÒfèµBÓœ·ˆƒ¬x©Òôõ³û'tÍ,Kû[¥ÿïTa‹41ÏðAQTÚ£®Õ‹¤¾YÄÓJjå®°q5 ÈײMu)ï fÛúRA2åé–Ò¥Æ&ҦʹٽDR…<¦bUPWĉÂrý®l…2;ËU±-P~ˆ«Ÿ¶tU€=_Ì©·Š]áÎ×VìK‹«´á`ñ·œ·Á|Þ†zq‚~È©b-ËhW/Ö«c …*®4ú:ˆso-ì4¼~üX;7âÞ.½ Ãœ6VG|pF¥ýsÛ¨K]ÿ‰2ßâ÷ÿ.týϼaÛ}ײ°….Ü:·#YÚm=ì§Ý׳°t›F¨©¡ý*V¡–µ e׺ákªæ²{.© -ƒª¢m…¶Öa#ÖºZ™¦fìŠðÖÕb džm›:`ßM¾9\Ƥ­þ²W8ho‡¡êL’¯Í)q”ŠÖ!ZÒ!Ú“â°¹`¬žMÜL€l/Rª>ùOmS˜t­æ  #Ò¡©:ªÃl{ê,î¢)‚Ø´í‰Iµ§î^O·ûè²Ë= I µék+-7–¤…ðx©Ýô°Œ9æšrç­5TÎeš¾gJS»F -hrÐb´‘†j6°íE)Ë&ÍE¡ Èd–•3úì“Írµ wØZò%¦¨Ò¿¶5mÛV)•hÛVq³²é¼yÄ+Ñ’)máìëÝÉZ²Ä’‘¹ÖºH©–4Y6¿6M¯GÛksTq52•ÕÌÎJ>Äô»M—…àJåŸ!3¢BÝâ5)o´¹ÆîçÀ!”6÷šTÉa›õÜÉ> -endobj -623 0 obj -<< -/Filter /FlateDecode -/Length 4988 ->> -stream -xœÝ]K䶾÷¯èsË|?€À‡1bd‘ŒfzwlãvùûùŠâKTI­î/:ÙÁì´ªø(?~,R”Zž~¾ø/9…½3çËO§ŸObòVà_J±¸HêïðëíY -ã'+£ öü ´Ÿ|´Ê»óë ÿ —}ò×Óßsú×2<«)F§¤=ÿò‰TFO>x/,£ŠP ©•µ“÷Ê:Fåä„&ÆÈ©`†õF™µÊà ƒåT0Ã(U€Úx©×ª3”—†SÁ ­gTRÀ©„`u0D££“vrpºãtJN.DY‡NzÅé´žœ7ÒJN'çœ œÎÀ…ät¶XiŒàt°Åèà9ƒ-ÚiÁê`‹ -^s:[¼]€-@W`u°E8!9]Ô“ÁV¡Á‡µN ;Ù µàtRNØÔ¬# -ä<£S°Å Yl±Z(N§a‹Á§OXíC`F«¢Ñ­…–œÎÂ¥¼au°Ï1€r°ExÇQFÐD¼Äq€ò~2QŽTГ &p, BœŒ÷š£íd\ôh!¡S’#-`‹5Žc-a‹ÁÈeu°EGÃqV° 8.ж(£9.Ð`[´p\ A·FDÉqß!Ç„ 3ÇŒ«ƒ3hP. 9.Ðà\ îä¸@ƒt1Ü=Ǭ«­ShЮ6Áq\ Á»ÚHÁqïjœ¬¶À€'-ƒæ¸À€wµžãÞÅ0R W'àÐq\¬L*Áqïª Ç¼«<¦Vç'ŒAÍqï*‹&p37xWY¡8.0à]e”ã¸@™À?‚À» ˇ°Ëqæ{è”清M -a Ǽ+#¦?fLƒ­&¢ã¸À‚we@÷±º8I3ã^ž¤s‘ã ÞÅD¥9.°à]Ðgà¸?aFUXð®Ô˜©9xWª(8.°à]Ä –ãÀa’8.Àü6I貺8‰Ç¼ ZR`žD“°:?H’ãñ$‡r\àÀ»˜Þ#Ǽ+¬Ö8ð®0{XlÑAq\€¸: [fL#X„Sp:ð®èaNÞÂGŽ x—¦MŽ œ' -ÀÀ Q°â¸À3EïÇ. -èò±:7áÚr\à”Åê`‹ñ†ãÖSÔ1p\àlÑJq\àlAÈÀq"‚)JDßìò¶.ìúÀÀDŠ€É¦á¸À[‡õ¼Ê霚‚]³ºôxo&LŒ㬥¦€AÏq~¢p‰ã˜4ø[0T8.ÀT4…ÈœÓIØ‚ ›ãDºÐIÉqAP°Ñ ÇA¬2à¸34Ö’p5§3‚Ö™ã‚`ÜD¡"Ç&Xi‚)YlMp\€þ¡Å¶å¸‹,6±Ìau°E[ÃqAŠ–›ã‚`‹Šã`“Ö›žã‚(` ">Ž ¢p…ɀơ‚ã‚(Ö›Êp\€qIëÍÀqAÔëM,ñ˜qµ£õ¦ç¸ Øb¢°:Ø‚ )2㜄õ&؉Ó9Ø¢¢á¸ :GëÍÀq ¬7ѳ[Ö›žÝ.ïÚfâtà]D¦Žã\`½‰È–[Û ¯õˆÏxe g`w ¨×bne· ¸³•g÷ È—ÖHì¦ÌÄÊ28v×Ó*”R°Ûü‹x̬8aÞ}ê·¨àà1gOŒÑ}]s´dz#Ù¼?ö˧/Ÿ0ùžø÷éå7i§¬üH)µA|…a "ºÛ"ú–h¾viÃE¤ÉBxO2ÂÇf¤-æM72Óý;¯?,,‡ád:rc]äh/À`º¹~0Q*Ý`QŒõ¢9³™|sž«&{Dñ\?HÞÖ檾Þæ+ÎÖ›ó¼»­À.–¬ç²^W¿oç·zõéª^ƒÙX9ŒÞØ£™ÞÙh]©R‡Rˆ†yØ%LÐcìÆ,ïh°Àrñ¡Cͧ I¬„„Y$þ݇¨5[1ïÚ×ËÎ|DxS¥²ç?¾üã7ßüþ?¼œ¾ÿ­Àºå«/$þš—ù¯ ùú ¿—,©Y7V´J9Éz‘¯sÞ’¶–Ó·L§^Z&6yIg/]ž—e^ñ²Ì_m(×~þ«mg§Ìí*vÚV–vk¹}£íc›ŠÍjéÇä;ßÙì»vÆζ°lgµß}õó‡oN_X‚2­­nÃñ±,oÁñ¯ßwáë·Ûr]w+×Á¨¸Ý-ÿÞÕE¾Õ?Ât´§ä©0U &=Wp"èúµ­ˆüÔü•º2ü+tKyãÐ|ÂÚÚùÕ”6>wiŠ?>[yÓ=ª[q|0Ï£Yª]"ÖÒ*Š.ËžzÌžÍ$;’ÿH„¥¬HµéÒ¨¡}¦«Cõû¡Î?Ô=ùÞhLuêuÞÓð˜Ö·sóÁ<‡i³ËÎãdLzò«ï°Þ…Q¯ôu Fì\&1;Ç”cý{ý¼šüÇ12b†™ài 3AÅö$q³ÑÌp˜®i>.ƒ¡„ÕÁ_ìŒÒ·“Ço x¤ÛG~¾†ßcy¿ûÁ1‡ß…ŸGžî×I„DrXéÓSG[šú ¾ô»ŠP6ðŸÒ\–6õ¹Ü쿆›œ–±¿!¿¡Þ:±ÀN*KóöQŒ ^ÚxÃÇzôC²1ÛPÚ“dœ}¶ÙcŸrÚÐô£MÛ©œ~äÇö™k÷j”ËÖÆR~‰EJú‚%3uýgæ¹H]ß.ìÙõ}—ƨZö—Õ͇¦g$·Óï Ò!ÅÞéú )måÙÙQÆ´oéÆ2eÉw¥ß¨Ol‹ó<¹ç;¿ò]×þ±¯ªí®kWÆJÂiöùrÆØ7#.|%Ù83mõÝFý,´îÓ]ßDWu.)þ K_¤þ“oŸq•XÙF‡Øœ´dÐÚ¶ûgc¶®þF‡ŠC]ó·Û…çÇ(ÜX;96Êé`Ø¡(ü`ž»nW¼cøm«½.NÁZ [6üNÃy\~ËLº òæNج0ºID:ô3TØw¿á'ôWû%Rte.7Öé •Í;n …naaºú˜…3»»>îÄ_k½ÑéÝ¿Ãót®sžoçµÜÔoà.­ÞÏó&(Œ²€òv°icî…Ý:ÆEËI>@xDZˬ´`}^Nú‹À[oÓë`•NG:¿7TšFöéY:š1˜Uà2¬ñèÀÁþí¹cydë¡rŸ¥“^ÛÜ'žúiiØ&(#ª_Öo2ßx­nSŒ÷Òòa±órgYÞj;Š»Ï¥ÛVtÙÊS=7·ëÓPÏå3¶å†qÝWº_h nWqŽÒx -l¥h—8ÚàåPáÞ˜r´jÌãC+`ØDumLÌóhcŠNÛ:&†[‹-5Úh²ù/ýúùšÕÑç¼|•OCšùo–+•õå÷cþ»´ÏŸ{¶½g qetp® FDÙ±<‚²f6ÃÝFÙÖëj3õYìnê`št‡²_‘9S}j»ìyq½ÌŠ6É”3°mŠâÇ’/ÇëJ>•bó&Ñ&R¿©Çò<RÃ.r‘e+X:±æŒ]®Ù87³ˆUÆ[d[·Øl—÷²´/Ù1²Îù,FRn_âu×]ëá³ÊyâÆÈ“­µÝ—.Æع帉ÌXùÆÀw ™Çò<2·ìÎÔC¤V½×#k%Üñ™>ïÓòÝ{ K¶ô«Óy/ãæQè[ìg¬š„5Ž³‹Âƒy…ÇâÅÚ3Ý-ª­£&ó¶ì’ö:r‹¬s– é7Ô·8Ãù<ç_1¢V3*Ò‡m[<ÉìÛ™+1¤ïãÁƒgæy8ä]‰!Çž2èëzv5“m|æ¢ÿZ³ZXñ7³¿Åî—ýxΨ¡þ̇j¸iðëÚ ôv1¢TSAÑS6ûè=–çáÐ{%®1+"û4ôl·jÙã»-ŸkœlÚŠFžsÌÌÄ´5ÒØØû\{{s”³Ø;Gì±<†Ø°o>L øÖ5ï-«·ÏÝÜ2*éÍ>×yûþ`ž‡Cî~Œúÿ¶£ónœý9Ñ]Ðzuôm=Ësûºÿ`ž‡Có~Ü»ŠG¯DÜì\³32úÝ¡ÒÃ4ZÆFÄ|vþ,²çµm#o+·ŽÖ-níbRzÜ‘{°ó<÷ãØ­û…=çRϼe=]ï¸ïôîîJíŽG|¶vÈV莹ÝYKéÞ4/m óŽxõ`žGCf¼¯¾ó¬ý.¨ºiïñ=bÃG‹~xÔÆno”Þš“Nå]AíÁ<‡Ú+û©o oŽ·Þá^ÕÏy§|cÄ2<6Yó•]¬;£®þÕ£CWîˆÆ;îÝÌóp½²ïzð¾Q <–VEq¾›¸â—áA×tÇQ1å~×H„{¨¯G@÷àÚ-6ߊÆñôHï®ÍïÏ:x,~µ-æ4ÑNˆ; ½EiµÇò<j¯Ä©‚GK?^{¤¶<ÆMÔ–³{Êí÷ò=r§`Ø—5ˆ|~¸S±µËFããñ%bV—㨺v‡4Æ;øòXžGCÜ°£~|ÒþÀ{8·Çéu<’ÒÝ6Tý‚xk»|„ì-ÛëfJÿ³[jÂßå÷Žy‹Þ¶ôÎuzsXì^cVq{5ɘ–ã²ë1åðò«å‰ZI_8 ÃYÑÓ;ú¶ÎÓÒŒª< çæátîþ2ߦDŽó UÎà¦óynJ¬&æ“>5è¤ó¸ùA£ô°OÌ«õúàg.+ˆLõ¥mÅüÀP÷ U-¿< ÕÙ³x0Œê´¥ «nüùäÒ»&ezß°pa’Š¾àìÌDÏúx¦÷[¡,Ý&“£åy#gú‡ŸkªüÍ‚^öL/úLÝÚ_äô?§ÿé$£™ÈÿéIäôv‘ÄA•‹&~=Ñ[ø #6¦=Î|ELÂüQÔ²Œ¬OGÙDì§8¦Ô¶¼%¯{„šÏÓ³5¿-ÙèíˆF”D:½p®˜"§“k1µ^L2‹é› ¤󕫦Ѓ>UØ -4}ÚV`ËxU,µè„v-]uM¬L±GÒ›o«ë\VÓ{×É®ûKZå»îÜ^N¨VÒWVJïO/Eï*Qeº3*V©-)k‡˜ÚOŒèrb„_ˆR´AgV}×kôÚY -LMK:Ft9±éri¶ö”¯©BË‹ç›) ê:TÇ3²K÷šO_ÍÒ¡ËÇ¥˜žP¯}-B‡µ^NÖÔ‘Øį'ë™Ô¶q…°z½PwåVq /MêCq†f‘Ñ;<éÿ™*l•ó¤ÒTHÑ{xÛU«„Æf/ÔË]eÃy@ßÒvî’ÞWÌöþ’A0é‰tkêê±…´sY'÷±˜G$UÉc)–uULVüS¹²Šbªkb[¡üº7;mªô.Î,t²ƒ»­å6±«ÜùÚ‹}íqI/U®öÖr;Ìá%MlfôC©¤‰•¨³]«¬6Ã@ -MÜhô5‰Ëh­ìD_S>¶AÆ͸—Ó§4Í)m=Åë´¤ïè£.yþÒ|ƒßžÌùÏ奴ó<®De U¹u!îg2úF™pPLß0S„uØtBe:ÚobZZ[ÐPçq¥:¾6-»hÄ^RÊÊ ²j{¡m>ìĪBWIÝyÆî/ƒk óÖ¾iö|©Kãè©dzq± -}spšN·)ù܉+JÚ¦thê2â¢/—]…±Y¶0“ÙWR]Oö›¾+4ÕÕ]ta]ê¦3mší‹.²ÔŠ. B`Ý_ôÙWö0Fß=¼ÞÜïÙdWFI+µWék/­ #i%<^ªÓ¥[^Ö9G§zËàmªeénìéä´¡ÑB ³¸è1ÚICË–ؾRSd‹JËDQé2QdµD_lr9[qKjq`½äkLѤ?öž¶}¯T'Ú¾WÜ*-•[f¼-éÙξµN´”5– ŒÌõ¹«Ô´”ºÈÖu›eÝe¶=wÍ0Í×"SѲÙUÊ»øïž±3çv!¸Tå'íŒÈÐ^㎉ÚH¯•NßÌ'‚sàC_®âMè¶Jnγ¿w²Þ!){'}MèŽÉh-¼¤ïXäMx…"^WtE•ï_ä³EÁ6é60[CæÄjg(}ÉVÚçLDõÒÓR‘¾SOSÐè«€¼ü›ãhåi±}’~þ ý9Ü -endstream -endobj -624 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 623 0 R -/Resources 4 0 R -/Annots [ 625 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -625 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 502.623057 101.433071 483.873057 ] -/BS << -/W 0 ->> -/Dest (cb101-1) ->> -endobj -626 0 obj -<< -/Filter /FlateDecode -/Length 4876 ->> -stream -xœí]Mä8r½ç¯Èó£å÷°Øƒ5ì1¼ðÀ û`øP•Óµ £ÇÀ¬þû~A‰dˆ -e*³ª{³îBu¥"ø ->>CJIŸ~~Ðø/9=¥”cpçË/§_OjŠ^á_)±:(êŸðýY+'¯sHþü lœbö&†ó—þyñ/§ÿÍé¿×uôÙL9£ýù/ŸIåìSŒÊ ª •ÒVPy?Åh|TAO8Åœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚON’Îè)¤l²¨‹Ðéh$µSˆN{-éòBðIÒ9Øâ³Ò’ÎïS’¶8›¢¤ °Å«Dl1)ZIa‹w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔaFaBt¶峨ƒ-Þ*#é,lqø‘tà ocJÂl54»­²ZÒyØbLt¢¶`ð%0¶¨$ -À šˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq˜¹¢¶Øì$.°¶ €ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.¦{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]kQSÔÁXâ°ãdu²8ð®Õ*J\àÀ»˜FFâŒê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãq -ÒÊ Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\€õ:c%.@c“AX"qïêŒåO˜Ó`«I§$.ðà]0|¢.O:Âã¼…—'B–¸Àƒw±PY‰ `?¯Jº`¦A×¢.A§£Ä1º K±–¸{©)aÒK\‚Ÿ(\’¸f@§Ä1ÃL‰ °MÉ 2—t¶ È–¸‘.tZK\ lA4(qA2 »Ì $.À -½$\-霢}f’¸ ¹0Q¨(q¦ vš`JQ[@`|h³í%.Àæ›MlsDl±ÞI\’¡íf’¸ %Øb”‘¸Ø¤ýf”¸ +Ø‚ˆO€ÂDa²Ä qè”’¸ ë„ý¦q`^Ò~3I\­Â~[ÔÅŠ9Ú™ùX/±vÆŸ?ýrúí?þøãßÿÿFŸÞNÿñ;¥\øýšþºù¯Öó_oyZŽÕü!žbÊoÓÅ¥lmk9¦2> íøåodKYCm¿övÛ_».§ƯY~ß G‡Þ¬m¨}¸*¿¬Û2ziÇã÷¿—ápõÃ0—árëáje^;¨´U„Qü—ß°&œ†”·)|¤"#tèÛ]ÛèÄÓ¶/%s{tÕyºÑuW9È£9òÁ8Wiä4+ƒåƆ¾¬  W†t¯ó±¤£:Æ­—$‹%Ç\–v_Y=×ëó¾°mœ—+^öeîÃ*ÖnXl©œ@uÒŒ<õöAç!㫇LÇñu¬ÎÓáëFxõè³±ºkŒÃŒ b•ã#ç1Ø1—ó±¬|¶f±í²`šl·;Œ•`¬cužQ×£&BÅ##ký÷Í>ï³_F•Q÷ïÖy6T™ëQÎ_›wîÝã›eF݈‡ ~hd\¦ìÐu¤«ótH¹1µIÅØØ𺣫±îe·çÆÝcêönvœ,ªó¼ÜgvŽÕΗ.mÛéßÇýso‰ƒawK»ÐÒ6ßùI†y—ºƒVKi3e• ¥O¯£õX§Cëøëîá¿tÿÜúPëzw§åìúÛ fˆó¯=²)÷ÂÊ…uÍo«4ÚRYbË›IyUבz¬ÎÓ!õF6ìá$#áEŒÓÄò˜yûþ²f2"mï<ÝVŠP"ÜZéÖy6DÚ1áΪ{OJÿ®Ë ßr|ôßeÞwÁd÷Öy:߈U?Á;h¹ÙãjÛbÊWë}‚Ōςðô²Ë­!c̱U»µ'?XçéÐ{#v=rÝçƒþÍzϬ¹vcT"ø¤éÂpN¢½;h| ïx°ÎÓ¡ñF|:Fûã•“a”Êžº"v@Â_o”Yµí—…ËX^ƒdßÇÊÈuêþÀÁ:φ\wì -î£×Ö¿9BãºÜ…úcøõ=ñöÕüÁè§±Ì ÎuäZÖy:ä‹_[&)ʾBÑE@Ë{Rv#Pä ·FDÉÈSŽömÎâû×wÔçw匙$V·e¼¤5dô‡Ö¥¡m~¿ÄÆÏï£p\ç>Xçéz#V}bÇêEË8ñ¯¯î¹xëÓu¢‘ÓZ½`æ€]+NÖˆ±Îµj+Ë×…s£súº;ÄÄ>Ϭótˆ}ß݇Ïç½?’yÚÝâͨEF³ Æ=XçÙÐì¯Ç¸ïÝM]»uúÈUÛÕ*ìú—ëD|ÆÔkîü·ÊéšýË|ïý½ûŽÈ¯6“wÐ÷@žõ`§Cß8õo‘çîÉT]Açf§ta}^»‹ý«ävÌcÒƒ;®ƒužÉï˹~—Hþˆ\ãô¶è¹M>ú×}¶ÜcàØlgQßñí —Å§G¯Ø¬ótè½qoè8ZîEºeÜéÔÜgCÅÈQü®Îamf§Í{Ëö;ï¸mZf€û™ÍT†îÇîó’Q¸¯à`gCi¸q_Áâj†§zú•!dÌ¥Hj_ç£Ñrjsá·Îá~ÏW‹Q•›Œvɹ[H=VçézðÛAÿå@¾ÃçvýÚGâùÄu›{×›Üp»wÐú@ö`§CëõصÜÛ%«{5µZçUë -¸“eo#3D#jé¾úÕ]ƒi]®Ü»:f„j\÷¶®¿AÇ‚š’ûÝÉ-Ô™¥êwî˜qæÙVlŽìú½\ŠcØms`̯°o\Ê°¶Ê·‡‚ÑHŠD;ÄøOÖzâv‚4h«M*#ñ‡?þË?ýÛYž’24´§k×Zê•Áî Ó¼<Ì؆xòð\Ö½Ö³›7ò´örѽ©u–:Ìå¨mÒ÷ŒÍ\¶¶Qú¨;§x»]o{/ ‚©½y?¾ô{éûÜCn¶ÜÍã{Öú¿–«w#‹DyêáнX½[ÊŒul?Û†#vöüÌK¸[¾³Í£^VO­ËO_ï„Å-aå§-=—ñ‡]ÎÁÓš’–‘¡‘ýyÛN°ôÐJz0ú¶µœ×|Î弯ØâܳCõsYùƒafNl£äåLÈBÛe¶ä¹~÷·¥­> ºÏÍçÅÕ&¿¬³©ûÚ/O$rqiwñ_ÇÍRV°¿Ï>;|P+씶¬l_vÀUÛÑÅÆņz>E&Ø·ú<ô_q\êpFÈý³ÖÝÖZ·Æ¥ 6Æk6bãàæõÇ\ }Uì•q`þô¶ŸcÁRûA—«¾ô_ -<2禗vCÍ‚ÃR¹ZTç³föÖ¹{¹±M]ë_甚m¿5ÖͦÀìõW}G_Í×D—ñNñ¿‹ù¥þ°íŽï^WVœRž­8åXïÆwžù”«_Æl¸RÖW@¶šÉ¾ÌÒ¾µ¡Mz¨¾ -I%¡Í}Û®ûi»2ïÛ‚é§å)©ÑÃ(Ooˆ¡çœföÐÕjß,r#²Þ>¢µ>èôL?cèÜý„&éõH6 èé‰ÂR€FË-¦RUXnÚ^àI®jA\^ÊT -ÐË0¾²éågWÖ¡(_†º¸2ÏrÓ–WF a»ì”þ^š¸¬§^k¿Â–Ù³¢Ô¼ÜrVÎa3Œ¿žBy2¶.oG¶&mèõIçà&š­1ŸéiÜIY§ë°éâh}Þ©Y^:õk+µ¼‡JÑ«)è±äóKªØÁRþ×2à¿ "tS¨1`ygŒ*âdêA9Ñ;ƒœ v®’7Ä$\>ªÖ–Ó-.­² öŽqÊcIëë3}Yðj}ýh|=ªïk5z–³Sµ-O3ž;„¨ôVLg¯&½ˆé½Ki²ËQh¦øPm†°7èxÙÞ`¯xS¬­bB¿*Ö]WíÑôœþæºÐ…Ítî:͆¿–5‘ ç5áå„ní(ý"Jém/µ©ê]£šÌ2£r“úZ² ˆkã$ˆ.'AøƒªM; fÓ³Q£gæÏÂTäZ¹\Ë ¢ËI,·´æÛHÅV*õª¹z¾›Ò¡nSs¼ »° ^¤ɱ9¢lý¸Ó> µJ 7f#¼œ¼k3±‹¿œ|JûÎÊWèq¡eí6qR/]JE›?ajV=qœþŸ©Â7)1Où ]ƒ½5 õNhn6ñÚI\ë8ÉÚÅ^–¹KÇØ0Ëý¥“Êé¶ÒÍc+)s“Ç\Í#’jä±놺&& -«þi\É…ªîºØ7(Y‰»¾MU€½v4ƒ»oívqhÜù…‹cqM¯€hö¶væ«ðR67Š ú©vÒÅFµÕ®wÆ„Ý0BwýRÄu¶6v*O]\>öI&­¸—ÓŸOe™3Ö›ŒÁjz£ºôùQæGüþ×Éÿ¹>B^ǨÖþMãÖ•˜¯dôþ»tPLïëÂ6m˜Ð8Fû]¬S/ë+Ú:n ãk׫«N쵤n ª›– }÷!›]£-óŒ¿"¼ ^lÌ{Ǧ/Øó¡­'‡n,½|¡Z…~:8L]gû’|fM∊ö%ZgXEðFqÈ:Ìݲ•™HÞIs=ÙïøPXê‹°0‚m×¹¾Ìò¦«¬œ+‚ØòÞ°Ó¼Ó¼²G0úáéõîq_Lu´Q{“~áÒvb$m„'Km9 ëöæØ3ÔÉÛ=ÔÚ²lîÙäô©ÑC ·:àeÒÔ«-<ïÔUÙªÓºP4º€LUYk1V›ÂR­º¥œq½[LÑ¥æžö|Tš=•°)KíÖ¯EK¶@žÃ9ö³S½d‹%“ ¼v“º^ÒVÙ¶o·î»®¶gv®zdªz5¿)ùÿ=2wæ:CB*UJfD§þÒ,ÔNGkly°J!€C½ -.ºÄR%w×¹ž;ÙfHjî„÷„ᘜµ*jz#´lÂ(òmkª¾-Z®–•xJ÷9@H ušS›ÌPy%h¹4[DíÞÇcè À–‚ÞD/.ŒJË×ò(òºJŸ”Ÿÿ” û -endstream -endobj -627 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 626 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -628 0 obj -<< -/Filter /FlateDecode -/Length 4760 ->> -stream -xœÝ]KäÈq¾×¯¨³€¥òù„=a¯aÁ‚öÁðaºfZ‚Ñk`åƒÿ¾¿H2$ƒªîÕh=]ŒÈG0óË/#‚,R_~~Ðø/’bLÁÓõöóå—‹‚Sø—K̲úOø Áé䣻þ̆œ þúvÁ‹Ã¾øÛå?~sùŸy}5CJÞhwýëWV‘B A9A• RÚ -*熌ó‚Ê맘’¤‚.¡µ*À JÑI*˜AÆDAa†¥ íZ•`† š$ÌÐÉA¥ìÐF)QC‘5‚N»Ácн¤3zð1™$êt:Igíài§%]¼÷.J:‚-.)-élqšHI:ØB6Iça‹õV‰:Øbb°’.ÀƒÑI‚. +Š:Ø¢¼Ò’.ÙÁ¥H$êt*†¸Öå­U’NëÁ›VÔaEa’|t¶xå’¨ƒ-Î*#é,l!üH:ð„³!Faµ^ÝVY-él1&¨ƒ-˜|‰Œ‡-*x‰°‚æ%‰L%C ˜hŠ%01 ‚•hÀ$7OAâ«4tFKD`lqä%&°¶V®¨ƒ-6‘ÄÖÀ¸ÀZØbÈJ\`Á¶´H\`A·¤’–¸À‚oIi/qáÂL%qãÚèIâ Ê”’ÄœkÁX.–{¸À‚u­óFâ Úµ½Ä¼kI+‰ ¼k-jŠ:ØK\v¬ŽVâïZ­‚ÄÞÅ22`VàÐK\¬ &F%qwMT$qwMÀ ê€5h%. ð®q8iç琉ÄÞ5d¼ÄÊþQ¢7Þ…8Ù€- X‰ °ßCg¬Ähl0pK$.pà]°ý kl5蘼ļ«#¦OÔ¥AŒ¸°n1ʃö>I\àÀ»Ø¨¬Ä¼ úŒ€ãì¨FâÞÕ;µ¤ïj“”ļ ¿ÁI\8 €ÄØß­]Q—•b”¸ÀwAKFâ샊`QIK\2üP‰ ã¯þòã]?ýtùç|ž¶'rðǧÉñ1œ„Wì -ÐòÎÝ ÍUÂÚ4898p8óÁ&ÃX ¡Š¢ÕèPéu¤z¨­«°Ã°æШj(4©(Ný$–ý¸ß¢± ÄŽƒ ´è^j©œ)ð^´ç¨6|a”ÚHµé3ú/#6Q©ƒ6s -žœ·#D_§¶Ê(-úÈ#H]ýŒù…=S]—ֲó‡ÃÇÞpö îyÎ aè|Ïó¨6Ï›rÙKø¨‘'x£ðhfí`Ó¥ivû}TšÚd'Í™gÖñ2=šÜ ·Ê=à×Ee±ÖÇÎOTöÊe¦±kέ&Îb,:Í+{ƒò4¨}"0g™H)±ó´Ëy'ë¼g7øU¸¶ìpŸú<Î}žÿ0Íùë|EåU·µºBW&µÕXÚ(幟Œ­ÅjeYåØ%æ–}êÖ×3X=þ5rΞӪßb[êX&ÌmÈçùua×í=ç/#Ô TŸÐƉg/°]€ž«ò$ølV³…Ûø¼ç9*_Ûæ¨Ê?aäçÆ^f•‘2qSÌÖ¬ù‰¹ô¢Ã=~2ÑÝÍO'ë<ÉüW~2)íÎá³øÛñ€F£ÚMù7ŒÇ¢Ž?ÛI÷yQæËôw’3éËï—éoêʾ|kÏ¥q[m¯ôíVn–Q†ð½!FCÙÉ:O‚²f¶¡=”ÕÝaBM;ˆSÓqé—n¶Ê(i³Ä€Éh²ÊÊlÅù¬ÔµßA…eoWÉý™í¶³î™mZhgÁ¶9"ò Ô¾žï+©îÆyµ»n Õºû‘z®ÎÓ!•vùPô=ô‚WŠN­9c—knsô̸k1ÛnŒb\W÷6·/ÛQQV–W¸’¦ó˼î»c»øl¦:icåévõ¼o±äOÓêm"ÓW>ä«ïD0àÈQ;Yçév9té©ÕÑ둵‡¿õ÷}~B¾ûdéV¾®5ï«¡y…Í÷#gåÈ3böQx®ÎÓ¡ðœ¿Xg†:$lqÖK——£c¤.¹ODÖr&{.½£¿ÒGvE_Æúcd2oé÷ýÙ¸mëŒ'…(øÔûƒ|§BÌW—w‘w²Î³!|ÈåL†ùH¯Ð×Íìj'Ûø,yÿµ!ZXñŽ´³¿Çî×}ŽÌ¢ÿ‰^x%¿úªÝ@oç#j3$ _·ÝGï¹:O‡Þ¿²Œàëüoå•Ï‹™í¢–=¾ëÑò­bd)·WÏãEµ|ÝbG¯žÆF¾ñ®Hî _zÕm ¶ùŽç{®ÎÓ!vßß|ð½1ï=ÑÛ7ðnîY³òtÀµñþþd§Cî¾ú÷–Ñù0Îþ–è.h=\}2š¾?î?YçÙÐìöýÞ•?zàA^yÛX}v¨Ì0¯·ðW—ˆùæüYd/kÛGÞ×n»j¹ÆÎ'åï*ï)ÞGã¹:O‡Æ}?vëzaϹ<3ëÝ ;³»©yÁ“«+ ³ü£3d+ô/ãµCÚ‰ÌÚÑõëã}i™ø«'ë<2üÕÞµ?Uwå?Â7|6ïgµ]n”¿‡‘ïp¤þëê\å‹e„ú®ÝŸ¬ólõyדתg°Ø!—HÊÙ!3¢Œ¯&®ø¥ÌXA4©ù‹8‰âÚÏÕË»6f×NØ|/—wôþnË¥m_ºz\-õÍç¤äøÄßËÙGí¹:O‡Ú?UÉhéwÂr_ãVõ:ú®Æµ{!ߟåí{„Öü·wLåØå5{¿¾R±•‹=þÚÓ´r©»syçÙÈóðå¹:O‡¼ƒëô‹øvµÖ…™]\î®Ë;Rº«†¦‡·²åKÄÞ“]§$}·µ wþeˆƒ¶”¿Ù±àsužÁùÓwø”gÐuOÞrv}«Ï „¹M_Fäßw\=­÷Ÿ2ß2Oßçy€²å*9ºW4t¹Ë³ÑÉ:φ¾pÎß<ºÖNR”²÷­‚Gü±ÎWüþxî=+y¥ÍW„#4DFÔÑÝ('ë<Jü˳QG•rm,‘ÆQQPõ^Ì™ŸwæûC .ë³àGwk„Þ;y¯ÑÉ:O7»'}¸¸Õµš£ œ›áˆÁ·…3Ù1ð7§ÌËx,é¸N‰0ŠÞ²w~›Ú}éêQ«ß÷U¿eÑ—ý<öÁCm×O¶Nà:qD^Žx>âpwäÉ:φ¨xp•8>6³œßøžÙç}öo ÊÞ ž¬ót¨:¸kñoÌ;wÏî‡ñÍ´¢üáø@Öëd§CÊÁÕ×.¯ø«ùÆwh/ï‹:“—•¾Y"yuýµ¤qu9…r×Ó¶È ßuå¤äk¸·5ÆûïÆ>YçéÐzà}ÃþWC½÷œÉÌÝqwOÎO,Ë}Vëû#–×Ìf™´G&u™­³ß·:YçÙš²açÕãw“|`æíûËšm ò;OÖy:Džû&Ë»îF¾çŠÂ·\·¿ÿnü@vïd§Cð¯úA÷Ó¿ûYüªM›NùŒÏ‚ð­‡(¶øúì÷NÖy:ôø®ßñ·ü>dÕ|Ó»+ÿ4=ô68LœãþðÓ`S÷ Ý -ÁÃ"ˆ+OÖZ?qõªŒ?| MòÛ®l¼²S™? zëÑ[æë˜jÉbòS:eºàTnÍÓZÕ‡}˜ò¸®0«ñ²iV•ÝE_Û4åGwù±H½ÜWÖ!i4…V¶.BÅl?^:*¡<“n-]Gl&톬“‡TÌc’ªä1늺*f -+ãS¹²ªbºkbW¡ü67;]]ªNÕμîàîj»Mì+w¾õâPg\ó=ª½µÝóExË-Å ýX:ib£ên×:ë„Í0B7}Ëâ²Z+;ñ[ -ËǶȤ÷vùË%osˆ ?<Ý[Í/¨ê½.}ý?”ù ¿ÿ}¡ë¿”7"Œû¸Q•-LåÖ™¸ßÉøu†ñ¤˜_oX„uÙtBCí7±Ž­¬+h¨û¸1_S«®±—’º2¨®Ú^èÚvbS¡k´íFÆío‹Q¬ŽÌ{ç¦mØã¡-'ǃçwi«pПcÓÙ¶%_»&qÄEÛ–-™®"úFqØu˜še33}'uèÙ~ê§Âr_ÝAçFð¡m:jÛlßt‘å³èŠÀ¶ýAß0é¾Ó4³G0úáåõîyŸLöe°´R{•¾õÒzb,­„'Km>ôóúçØüõ²xÛÕ¶l·ölurÚÒh®ÍzŒvÒتM\ß)Ù¬Ó²QTº€LYm1›üT­ K>ã(ŽR¨>E“þ¥i×ÏJD×ÏŠ_•åvËŽW½%[ ×Ã9´³S­dõ%£ ó}í*¥VÒÙºoš÷]vÛkwÔ ñÍ3U­š[•|ˆÿY;â«R¤Rå'gFtlïÂFM:Xcók¡UôBüf¿@±K•Ü]g?w²Î”ÜIߦc kUÐü‚oÙ„7(Ò±¢kª¼ü[®–”xJ÷ €j4·~±M~ÃkNYæQ= *ò -;½‘ßC”ü¢›|?òm–>É?ÿFÁ`Å -endstream -endobj -629 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 628 0 R -/Resources 4 0 R -/Annots [ 630 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -630 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb104-1) ->> -endobj -631 0 obj -<< -/Filter /FlateDecode -/Length 4950 ->> -stream -xœí]M$¹q½×¯¨³€Mñ#ø:!­aÁ‚òAðaºfZ‚Ñ+`¥ƒÿ¾™I2’™•]Ó»* žFOWFð#|| 23YúªðóÆ‘ôc -ž®·.?^Ԝ¿’buQÔ¿ÇopW­(LN'Ýõ‡,°a -É™à¯oü7\òäo—ÿüÅå/ë<új¦”¼ÑîúׯYEv -1åU‚Ji+¨œ›B0Î *¯'41%I3\ C[U€”¢“T0ƒŒ‰‚* KAÛ­*Á 4I*˜¡“ ‚J+Ø¡R¢†("kv“‡Ó½¤3zò1™$êt:Igíäi§%]š¼÷.J:‚-.)-élqšHI:ØB6Iça‹õV‰:Øbb°’.Àï$Aa ÐElQ^iI—ìäR$u :CÜêŒr“‹Ö*I§õä€M+ê0¢ÐI>:[¼rIÔÁg•‘t¶~$xÂÙ£0ZMÝVY-él1&¨ƒ-è|‰Œ‡-*x‰0‚¦ÌK˜&J†$0ÑN)J,`bš(+Ñ€In"Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!Œ\Q[l"‰ ¬-H qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ] ÷ qëZçÄ´k)z‰ ,x×’Vx×Zäu°–¸ì8Y­ÄÞµZ‰ ¼‹ad$.@¯NÀ¡—¸X™LŒJâHâ)@Ô… cÐJ\@à]ãÐiæ琉ÄÞ5d¼ÄÊþQb4Þ…89€- X‰ 0ßCg¬Ä(l2K$.pà]0ý cl5阼ļ«#ºOÔ¥Ix\·ðò¤½O8ð.&*+qï‚>£Äàø 3ª‘¸ÀwµÅL-éÀ»Ú$%qï"np“F qæ·I+@WÔ¥I¥%.pà]Ð’‘¸³ð¤"˜DÔ… @Ò€Œ'…8TâÞÅôž$.ðà]嬕¸Àƒw!ìu°ÅF#qâè0l…1`uRL!éÀ»J£‡%xW©$.ðàÝÄï¹,߂ߟ¶)Áv„kí®3ÝðwgX§Û@P@S/Ÿí SÛaw¯í#¬W6Úµ/Zž$øiLÓÊ‘a›ï>5Í@¡”#ÀCÜžÌólÀÕæ˜pií±úwôèˆðŠn|'*s[#P$ Z#"ç±@’zÅçˆ4/ßÿ…¿FÏ[,N £?H˜”†²é…!rôóІ]¤Zzw„p2ÏÓ!•9¶L¡µÇG~³ŒßáuŽRû2ç·nËi­¾¡œœÞœ°kʼnÃ1æ¡liù¼°Ó¶Ü¦‚÷Êza!Ç`[«CœGvû@L{2ÏÓ!öN0»7«³~® ïÛ#™Æ¥v ÃgÃ…?ZïF-;h~ Â=™çéÐ|ã~ëRªôF7m=n†r9VÄQïá{™QKl4Œ£¨¯øvÐËâÓü*&½çò<zcÚMo «–†>3+ºñÙP1rÔK癇U´™2ß‹ø{¶›hç2è © Ýâ¸[×JYÜy¥çò<JcÕ]ÄÕžêé†q/u@REkA&ÍqåßóÃÿåÛ–ŨŠ&£)ÝAêÉ<φT{×þÿƒh€•×luk‰í ë2÷n(6¹ávï õ=Ø“yž­Ç±kë¹×5JÊœÝÚ\í«Öpg—½õÌ Œ¨5¯ Ñ,mȽ©íŽPë^×ù7èXPSö~wöêÈÊeYÿ¾gmÅæÀÚÉ#¡áþY³ßï ø=Ù“yžÁÇñëÈ_ãŽÒj7É3$UÏ<òP/ÆŸãÐq‡kŒ_qn¥2[sвY!íÕµŒóÜj™_óûrÃ|¢^wàâsyžÉÇ1®Ö³›{BOÙ³Ã=¶=.¬e \jÙ×Í}9buè¡þ!Fmï~|~4Kv›wÅ4"¦é]Þ“yž Ótg—w˜óœ^üÖyœQõN_·xÄÍeff—˜r¬ÿ¨Ÿ÷î%oÆÎh ·;mg7DÅG³ÑÏH˜ni¾¬ã¡‚ÕÁ_âŒÂÛ)ã·Çº¤ó+}~¾‡ßsyž¿wövü®ü<ò4‹]Û“.i+<60u&¶}l§Iíî¥ÃnãþÊRNÙwÀÚ,ßFÏ=@(Öí’=·M‰ò ïÚÄÒ¿þÝ¿ÿë~Çö)óM^Óµ{-Ë@š=aš‡‡ÑÚО½;§u™}^jËæë<.£5{tÖµzÓß±YÒ/å”zÜìíÎÛ²JÚ‹ñ,ù‘¥¡E^ü}ÆÁNsÿ±¶Ý.¿Žõâr]Ú°ø§¶Cå½\>c³Ø·´‡¥§lëmF„ö‹i~e“ËoãØ|Ãb“]úÉeF³‹¿lËñ6¿ª”_‡ß–£–vÍ~*¾:²#Æ=;ToËʹÌ<¢Ûò±^‘ñI(»à5Íù F^—²>svŸ›¯‹/ªMn™åb÷uncÁEXÊ]ü×1¶¤ìoxÒKŸÙ¹<Ž·R–•í˳¹yí«UÙÇ^~(6.6Ôö™`ßêóPÅñ0ˆtÍ^,‚¢s -ò-Ö µq©—!fY¸2wÂn…ÉO*åㆠ-ë”·Ùsכ߻%›&çq„Ýë½ÜWùô ïE{îåv~J}&åæ·ÐÙÞõ)ÇZ‘óvÇC?×ãw[O¶¼ažß¶}Àóùœ¸Î¹÷rç~Zóqž§h0Ê"!ÜÙǦKK/Ö1.DN -Þ=à/.Ú lÂ]¥v/ÐÜrù¼¢”O*-#{ôÄ…À2ε -t÷ᨓyždݸ/*wÄ}êóþƒòÇ£³ôÄd7ÃÕçº|ZØ9[ÐͦÊhÃy,æS°Øp–Iž\ ‹ižœ c±f‹CšRr1è¡Â#ÆüRÿŒ)g͹‡ôNæy:æ3Böq¸yì|Øh.EËÅ´ü†ùZÔ9öÀÈç!Í—þ`rY6˜E_¿,KûòsÏP÷˜RL¡#æ䣠'ó< Êú[£Z¡ì=)mçòG’ÆÇ’öõá¯Ik<×cDýóÃʾ~ #{7ROæy:¤ÚC>üÖÇy~Li|Ynç†ø@òmmßéHêHZÚWxݳk;|6Kž´3òtoGk7{eöèfÓ.2©ña>¹ø{È<—çéé9ô[^‘ä[Ýäy??!ß}²tO¿y4ëuÁ;(ì±93)G>#æ…çò< -ÏÅ‹­gØ-½‡ Þ÷zø–ûDdí»?ì€ÿŒ§:ü~9Y-8ô´Ë§Êç#Ò;¨­aön’;­[Ûƒ§®z8ìk½K"óW*Øx5@b -ù½=Š|“ÑÔ]~9pc¹©˜!ÑnÀ/Q‘©ûeΚÝØnÎdÝ×Þ5ec¹)Rn:¤YnÚÍYÕ÷â¼ÚÜ´,õ}^öFòüÆnž´òê7q¼ê7ùkƒ«mØtã_NÓÔåDeåã¤MþÊ…«§)ß3 éšOðŒÊ’®Ý¦‹£õu'gù¢Š[ªå»+T>Î:eZº•_,é,þÃEç"ÔÌó9󪈣©]üvÉß3@‚˜¨? -pGœ…ËGÕÊ"Ýž,¨²H8LiLiݤ–ýñƒ¼A34®¶&çw5[>ÿ‘TMdË ˆsÅ‚9½ÞŠsëÕ¤qþ®†8ÙåÊ7Sò ‡&ìOÛ ìULè¶BŪëbCÕÏöm®ó]ØLç®Ó¬ûkZXw oTkGé›(Í'Ä×¢ªwj2ËŒJMêjÊÖ!ÔúIÝ.‚ð;U‹&tfÓ³^ËçìÎÂXD-]ªéÑí"¦[Js­§BK{ÖT=ßMéP·±9^ÝØ#:!ù #ÊÖkq~Š¤õµŠ 7f#¼]µ‘ØÅo„Ô®s…rz\hY¹MUÇK—†X]…¡Yeù”ÒüÿL®I3󔚤òIÃýªW’Çf¯Äå¾±IÐzZæ.BÃ,÷—ŽJHŸI·¥n[I™Ë˜<¤j^&©Fk±n¨kâLaÕ?+¹PU#P]»å·•¸ÛéÚPuªUæ5ƒ»kåv±oÜùÆÅ¡õ¸ÎÇF7{[¹ óUx+â ýX+éb£Úl×+cÂnH¡‹;¾q­ÊÙ(ËÇ>Ȥ÷vùó¥LsÆ:“Ÿ&ðVçoAàQ—¾þÒ|ßÿ¾Ðõßê±»ó> -endobj -633 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 311.373057 101.433071 292.623057 ] -/BS << -/W 0 ->> -/Dest (cb107-1) ->> -endobj -634 0 obj -<< -/Filter /FlateDecode -/Length 4712 ->> -stream -xœí]ËŽ,¹qÝ×WÔZÀP|_€1 2¤1,xà yaxÑ·fZ‚Ñ#`¤…߇YÉG2#•Õ·• ø6úve‘äáa0’YTW‰Ÿïþ ¤DÑ;ºÞ~¹üz‘Â[‰CŠÉÅ þ¿Þ^•$/¬Š.Øë/I`¼ðÑjï®oü×]¶Éß.ÿù›Ë_§yÔU‹Vöú·Ÿ“ŠŒðÁ{iU„J*è¬Þkë•S·#§‚Ö“¦¹Êà ŠÁr*˜AZF`†!¯Ì\a†öŠ8ÌPÑzF¥$ìPZJVC$‘ÑŒNYáÐèŽÓi%\ˆ:²:òšÓ#œ'e§‹Â9g§#Øb£TœÎ«ˆ$§ƒ-d‚çt¶g$«ƒ-:xÃé tภ-xÁšãHDïÇ.Jèàò±:'pm9.ð Êbu°…?ïyO洫Ńßàø¸;óœÍë>©ÕïUi{|á©íd¦ÚÃKoµL~³<=³¹ï=HÞùÍFòúÄYwæ9ú>öìSðÜ#‘ªt®~CÇÚ.öo{Xø"¬ß(´3ÏÙž‹¹~J$¿G¬ áôÉ·fÜ?¼o‡6ßfãƒ}o&. ·ñO÷>±Ý™çtè}ì„žzW5£¢ç¨vWHËamz¡ÌG¿eûƒ;nX›Æ@?5#µA÷±}^ (=°¯`gžÓ¡tc_Á#oGo¼+Ë}“Ä°·³sú£¿ã?9*I _°õÝ;óœ©;ßúÿ'üÃ6¶k§mÄÞÏSßÛÅ£5ˆÁîÌs6´Æo2Ó(Èl÷j*9«æpã+‡{o GmÚW?Ù5¦é†½«}D(ûu¯Óü3tŒ¨b¿ ±…<²d~çৌ¶ÁfßÜgë uÏÏŠý o¡Ä1ÙyN‡àuÿõ‘oÒHo|$å–ïxäP/y9ß•x{Ö¾¹§E!ûÍJ~nkrZf+¤¥ºÆ ß[Mû ùÛçrÝ|"_lpñ¾<§Còºk˜õìì™Ð){¶{ƶą¹¬ŽKMóäuö\Žš:6¾‘‰µ¡úÝ¿+±2‡:Í<ï„i2¦ÏfðÝoÓ¹”ét…ØõP€¼™d·óƒ!òñ -×ôÓÓˆt˜D:”Õ„+œŠ>c’€ø»?þû¿þé ÓWZý|LŸøexQîv§§t¿œM©{à}H34þD7fpãRC%°Tw0ý½S]úb‡¯)­»ÿeŸ‡rBžLÇúÒCÚ”?9 þ®Ÿ”oǺ{†2ls6ßÃ÷}7þzqÃy^Ó@àU¹ÛÔÐÐêºs8êö×’j<ýV¦ñÒaH÷£q›‹1ý¯C‡ÿrQ‘DjÿD)÷“*å :_TñÛ%TJŒ˜°ÎÚ)NÂñ£,e‘Ê ‹ìfö"ö)rüKáÆæÚæ»IùmΖN!™™á •{ÅŒ9š‹ÓÝK¡Fq:í53^¹bŠuÙfkÔ¦­ÖŒ›bed#´s¡lª«bMÙ•N+M窰˜Þ6jº?§Õ¾éÎ5áí‚jM/}c¥éŒÉ\Tn]-‹Ì4FÅ"µ9eé*ýĈnFøÌE:³è›^K'uÝ…!‰Jº˜Ó1¢Û…M7–fKOù’*Ô¬1·|5¥BÝ„ÒðŒlh£QêÓñÕÍ‘&œŠ]êÜ×24¸Ñ3áíb©ŒÄ*~»XϤ¶•+¤ÍÐk…¦)·ˆƒ¬x©Òôzûý†f–¥sŽÒÿwª°Eš˜gø ¨@*UV¯j%ilñ´‘Z¹+¬C\ (ò5mÓ\Êû‚Ù¶½TLúDº%ui±‰´i²Fîc6/‘T!©XÔq¢°Ü>…+[¡ÌF º*¶ÊoqµÓ–¡ -°çÊœjànK¹Uì -w¾µb_z\¥ƒçŠ½¥ÜóYx&6êÅ ú!WRÅZ–Ù®VÖ«a …*®4ú6ˆóh-ì4|{øø±2nƽ]þr¦9m¬ŽøàŒJ稶^—ºþ/Òü€ßÿ¹ÐõßòÁ]÷y\˺pëDÜÎdéÔí°SœNáÎÂ2l¡¦†ö«X…šÖf4”y\놯©f—•ØsJUTm+´µ ±.ÐÕÊ4-cW„·®‹#ólßÔ û~iòÍ¡“Ž|ËVᢽ\†ª3uJ¾6Eâ*%­S:´¤›Œ¸h ÅeSa¬–MÌL€l+)MŸì§¶+Lª«¹h܈tiªŽê4ÛeÃ]4Ià›ö¢-˜T[iœØÃ}xx=Ýï£É.€$-Ô^¤o­´ÜX’Âã¥f¸tÓË2ç˜kºÈƒ·¶P)Ë4cÏ'§êZÐä¢Åh# 5Û˜À¶•R–M*ÍE¡ Èd–•}¶ÉÙr³ wØVòŧ¨Ò¿´-mÛ^)hÛ^q³´©Ü<ãoÉȶpöõîdMY|ÉÀÈ\›»H©¦4Y6¯›¦uçÙöÚÜUC\õLeÍfg)ñß‘±sÏÓE!¸TùgˆŒ¨PºÄDMÊm®1¹;Á9p¥¨=…&TòpžõØÉ[”ì-=ÖLh¨ÒœœE†Œ0càs•KŸ–Š6ÇEËÒqé^*6T4콤Iødøù?‚Þ- -endstream -endobj -635 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 634 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -636 0 obj -<< -/Filter /FlateDecode -/Length 4907 ->> -stream -xœÝ]KäÈq¾×¯¨³€¥òùŒ=a­!Á‚öAða¦fZ‚Ñk`¥ƒÿ¾¾H2LF‘¬îÖ äiôt1"‘‘_F$É,}UøùAã¿HzŠ1O×ÛÏ—_.j -Ná_.±ºÈì?à7¸«V&§“îú3l˜Br&øëëÿ —}ñ×Ëýêò¿ë:új¦”¼Ñîú—oÌ";…‚r+¥´XÎM!ç–׆˜’Ä‚.¡-+@ JÑI,ˆAÆD!†¥ í–• † š$ÄÐÉ¥äÐF)‘A‘5O»ÉCé^â=ù˜Ly<ŒÄ³vò´Ó/MÞ{%A—”–x²8M¤$d!ƒÄóÅz«Dd11X‰ ‹v’À‹ÞEdQ^i‰—ìäR$y <CÜòŒr“‹Ö*‰§õäà›VäaFÁH><Y¼rIäAg•‘x²~$pÂÙ£0[ Ïn«¬–x²HäA_Bã!‹ -^‚Ì ‰qIÂÂDÉ&Ú‰"E LL…`%0ÉMäSpÀ* žÑXYy ¬†,„™+ò ‹M$a5$,°²²X -Á[$,°€[RIKX`·¤´—°Àp!¦’°Àqmô$aä•’„˜kX€.¦{°Àu­óF ص½„¸kI+ ¸k-jŠ<È–°è8Y­„ܵZ ¸‹id$,€U'ø¡—°¾2™•„Ü5Q‘„Ü5K€È æ •°€€»ÆaÒÊ Ü5N ¸kÈx à(ðG‰Ñpâäp²`%,Àzž± ±É ,‘°ÀwuÂò'Ìi Õ¤cò8எ0ŸÈK“и0o¡åI{Ÿ$,pÀ],TVÂÜ|F €ñVT#aîj‹•ZâwµIJÂÜEÜà$,€;L€„Xß&­àº"/M*Å(aî–Œ„X…'$"/Lp$-aÀxRˆC%,ðÀ],ïIÂÜUÎZ P`…ôñ G› ¯ŸEd>ŠV…ÿùÓPºH1ïÒ×ËN|DtK£q×O?_~ýÛŸ~ú—ýxৗËÿI)ºýøƒÆ_–¿7TAäqÍ´ZF·rV/4³”Y躟ÿ"ÁÏmßÊr;µüнîÊfyl׶[÷Qëø¡­(È:™_~)§ÖõXæRf£‹¥¬uÛ1×2_¯ŒaÔ—õ­ ùAç_?ýtùͧµKæL*»$iÞÐÑPóŸ«ò/þ{8oJ:ïJÉ/kƒT/Nn">§;ŽâšÑG‡2/[GeA¶®Øwù·¶×Æëä²Å)Ë>/ôÎqë(}r.ÿµ›u2ýXÜ©"løƒê Q/»U[#HBЦMÌ–øÍïÿýßþó÷ÍH¶¼ãw‘,öíšµaª–‡éZÝ5<—u ?_Êèæë =ZŽ Ÿ§TXh~®ÏÚ£k·ÕËíºYà –vŠŒK¿\·È›åðM†Z†zÖñ)¥ú^©,cµË¯ë,·\ç1,ú(ãP_ [êƺzj]žõ¢n³ ¿šEó½LHôJZ¾û¶Èd»8†ð8ëÛÓ_·íxË©)ßþض£–qÍzʺړkí9TËJl#3ÏbA6¾ æ!nÚÎþ™æúÙG^–¶>÷~×tn¾-º(2¹eY‹M×<ÆìaiwÑ_󱥬 õ'½ØÌÎíõþ–Û²²|¼|3JÙ}»QYÆE†2žL“äsMÖS.”©øö<—:½¥öY÷f^ë6ÆÒ~ JùâkÜèìGóJanƒnWòìê.ŒºËsÔ¬íålÓaöÕ‚C~ÇîVñ-ý^ùú¤rÙŠº“£ÌéÐÊmêRïÀnlWæ⼊íé.mt×´U•ÝwãZ|%ûé¢ó•ŸíÍ›Ñ/ÿÊ´~œAÝ·]ßglmçñ¸æƒî&ÙvOGVKþU׬¢ç¸ÖI™oYÚ•‡w´Vò˜eÌý\+¸;¬6ªÉÛœöñmÍSëÉ:oJ¾?0VuUÞDSDRk”¬æéå¶Užž¶ ‰f#Üí0ùI%¾e5tX–±ÙìK?‰i?î·hlšœÇEZt/Gµ)æ;¼Þ‹òÕv~J6“jçÀ¬h¬7öPC&?:EÎÛ;¢oC8>ô± -Ù­œcnrÑ´¥Žžl¾‹Á;ºoÐ<ߡê|ÇyT›í ±æã4OÑ`–EBˆuß7]Z¬°Ûǘ¢ˆ˜D˜|Éw¼˜”äôîËz^Âö^p» ù™˜ÄwŸ‡Nó̾zäu0K+,Ñè¬ó$yzÅ>~^cûÔç~I’ê2£ú$¸Ð¨áXMâ_Ö>£>—m=Cçtc=#7;5câÞ÷œö{¾gûàxΪï¥e!~Y|oKSJ.=t¸çwŽoZÍ>ä¬)ñÍ–ýMÎsužÍïß¿ïwÍð·ß¤á­ ·üåß0_‹<þ¼¤\úóPæëòw¡³ðËï×åoêÊ~ùÞ+Ò[6¥îx™ÍcÔI/;WçI¼¬‰õž—ÝÛ²ÛlÏ}Q»{Äì0Ù›lçe æ·ÁjÒ"#gîÏÜo{N÷=³z›ÚÐ6Gº~M+2é+ëT«»÷îzj2{ê¹:Ïæ©^íâ¡ä!ºluÚ§¶˜±‹5Ã&û -»k»Á36㺺·µ|YŽâeféyÖ‰3i_Æuß]Ûá³Yê¤;3O·qÔqߺcçÖ=Ïôºâ!? Kügž¬ótžiw1tŒÔªözÏÚó’Í­Žû>?!Þ}„géV¾Îµî«yó/l±93)Gž=fß ÏÕy:/</VËt·UFëV«|éö[J¾²ã©#ö‰ž5Z²ÇÒú«wáÙ ¾ÌõWw¬ÕàQ›åã}YW8)ìmÑA éûxðäã'ë<çÄ£%ÃZÓïë,»YÉî|–¢ÿÚ-lpGZÙß#÷Ë~M øÞœ÷‘ìí;D7Ì -i§÷Öz<‡?Yçé”Îïøí{ã¹:Ïæq?Ž½w¿°Ç\¶Ì{òézWzǺ»™ÚøÀñˆ¿âþ£wÈ6Þ?<8}vg­< üöuIöÌø†xõd§ó̃xõƒWíñª‡ö?"6|¶èçŽ×v{£ü^t~ríðõŒSužÎköSß>o}À½*x#þÝóÖ1b)X:Œ³îb½1úúß¼ŒrpG4¾áÞýÉ:Oç¡û®'ïÕÈàÄ«E9+JóÝÄ ¾‹&µ~tÈóG/ßë= {ê™õÆñé‘>Þ_SZ=ë0¾RõÀÝÒØbNJnBÜIñèyº“užÍkÓAœªdoéW£74ó‰n~CÓ,V1~ßÊoyqMz -¦bìxÏÞoïTÜÛ‹#þÞÓ2ss¹!»gÕÑÒ¤ÇË“užÎóîÓùíf® –]ÝW×ñ‰”éóá{»å£Ç>²»~âéÒ¼µ;ÜÅ—!NÚ?±àÁçê<쟾#¦<ã]ì[®îoõ{a-SõŽ¯³äßwÜ=­ÏŸ2Þ2N߆qxÙ8KŽžMÝÞåÙŒèd§ó¾sñæѽv’²”;¯£¿9ëbÅ<œ{ÏL¾ã¥-VD 4Eö¨£§QNÖy6/…N%î‡iG›rH7F×Î.ÆiQPõaÌU Önж­;S`Öoƒ küa9[)8hÂñ¹Ò|JRêŽjª6=,r`ÂòÂÈöð™«üY¿S‚&ùPu¯–JÏ!»÷F ¿vnÊ+Ì~~}Ù.j,g>zay†Õ”·Pò† d´Pók¤ßš ò)Ëk¯ù•Ð´ìWsY¯Úk´Ëçñ5öÜ_>JAͯ•v¯ÇÖöË««<«×yÓ².å1lÌøËÅçóôt>SUyÄ$†]¿zšømð€Iù,>Kº˜MgEëëšù¨ú_j©åôzÅÚòa†óÑöÝÅRþ—lðŸ/:ÑÄúÏç:䓦U&GS.ùõÂ'“@&j‡C™¸|Tµ-Òõ¬‰B»¤Â”Æ’ÖMjùؤà×iæÆ•Ñp}Wªñ p¤J!›Ï@›;ˆ¨éõ–Ì£W“^È|Z{œìrå«(ü:h%¶©/ÛlÉÚªŽè¶DÕu×ȆŠ<šO÷¬ªóXEïU§;ó—²&tæÜ#Þ.èÖŽÔW‘ÊgD—¦Švª4Û •*Õ•’Õ Tí$nøƒ*MŒYùÕø¤Í™‹#Q-—J9t»ˆå–Ö\µT¨¥b«šŠæ›(ÍÕùÜû´[whK௟è戲åãšÌçŠT[«ØùÙoGu&6òëÅ¡´kX¡\q½žh»v+9ªæ/ÊÙÛü S³ÐøœBþ† -W©Œ<ùƒ¦êR|Öh»jðܬ䵒zº¯¨C’4…V¶S—¡úl¯/•PžA·–®[Q;•uôŠx R<Öd]½®’Š~*VöDU„@wìª+¿®ÈMNW§ªSµ3¯;wwµÝFö;_{r¨çã†Ê Ú:à;Ÿ/Ä[^Øh$³ëÇÒI#óQ?Å}jg± Ph䣯™\fkE'þ2Œò±M2iŽ]þ|ÉËœ±ÎðYÞj>½ºôõÿPæ'üþÏ…®¿+oÎë¸Q-LÅÖ¹_Éø[3âI2‹F!ÖiÓ u°ßÈ:¶²®xC]ÇéðšZuÕ€½”ÔAuåöD×tØ‘Mu]£m§·C¼ Z¬Ì{mÓìùÒ–ÁñÙ|dk‘ -ýpp϶%ùÚ5‰+.Ú–tpÉtqÑ7ŠË®ÃÔ$[‰ÉÙwRUÏòSo -Ë}u]Á—¶ñ¨-³}Ó…–GÑAlû‹¾aÒ}§i% ô›§×»í¾ˆìË `j…öJ}í©u`L­€'Sm¾ôë˺æØ|ìC™¼MCµ-ÛÍ=[ƒœ65ZhA«‹ÞG;jlÕ–®ï” -mÕiY(*\€¦ -­¶ŠL~©VÔ’GE-…S4êŸ{M»Þ*U‰®·Šß”åvËŠW£%[ ×»sh£S­d%£@ó}íJ¥VÒÚ¶oZ÷]VÛk7 j‚ø™ªVÍmJ¾ ÿÞ2wæ:Ã.„TªüäÛQÕX¨Iklþö1½†D Øm•<\gïd»CRöNúž`Ž‰¬UAó÷ÈÉ"¼‚‘Ž]Så;æäjI‰CzLÂÖPƒ9µÙÊ_$”÷óQ½ œ*ò÷†Yz#ÝIPZ>“·ôÝjû$ÿü ª‘Î -endstream -endobj -637 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 636 0 R -/Resources 4 0 R -/Annots [ 638 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -638 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 558.873057 101.433071 540.123057 ] -/BS << -/W 0 ->> -/Dest (cb110-1) ->> -endobj -639 0 obj -<< -/Filter /FlateDecode -/Length 4922 ->> -stream -xœí]M$¹q½×¯¨³€Mñû0ö @†´† ØÁ‡žÚm F¯€•þû~ÁL’‘ÌȪ¬êžÙZAÓèéÊ~ƒAfSŸ~¾Ñø/9=¥”cpç˧ŸNjŠ^á_I±º(ê?â7ú³V.N^çüùGØ8ÅìM ç·þ.yò·Óÿêô×u}6SÎÁhþÛ¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS€Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbà,èlº’¨ƒ-*(-é²|NΉº J1muFùÉ'k•¤ÓzòÀ¦uQè¤-Aù,ê`‹·ÊH: [~$xÂÛ˜’0Z n«¬–t¶¨ƒ-è|‰L€-*‰0‚&â%‰LŒ“ËÆI$`’\rIb“òäb´ ˜ì'r”xÀ* ÑX[¼ X [F®¨ƒ-6;‰ ¬-H qµ°Å8+qÛ: Eâ ºu*k‰ ,øÖ)$.° \˜©$.°`\›‚“¸À‚r¥,qçZp§Ä¤‹á%.°`]냑¸À‚v­KAâ ÞµN+‰ x×Zäu°–¸ì8Y¬Ä¼kµŠ8ð.†‘‘¸½:‡Aâ`e2))‰ x×$å$.pà]1ˆº8a Z‰ x×x4Aš¹Á»Æ+#qïg‚ÄÊþQb4Þ…x9€- X‰ 0ßCg¬Ä(l2K$.ðà]1ý cl5锃ļ«ºOÔåIGx\·ðò¤CÈxð.&*+qï‚>“Äàø 3ª‘¸ÀƒwµÅL-éÀ»Úd%qï"nð“F qæ·I+@WÔåIå”$.ðà]Ð’‘¸³ð¤˜DÔÅ @Ò€Œ'…8Tâ‚ÞÅôž%.à]å­•¸ €w•CØ#ê`‹MFâÄ5ÐaØ -cÁê¤ ˜BÒw•FK:ð®R1K\À»4mJ\" L’¸Nˆ‚Ä!¹)Ç$.YA‡OÔ… ×^₨ ð ,Q[\t °ž²ÍIâ‚h`‹5Fâ‚h` B‰ LY#ú—°p׶ R”¸L6¥ìœÄѬÇàUIÌ”"èZÔ%èt”¸ F7a*Ö`-5% z‰ @ð…KÀ è´“¸ fØ‚¡"q¦¢)Dæ’NÃÙ Ò…Nk‰ ’-ˆ%.H&a•”Ę¡±–„«%S´ÎL$& -%.À0ÁJL)ê` hBâô-¶½ÄXü`±‰eŽ¨ƒ-Ö;‰ R2´ÜL¤[Œ2›´ÞŒd[ñI\U˜(L–¸4Rd°Þ4NâŒKZo&‰ ²UXob‰'ŒÛl­7£ÄÙÁEÔÁMY·à$¬7ÁN’.À“Ä9Zo&‰ f`½‰ˆ^ÜH´ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^x}D|&+­8“¸c @½s«¸e À½˜­¢¸g @¾´F7 `&V–)ˆ»˜V¡ÔJÜ6Pà_Äcnà óîߢ -€CÄœ™"52cX8D÷mÍÑ“ÙdóþØßþ|úõ &ßóŸÿ~zýUÙ)«?BIí_a˜Œîöˆ¾5šoQ4HC•ÅBøH2"æn¤-.›nd$¦?úwÞ~XYÃÉtäƺ(Ð^F4°¹~0Q)ÝaQŒõ¡9³›|wž›&GDùÜ>hÙÖî*^o÷•dëÝy>ÊVÛº5SÒR-`ki‚v@ÂY> -‹ND1il6Äúʈו[%þͧ`±bÞ[n—Ì|Ä!„nüùÓ§_ÿþ»ïþõwÿ ?}z=ýé_”òáÛo4ýMó_wY®ãr½Èk:C±,Úh^ñ3¼3‹<á׆tŸçkIGyŒ[Ê^ôö²ËRîg–Ïõü¼.Ä#ˆÄñËÓ¾Ìu`Âîå†Å–¥œ’eiL‰êõƒÚñ?çOß~ûi ™Ÿß‡²cYÞƒ²/.,ö¯€ëáfuW‡ˆÈ?®ƒ´c°c¼.í±¬|¶f±í²šl·ßŠp¢û ÷âé`žgÖ|×E¨x¤g­ÿeSÏûìßA•m”ãôâ2†p UÇò<ªÜ!žú¹xçîÞý0¾YFýUô»ƒQϸLkŽëH9–çér=\já‘î!Q ‘ÜJy¿Ö“‡½]tf¦†[^Q¯ôAþ¥WkÞjÃJWmˆë4-|ÓÝ>)¤ó<ݬÕΗ.mÛ©¿¶Kj»{l­þ»,eg¦{]Û^üdvÐÊB),Ž²J†å×Ñz,ÏÓ¡õFü•Ö½P=L5´^®=7 µ!S å *å})$èþ¹Õ¡ÖùVˆÜi³“êÚÌç?W” é^Xº°®¯ùír›WMÑí,xUW‘z0ϳ!Õ\ën¡qÿM­‡G1NÓH¹3oÙ8Œ„Š”¯9âò†ö©k‘=¾óô°B‰pk¦?˜çéy#&Ü™uÇY¿õZÞÊwÙ!xëkŽ€ýåÁìðÌót¾«~‚wÐr²ÇٶŔŸY¬÷>3> ÂwÐÛãPz¨Ç9,Õn­Éæy:ôÞˆ]oŽÿCøWCè=£æZƨDðIÓ…¡M¢½2íûŽó<íøtŒöÇÛ&C/•5uE쀄Ÿ¯—Y}µì—…ËؾÉ~9»ƒ\{ÿÀÁ3DŽ~ÞDH;H}à.÷Á½žÅ§GïØÌólèõ7ž {kXµHO¢Œ+º÷ÙP1r*„sXE›Ù)ó^Äß²ýÎ'nD›–à¾g#•¡û±ç¼vPúÀsó<Jo˜çé|=ƵÂzvsOè){v¸Ç¶Ç…µ¬K-»óº¹/çXz¨ˆQEÆ»ßãw%®ŒÆR§Ýæ]1Œévyæy:Lüæ{² ~ׯaÇ•Qoôu‹Gü\&1»Ä”›/æ_éç½{É{ßY‘îJÑg?DÅ×f£1ž‘0ÝÒ|¿Ž‡ -V‰3 -o§Œ_öl¬¦û4ü| ¿Çò<~oìí -ø]ùùÊw°Ú“.y+<6¿s ¶}ô…{{)Ža·q…}ãRÞk³|;j†z€P¬'Ú%;‡…Ž! Új“JOüöÿñoÿõ¶OI;4´¦k÷Z–;€aö„iFkC;ywNë‰}>×–Í×y<œzÙ.ÌåÍÏI-ù.+/4o½gº<§uq)Ó×;’Ûü®¦}™½zÈ»ñOµ…~îçÎEëU”V„Ž¯¾ÁÒ¸ušrm…–.×¥‹—«WUùÞ5\Y>µNOžR—ÅaizàmNŠNì²tbóÒf»ô¶'¯R¯syúûm9ÁÒqftd´knsi÷5;0qïØ¡z[Vþ(¨™yA°ŽNÊ™…² êóœŸÚWÚHe½p4wŸ›_øŽ¼yϯûÚ/£ÉÅ¥ÜÅ/KZÁþ†½ô™­¨^d ÍK™lD‚_®ùÕm7‹-û#qÖ›úKõúu¶C/m°Ìo5>(éYÿ­ƒùØÍóƒ¹ÔñÃ|û犫âãØÓúZOXl«6†+>ÚQXË\õgýÙ0êNå1¬”;:u¼jfs{±§ËÔ5_ãÙWz¹gXÒª¹Ê®}0öC³)0{«ßu÷;æÛk~Ê? øn6ïàa={ÜÆëzƸ5[ȸn|å™Ï’à‡eŒ‹þ«e,òêo—¯ù«œŽ¸òW+—Ͳ›q÷ýÏã+£®¶…NP\sŽ[ðË8 röA#‚:r9FûP}0ÏC‡»}`èìû)VnJÞchË7– .ãÒY/”aY6wÂn…9L*ÓÉC…u -ä7¨{ë-ÿÝÍ“¸ˆB‰þõVn—ʉâ!ˆöÜÊíÔ=úLÊ͈n {ÓC¦¼ªÃù`w<ôµ¹ÙzgË©¹t‚螧³ãáºåvÞÊMý.´æã<ï’Á(KáÙ>6}^záj ?.qFZ<½„„ŽÒÌì\ÏÆ7“Ü ‰º4ÛžùxÖÃiD Q$½Ç&ŒƒÉåH‡ÖJ«5Š{)Þ45. -Ë78–ø’œÒVt‹ƒŒ_sÙs¬ó¸Ÿã‡êÔ§-so™Gò,7-Ng1HP›øµÔ·Ä¡|ÎX•_çOfÏjþÌËó§¥ ßŽÝøÓ)”×u9€_…4iCoè9cF!fÌg:ð9)ëtí6]­Ï;9Ë{~j©–W)zû|]º•_,é*þ#–˜ÒÔ̪ókITÅ~¿èµ4Nc™nŠI¸|T­,§Û"¶Ê.˜ã”Ç”˜jÔò±¯tiþQ —ÖÖP~_³ÑqÁNÕD¶˜;W,‘3è­˜Z¯&½ˆéÕ>i²ËUh¦—7a/Ðñ´½Àžñ¦X[Å„~+T¬º.6®Ú£é(øæºÐ…Ítî:ͺ¿¦5‘uç5áå„jí(}¥ôB‘ZTõ®QMf™Q¹I}MÙ:ĵ~D—“ üFÕ¢:³éY¯Ñ±ì³0U ¹–.×t‚èrÓ-¥ùÖS±¥J=k®žï¦t¨Ó‚_va»A‘ÞUÆƈ²õãZL -­¯Ub¸1áå„ØmÄo'…Ô¾s…òz\hY¹MœTÇK—Ò ‰ó' Í*£C­éÿ™*|“ó”Ú5HÑÁôýªWBc³‰×NâòÐXÇIÐ.ö´Ì]:ƆYî/”žH·¥n[I™Ë˜<æj‘T#µX7Ô51QXõOãJ.TÕTמAùm%îvú6T½j•Íàî[¹]w¾qql=®é-ÍÞV.Ã|^ÊÄæF1A?ÕJºØ¨6Ûõʘ°RèâN£oE\Gkc§r¨Üò±2iƽœþr*Óœ±ÞÐB- Žë#­õùÿæ;üþïÉÿ½žÒ>ÏãF5¶0[Wb>“Ñ+ÖÒA1½r­ -Û°aBãíw±N=­¯hhó¸1Œ¯]Ï®:±×”º1¨nZ.ô݇Llt¶Ì3þŠð2x±2ïí›>aÏ—¶6Žžt¾µ -¼9¸L]gû”|fE⊒ö)ZgXF\ðBqÉ*Ìݲ•™H^Is=ÙïxWXª‹]°0‚.m×¹>Íò¢«¬´‚%Alù/Øi^i^Ù#ýððzw¿/&‡:HÚ¨½I߸´5Œ¤ðd©-—a}Ùæ{¦‹:x»‡ZY–=Û‚œ>4zháV£Lšz¶%畺*[UZ'ŠF©*k%ÆjSX²U·”'ÑK±Å]úîiÏ{¥9Ñó^ ›´TnñZ´d[ä9œcoê)[,™Y๛Ôõ”¶Ê¶u»uÝu¶=³f¸nHè‘©êÙü&åCü÷ÈØ™ó »RªúSvFtêï5ÁDít´Æ–WÕª8ÄÑÛÆ¢Kl«äî<×÷N¶;$uï„ׄµ*jzé°lÂù¶‚U_H,gËJlÒ}¶†:Í©ÍÎPyëdyN£lµËHKEzɬ¥ 7Ñ»ñ¢Òò}zü ¬¶OÊÏÿ´î -endstream -endobj -640 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 639 0 R -/Resources 4 0 R -/Annots [ 641 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -641 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 108.873057 101.433071 90.123057 ] -/BS << -/W 0 ->> -/Dest (cb113-1) ->> -endobj -642 0 obj -<< -/Filter /FlateDecode -/Length 4695 ->> -stream -xœÝ]Kä8r¾ç¯Èó£å#ø{X` { />tgwí¨10ëƒÿ¾¿Ä‡¨PJ™US«Þ.TW*‚ùñc0ÄõUáçÿ"é!Æ<]o?_~¹¨!8…cŠÅŨþ ¿Á]µ¢08|tןY`Ã’3Á__/ø¯»l“¿^þã7—ÿYæÑW3¤äv׿~cÙ!Ä”T *¥­ rnÁ8/¨¼p‹)I*˜áZ«Ì ¤‚dLTfX -Ú®U f˜ IRÁ \TZÁm”u0DY#è´<ÝK:£“I¢.@§ƒ‘tÖ>vZÒ¥Á{#Øâ’Ò’ÎÁ§‰”¤ƒ-dct¶Xo•¨ƒ-&+él1h$è"lº¢¨ƒ-Ê+-é’\ŠD¢.A§bˆkQnpÑZ%é´°iEF:ÉAg`‹W.‰:Øâ¬2’ΤO8bF«áÑm•Õ’ÎÁc‰:؂ΗÀxØ¢‚—(#h`^’8À„0P2$‘€‰v HQbÓ@!X‰Lrù$°JCg´DVÁG^b«a aäŠ:ØbI\` lA‰ ¬…-†¬ÄlK@‹ÄtK*i‰ ,ø–”öX.ÌTX0®ž$.° \@)I\`Á¹Ü)qéb¸‰ ,X×:o$.° ]KÑK\`Á»–´’¸€À»Ö"§¨ƒ-°Ä`ÇÁêh%. ð®Õ*H\@à] ##qzu½ÄÀÊ`bTx×DEx×L¢. ƒVâï‡[fnð®qÊH\@à]CÆK\  à%zà]Pˆ“ÝØ‚•¸ó=tÆJ\€Â·DâÞÕ ÓŸ0¦ÁVƒŽÉK\àÀ»:¢ûD]t@‹ ã­ö×?_~û“ïõÏÿ{yùÍ)Ë?˜š€g “ÐÝÞ·Æí[æh {$-WR5Jƒç …éŽÿ]×–ÂП–ÕSB½à…$Úz4Ó;½nö?|º€_¦Ø¦ç²±´óÎÀ 3` ÀèÓÏ—ßþñOÿúÏÿþ'àâÓËå?ÐG¥Üü‚b Ÿ Ó&“és`‰c ÓµcË_8ÍïÿëúéǶNÃËìÄí²N®F’ÿñÓØt¶ts€—4¶œ‰`Ð\ DhyÚjZûÁ,oi빉q pbpXè&}ŒdÜ¢U»S®|jŠr©­+A‡hºqc7üÓ?þÃ?þ[íõm¤¦_Š¿ÿACæ4wÇüÙÍoÜUóç0ý¥Û|mj>.§¤s>Õ<”ˈ˴£~].µy?Ov3DŠ s–õõ—:|w­ç{É)àÞÄ´vö¨ `ÃXçfë[PóÐ æ8Z³4Fprpʺ -ï!Zó‚a§³< (ñÄpÒóœÓ°å¦W¸3KÜr/À§ÅjnþË¿aºuüÙκÏ]š¯óßYn̬Ͽ_ç¿©IûeÆî·Ù®Ôáu 4§±Ý˜ë±ìš1ÖÉF{TW^ìÆámÙFZÉ(3ÊVĨc(;˜ç$(«fÃÂ;(£—%ºhfR§æëÜÒ_šÞÊ­üµöfD“mPÖ3rî%¿ìµ1Í· ·Ž-_–ú±>³]ö¨ÛAfA›ÊéØ–ËËŸK;¼¯klSÝ´sèõH5ñq¤Ës:¤Ò]>”¢uÇ+Y§Öœq—knKô,¸«ëm×!c…˜Ö¸-ííÈÈÈ#KO£NIóý¼î›kÛ}6sž´1òÞä m Ó>äÈ= ð{È<–çtÈôw9ô#<ÅÓñÝ{ K×ôe4¨e]Í(¬¾93(Gžs…Çòœ…ÇüÅÒ3Ô a‹³¾T]î{Hí¹ODVß“-—>P_®ctE¿Lù§•É²üÞ/në³qÛÖO涻5÷±ãCÚÖä§qŒLßEÞÁ4ºóJ~õQ»ÞÆGÔfH*ŽùÞGï±<§CïŽ_™[ðeù·ðÊç®g›UË=¾kÑòQkä»q«/³Ï,ø´ÅÓècJ=OYÉmÙ›óì®ê6[}Çãˆ=–çtˆ½ïožÆ|ëš÷‘ÕÛx7ŒŠEzÚáÚðøþ`žÓ!÷¾ú÷Ñy7ÎþHtg´îŽ>ͤ_÷Ìs64Ó}¿wåîxÒì\sgd´Ñ¡ÜÃVn­ÜJOÊßKPzÜtÇòœ÷ýØ­ç…-çrϼe=]wßéÝ»+µì#w<¹z²Ð=‹•"d+ôg/ã¥AÚÈÚ˜îMóÒ2ŸðWæ92wüÕwžµßUÅßÃ7<›÷³Ú&6Ê{8MÔÆí¡öXžÓ¡v'žúVßðaëžUQ§ëùo ­½Ç’¹´»ÏÅzÒûê/£s/–êžxv0ÏÙêv⮟Ϡ›!{$Ñ!3¡ŒŸ&®ø%÷XF4Íéûò32:„–z:T÷»6ÏØü(ûÝ#­¿[Ú²·ík“¥®úœ”Ü¿“âÞV½ƒyN‡Ú?UÉhigB«ï§Q/“ïjøwîãï÷òö¡5ÿÝÛS8¶fï×O*¶b±¢'Ð>{šG[]ö£jï ©sOðå±<§CÞÎsún}»ëBÏ.žö³k¿#¥yjhÚõðV´¼Gì#Ñuºƒ¤ï6¢¶àÆ¿ÄGm)ø½ˆÓÁ<§CðNüô >åt=·\<ßjcaiSAÇ× ãïžž–ý§Ì·ÌÓ·î>wPÖ’½½¢¾‰]]Ìs6ôùcþæÞ³v’V)½ï$EÑñÇ_ñûã¹·Œä ”V_ŽÐQ{»Qæ9JwüË£«Žö)e·Úè‘="ŒWEA•½˜ ?/,QP£ÖMOw\ÖFÁ÷vkx÷ø^£ƒyN×»}¸ØµêÆXW¸7Ã+_gŽdóŠÁ°îËt-é8O^ad½eïü6—û¥ÉG5[Wù–E›öóT/J¹~¶%sç‰òÆÏ{܇Œ¯öióQ|Ës:|íxXÏöqÓWõ±ŸpÁ¬òn}|ä>:;úëüm¡RçË̶ÝfL+^™±Â»#æ9¢ÂÎSâø\Ïr|ã{fŸ·Ù¿*óøJð`žÓ¡jg×âߘwîÝwã›yDíøÃቨ×Á<§CÊÎÓ×&®ø«ùÆ;´û}QGâ²Ò7K$¯®}–TV\ML!ïºqzöqᇞœäxí{[Cx|7öÁ<§CëŽÿõkø_ î-8™{`wÏŸèÓ}Vëýý3³E$MFjl"[G¿ou0ÏÙw¢aOÇÕó»IÞ1òöýEÍ6ùÄÀƒyN‡ÈcßdyÓnäGž(|ä¾ýýwƒà'¢{óœÁ;¾ê;í§ó»Þù;T›6òÏ‚ð ô6OZ~à`žÓ¡wÇwýŽ¿å÷.£æCw-n¼퉸ãÁ’Ôäí÷óŸá­é‰çÜóœ©;¾êgÁw̭ؼ­ì£ßØcØuï{Y}ž{1ÔGÞÓÅ÷ôë®7Þ‡ªžphf:fµzÛÄó¹zowfN»`<þú€Ÿæ7š‡žw|š¿î;5/H/ ÞM²ÙõëÔóKʯü³ýÆoÉGÚx5@f -üöÿ­w#›oÓ,:¾)×ϳã¼#0wJkUÞÆhòû”Ç'š§º±kÕøneúV¹e|·²ŸÒó»•Î#/rZ?ý–—‰û¹œ˜»f®9”óóó§ùeä‹òÝ\wcÍïy.÷àò=¬ºñ—‹O±ÐãIFŠ="ÃG^= üØ?¤+Ÿœ•%»M ­¯9Ç")©æ3##ÅGˆLJ6sú_Æÿù¢ ÜþÌ&ÓùnjG“/ªøõÂçû‘ &ÌA1 窔E:',²X9 ©OiÝ æ©Î/†ž>—ï†ó»œÏ] •Ùñä©bAˆœ^¯Å|÷jг˜ÏHŒƒ¯|1Åùl3„µ@jÓÖkÆ]±¶ªºµP5ÕU±¡læ3uJÓù*,¦·M§›îÏiMhºóžðvAµ¶—¾ŠR>™-•[ר"³Q©H]NY:„J? ¢ÛEþ rÑ„Î,ú¦×ø|›I3¨¤K9 º]Ätsi®ôT(©bÍšrËWS*Ôm, /ÈÆ6š¥}mÆÜ“û¡{îÜ×*6¸1+áí⨌Ä*~½¸ ¤v•+”ËÐk…¶)·ˆ£ªx©RÞ}6}ÂÐÌ2>„ÿŸ¨Â)3ÏøASŸðS¯j%<6‹xÙH­ÜÖ!©4…š¶i.BÁlÛ^:*!=“nI]Zl!mš¬‘‡”Íc’*ä±낺"f -ËíS¸²ªlª«bW üºW;]ª{®Ìëî®”[žpçk+¥Ç5×Tì-å6˜ÏÂÛ8±Q/fèÇ\IUf»ZY#¬†ª¸Òèë(Σµ°A›?ÖA&͸·Ë_.ã4g¬3 ¼Õ|ú`ëuéëÿ!Íøýï ]ÿ%w3ÍãF¶0…[âv&ã³jãA1Ÿ]›…eØ4BC íW±Ž5­Ëh(ó¸1 _SÍ®*±ç”º0¨.ÚVèj6bS k´mZÆÝÞºV,ŽÌ[û¦NØÓ¥Í7‡j,””­ÂE{;¸ŒUgë”|mŠÄ'­S:´dšŒ¸h ÅeSaª–-Ìd@¶•”¦gû©í -Ëu5Á—¶ê¨N³mÑY6ÞE“.°m/Ú‚I·•¦…=‚ÑO¯7÷ûl²Ï#€¥…Ú‹ôµ•–ci!> -endobj -644 0 obj -<< -/Filter /FlateDecode -/Length 5008 ->> -stream -xœå]I%¹q¾¿_ñÎ&Å%¸†dØcX°à||è~Ý%Á¨10òÁß_0“K2#—ª®i?ÀÝxU/#¸ƒÁ/‚K²ô]áÿ?"é)Æ<Ý?ß~¹©)8…9Åê!³ÿˆOpw­(LN'Ýýg&Ø0…äLð÷×~ }ò×Û¿ÿæö_ë<ún¦”¼Ñîþ·¯Ì";…‚r+¥´XÎM!ç–ך˜’Ä‚.¡-+@ JÑI,ˆAÆD!†¥ í–• † š$ÄÐÉ¥äÐF)‘A‘5O»ÉCé^â=ù˜Ly<ŒÄ³vò´Ó/MÞ{%A—”–x²8M¤$d!ƒÄóÅz«Dd11X‰ ‹v’À‹ÖEdQ^i‰—ìäR$y <CÜòŒr“‹Ö*‰§õä`›VäaD¡“|x²xå’ȃ,Î*#ñ,d!ü—xÀ gCŒÂh5<º­²Zâ9ÈbL ‘YÐùYTð`MŒK˜&J†$0ÑN)J(`bš(+Á€In"Ÿ‚„ViðŒ–€À*ÈâÈKH`5d!Œ\‘Yl" ¬,H aµÅ•°Àm Ö"aÜ’JZ ¼%¥½„€ 1•„ˆk£' , ¦”$,°À\ ì”°Àt1܃„¨k7XÀ®¥è%,°À]KZIX@À]k‘SäA°„@ÇÉêh%, à®Õ*HX@À] ##azu‚z `+“‰QIX@À]IX@À]àD^˜0­„Ü5M<7p×8e$, à®!ã%,€¡LÀ%FÀ]@ˆ“ÃÈ€•°þ‘—& qaÜBË“ö>IXà€»pTVÂÜ|F €ñ<ª‘°Àwµ…§–xÀ]m’’°Àw78 `“F aüÛ¤LWä¥I¥%,pÀ]À’‘°^xRH"òÂCÒŒ'…8TÂÜ…{Oxà®rÖJX໊öˆ<Èb£‘°q x¶Â˜F°:)¤xÀ]¥Ñø«THxà.»M |`‚‰@À Q°‘°ÀGšR^ŸxùDžŸðì$, -Èy…IX€ÀzJ6E ‚,Ö ‚,$,@D0%è[œ@˜‹8? È‚HQ ّ„ÁyÌÇ U‰çÍàZäEðt° šàŠµ„˜KMƒ^ÂüÄá’„µr ˈBÛáSè¤×iþ­l×®"ÓËR¶oõŽí‘d£¾ý/ëôY.Óåk=ió»ÿ¸ÿôãí÷?­ *Çì³Aq‹8Ñ÷Яeùü5L/¥#Ó£¯‹Úõ‘Ûé-¨8ÝiÚ÷jÊ/wVWîêb~‹É–n?Më¡ŒÂWó﫦Y‡dIœÂp+í¬õ>~=3æ½j”l8”8þ8´ã‹yžÍ1ÿügÉ{Öô ï½:=—SÒWú¨‡>ÿ¨³Ï³ÕR7ÆQTäRvÇzmƒTÞŒƒñ§Ö{-ÏÓY/â𦷊e…Ázz·ø²î=v×=nm0êsÙ†k3;e¾ÕâÏd7ÐÎeЗn¤vÖ-Ž€Óºv¬´ >/[éµwR°¡`Â`IÅZ³eÒT®<ô;ƒâM½£•Äf-+kûU¼÷Gû§KíBTE“щÎ,õZž§³Ôã¸ö[½÷÷¶ºò½Ž¬Ñ -õE]yUV·Ö‘Øž°.sŒfª¾C{õ>®š>½8»˜çÙ¬ÕÇ®µç^ÖV’'àÎb|Ã[< =3`Å ŒVk^:‹îbÐj¹.Ï`!êec‹ÕX§vÊÈⲬÛˆ3ïmYæе³„âºU~¿cÁöí«ó<ǯ#~ËI«¥$ßYRÑü€#ïê¥Ðáç`©›å­1ìðª·ÂEé ;Y9hÙÌöêZF€ùlµ^+ŽîÒ þD½ìX²{_Ëót–|ãZa>[ñç©{vÁÙÿG,,e Xj©Kc†öQW‡êbTQ†0Ô=àùÑhÌuÚmÞÒÈ6ýŽ5Þ‹yžÎ¦OVyÌ>=ë5t¶ÞÇQOúºÆ#n.“‘]Bʱþ£~ÞøÿqŒŒ6#øxã'pCT|äÆxF²éšæË:ʶ:èKô(};Eûµ-Ö%ÍÇ5ô|b¿ó<›ýÚ“µ]Á~Wzqº‹]s$Õz}µ·•>6lêJlû¾•&µ»–BíÖ10®¯,åäõWq¬zùº1Ï=ƒP]OÔÇn ÛòKÚjsOüþÿúÏúC·NÉ+4<§«{-Ëö_˜5aª†‡ÑZ­µ;§uŒ>ŸKËægeg~ÉO~ΓW«KžÇª¥µ2ßu¼4§¥°”麘Í.uvòäg©œå9—µÈÉyè…åš5}Iµ±WíŸK놖P‘úÓVk´hHñJnﯻÈשAJÎS¤ô‹x¾—‹Ï\ûdù½”E.»ÔçX¾ÒR”£¿lËñ–mñ‹ÛrJ¯dy|Öþ‘ü.‹,‡jmYõB¶„y< ²ñ "^‘ñI(;[kšósûr¹¬O½u6ë0_]¸Îšôò=4}eK -K¹‹þŠü3îÈòW Ô­ŸgûXh+»-÷P¯ql»YdÙ]3ßìÔŸë,Ï/³ziƒy´öT>:Ý ùŸK[çøvùøõÈ,úÍéÜü»æý:ë¸Ô‘ó»åûRNikí/·¤ûÜéþÐ>õ8Ú]Ôë­d¤ÒúP~gÑ9mTíSZì³ÔµØõ]Û;y¤ñ¢ø…‡`Ê_íáåײlŒ¤îŽOϧˆØ‹o}0÷€5Jy{žw²k#Û0Ê.NÑ­ÚŠZÛ;ËnÛ†Õ2AŸ÷Óàjú.$?‘±ù%ØñDÿlAçbžÿkkòò!z²Fùã™°d–Ãúó®ѾäïWåüƼ·IÝ#‡B–_ 9Vÿ•Ï£üè¦Ä¦lv0bÇ.ùE.qäwX¦Üȳ]÷kYžF1_Eµ)‚çf­9 à2ÒËy†/²bÚ‹°1ð,üNPAÙ³1Ïó¨Öz~›o¡8RmùŒKéu©©lÚu~$OV6…‰Qð§áÉqÒ -OB0S°A}=<¹˜çùÂ~Ñ09ï£=0ƒeƶ[œã˜]EL«ÖÅåµ´n%ïªZsV€0çpZ(IQuõ¤wÛ›¦.ôØC†ÃpåàÄUæ+¨ÅÄ/ìñ–ò7aŒº ×w:ý»…0{NùF˯ŽÛpº/p1ÏÓ bÔŒâ2î̸ånÛ,”÷›PÃ&AЮ‹ªù~ZºK~Äà«7|ªÃú ~äZžçé¾0%Hì^E,;„¼RÈ«µvÙ™a´á•@FœzRÉti;:ã§5Ÿº4…¶ìÞu‚Xb뤭WƒØ=Ý2ó?zQ껞ßìV6'÷^XŠ“3ó WGýÅ<ÏcpޛÊ$ú£ùëãÚ¶–|t#^­»@¹.ùN¶äÌi„tœô£"¤˜Ð©NyŠwâW“#ß(t&Ùµ<Ï!apO^øʲ£™1-«sö+Îâ¾:@+ÖÀºø~ÅûJ”$䦳܉0"ùŽ–÷Ôm†JR Ce›{ÞG>+Á¨Ióµ%ñ]õ›|ÙƤ”Ûå¶|u‚”›wϾ~_ÿâÏü 9Ê+²²¥œµ7¿Tt-Åæ¥i|ÎJá ä £ûüë…^s|-‹Nì5)ÞíN¬P„擄xæ{®ÎÌ/æyo”òå -&:ùPÊ<#¿>%[×û³~]7ûªë°³)ó\¢v¶¹Ý…Õƒ‰é6ßž¡l¼;ÃûÚù3«¸”åyŒ‚Ï;$çÜÎ>Ó[bUÜ*Èé7!ÂÞ4$ñ½FÑ¿»Å· æ[wŽ~)Ëó(œoGsÑÐÎÑ°²H°óz´‚“Sš™g!ÛIÚoPÈ—›P‚»ó^²›<_i’º‹Uª<§INÄ(§½¶×oÜõ£±þÛÞ?Šä+1 -Ò”ß$c'lçœüâˆËpê‰-¡˜)Ç.–½ðŒsìðʬ¯ª£«G–cGÜ¿L7õ‘jG“¼Ú­Éõ-Gdú=ôUùNµ£6ÝÞ}=2’–û,r*Ò•nüåæóíW:߀¨|œ´á+’ïþû%ÝùÆ­¨,éÒm:+Zßwræ‹¥©©ø'HŠ¯Ÿä«Çr·öKú_r‡ÿ|cLgýçófù^X•ÉÑ”‡F~½ñ½À$‰Ú¡µ2—¯ª–Eºž¤(´X˜Ò˜ÒºI-_ÛA9ÛN^¸ÒÎïJ6¾¯‰TIdóEsÅ9½Þ’¹õ<Êg2ß­'»<ù*ŠóEf[Ô§m¶Œ§dÞ‚lD·%ª®ºF6TäÑ|_UoÄ*z¯:ÝuIkB×GÄÇ㵑ú*RùF×RTÑ.¦…f;¡R¥º’²vÕ~H›@üA•¢átåw½Æ÷âÍÄX ‰jºTÒ ¤ÇML·”æjO…š*¶¬©h¾‰ÒLÝƪxö蓾,¾#Ê–¯k2Ÿu¬}Y}³³!>n˜ÊІüzsAHíV(WL¯'Ú®ÜJŽªÙK£†XT…¡Yh|«ÿœ¡ÂU*#Oþ‡\²ñÍ€í©UÂc³’×Jêé¾¢IÐZÚN]˜$W›íõ¥£Ò3èÖÔUc+j§²ŽRAª‚Çš¬«ÕU2CXÑOÅÊž¨Š¨®‘]5å×¹ÉéêPuªVæugî®–ÛȾbçkOµÇ5_óXå­åv6_ˆìØh$³éÇRI#óŠH1ŸZYGl‚¹Áèk&—ÑZÑ)¿i¾|mƒLò¸Û_oÙÍë8ˆD¯ùÖâ>êÒ÷ÿAšñùÏÝÿ¥\“7ûq£*Z˜Š­+rïÉøŽûx‘ÌwÞb6ÑPû¬cKëŠ5T?nL‡×Ô²«ì%¥®ª+·'º¦ÃŽlªéòa̦w@| Z¬Ì·öMsØó£-ãå,¾`±H…‡¾9xŒg›K¾wE≓6—.™.#úBñØU˜šd+1Ù ûJªêY~ê»Âr]ÝCFð£m> -endobj -646 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 416.373057 101.433071 397.623057 ] -/BS << -/W 0 ->> -/Dest (cb116-1) ->> -endobj -647 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 397.426036 99.933071 378.676036 ] -/BS << -/W 0 ->> -/Dest (cb116-2) ->> -endobj -648 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 378.479014 99.933071 359.729014 ] -/BS << -/W 0 ->> -/Dest (cb116-3) ->> -endobj -649 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 340.584971 99.933071 321.834971 ] -/BS << -/W 0 ->> -/Dest (cb116-4) ->> -endobj -650 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 321.637950 99.933071 302.887950 ] -/BS << -/W 0 ->> -/Dest (cb116-5) ->> -endobj -651 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 302.690928 99.933071 283.940928 ] -/BS << -/W 0 ->> -/Dest (cb116-6) ->> -endobj -652 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 283.743907 99.933071 264.993907 ] -/BS << -/W 0 ->> -/Dest (cb116-7) ->> -endobj -653 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 264.796885 99.933071 246.046885 ] -/BS << -/W 0 ->> -/Dest (cb116-8) ->> -endobj -654 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 226.902842 99.933071 208.152842 ] -/BS << -/W 0 ->> -/Dest (cb116-9) ->> -endobj -655 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 189.008799 99.933071 170.258799 ] -/BS << -/W 0 ->> -/Dest (cb116-10) ->> -endobj -656 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 170.061778 99.933071 151.311778 ] -/BS << -/W 0 ->> -/Dest (cb116-11) ->> -endobj -657 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 151.114756 99.933071 132.364756 ] -/BS << -/W 0 ->> -/Dest (cb116-12) ->> -endobj -658 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 132.167735 99.933071 113.417735 ] -/BS << -/W 0 ->> -/Dest (cb116-13) ->> -endobj -659 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 113.220714 99.933071 94.470714 ] -/BS << -/W 0 ->> -/Dest (cb116-14) ->> -endobj -660 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 94.273692 99.933071 75.523692 ] -/BS << -/W 0 ->> -/Dest (cb116-15) ->> -endobj -661 0 obj -<< -/Filter /FlateDecode -/Length 4427 ->> -stream -xœÍ\K$I ¾×¯¨3ÒaÇKB{@Á"ˆVzŠiêEZ8ð÷ù™ñÈ*WeNOô´º§ÒŽ‡Ãa¶#3Ë-~¾qø“Ù™œKŠ|¾üpúñdM -ÿj‹ÍEeÿ¿)œåd‚+1‡óB dR >ÅóË ®.çæ/§?ÿäôÏmwö¦”è]8ÿë“°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ,±1BbÏ·¬1¸ä ± {ŸV†ÄÉÑ-«@ Ÿk,ˆáJH -ËYÈá¼µ*‚Xfò -Ï¡ô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx YB±NãȳÕx…)'! E²*²øœHã%Èâ¡¢ð2due•Yl´Nã2¡df•WÀ³9å[ž·Á„Ld5žs&À6IåÁ£°I1)<Y¢ EåA–@Ök<‚,Œœ”rV¼Õ‹w“%§ñdñ>±Êƒ,Ø| |„,6E àAFpIß’áâYŸÉp次€ÏÅpJ¤Á€/Áp,Iò<ï4 YG ÈA†çª<ÈB…5, YÐ@Ã"Èâ™4,  -ÃZ4, À-Ûâ4, à-[5, .Ä´—rd  S*0—€@îž4,  .…è5, À.qŽp—ØY ¸K„ž*²À€5,:r™4,`à.9›4,`à.ÜÈkX€]5°Ã¨alÅøœ­† ÜõÙ²† Üõ !@å%$ ¸ë– Enà®ÖkXÀÀ]Ï>jXC1À«fÀ]@HÐÓÈ€Õ°ñ ´2.—¨aAíSyŸ+~ -cÑ° w¨HÂÜ|f €ñÕkX€»Ž©5p×ùb5,À]ä A؃qH4,@|3ÎÂtU^1¶ä¬aAî–¼†ˆÂÆf ‰ÊK†ä4,‹kX ²`¯aAÌlJJQÂX,xHùT^4¸$ Bd©<ȉ5,@bm -•¬aAò…¼×° yÈ‚”AÃd¦8dßjyY`.j}À™¢†@2“ ³†)DÔcЪƋÞä¸Vy<—4,H‰ B±Ó°µ”Épz ðFÒ% xŽ5,H²ÀU4,@(2Ù#3×x² ÉÖ°™.xÎiX=dA6¨aAöUf´ B£–„ª5[©3³†™£‘TQø *M ¥Êƒ,€ °?Rl Pü ØD™£ò Ö° g/åfÖ° gÈâ­×°¶)õfÒ° XÈ‚ŒOÂb£‘4YÃÀ8xÖjXP\F½éYÃø¥Ô›YÂBõ&J<Åo E©7“†…!K@Š¢ò ’¦¢ø-0 õ&ÐIãEÈâ kXPb”z3kX€4õ&2zõH K½™Ôãàn(@&ÜEf5,ÀêMd¶Zmo¼!!?Ó™Y*άžX@o@lU ,°Ñ*©gà+5’zh1QY樞 ¬‚é¬zl`¿ÈÇø–Ó§ùˆ*ÂbfN²È·`d÷½æÍèN³å|ì_;ýô Á÷ü·ŸžROÊÚƒñG)¬ƒ¸ˆ/ØnÀ•©Ã1 -a–Gü¡*!|M"•!¤,®‡n"$B1ú”sÿà¶"Cb‘Ù!™©+ãy^T -[EQ—õ³û¼‘¬CG¨ QWÁºYI(êĪ^öys½ÎóNJRdýì>o.+‹e/ùÁf^UȽƻґü;ß~Ø3TŽ ¹×øm…Ö–!Ê:ïQ =ØçÍw}ž÷¨…ìóV²R›Óz -(ÛΆÈsí¸’õM¢~f—·IÑŠŠ—¬ ¡õ®åMãŸ8!€®Ó/÷fúå$7òx†n½=øáôÓ_÷Ý/õGLûáùôýϬe¤WÁûÃçðÿ_ξ{0n,– b3® eéÛÎ(7¬KiÄMç@“ ?›d‚||Y>sZÿχåõ$'Þ¸Hš¼cèàÈä֥̬ ö:gl¡‡ÖÖâwgGů©~ý¶6›ƒa”¶˜Ó%9Y­ÆC+?ÔãUFþ5l» £r ežnÛi²%U?À^¶”rfäÍ©_Œ;:ØçÝèÈ¡B߀tXS’xÁ¾ç*d³›áªš›{–ãþ;ʾ R´:›‹ÓdxÐÑáöáÁ9¹¹Cä¯È£DqrŒ•µÞ»€àëá ÄÕz§¯‰rƒÉÁ³º {R“ †YÛ…]!t¼ ¢ÕÜ0j‡*!Ú{ûÅèämø(÷ûð{Á/ìœgå³mØOm':\°¶õOS›F{^æ‰vGâ¿AêH|톇Ö+GîÞådµÞîÓ^ï˜LAŒˆšÏîî*zm`¯õÍê>N–çô„í’3ézNJÖ°%»=ˆ=Öçý@,¶ÙE¬‡ˆ= -µHn†ý~rsŽcFt»5Ö›Tl‰Esæ&¼í†9t Ê[Pº—¸ˆ: G*ö‹œçd9„yl‡º¼ÃHò@Û¿­al† #|œrÚt7íÉr|Vl–[õr*]O‚+þP—w£x/'Θ¶¤7Iz¶Ãµº©*ZU°¸Lv’™Vð±.ïGÁ>Ör¦è–½I½×úªÚ¨®.¹ß™‰4æÛQÓæ_ ží,±Vz.99FÅ+KÝ“ìXŸ÷w@àêCˆ1“¾•¯‹9\m'øÜd_éVÿãU¢çÕÈⱸãs’Û r,Jñ wêòn¼S0Ë®PÊ·ôn´è7'd¾¸NÏó18Ë-îR"×~ñ»ßÿæO¿3x–4@p@fÑЕ¬¹Î*¼¸´ ­_pÂýUß6’»Õ±ž’D#èx×)öùo\èòf26{ œºqn-Nä¹ÞÙo|ôÓ¶¸IúhÓ³µËTj¶Äþ¢ÀwûüÚ²t–'*ãÏýŸÆZ»WÜÁ –§ J–Ra«Æ~ØÇWRÅ+­…éú¸+0ê#—} Ew…ÕäMfŸÖÏ«[H‘*×au ~®{±¬wL*Áj*9_MZmãŽÛ0—æ^ž#$ªÏ—²8Xz³ç¬#!Ú±¸ƒ}Þ›ÅñÚ¾yªf¯,I³ÕVŠñv’¹_Ζ#OzXŸRR-DZ`/~×9ëgà’ËÚý8ôÙ¬'t¼_,mYCÅîÕ[F*°¡¯m%mƒ:9d«¿ZpŸë~+Gµäµ¯4©Öý©aëä¡×û·ãI,šç¯^”ùV=¢öèfµ¿9ÖQ/Kt¨³4 žV-ò9š¦.K©ÚŠkâD[MÖ1§ÕÚ-!›VÓVbÇ®tl¸ÜàÀ¼Îr+|Â=z |˜Ç‰$O¬É[·ãÔxZå ãHñŽ™ïÉaÇZª¾Úú”$sÆ:'oê°E»%¯× íbÅ÷-Xtr×zi‘§áqÕß”%TÙËØsm]Z›ç!GÍ[r×ëOëþ„I&7µ[÷ÐùGzOöZ7݆Ü$s³‡ÔƼߵ~´®éŽ®BÛG»¬ÓÒV×ûÐeš²­®w7ôÞÚwùÓÕ¾ÝÙ綆jë"ÇÓCùµ9ô®¼•Õ­k“ÿä·òžW}Úa#‹ÿOýìCYøF–æ·—­†Õ[&Ï‚„ ûÅw¼Ð?®>qE—¶âB§§õ–ËÚ¾¶åõ6Í:f8"wã?­·cì:F\çjíÄv¡ŸËWo½™\õ¯õûVkø,Oóùë¹iíGË-¯:÷e]o\ø"ßW×龜ÏÐï 6ßè7.{æÒWXÃÿX¯_äW¯Òo¾Á÷ûú}8Û«q´C¡{5DŽQîœúZ_Ë=T{gÃû¼›Ãžœå}N±èŃ„¨VLÏ) ½Âô£Šû–hl‘7›®&liM %yN|÷nRiUÝŽž÷z#ï“cTåÙë¢){¦õ~íS õ {‘îh¨§õòëjŽ%‘Ù] \…- Ζ¶»z¦ú²‹<øÿ -ÍË+ŸP]Lú:÷z˾!O!ÿvšçìáe™1Ð}Û k1öxÈÖççSÀ,R™Gyª¼LãwÔØm²­ä¾}Æôì®nÙlOp0¤|qås}&É»&÷Îoüú8K«õ*Þ¯µŸ(¥Wê«‚|ËëÝš~œòà°äßM©Ku;rXq|¡û–3·üwýÜóS7rb‰'-oœsé>~Ëm'y6yxYcT]÷×Ûøã)Öw¦\}oÖÆlœ—/Ö@åh$ì¥r–÷´²%vmÛ\U´;ßéY¿ŽäÇÞJþ‚då¥eya­në|±¶ÿ±nø(óÙÄVØ×o°• +×ä—“|›+däßþ YˆëGÛÇb×í‚0˜L¹n‰Pc×ãDBâ]±´­Fú‡ÖM0@ìöíJ|`™X!¢gt·dY½5n%Ë7rdCëU좖wâç¶cÀÑq—,O b¸%ÚiºA–Z[ß?–¾ç vÑgÕ¹iû[[Ÿ¦í|D¼œ0-]S_TªœÅ·¡šv½í4š„*Z˾!Ü÷I!]N -ñÛ†flfçO»&oS.ÄÜ ‰{»ÒÚ)¤ËIm·ŽúN¥Þ*®¥i~ˆ2LrW¼B»L§vI¾bhòKíã–,‡D}¯mžìÆß/§ÀÝùå’Ò: ¬°¡™ÞL¤iÜNÎvØË ÊSÉË'¸f£É»hòwŠÐ©‚<õƒãnRò>鸓ˆovòVI3=vÔaMŽÓh;©Ë¥ÔmvÖJ¥½€noÝ5¶¡N*›è©4ñ¤:xlÉ®[]' „5ýt¬œ‰¶ é9tS~Ù‡œ¡»j°}²è&s}ÜAŽ;_frê;îäåà.ow²ùF¼ÔÀÆ×d1ýÜ&dy˜°™OŸl"Á -ƒ<`ô¥’›·vt’/^Ñœwh¨E“ïQOr†kŒÔ‚7³NÔ<º­ Â<)7ÚfÒ(:\€f­˜šLqíÖÔRWœU-¥žS êßgM‡yWºü+ñ¦­ŒÛ"^Ï–¨'@a6ç4VgGËžKf…çÞÊ£%5Úíܼ»EÛó´ ‚Ä‘™ÚÑ-Ü´|þ½Æw–>W§Z«öSOF\_G€@-/rzªß0isŒõÑc”ä‰ótTòÙ}ŸÜž´³“y&l‡a"›œ|W¨. eŸ1 Õ¾GTïV¬º¤ÏS€r44`ÎÞœ Õ/‹«OªÔ¢~™¤T”ï†$Iz³|¥U²N`ãéæø¤þükä.° -endstream -endobj -662 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 661 0 R -/Resources 4 0 R -/Annots [ 663 0 R 664 0 R 665 0 R 666 0 R 667 0 R 668 0 R 669 0 R 670 0 R 671 0 R 672 0 R 673 0 R 674 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -663 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb116-16) ->> -endobj -664 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb116-17) ->> -endobj -665 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb116-18) ->> -endobj -666 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb116-19) ->> -endobj -667 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb116-20) ->> -endobj -668 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb116-21) ->> -endobj -669 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb116-22) ->> -endobj -670 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb116-23) ->> -endobj -671 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb116-24) ->> -endobj -672 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb116-25) ->> -endobj -673 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 567.702842 101.433071 548.952842 ] -/BS << -/W 0 ->> -/Dest (cb117-1) ->> -endobj -674 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 194.455821 101.433071 175.705821 ] -/BS << -/W 0 ->> -/Dest (cb120-1) ->> -endobj -675 0 obj -<< -/Filter /FlateDecode -/Length 4938 ->> -stream -xœí]ÉŽ$I½çWäißiÄ ƒ@ Zp@º²»@¨©áÀïóÌËËÈÈê†NDMMvf˜ùbnþü¹¹Ç¦Ï -ßiü“œžRÊ1¸óåÓéóIMÑ+üWR,ŠúwøDÖÊÅÉë’?"SÌÞÄp~9áŸÕ!OþrúãN_æÑg3åŒöç|$•³SL1*/¨2TJ[Aåý£ñAP=¡‰9K*˜á£3n«Š0Ãåä%ÌpÆ$A•`†uQÛ­*à µ“T0Cg•V°C¥D QÎY#è´Ÿœ$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ÂïdA—` ЕDlQAiI—íäsrNÔeèTŠi«3ÊO>Y«$Ö“6­¨ÃˆB'…(è l ÊgQ[¼UFÒYØâð'éÀÞÆ”„Ñjht[eµ¤ó°Å˜èDlAçK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0rEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ] ÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö"§¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒŒÄèÕ 8 +“III\àÀ»&)'q)@ÔÅ cÐJ\àÀ»Æ£ ÒÌ Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\€ù:c%.@a“AX"qïêŒéOÓ`«I§$.ðà]Ð}¢.O:Â㸅—'B–¸Àƒw1QY‰ p°‘¢Ä`²)eç$.ˆ>`=¯Jº`¦A×¢.A§£Ä1º S±–¸k©)aÐK\‚Ÿ(\’¸f@§Ä1à ‰ 0MÉ 2—t¶ È–¸‘.tZK\ lA4(qA2 «Ì $.À µ$\-霢uf’¸ ¹0Q¨(q† Vš`JQ[@ h±í%.Àâ‹M,sDl±ÞI\’¡åf’¸ %Øb”‘¸Ø¤õf”¸ +Ø‚ˆO€ÂDa²Ä qè”’¸ ë„õ¦q`\Òz3I\­ÂzKƒ™$x‘i¸Xo"²•Öö -Äë#â3Y™hÅ™Äêõ˜[Å-îÅlÅ=ò¥5’¸i3±²LAÜ5À´ -¥Vâ¶ÿ"sN˜wŸøU"æÌ©‘ÃÂ!ºïkŽ‘Ì^I6ïýã/§¿Çä{þË?OÏ?*;eí°ái‚¦ÑÛ&£·?à,×&~8!2]‰-hº¥¹†µ°ìZáåÄĈòÀšû²”cU—ŠœU§kÖÔÌ6&½°–0ñË ‹¬HWbï{ÚQ†Qî–¼0éhô¨jxGòïåôGtôg^Æð&H%bZ£¬w=­ -6ƒº2æÑÕ“KݺD -¡^v5zšúš÷ëd©úæFÞ\æt..ˆeMŒ2„"/(Á-Å´zniñk#\@hˆ—âr? ,½:MÓ¦!%CH1%¤^‹}héÕq!‡P!Ô¥£Ñ£ªáÉ¿—·ûM.EêôßyûC YîцOò€¼:ȸ߸ïßßÛàû?|þ‹çí;3˜·˜9b‰ì·Á÷6øÞ߃Od÷…œWäÛÀ{xÿgïž‹Âɺ@'ÊmBm~67ª©,ÝÙäÉCÊuUùš<û+QÚZ7Þåsÿ!¯KµÕSÙ©p‹z½ÆºWD[ïÎóÕmupŒÖ–öQõŠFÞJ|ÓºC}¿5r®l]¯Ãpö*Y“DcfúŠFo7¨~úî„-Wá;»É¹TÎ_Ñe%‘öàÏï>~ü³ßüöWø zëÝóéOß+žT0XiÚP·J|{ƒd€²ò~>vÏõ“f¥Åÿ -(iéÛ½oúŸüùü¦T¿Úì»qÈFŽÆ؆çŒMdÞÚ¢òíªeé'ßé勇úêw“û¹vJK–»§Y^,Œ‚¼¦EåStµuÔ@wuµ2HhÎé©3î±â#r6¬ÇͯÌ’q›eºÆ?»¾²_±ëy`ºÔ[ÇJIÿ4ú·Œ“ŠýáÛù‘ÜWfR»ë‹V¾˜ùzÉ7³~ö®Ä=¶G’ˆ2l.q]˜åvtBEº2a±XéÞ<¯Š>kh4ºLíEE†Nk+Äa9)·Ž—´kµÎ®é‡ÚúˆªDW;‡O¿üᇟÿâ÷,|"—û:}^Z€RéDz@eî„«æ0©L8­*lS@@F ‚ªuëµ ]>à -%úç[¹]*׆ Ús+7ÖË™P%å.JóX ìM™r¡½óÁ^ñû¸ ݪŽ™Ô—a×Lî-D[‡d«ï´L7 Gyí÷< ,óÜôp:¡Þ¥×ô]É1JÄ>¿]·A\„U¿Øç¯ì5°HÂÚC­ǵϵwëùôE]‘ÏÝK¢mÒQ\ì˜JÖ<˜Y öZP¹ ÚèêëL×9®*-¬p…0érÙJ~6dºò’¤û„y0Ï—¬-ÿ#¼™òoª÷|Z”GX]—íèZçq‘J»ÉL7O£,m+çIÀ^`º5+Ô|ÔŽyIµÌ3‡ÑËölÊM£]ÅŽã8€÷pÞ1g ó ¹ã<×`õ¹â|4릜=m,+ÜøùW¼z”¥T® ÜÅøÁ<†qÚêÛÁøzFéßq`¤„h¾~Sx—程KÝ"͇ú]ñhjø¬ÛçCývõ·[>ÿK3çmIwäXê]—邵}´Ëó hfg¿‰ªeO5ïûë\cÛEÞË’åZš±¨ …mÍ+òÚ±]ý65OCn³óê$ÄÍ -%ÅÃÚ—yçÅý~=½Z(gå»Õ‡¥¬ù¹md¬Tç6„S»x¡ó<BƒÙåã=^zùý1”<75´ÏÛ<«Øå™q}C¾“mé6†UýqÛæy{g9J‡þ --ã½tlf>˜çáèv¹òϵ±m”€¤´ôö¢gp–_¡GBò^Šr×ÑŠ[Vè[G£‹ö¬FIÏ»7‡¤eù>÷øö -’Y¼xtÖ?˜çá¼cö5ÔÞš§õGâ:¸¬Ð¤W룦W«ž¿‚¾23§‘^³ÓLnÐû$¬¾ßÚ¿áÈ+íøïDWК^Á»Çò<Z÷cÔÿ^,ömô–·üÝí½:ÉHŽ,.5~ÊÑi¾äƒy ÉñF,ûþz|Æg\ËO•G¹Z>óq­kÕ¼6£'oeFJ·æTa~¸j뽑‘pŽdÌQWÐ6bOG÷­‚¿…¶cym7âÕuܵòüy}‡èýνýv«^c3p·¡Õ¹BdIÏvJ×û -BÙ êiÁ¬ãZ†J¿ŠÛ³õñwÇ»WP8âFòä²ÓîÖì}0Ïáp?ÖüV(ìHYõ ´cÕQö´EÄÕ~E|v0ÏÃõð~|¶¾¤®{uo†£‹ žëLTÇ#g£Çî©^À$è(i¨ªzK‘ö¥–ûÄò¹‘Ÿ×Õ‘ÅÓ¾Ÿë(:µrCµ¥–Sò¤º/ù|;hf—í—Q–T¸eó<ÊÒ~ìô¿Ð»¯FéÊŽõq±Ë²rèLœ©¶]ع;Û¯ž¯ é{yó<šöc£¯7nïD&CØ]È 3šuüÚ¼s"¯ Ê¿‚£Žåy8TíÇ:¯¯0#þ‘y÷¬7â$‡ØãÐ%‚ó<¢öc«ÇïÁo03ßX{e¶wttà`žGCO¾±ßtÏ™¡+ékgpÊ­&|íµ¾VÉ e­Ò,Îq†å÷æ|Û=•lï+¶’—·¶Ûnç…í~^–¾ã{X¯ÙÏÏ,Ž¢g.ÒáÖÙ§ƒy•7ö¥h?ÿ› 5.ÓmP¨wÐÙöñíJW÷ò¿|^Aï+b¼ƒy½7ö³¾äJ©Õ~?#¿8“ÃÎà\½z*ìì‰]»zjç¼iGíšC?ú€çKó+öãæy8„¾/]ðçœ/½uÕîb׹ŴW¸iq*7••Ì­åÏÑL†åòPÈ=0Q(öXƒAÁ=úîå{#Ï‚^W›ñkšo·7¬§¡Ààwõ™–Ñ£W=Åz!›œÙ#2;@o&¹Çí5ÛÃ6Ï_\Þõ€"ée66 P—#=ÿõÚ=tÝ°¢Ëz¶^åN±R´@MM»O‚ÜÛn¢,³«šo®ü8º­Ü3Qo˜-7YæY^n˜ jÜL[›ïU¿ÁÖ”ëÿÔ|³*»1·—ïÕ¸I·Ú³¸1;×õsiæ?ŸByŽ±.ϲW!MÚÐËnÎÁM´¬ùLÏNNÊ:ݺMGëó•œåAŸ{ªúÖ E/ ‡Hϯb5ýçÒáŸN:»‰ü_ž^PÞð¡Š8™v0Ä/'zËÄÎG Ü“°þT½,§ûšìÆ¥GɬRZ?©úsT½ê•Íàî{¹C:w¾pqì=®éýÝÞ^.Ã|^ÊÄæÖb‚~j• ±Q}¶•1á0 ¤0ăF_Š¸ÖÎNô²ös 2iƽœþz*Óœ±ÞÐS‚Õôþuéó¿æ|þvrç_·£Íó¸Q-LçÖ…˜Ïdô¶²tPLo/kÂ>l˜Ð8FûC¬ÓHëú> -endobj -677 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 548.554475 101.433071 529.804475 ] -/BS << -/W 0 ->> -/Dest (cb121-1) ->> -endobj -678 0 obj -<< -/Filter /FlateDecode -/Length 4772 ->> -stream -xœí]K$¹q¾×¯¨³€¥ø~ÂÈÖ°`Áû`øÐ];-Áè°ÒÁß_0ùJfTfVÏh·ì4zº2‚HòãA2“¥®?ß(ü­1¦àíõöÃåÇ‹ÁIüË)VYý'üwUÒáTòÑ] "$§ƒ¿¾_ðßt9&¿üׯ.]çQW-RòZ¹ëß>“ÊbÒ1ª•T†Q9'BÐÎ3*¯n1%N3\°ÚnUfا‚VëȨ"Ì06(³U%˜¡ƒ²œ -f¨ä£Rv(-%«ƒ!ÒZ£r£Ñ=§ÓJø˜tbu:4§3Fø`•Sœ. ｋœÎ—¤ât¶8e­ät°Åš8‡-ÆÉê`‹ŽÁpº[4Z'1º[€®Èê`‹ôRqºd„KÑZV— “1Ä­NK'\4Fr:¥„6 «ÃˆB'ùÀè4lñÒ%V[œ‘šÓØbñÃéÀ΄™Ñªiti§s°Eë`YlAçs  =l‘Ás€$ˆ—8Ð!›´åH@G#l´‘c“°!ŽtrÂú80RA§GFÂg=ÇFÁ‹‘Ëê`‹I–ã£a p\` lÑÖp\`À¶há¸À€n­LŠã¾µRyŽ fJŽ ×Do9.0 \@)q\`À¹ÜÉqéb¸Ž X×8¯9.0 ]c£ç¸À€wU’ã Þ59Yl€9.; -£¢á¸À‚w’ã ÞÅ0Ò Wpè9.V„ŽQr\`Á»:JËqïêÀê‚À4Xð®v¸Îsƒwµ“šã ÞÕV{Ž þ‘l4Þ…8>€- XŽ àï¡Ó†ã&4ÂŽ xW%¸?fLƒ­„ŠÉs\àÀ»*¢ûX]* Å™q‹VÊûÄqïÂQŽ xô9.Ç xTÍqï*OÍéÀ»J'Éqï"npB!à¸þM( 貺$dŠ‘ãÞ-iŽ à……Œ`V€¤8. ‰8”ãÞ…{Oxð®tÆp\àÁ»Ò"ìau°ÅDÍqâè0l™1`UH ¦àtà]©ÐÃœ¼+eHxð.¹MŽ | ŽÀ@(Xs\à£)ÏqO:„|¬Î \;Ž ‚„À²Xl±Ár\€ÀZ$“"ÇAã5ÇAÄ  "I!úf§°paç¶ Rä¸L&b²–ã‚à<æchUN絈tÍê"t*p\‚pÅŠãÌ¥DÄ ç¸/(\â¸f@§,Ç!Á Ž àŠDÔˆÌ9‚-²9.@¤ RD [ r\uÄ,ÓKŽ à¡1—DSs:+iž9.ˆÖ -9.À0ÁLLÉê` h‚ãôM¶Ç˜ü`²‰i«ƒ-ÆYŽ bÔ4ÝŒÄ[´Ô›4ß $ [ñq\¤&s\‡NJŽ ’Š˜ojËqÆ%Í7#ÇÉHÌ71ÅcÆm2žæ›ã‚da‹CˆÂê` ‚¦ÄŒ[pæ›`'Nça‹N–ã‚ä=Í7#Ç30ßDDÏ. Dšov¹¼ë˜‰Ów™zŽ pù&"[nn/A¼. >ã•‘fœ‘]1 ^ßÊ.Hp/¼U`× $È—æHì¢ÌÄÌ2zvÕnJ%Ùe þEKTpð™1ÐM& ‹è¾Í9z2s'Ù²>ö·?_~ýç{ýóß/o¿Ê+eõG!@È©-â+ ÐÝÑ·Âí‚&¿LE¾d!Bê&*bYr#áüèßuûae7Ì&ѳ"O+À–¥zðP.ÝbJŒÙ&Ù-~8Ï¡ÉñAº¶Š·µ·ÔXoo*ÎÖ‡ó|u[áþ1au7×õ²F%þº?@ålëuàyí1xcÏfúÊF›V¢N µÚS°d \ ´Ó{0ËW4Xb2èÐ#Iš¼)(ó iW‰ûéb-V,köír0ñ‚£Ôîúé‡Ë¯ÿðÝwÿòûÿ?½]þû7³–o¿Qøkãò×¹r}+׺\‡å¯Fé$¥BÄáü"Ã4E*¹üÖòj9-êeÚ·©d´/KÙ9]§«õTWõÞ~'™:J¹sžzo+ûõVG6Z_¯¿ýŸë§ï.¿û´Kžñ,`ƒVð1Þàë\–/Á×?V)íª6ñë©8uçëÐÌo Ìì³ú»êöTÒ¸µ|†NƒP©Ç½ ];4š½5ÿKùe R!°);nï¡–Û`×m±º§¹}â>Ôhw§Gc¢†¹‘£.ÚÅÚÉ<Ï6Ì°wÑ6µXkí‘t6­:ô¶_ÿ{tDȈ€Ùv&£YÕŽ;ävˆ–ŠPRÛ!‘CÛµË!ÞÊ›]ðÀ:æ¶ûÝÿý_ÿó½íò(S4÷*]G¦n÷±¶µµ‹#Û–´ˆå0¢ë=.×yœÅRÆÚIPÛ,k½4)_.×-×͹”Ûl,õæüƒƒêYÛVëÎyÒRÕ?`*·ü©¦ŽcSSëJpœ¶ƒµCÙòÒRd•%«n¥6_ªñcùšö^1±ÅŒ§”oJ  BÅrrÏßoËñ†h£j[NnÚÂ>ßýž´·ÊÛ!û½äž¬÷G½¡—ÁØF–^ZÄÔLÙ {™kduTißëÈíì–댦·b_ñ¦¶½*=þ²ÖgdêÒ'¦´‰)÷æ˽U´zþ>¢n½þŒ~ÝQHy•Þmë8·‡ý\úÚu›ó}ÄŽ%ç—zÜxŸÕ抗ÐÓÍe.,w®=óHÞiObW± —¼Ò¬ÛiîËVžîÉíµ“‘s;e»KÖr›C¿ÎŒ0ÚQÛ#+²÷e+n¸¯±ýË}ólÇ1œBàÊBñ÷MÏU¬î{á›õx©cnŽ!Œw›<£ 1§•¥…¨ÝâdžMŠ¿bðàš½!‰ˆÉ¦–lðá?ÏzT>fp|K'Ü­0y!m,MV -ËC*vG'Í·û%jô¬ó¸L‰îí(·yÖ{Öž£Ü΋äÐg\îì~ç Þ¶Î8YçͲŸ§°gªczéÞS›°ižT¼M¶ºaP牶—·šLy[8¸gãGzvF ÛçÇukøÿ+öšóJhÌäË*F†y.oqËë‘ã·Óõ{}Nª=ô5d…YcèÕÐ7ºïȺom¬HÉÅ ¦ -÷ç(h_P„æ€mÞ'Ý_º<—çÙGϵì oæùö7 ‹*vYÊ)ÈMË/« kÝ*Í÷åoA±ÖE_¿/mù\Êügóg´9Ýc¨wm¢í»}´Ëó$hëf{¿Ê;Ë~Órݽ•èUÞº4õðj¹³,ddTºáÚLŸuÉS‘[í<@‡¸Õê|™†,ÓÔéÞêê·>®§¡W1åLm—cm¿–Õv®Óã BCã6òTlÃBÏåy:„¦]><Ûã¹—_Ρ丩¢}Y<(ŸåºžGÿ[;ÜÙÊ6*¹Ùû9Zˆ÷rà½xÎ3ŸÌólHôj—+xîôb÷ܳ'8ËMèá|´e“0GÜõ‘]Ëy”´¼{>$®ËßðùCÛNw<Ä‹g½þÉÛóu5di_–:òã3µ\_l)åä<±¬K¾=~äÙyûï ,„ÇQv.ÏÓ¡l?vúgèÝ£t²c¾Îv™¡Ú‰ÓŶ۰×cûåÛç·?°–w2ϳ¡)îÇF_oÜ>ˆÌa!Ó/h¦}“¯Ë; òªôãu2ÏÓ¡j?Öùøx}øDæ£^/ö8É&wîÁ½“yžQû±Õó÷àÏà™æ^qX;:»p2ÏÓ¡ç`½é‘¡3é{;8ùeqîõ¿²2ÛÞf ÃLžÛ­+·ÍÎÛ°ú9¿Ï7¬a}d=? q@Hû£Ý§“yž •é`]ê‰Öó´NÏûmP¨vÐY×ñç7[ËZþ—Â;èý@Œw2ÏÓ¡÷`=ëKž”šÖ›ÆùÕNΰƒs÷é)¿³&vïé©}Ó†Ú™C¿g8ô ÷KÓÖãNæy:„þ²_ºâÏ'Ø/=zjwµê\cÚ{\;¬ßI+òDæhös2ÏÓ!ù ~ý¢8ì¹F‹€G¼ùî³{=ÏŠ[§•ø™ã³Mã[-sDs ¿~xkÿl¦gê’ûaí/‡È/=läOåì¨àÐ ŽÎͦãŸÒpUÔa’øÔ—e¶Çé\Õt„Ñú}I‡Æ›xÕ@ x׸»oÓгzx;¯””÷'( -oÇ”8M×7p¨‰}‰ËrÜ&——q?÷.Ëoã”|ó‹¶i‘çd½ì/ÿ–Ïý(Ù^ÖùÉR¹¼¬;¼HÜʯ/ö¬^$Oee&ßæ¼ø|^ ÊgÆJ…Òt¨üÕ[A F!]éŒÂ(UµÛTnhu½“3ÅÿcKUNç—t`/Ö˜»u¼(éÌþÃE%+¨ýóÉù$m™ÅQ׋.~¿Ðá–[ÛG8“°|”­,L0ô$»!ƒHsJãêYgÑ ô*Ñòìé{~W³Ñ wVÖD&Ÿñ¶TÌ‘Ó«­˜î^ -UÄt}¦\ùf -½HÛ„½@;¦íöŒ‡beä t[¡ªëbm«=ŠN/mMç»°™>6º¿¦ÅìUŸÞ.¨ÖÌÒwVJg`×¢jëjÙdf0*5©«)[‡ØÖOŒèva„ßÈZ´Eg6ýÐkt’è"ŒH¶¥K5#º]Øt¥4×z*´T±gMµå»)ê&¶†gd·áØ’@_¯1Œiêǵ˜Nãh}-〽Þ.ζ‘ØÅï˜Ô®s…tz£Ð å6q”/]J'e-Ÿ04«ŒÎa¤ÿªpMJÌ“?(Û Eg©ö«^ Í&^7Ò(÷u,×ʆžvh.BÃìØ^*J&=‘nKÝZl%šl‡TÍ#’j䱫†º&& -«íÓ¸rÊjªëb× ü¾w;]ªN¶Ê¼àîZ¹]ìw¾âÐz\ÑÁ¸ÍÞVî€ù*¼eÇfg1A?ÖJºXËæízeƒ°RèâN£ïY\Gkc'ú²ú±2ÎãÞ.¹d7§ÓtJ†7ŠÎy£.uý?¤ù¿ÿ{±×«‹.~\ËƺqëJô¢ÞÞB­,3Œ=Ó‚œ>4zhaW#FiìÙJ7Vj«lUiu. “UÖJ Õ&_²ÕfÉwÙV --¦èÒ¿Œ-íÆ^ièÆ^ñ›´Tnõx-Z2-r#œC¿;ÙS¶X222?ænRÛSš*ÛÖm×uWo{nÃvC|LeÏæ6)?Ä;Kži‚KUòʈŠý(n8j«‚Ñ&»šŒÞƒC,}AF°qX*y8ÏþÚÉv…¤®Œ5¡;„5FEß“Ç›ðE:V EÕïÐã³%ÉÞÒc À, uš“›•¡üEIyý1/µKzš_Ó÷¢ -z#}KŠ?¥’6F^WË'ùçÿLÀR -endstream -endobj -679 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 678 0 R -/Resources 4 0 R -/Annots [ 680 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -680 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 570.123057 101.433071 551.373057 ] -/BS << -/W 0 ->> -/Dest (cb124-1) ->> -endobj -681 0 obj -<< -/Filter /FlateDecode -/Length 4788 ->> -stream -xœí]M丑½ç¯È³‘ùý,æ°Àök¬± ïa°‡êœ.F±þûû‚ÉR*«Û3i`ºP©~ƒAJbé«ÂÏWÿ%§§”r îzûáòãEMÑ+ü+)VEýGüFÕÊÅÉë’¿þ@§˜½‰áúvÁÃ%Oþvùß_]þ¶Î£¯fÊ9í¯ÿD*g§˜bT^Pe¨”¶‚Êû)Fム -zBs–T0ÃGgÜVa†ËÉK*˜áŒI‚*Á 뢶[U†&j'©`†Î> -*­`‡6J‰:¢œ³FÐi?8=H:£§²É¢.B§£‘tÖN!:íµ¤ËSÁ'Iç`‹ÏJK:[¼vNI:ØâlŠ’.À¬u°Å¤h%]„-ÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…N -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) £ÕÐè¶ÊjIça‹1щ:؂ΗÀØ¢b(#h"^’8ÀÄ8¹lœD&ÙÉ%—$0)O.F+Ñ€É~r!G‰¬ÒÐ-U°Å» 1Õ°ÅaäŠ:Øb³“¸ÀØ‚X [Œ³X°­Z$.° [§²–¸À‚oÒAâ Â…™Jâ Ƶ)8‰ ,(PÊXp®wJ\`AºîQâ Öµ>‰ ,h׺$.°à]ë´’¸Àw­ENQ[`‰ ÀŽ“ÕÉJ\àÀ»V«(qïb‰ Ыp$.V&“’’¸ÀwMRNâÞ5S€¨‹Æ •¸ÀwG¤™¼k¼28ð®q&H\ Là%Fà]Pˆ—ÃØ‚•¸ó=tÆJ\€Â&ƒ°DâÞÕÓŸ0¦ÁV“N9H\àÁ»:¡ûD]žt„Ç…q /O:„,qïb¢²xð.è3I\ŽŸ0£‰ ñ-ª8DÌ™)R#3†…CtßÖ=™ÝI6ïýýÏ—_¿`ò½þù—×_•²ú£ ”Ôñ†Éènè[£ù6 8,–Á°GÒR¥1w£4hpÙd#£0ÝÑ¿ëöËÊRJ¦"7ÖAÖþ´¬SK½`žRºÃ"ëCsd7õá$Ÿ÷4TG¹R_-Ÿ±öU·ÕÅ¥\–¦”Må½.u?ŸrlàŽý®¶ÝÏ´ÑìQÛ:ÉTomkño7ó_m_»ö³\Fcu²|^õ>©>P·™N°š›x»° CÈgé.ÙÒ.»øÏ“/Óâ+òï÷Ûr‚¥%$ݦؖSÚ`{Bió‘­wìP¬?o¬}äS3;Á6º]”C|%”=c¾—¹Æp÷µ ½ŽÖföIù]pKimõ½^0ö²Ö“/JÞZWXü“|SÛ8þ…v,Õ4¯lœ™Ž%Ê«Í¡¯ýè÷iékßm.íHK>ÌõxÞÎjsÅKìéÆ2Ûø<áÏ þ$îò jΫìÚOc_¶òk“?ôSýTì6[ú¸í}:ŽinCõESdëË0N†H–öDlYЭo´£-Ãédžw-ξ`t䛽´·ŠEQbxT†ž_‡!…"©Ë-›†çNØ­0,Yé–ÆPa¥Ï©:5e’}}\¢±pnÀEJô¯÷r»Tî† Ús/·SÆêÐH¹Ë>®Yì]™òhóÁîxÈ}»¡ŽUpizOmÃqÍô:ØêÙG­Ï™<ÙgÈs×sÀé„x—ÞÓk´L%bŸß¯Û|Åÿ_°×|ГÁBH‰ãÚç¥ëÃs‘ÏèÎ|öଠä„øë@`¼Ù½€lðÐó™îl•VØ!Lçt%?ƒ7¹é;„y2Ï“¬*o:ïxS½#o\½¿Ôp~½œ)S¸f£8vyà ÙÇeá*¬G{‰'_–ðjgÙíúúDÒ}Ð}D6´Å%D`¡`CdfS¼<¥Ìã9ûõPá= ² îšes'ó<½ Gh¹_BVYÌûå“‚î<ÿŠº¸Ö­Ò|¿|.è6K0Ûöâ¾_>ÝòÝõƒ§9nƒ6r,õ®Ët3émçò< ÚºÙ˜õŽbFµ³Ó9lÛøqËËo{¹m} =¼Úá]¶G -*=»¶Ãw³ä©È­vÞA„8Ç·_{ kK\ç—°Çõ4ôj¡œÁw%þkYõs]®o·!0˜"8ØÅ{=—çéšùðl—^~9‡’gঊöy3cù®Öõ—çé|'–}ÙÏøŒkývÝ¿—Ï|:@눠%¯ ÂèÉ[™‘Òœ*=|±g룑‘p7£ÏQ;h뱧£Þmçò<ÚâxuŒ»ÏÈãl;D/kôúÝ ½ÆfàfC­s@dIÏž÷j„²AÔÇ!‚ãZ†J?Äí«ÙzDüÃñ®ŒÂØãFòä²ÓîÞì}2ÏÓ¡ð8Öü¹PØ2ô ´cÕPöq‹ˆÝ~G|v2ÏÓõðq|6>2Ö¼z4ámæu™‰–ñHwÄhÆ1¤û¸<¦#è(©¨Zô–"íÛRîG–Ïõü¼®†,žöe®£<ÎSË ‹-K9%OZö%_oÍì²ý;(‹æq”Ëót(;Žþz÷Ý(쯋]–•CwâÌbÛÝë±³ýêuMïØË;™çÙДŽc£/7nD&CØCÈ 3šé¾É—åG¹ótºyœ£Næy:TÇ:ï¯O0#þ ‘ù謗zœä²?÷0ßÉ@gÝÇ·ƒnÙËÿüQ(£7¿#Æ;™çéÐ{g?ësž”ö›øùÕvg÷é©p°'¶÷ôÔÁ}Ó†Ú‘C¿8ô ï—æwìÇÌótýå~éŠ?Ÿà~齧vW»Î5¦ÝãZ¶§ÜT2÷V?'ó<’ïįŸ‡=×HðÈl~øì^ϳâÖa'~äøbÓeŒhîEì¾éÙ;û'ó<Rµ:j7]8N£C×øFµûˆÓÞrLüöø2…>úÐÞ^ØÒH×±³¤—“Ò£e/l˜vhýq9Ç(zô‚§3œéD¢ÌŽEjxº›ä|ê«2Ûƒ^®z8\gý6 Š¤Ìmº $G:ókï]z2ð×ÉË>ÉòöÅàíH†%J3õýrqX¢²µ©ù•ÛO½ËÊ»8Ë+¾åõé<ËË+³AõW‚—ïýxÕ^Q6å¹R5¿¶Ë^knå×W’™=«×Úó²/SÚ°éÆ/¡œ]§Ëù¥*¤I:àüÜDÛE1_é¼¼¤¬ÓµÛtq´¾îä,ÇÂÿØR-'Å+:<–,ÝÊ/–ô?–ÿᢳ›Èÿå|‡rª³*âdêE¿]èTo'ˆë‡DÜ“pùªZYN·3'ªì‚ŒSSZ?©åk?˜‚^$š¿‚=CÏïk6:mÍ©šÈ–óÆæŠ!r½SëÕ¤1Œž&»\…f -½ZÛ„½@ÇÓö{Æ»bmú­P±êºØ¸j¦“4›ëB6Ó¹ë4ëþšÖDÖGÂÛÕÚQú&Jé<æZTõ®QMf™Q¹I}MÙ:ĵ~D·‹ üJÕ¢:³éY¯Ñ©–³0U ¹–.×t‚èvÓ-¥ùÖS±¥J=k®žï¦t¨ÓÙû²;¼%ÒŸz`cDÙúu-¦³AZ_«Äpc6ÂÛÅ»6»øíâ£Úw®P¾B -+·‰“êxéR:#lþ†¡Yet& ý?S…oRbžòE»):׳_õJhl6ñÚI\ë8ÉÚÅž–¹KÇØ0Ëý¥“Òé¶ÔÍc+)s“Ç\Í#’jä±놺&& -«þi\É…ªêºØ7(¿­ÄÝN߆ªW­² Ü}+·‹CãÎ7.Ž­ÇéØ¡Úˆ>†ù*¼•‰Íb‚~ª•t1×SáÓ*cÂnH¡‹;¾q­èOÔ¯}I3îíò—K™æŒõ†ÎÍVÓ™ã<êÒ×"Í·øýëÅ]ÿ«r9ÏãF5¶0[Wb>“Ñ_¨H'Åô+ª° &4ŽÑ~ëÔÓúŠ†6ÃøÚõìª{M©ƒê¦åBß}ÈĦA×hË<ã„·Á‹-ùܾéö|ikãè:µZ… Þ\¦®³}J¾²"qEIû”­3,#.x¡¸dænÙÊL$¯¤¹žìw¼+,ÕÅ.XA—¶ë\ŸfyÑUVZÁ’ ¶ü‚ì4¯4¯ìŒ~÷ðúì~_Lu´Q{“¾qikIáÉR[.Ãú²Í9¶ƒQo÷P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«JëDÑè2Ue­ÄXm -K¶ê–Òâ$z)¶˜¢KÿÂ=íy¯4'zÞ+a“–Ê­3^‹–l €<‡sì­S=e‹%“ > -endobj -683 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 573.873057 101.433071 555.123057 ] -/BS << -/W 0 ->> -/Dest (cb127-1) ->> -endobj -684 0 obj -<< -/Filter /FlateDecode -/Length 4747 ->> -stream -xœí][,7~Ÿ_1ÏH1¾_$”$qˆ‡=›³‰Ð)ðÀßç+·oí®îéÙs’L»Úî*_ÊUåÏe»Û£®¿Ÿ)ü‹V‰SðöúüÝåû‹ÁIüä«›Ìþ -Á]•´A8•|t×ïˆ`‚Éé௯ü›nÇ䯗¿þâòÏuuÕ"%¯•»þ뱬!† ÃJ`Ie–s"í<ÃòJ ‰)q,ˆá‚ÕvË -æè8Ä°ZG†!†±A™-+A ”åXC%–’Ci)Y‘ÖÍð”J÷O+ácÒ‰åðTÐÏáƒUNq¼$¼÷.r< Y\’Šã9È┵’ãAkbàx²o$˃,:ÃñdÑÐNbx²À»"˃,ÒKÅñ’.EkY^OÆ·<-pÑÉñ”¾iXzŒäÃÓÅK—XdqFjŽg ‹Å/ÇN8bdz«¦Þm¤QÏA­ƒeyÆç@{È"ƒç =H.q C6iË€ŽFØh#‡:&aC0 èä„õ)p8`¤O+Œ„,Îz Œ‚,=—åA“,‡FC$à°ÀÈ¢­á°Àm-¼…øµ2) ðÖJå9,0\ˆ)9,0@\½å°ÀráJ‰ÃÌ5ÀN @Ý=pX`€ºÆyÍaì=‡¸k¬’Xà®1ÈÉò ˜Ã £0* ,p×(8,°À]t#Ía¬*à‡žÃøŠÐ1J ,pWGi9,°À]0°¼ Ð ‡¸«šÀÜÀ]í¤æ°ÀwµÕžÃ8ŠþH6îB@,‡ïÁÓ†Ã&4 pW% LŸZ “ç°ÀwU„ùX^*@ãL¿…–…ò>qXà€»¨ ‡¸ øŒãFTÍaî*ƒ‘šãw•N’ÃÜEÜà8,€;…€ÃŒoBI¸.ËKB¦9,pÀ]À’æ°£°HÂò‚€#) ÆB"å°Àw1¼' AG  @¬9,ðÑŠ‚ç°À' B>–çî‡A‚àY,²Ø`9,@`-’I‘ !‹ÑšÃ‚ ! B ˆ¤}³ÓÈwaç² Rä°H&b²–Âà<æcÐ*ÇóZĸfy<8,Á - ÅŠÃÌ¥DD§ç°/(\â°b€§,‡!At 0‰¨™s<YdsX€H<¥8,ˆ² ä° êˆY¦—`„Æ\ªæxVÒ<3rX­*rX€n‚™&’åAÀ‡°M¶‡˜ü`²‰i˃,ÆY bÔ4ÝŒÄY´ÔÀ7i¾8,H² âã° I/(Læ°0ž”$1ßÔ–ÃôKšoF ’‘˜obŠÇôÛd<Í7‡ÉB‡…åAM‰é·À$Ì7NÏC,‡É{šoF f`¾‰ˆž]ˆ4ß ìrp×% Çî"2õàóMD¶ÜÜ^x]@|Æ3#Í8#»b ½c+»d ½­»f ¾4Gb &f–ѳ«VÁT’]6À_Äcvƒ ËêÓ¸Dåácf ÔÈ„naÝ·9GOfv’-ëcÿúæòË' ¾×oþ}yùE^)«¿ -BNm_¡ès;Dß -Í7Áa– ‚Ý“–* © ¥ƒe‘„ÂpG?×íÅJRJ¢"7æAžæþ0®¥^ O.ÝbŒù€¦1²‹zwž›"DéÚ./kWÑXo×'ëÝy>¹¬öÄ”æº^VÈ[‰?­ñŸƒÃo뵘AkÀ {6Ó'Ú´ú j™ -½Þc¸ˆ\ø‘ïÌò –˜¾#ôHc’¦ñ ˆ™´«Ä¿~w”)–Uúv;ˆˆNahÔîúî»Ë/ÿÅ¿ýÝŸáï^.û•Dñùg -Ÿö=®]¹ŽË§óO—ë—òYòiÔ†HK*Óÿ$}ÊåÏ¥’Æ­éÖNå•ÏZ{Z>sU5È[ó?•¿¸–+×áwÊŽÛ6Ôr«Zšò¹jÓ¬ŸXëüüï×w_\~óní@yÞ“H#„FÔêÈB‡>w.ËÇøÜáj)ºÚ¤®¦j¸ˆ}.¼JSûõçlÎÑ=FóÏn]Ín9·ªrLîYe¿é*ÕÚ@OªÃx!ÕµÛaTTB)³î~óåŸþð—/»îrS—Ï°¸¤nmXËÙtâH®%-F[tåÚ¾å~C“«ûN§²[‘nÚbŸrï9›”ÏPÊ3E¦çRV‘£•õ¡Ôõ\îk}/Y¿Y»§ÔéGuþ­¶Ø-`Ѥ“¥¶AJj}–Î÷Ž¿ÒBMc×iò½é-lšZ<¶–òH«¶ƒHßz鉌l´å¥EÄÅ”½ô‚^æÚ«»®µïud=»å>{ÖK÷pJkªîUñî§5?ÛT›˜¢SÚæKÛƞ´3ûÌÊ»KÏÓÝÏ(¯Ò‡ºv³>¨e[».snGì¾äüRÛYe®þzº¹Ì]Ïé3÷ú}š¹ê rÉ+ÍZO³-[y~h“;ÔS˜õ”å.6¬å6»Ž}~–££ä=¹è²êíãQqêŸnÐåhs×Û@2¬Ûs¨»´ÑݼYƒ¼{~N´¬ 7éšÑaµÍž]:›éϨMô¡óÓZÒ*ÿ2f¬1¯âæ|ÄÞä mr9­,-.FŸ'ó¼iÚû ãN×äMVDL'µdÏ anà塆Ìn†Ài1Ân…É ™h³hª°CÙ-j0˜ˆöùq‰Ú@¹7)ѽÜÊmcÞ[Ål”“çVnçEr°—;IólÐÜÔÎ-YçÍŽ†ì‡)džêX…íº[jrϳїIV7Ìå:¤_¡aö8幩9ø©@ œo±í -ôÖæ·ëÖ—øÿ ­æ¼SL9w¤Ñ¯]*<¬cžø°xfÑq“fyvªCÁœ{¿¨VA°Ù l·#=É’hÏxª4£Â`Z¨£‚„v‘?¹˜'ó<È|½á&=eq€›ò‰›þ8“÷†Ë3n§¡'¦¾“œ«‰G jç2í[O¢—°Š_DØè£Ê¾8åúAóñP‚“!oý &Ùÿ#ÈicEJðH5UxÔm{-þì,¼0Ƽ {¼Lz.Ï£õG»èû}`qÚgÖí²¾™?)MËË kÞ*Í×å³ø£.az[[ýº|Úr]Êü¹¬oó¡yŽ!ëÚD›ƒÇÞv.σx[;ªÃHUî¬\O¨3#ßh•–·¢ÝdáÕŠ}YøÊ^é†{3]ë’§zn•ó†×q·Bâ§"ÚÖy—ˆãzš÷*¦œIw9ê÷kZÕs]lÙxhj؆pD`° 7·Nåy4õòÏZ<[ù霗<6Uo_–¢Êµ\×sÏþUÓÃA¬²,A­{é­½$¯Ü‹çFæ“yÎÍ!VÞ¹Ó[6³eO`–›¼‡óä[»ŽÙæèâvéÉîlO±í™zIË{4†Äuù<¿kçtÇ“‡xñì¨2ÏÃyòqŒÙæXfí «½ìj%f¾5o^Žž«$דåw¼/̱§WÃV‡…ï}ÏÌ~µ•ƒ‘;íøq¢oõoÀÝsyÎ[cÔ/û´ÑzXÚâw“ww,Úñä!.ÕN¤`éò†'ŸËóhžnIJOûñÙ8âšq;?ðV¨ùô‡o=¨ä5žé=iKÓ\ºS¹õ¸=Y=”>FñÞzìié  v7¼ídž‡ó¶ñêwMšŸ=oôÀ¶Bôt0G¯×v²Ú07j“GæôÃÓ~ózCP6õž_µmå ^馸}5ZÏw¼»ã…=nÔ> ›¬²·Fï“yÎ cÍŸÊ ›§LäV¬š—½ßzÄ®…ߟÌóp>ŽÏæG›VF8´M¿”‘¨ôGÚ‡£Gï}yÈŠáQ]½ªð EÚÏ¥Ü÷C>Ûóu5ÏÓ>-u䇱j¹¾ÈRÊÉybY—|¹¿4²óòïxYÒ÷{Ù¹<æeñ8vú9X÷Í^:É1ßg¹ÌPíÄé"Ûó°×cùåËÎsáoXË;™çá¼é86útýöNÏ<ì.Ïô‹7çÇ°?)îÜã‘{oÜQ'ó<œWÇ:oï¯0"þ€žyï¨{œd“;÷áÉ<çQDZÕã[ð'™o̽â°vtvàdžGóžtc½éž¡3齜ü: ûÏTæÿÀ³[o]ÏOCEçÛÁ¥ý­Ý§“yÎ+o¬K=ÐzþOâ­anã…êÀ;ë:¾™xe-ÿã{áŽ÷¾!Æ;™çá¼÷ÆzÖÇ<)5­7;ò«œag÷é)°&¶÷ôÔÁ¾ióÚC¿f0ô÷KÓÖãNæy8ýÿ~é -?`¿ôÖS»«UçÓîaí°~'­È™[³Ÿ“yÍ“¡–c°ý¨@챺ë÷ ç‡ïõ<+p–âgÏ2/ØÌ!Í6,øªœ¬êèäd:( ‡5ÿ¼™ä†;ֶǫ\Õt¤ÍúIdž›xÕðº褭½7hÿ\¯lçÙlyÆ"¥vBKu}K‚ÔëËØ™ÇV¹¼¾ù¡›-¿1Q^ͯ^¦…ž_§ô²¿2Z®ûñ²½¬óÓry}sx嵕__¿äY½~›Êì9·acÆï/>Ÿ§ò©¡ÒG¡4+~õVФ>¤+R¥±ªšMeE«ëNÎ|û÷-U9Ÿ]Ò‘­t\ßrxûpSÒŸ þÝE%+Hÿù|…|–²Ìä¨ëM'¿^è,mË­í‡4Ü ±\ÊV–Uí̇J{à‘æ”Æ Y.ûÁôºÇr©]m åw5qfeMdò)_KÅ 9½Ú’©õR¨B¦óÈ£0åÎ7QèµËFìÚ1m/°g¼IVFD·%Ê¡ºNֶʣèüʦ:߉MôQuj0M«Ã`Î#âóÕš™úÊRéäZTÕ®–f¡R£ºš²Ä6;1¤ç CüLÖ¢-ŒÙøƒÕè,É…«#Ù–.Õt éù¦+¥¹f©ÐRÅž5UÍwQº«Óùû´çáð”@_°0ôiêåšLço4[Ë8øÞŸ/ζžØɯ˜Ô®c…tÕõF¢Êmä(»¿t*̵\¡kVÄGÿ¨pJÈ“/”m.E§iö»^ õÍF^+i¤û†:–Ó€²¡§Ô¥Bh>;êKEɤ'Ðm©›ÆVÔAe=¤*T5Y5¯kd‚°ªŸ†•#QV!P]'»æʯ+r—Óµ®êd«Ì«ÁÝ]+·“}ÃÎבšÅéØŸÚˆ>øÁç+ñ9lv&“ëÇZI'Ó‘8Õ}Ze± Pè䣯™\{kC'úº‡zÙ;7â>_¾½äaN§éLoô=F]êú¤ùÿ¸ØëëÑ’Ë8®eC Ý°uEG2ú^ˆx’LßQ‰­Û DmØïd{ZW½¡ãZxm{vÙ½¦T AUãŽD×u8us]­Ì w@|ž´Ø™µM°—[SGgDС¤U*ÜŒÍÁmì<Ó‡äëP$î(iÒÁµzȈ›±Pܦ.ÙJLrȱ’¦z’ߎ¦0T×p3„tk:Ïöav,ºÒr+†$Íx3lÕXiZÉÃýæîõÑv/"ûÚˆÚ ½Q_GjkQàñT“oýú¶9&‘P;o×P+Ë }Ï´ §wZØÕÍè£5öl%+µ•¶ª´ .@“•ÖJ U&_²UµäGVK¡Åúí¨i7Z¥)ÑVñ›´TnñZ´dZäFw½u²§l±ddh~Ìݨ¶§4•¶­Û®ë®£íuh†í‚ø™ÊžÍmR¾ ÿÞÒw–<Ó*—ªþæ•ûą­ -F›üýZ2z ±ô ÁÆa©äî<Çk'Û’ºv2ÖskŒ Š¾)áŒt›1U¿EÏ–$Û¤ûÀ, u˜“›•¡üU9y=3/µÛ@SEúf,CAo¤/ôRñçaÒfµ|’ÿ RÚVh -endstream -endobj -685 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 684 0 R -/Resources 4 0 R -/Annots [ 686 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -686 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 558.873057 101.433071 540.123057 ] -/BS << -/W 0 ->> -/Dest (cb130-1) ->> -endobj -687 0 obj -<< -/Filter /FlateDecode -/Length 4783 ->> -stream -xœí]K$¹q¾×¯¨³€Mñ| H°×°`Á û øÐÓ;-Aè5°òÁß_0ùJfTVVÏh·h=]ÁGdðãÇ ™ÉÒW…Ÿo4þ‹¤—Sðt}ýñòÓE-Á)üË)6YýüwÕŠÂâtòÑ]d KHÎ}¿à¿érLþ~ù¯_]þg›G_Í’’7Ú]ÿú™Ud—CPNP%¨”¶‚ʹ%ã¼ òzÁ-¦$©`† dh¯ -0ƒRt’ -f1QPE˜a)h»W%˜a‚&I3trAPi;´QJÔÁEd Ónñpº—tF/>&“D]€N#é¬]| í´¤K‹÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ éQç\;‰ ‚‚À²Dl¡@ °^’MQâ‚``‹5Fâ‚`` B‰ ,I#ú§°pç[)J\&[b"’¸ 8ù¼*é¼Yb]‹º„@ †b-qæRKD§—¸¿p¸$qÌ€N“Ä!Át‰ 0-Ñ 2—t¶ È–¸‘.tZK\ lA4(qA4³L¯$.À¹$\-éHñ<3J\É/*J\€n‚™&˜RÔÁЄÄhžl;‰ 0ùÁdÓQ[¬#‰ b4<ÝŒÄ[Œ2›<ß $[ñI\”_8L–¸4R$1ß4$qú%Ï7£ÄÉ*Ì71Åúm²žç›Aâ‚D°Å!Du°ASú-8 óM°“¤ó°Å$’¸ yÏóÍ(q Ì7Ñ‹K‘ç›A\.ïºf’tà]D¦^â\`¾‰ÈVšÛ+¯ ˆÏdeägW ¨×al— ¸£U× È—çHâ¢ÌÄÌ2zqÕÃ*”Z‰Ë -ü‹xŒvœ°®>KTp3cà›Lè„è¾Í9z2{#Ùº>ö×?]~ý‚Á÷ú§ÿ½¼ý*¯”Õ!§&ÄWè&¡¹¢oÛ·Íã2sû>…M©›¨AŠeÉMÄàÇÿ®û»a6ŽÜ˜y^ ° T©<”K'L‰1;0#ØÆ[š^¢n¡ì«½Ì-öº¯ïud?»õ:ãª`Ë•ÅVßëõï:t}nSSÚÄŸØro¾Ü[Å­—ï3ãNÀ6oçWlr^m}gÐçÒÖ®Ûœï#v,9¿ÖãÆû¬6W¼„žn.³öÑ3þÌ}ýÀŸÌ;®bA­y•ÝúinËVžîÉùɪÙOÙîÒ†^ÑÛvyb¶cËeå÷$‡¹‘Çê½mäz\®T?ùž¶âKÄ]MïÖv¬÷¸Úsè7³Ã×t/¼ü¨õ—ùèC0 ÛÚ°ræ¶ÏWÞ˜#%Þÿõ6O:yÛÏM¼Üv)Ìó¡©ÿW ‘\³FFL©C¤Ü…ç¹.`‡á}m„›&¿¨ÄÛgS…•†sÓÖ°%±ìÛã…s=.‚P¢{»—›bÞmÆŒI²ç^nç—äÐfRîXÌS{×C&?ÆEÎÛ¢ÏSp7Õ± 0Mo©]p8OÞ&[Ý0Õ©³aêåm¦:Sž»žNÜ£ø‘Vã}ò€^"¶ùýºÇGüÿ[Íy½̆ÔÜ‘F\»TZð°Ž9Dù Õyà,/å̸OÛ€bÚ[Ý>pâg{ï¢O•fV¸A˜Ä›+ù›÷‚òÞá!ažÌó$SËÆ›”÷8oò¦z‡´©W¶)‹°8@ƒLZûªÓ¬—:EÙN±Öð@žf•ÎãÃÙþ¶B †²á/•@î­àoDKKJ.=Ux„=~p¥àÈ1`cÌûÁÇK´çò<ö˜u°wo™—h]Ë9TO믨 [Ý&ÍåoÁ£)áf[€û¡ü¥ò¹”ù÷6¢íÐÆ[¬9–[—oS£í\ž'A[7›ŸØ8ˆÕå͉un­¸oòV¶›Zx³¬[i2*Ýpm§Ï¦ä©È­vÞA„¸ —‡u²=Ý[]å7÷ëièÕB9“ïr´í·²êç:Éß!45nC°p0…»[V§ò<B½>äó-ž[ùåJž›*Ú×%òYmëyd“cŽAf4fõ~§—‘èÍÀ{ñÜÈ|2ÏÓ!Ñrå=ž;½¨?·ì Îrz$$ßÛš£Ù;Üõ‘ÝÙ¹—´¼GcHÜ–¿ãó‡¶×n yˆÏŽú'ó<’cÌݾ½´ï][IØN›··Fänöç«^M-}ydŽ=ý­ç ÇÍèý$Ì~³·Ç‘7îãç‰6n 5|€wÏåy:´Ǩ?_,öh£õ°´çïfïͱè’‡¸ôìãW'ó<’ÃXöåv|6Ž¸vÜFr+Ô|æóZg•¼Ö ½'íeFJ7sªô¸Å-[Œ„½‹>FÉh =öä ™»ƒ¶“yžmwâÕ9îšÁˆø7D棣^ìq%wîѽ“yžQDZÕó·à/02ß™{Åaíèì -ÀÉ<φžtg½é‘¡3é[;8ù5‰qîõ3¿š³{fêu¨ï`?´®Ü6;_‡ÕÏÏn}t=? qŸ´Hû{»O'ó<*ï¬K=Ñzþ/‚Ö°M·C¡>@g]ÇŸßà-kù_Þ o ÷1ÞÉ°w2ÏÓ!ôû¥þ|‚ýÒ=%~ÉÃú¢%OdîÍ~Næy6$ku'€ý¢@칺‚G†óÇ÷zž ¹NKñ3Ég›Æ[æfü¡œcZÕñÎ|QŽEjø¼›äë û£]®z:NgûΊäÌm¼ .>óëÖ¼n†W…ól¶<ãΑR{U¾Œ¥¦¾%ÁîõeìÌc«Z_éüÜ›-¿1Q^Õ̯<¦Už_côª¿fZ>÷WÙU{õÔä§ÿÔúÚäðJg+¿¾F:سy4•Ùs¾‡]3þtñùì:Ï/U>.ÚðçWO OêCºòyyQYÒµÙtv´¾ÞÈ™…ÿ©¥*'Å+><–ÌÍ:^”ô?åÿñ¢-ìÿüÞ}>ÕYeq4õ¢‹ß/|Ð b¢þòþ1 ËGÕÊ"ÝΨ²WnXҜҺzîÖp`¿î±~4®Þ çw5Ÿ¶Fª&²ù¼±µbAˆœ^ïÅ|÷jÑEÌ'£ÇÅ–+ßLá×›°HcÚ^`ÏxW¬­„n/TCu]l¨Ú£ù$Íæ:ß…ÍôÑuzhþšÖ„¡9„¯Tkgé»(åó˜kQÕ»F5™ŒJMêjÊÖ ÔÚI½^á7ªMh̦ZOµ\…±‰ZºTÓ ¢×‹˜®”æZK…–*ö¬©z¾›Ò¡ncs¼ {ÕüUCQ¶~ÜŠù܇ÖÖ*¸1;áëÅQë‰]ü~qAHí:W(W¡7 -íPnGÕñÒ¥|jÓú ]³ÊøL@þ¥ -פÌ<ùƒ¦)>׳_õJ¸o6ñÖI£Ü7Ö!ÉšBO;¸K‡Ð0;úKG%¤gÒm©›Ç6ÒÁeƒ<¤j“T#­X7Ô51SXõOãÊQ¨ª¨®‹]ƒòûFÜít­«:Õ*óz€»kåv±oÜù>ŠCkq͇´6{[¹æ«ð5l4‹ú±VÒÅFµÑ®W6»a ….î4úžÅµ·6vâ/ž¨{'“FÜ×ËŸ/y˜3Ö>ËÀ[ÍgŽQ—¾þÒ|‡ß¿\èúoõËu7ª±…iܺ#CE<)æo¬¨ÂÖm¡¡ö»XÇžÖU4´qܘ¯©gWØkJÝT7í(t݇ƒØ4èmϸáëäÅÈ|iÛô{½´õæøl>µZ…‹ñvp»Îö!ù:‰+NÚ‡thÉ q1ŠË¡ÂÔ-ۘɀ+i®gûil -Ëu CÁ—¶ë¨³cÑU–ïbH‚ØŽcÁ¤ÇJÓÆÁèw¯/n÷b²¯=€¥Ú›ô}”¶ci#79[Râ-=æai¨ÓœÚ­ å/íÉë™y¨]ž*òwtYz#µHPZ>1‘ ÍòIþù›…r% -endstream -endobj -688 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 687 0 R -/Resources 4 0 R -/Annots [ 689 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -689 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 555.123057 101.433071 536.373057 ] -/BS << -/W 0 ->> -/Dest (cb133-1) ->> -endobj -690 0 obj -<< -/Filter /FlateDecode -/Length 4601 ->> -stream -xœí\K$· ¾÷¯è³—õ ^€áC‰ƒ1²HF³ãÁ8€Cþ~>ªJKÅ~ÌîÚ˜ žÁLw‘zP$õ‘R©Êž ~?µø—É.9—éüøã駓YR0ø©%v•ý þR8[Ci ¶ÄÎ?2Á§%•àRå¬ÌVdzÛo5^€,Î%RyÆ×ÀEÈbRÔ 3ha\Ò0À¥´Pq¤€Ë~¡LYC—ËB)y \ Å’4ðÆ‚ç¬Þ@–@QCo! aæª<Èâ iXàdA ¼‡,Ž¼†hKð <à–L±xà-5,ð\ˆi4,ð@\Ÿ#iXà¹p¥¢aæz`§† ‹éž4,ð@]¢Ó°Àv=å¨aîz²FÃîzš*²À5,:.Þf¯aw½5IÃîb9 `Õ~5,€¯,.g£aw]6¤aw]BPyiÁôp× A‹ÜÀ]ŒÓ°€€»Ž\Ô°Ž²Œš w!AO VÃÄ{ðœ×°-i‰†¸k Ÿ2§V‹Í%jX€»6Ã|*¯,6Aãʼ…–cÑ° w¨¼†¸ øÌãDT§aAîZH­ñ€»Ö£aAî"oÀ‹@ÃķŸ®Ê+‹)9kX€»€%§a¢ðb2D奎d5,/y¨†¸‹ð^4,ˆÀ]¼×° w !íQyÅg§aòð0m•9du1H¡ñ€»Æ¸kL*Dà.‡M bb‚Ë@ÀY°Ó° fZJJQÂX xHùT^\p4,H„ÈRy…iX€Äz)¾d ’ƒ,Þ9 ’ƒ,H4,@F°‹ì[]@¸‹º> È‚LQà ْ ‘†)D¬Ç UÝ’àZåeðlÒ° %ZŠ­†XK-“^ÃüÂé’††9;^nf r†,Î8 à›¼ÞLYñiXPL\8MÖ°0ž1›±Þt¤aæ%¯7³†Å¬7±ÄSæmñ‘×›IÂB% EQyISQæ-0 ëM “Æ‹ÅÒ° ÄÈëͬaÒ ¬7‘Ñ«[™×›IÝ.î†dÒxÀ]d¦QÃ\`½‰ÌV[ÛoHÈÏtfægVw  7 ¶ª[Ø‹h•Ô=ðå5’ºi1±²ÌQÝ5@XÓuÛÀ‘ÑÖÝ'¹Eá 13'dÁ´ d÷}Í1Šù ÅÖý±Ÿ¿?}ö€à{þþߧ§OêNYûµHjiB~…ià -Ì}[ ßG4ÇeÆ(ò½G!•!¢(n[n,"‚ÿœ_vrClµ±*Š¼€U/¨k÷À¡Ú:aIŒÕãˆ9$~q›"'äåÜ¿X]Ö¡)ÙïP•&ë‹ë|tYåøé¦ìð¡ y«ðÇ5þè7Û¤ôë8NĠ¢ -{o¥,´ïó¥°Ø „¤½$bIbÀ¦Ø «|D óÈ#Êøâ8š"±2´+ü»7'ë&źgß/…øÈï,¥ ç7?ž>ûãW_ýþ…¾y:}û¹Áªå‹O->)¯Ÿ!l×ÛµÛ®ÓúéÐ:Ic‘q„¸Ò°L1Ö¬­½ÖN¯_F›ô4õŠô°¶]ËѾ\ë§É¸ë/éò£ô±µ;×icÛÉïŽ<–‘b»þâç7_¾|³w–ºâYÚ"ÆÄxÿî«ò!þõK¸U)Wݪ©ø­p©<™ó­Pó“âf´ºYûÛ™½lež>»Nw¡­Ÿð L‡kty[ý‡íOq‘懶óq ­Ýî–y¯‹Ý˜fýäë®Æww6ÇqX¨amØDW}íÎ:¯Íٰ¾êm“ƺ¶%è´*¬÷Ÿ³E¥‡H˜=›f0’žÕä¸n7½¥ù@O(YwÈDŒÐ]¿ùV½Ù…ìrÕÝ—_ÿåOûzè®Î2Ëk¯í³¬^éúörv–k-‹<³¹o½>з²>ý¦QžùîóÖ>=­Ÿ\ÆÇÑ÷_í»}wQй½ÇtØ^²Ÿu6Ý¥º,U÷m]X±¡kÂl=Û1*)÷,CdÒ 5môë -¿Ò °Ò‘èSÔ«ý -·ý¸2nËr\ŽïábŒ•Ó6.¿i‰úXµÎíÙïŽíDÏ›|ÃëØNµ0{½c¬rûõ¯ZSX¤ZùIXE——ïåêòš1æÚ. ëW¬:¾A !‡WÚ^½´¹÷æaö¸ÖG·›ÛÆÓ¼v‹O¾ÙÈnã~Øó«~Üf;¿ÙÁoc‹W¼YŒ³ú\+ó4ääÃÍ縮uWug}лÍ'¹Ž£µ¹ù ÷ä8›ÌͯÒ(7·¹¢ê}ú¬±òŠ>ÅBó³Ö5~¯§Ù–½½(Æ®éÉ›YOÁ¶v»ŒÂ®óü—rôBÆulg‡ú±êðŠÁÓ%9>8“:¶ýÿI…0ëã·LJÕSšõtO&µâɘ?GÜu›>Â1 -Ôòe{Ë~òðVïj¶Ö1ó^šdj×t­™t¶bÕ~®µù:ïEL|ÞÇæcPÁYâÛWwŽî¬ó^·B>â–Qèò´¦ˆºeT§Î¼×m·©çEX[p±Ã­>N4uØ௺B[Ì×­•/®·è<”q‘”ÃÓ­Ú”ëé»UynÕq)6Ój×€>oåú›rõX;…è/hˆÞM›]S» 77,uØ,›·’Ÿ&YÃh¯ß ÑÞnëwªsSsðÓ#”ßÇj¡Þ³Eµùí¾]ÄWüÿˆV Ñ.Îædæ‰$ý:l[…×û˜·,u<ãS¸˜ÕMJN"ÂÛ} ß%_þRBuLXø¬sáS…S§.f²©_àsd&;>?q0ï¬óJ¶Ú;n&¾W{7ÍCK§[*½Í*á;­uÖt_Y.4©ö¼E¾†Þý,¯yàÈâÝê1½Ê1awó§É–öŸ—nrõ±^ÔÁ#×¼§ ÃæÓ7î®*¯Ä߆Ԉ9WümMÛLøƒ¿®÷Ã-˜û±(ñ©ÿËXÔqFl#Í[ þP*8L(!';ux ‡²óS–ɹž•¼~{ù¾:¯Ä/:eàô5¿˜¢¾æ#hÛF)ãöÖ—ö¼]™ïÆÔåê¶qÚoN·}Òö}kó-»9žeÈÝs<[— -á»q˜á®:¯ÄÛ†ØÑ]]-£ßúŸÑþÂi”]Ýv#x²ðîÈC‹Xió¼K‘Ímušç69oxæq»:ÛiœuÃc[;ãn÷Ó½×*íLº«+¯)j6=·–ƒ‡¦Žm¼ë—€Á”nyè}u^‡æ«xx¯Å«•îó’×€MÍÛ×m¨í»Ù÷ó’@]΂UEÎ1é¸xî«ÜËwFæûê¼6OäÓú×<ñÎÝ}àe¶ì˜&ïÑ<ùÖ±­êsvq»Þçäâ«T~‹Skªi×™NóB¨Ò©¡•ì¡n'…ôxRˆŸšÖ4Á˜/¬ÆïÂX‰¹9õr¥•SH'µÜÖZè–J½TUKÓüe¸ºÏ]ñ -íQùLü‚H1GŒo_÷d>•Ømm²ðw >žõ™8Èϧ”Òa`… Íõ$Ñ‹v;9›á/ƒÊÏz®ß05ß$ÀÿW¨ÊÈS¿Xê.ÅoW£ž›¼W’¤ÇŽ:¤iÀRe…ºlJÝg¥¾l6JyÝ^ºklG*ôTšx R<ödÛ½®“š~:VJ¢iB »AÝ•Ÿwä!gèS5˜ÞY´ÂÝCowcÇÎgINÝâ–_íÒåíí -ŸoÄÇØh&³ëçÖÉ ;Ó£ÝèL‡`…A0ú\Ém¶vtâ×U¶¯c’i÷ñôé†9çƒãÑ[~S™Ìºìù?(óþþy¢óŸÛ«1Ö8îLG ×±uG–‘Œßk™ï$ó{.±OAt$`meCó†ÇxM£ºÀÞJÚŽ ¶s%1  -²ë®ë¬š Wˆ“{"ó¡¶{½ômp|‚‘_ªÒ¤Â….óàù’Ï¢I\qÑÒÁ%'*âB6ŠKÑa’íÄd‡”tÕ³ü$Má¹/q!Ò¾ôƒG#Ìʦ­ŽBA -ìå…l˜¬ì´ìäQ„~ïéõÁvßDŽm0µC{§>KjS;àéT_/ãþ²Ç_ðµÉ;4ÔÛòbîùžäŒ©1R Ú]HÔ<ªm‚ì”m×i .@3Ö[LM¦¸Ukj©#Ϊ–RÏ)õ©é ­Ò•¤Uâ¡,·Û"^Ï–|O€‚tç4FgFÉžKf…eíN¥QÒ7Ú±oÚ÷Ý¢íY ƒ† qd¦fT ‡’ï…ï3wÖ:Ó.„VªýÖ›Çˤ¨É&ï|}?¸É1Cˆ_ñ˜(‹­’×¹¾wrÜ!i{'²'˜c!ïM²ü¦w]„g0Êm†hª½^¯VŒ:¤—)@Ù0g;CõU¿u¯²nõËÄKE~³·ç¤—ͲÉXý= ¼vÛ'õ÷¿ùM-R -endstream -endobj -691 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 690 0 R -/Resources 4 0 R -/Annots [ 692 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -692 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 367.323057 101.433071 348.573057 ] -/BS << -/W 0 ->> -/Dest (cb136-1) ->> -endobj -693 0 obj -<< -/Filter /FlateDecode -/Length 3527 ->> -stream -xœÕ\K$· ¾÷¯èsË’H½€À‡’ bÄÈ"99Ìv<6‚Ùëò÷óQUzT5û1³vÜÙFo·H=X"ù‘TW;Z¼¾pø/³39—ùxúxøt°&‹µÇ¦QÙßâÂÑYN&¸s8~%“Jð)_øoל»¿þú«Ã¿¶cÜÑ›R¢wáøãwÂb2)§dƒÂ*`YG -+“’QaEgp‰¥h,ˆ{>g%ˆÁ%1Øû¬°2Ä NŽÎYbøäXcA WBRXÎBç­UyÄ2“Wx.˜ˆMÏ;sñEå%ð\òÈÄÄ.8WLŒ1dÇ%ë4^€,Á1[Y˜rÒx²P$«ò ‹Ï‰4^‚,»S^†,°®¬ò ‹Öi¼B&”̬ò -x6§|Îó6˜‰¬ÆsÎØ&©Ã)‘¾ñ$ È:ð¼Ó€€,d 5$ Yž«ò Ö°€H0p×\‚¹»>X¯aw=û¨a Ŭš w!AO VÃÄ{ð ŠFÒd ãàY«aAqõ¦g à—Rof -YÔ›(ñ¿-¥ÞL†,)ŠÊƒ,HšŠâ·À$Ô›@'!‹/¬aA‰QêͬaÒ Ô›ÈèÕ#,õfR €»¡™4p™iÔ° Ô›ÈlµÚÞxCB~¦3³TœY=1°€Þ€ØªX`/¢URÏ ,ÀWj$õÐb¢²ÌQ=5@XÓYõØÀ‘ñ&,§OóU„9$ÄÌœä" Ü‚‘Ý÷šct£ Ý–ó±¿?|ù„à{üþ߇ç_Õ“²örHjoF~7ðêȾ.Ÿ KðU4HöªÎ²l*C, \ÙD,<ùw<ÿ²‘¢~[×¥¾nAÜ®ëz¤ó\€óP@FÁZO'Q_9ä'Ø¢B|èCÅ ÁÈIZÞtþÍûLs•b9õìÍI|DH”¿ìÃñýÇ׿÷î·¿û3 çýóáo¿¶°¥¯¾pò™¶Ÿ!¬í¼¶ãöÕ(ï€÷Þn¡;ºð]ä’¶]Þ¡­÷¼Wx¼~çÓÊ£µýa’'´þ_ýýøþÝáë÷[¥ÕÜm±/Ie/ò-=ß7äsôüs¨…àõvµåÝ–&]½¢V„ëŸñ‰Ô‚ýJÏx£í…÷aik<ã›I­|‚yøÓ:ï‡iñóZݬæ¾OËd§yã*Ë:Oƒ¹b±}~ýu D¿ ¿nbr>ýZ»sÌ£j„kVöÿ Ý7[éNŽ}»ÊEÓ<øN~•í´^o\Á0‹ì¬‰^XwŽy8k⫘õÓùí+-s²°WYf\¬êOŒ;¯±È VÞ€Q÷y8«ºžè¼Ý_ "þŒ–ùê¨7Ò$.…ˆc)þ®[Ô}c΢®çV¯Á_ 2÷_·?ò–#8 ‹7¬çÎ1f=þzÎÔ‹œVù]¦žFAÔ - Vôô¾edô¼ÏèÃÈè7…WÔûmæÚõ©EïxQ—;¸Q]h²÷ -¤Œ9÷ÕH]ﻜ§•>Ëù¼íS‹R?I[Y¿`•S%7À¤åœèºUÞ7æá¬òzîÕv½[áþ -Ÿíò®–Mì šÆª–n¬õ‹XkÚö;³BwÅ:×£Ž~\Ñxvùü|/¼`½oÈñîópÖ{ã0k©ûë Y5º;lªZjÉCûü´ÃÞt¥5j_:ó똲µˆ¾ÆÞ«>LV»ÇÐ(Úx~È<[ì%o;ó·ÃÚ§ÏÀ×7œÆÝ9æá,ôzÎøHøÚ½¥,Ú½ÇJæãÙÙRÂîظãçóîSñ¼†/køý¤Œi8{šÆØí:¬ÝgMí3_S›ïÖÒt~gÙÔBæVõsç˜G³dº‘¿~VöXž ZÀk¢¹›,^ÉeÛ˜ ¶îNâ÷_ez:A÷f4òS¨_9ÚrËRïóp–z=§=Óà>Šî4W­7-ѺYÓFÛª1Õ#N“Æ×ÊSå³ÿù«É¨þT¶÷ «¬q¡¢R«IΫxoXÖÈ9eãˆSŒ·,ë¾1gY×óÍMŽváÓ9ëV1[ZË×÷Fóeíô\q];†"Uâ’äŽ,QÜ×ßüéùfúA Öç¿[\ÅêO§å UÚ¢À -n”…>Ȇ¬ W©Ê”“”f¸•|Öƒ\ù ây 0B÷Ò7.ï:×ú½Î“›âÖõ$Õñ’T§…¿™?¬kOòÔ9Ât ¡]ÃW{5~:Äzg¡«w—Ûˆàåñ³cd#çÓ©ånÆl‰]S›«íŽFÖ‡ö>õ^ës|Vní—Û:—‡ü¦ÆÚÿSUøǃ+ldÿÅ—gnl%g߃ürg®X!3òù;ÉB\¿Ú>»Ö±ÓN@²dʾ'cׯ¥ON¡}EºÇøІɽpl['ªwƒ- +DŒŒîœ,W]ÉòÜZ6´¶b%Ä&3ˆcBžûŽ ÇÀ›dʼnΉvZn=7yœÜçÜ·.b}Þ:7©¿õõiRç5âé€eiO}Q©ò´L›ªí®·F“P¥SCëÙÂ]O -étPˆ_Ø65C™?iMî9^ˆ¹÷~¥õSH§ƒÚo-tM¥Þ+¡¥íüe˜:å¾ñ -­îÑJMò îä#–Ú×-9Šš®mžìÆŸO‡ÀÝùå’Ò; ¬°¡™ÞL¤iÞNÎvØË J²¼|ƒk6šÜ±)ÿ/P:U§~qÜMJ±ˆøf'o7i¦ÇŽ:¬í€ã4úNÛåRê6;ï—ËVé/ Û{÷ÛP§-›è©4ñ¤:xlÉ®[]' „µýéX9mË rè¦ü²!9CwU{[,ºÉÜCŸwcÇΗ™œºÆÜBßåíóN6߈§ØxOÓÏm‘Aö¶G»±ØD‚yÀèK%7oíèT9_¿'Ó"îéðá†9OÁ|‰ä䉰9ërÇÿ Ï;¼ÿyàãÛ-ÈK÷¶£…ïغ!Ï‘LžÎw’åyâFìn3=O°?È.¾¡YCãÞOxÍc¸ÀÞzºŽ ®sgb{8‘}7]ïhÚ™p…xÚíbOd>W7#`/Mj‡eHn^oR¡1_šyðh„äã4%ZÒu„tpÙOј'EsZ° É6bŠA΋ô­ùyVÉZScJ#¤IƒÇ#ÌÎS7Z½Š© R`šóÄìæEËFEè7»×gë}96j‡öN}™©ý„ÚO§RmÆm³ÇÔýh4ç;Ôç¢É÷¨'9Ã5FjÁ›Æl£5ak‡0/ʶY´Š ÙFë3¦&S\‡µm©WœÕ]J=§Ôæ³Vú&†Y+ñ¬¯ÌÛ"^Ï–¨'@a6ç4®ÎŽž=—Ì --Σ;•GOj´óµy»v‹¶Çé2xGfjÇ°pÖóMø÷ßYÆìN!´^íUOF\í P³Kä©þ›c†°©¯ÿnpœä -endstream -endobj -694 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 693 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -695 0 obj -<< -/Filter /FlateDecode -/Length 4517 ->> -stream -xœí][d9 ~¯_QÏHrqnÚ$,Áâa¦v„zøû|Î9I|N¹n½=»èíí©:v.Žã|¶S©´;Zü|åðO!gJ©9Ññôéðù`MŽÿµ›‡Æþ~s<:KÙDWS‰ÇOLÙä}NǧþÙ=ÊâO‡?ÿäðÏmwô¦Öä]<þë;fQ0¹äl£Âª`YVŒ&g“ÂJÎ`ˆµj,ˆ3y:geˆAµD1Èû¢° -Ä”]8gUˆá³#1\Ya9 9œ·VåAK¼ÂsÑ$(=i<ïL*ÕW•—ÁsÙk¼LÊä¢ÓxÕ¤”bÑxYbµNãEÈ‘Õx…BÉ/A–‚UyÅ—4^†,Ú© -¯@XWQyÅ&ë4^ &ÖB¤ò*x¶ärÎó6šXB°Ï9a›AåaEa’RVx²$«Êƒ,1X¯ñd!üh<àD ¹eµz^ÝÁ§ñ"dñ>“ʃ,˜| |‚,6' °‚ ã’†>gCÕ“¾C…Š†¾TC9 |†RÍëÀóN‚`!K¤¤!Ap…°rUd •4,² €†!@OA´%X‹†pK¶: ð–¬K.Ä´ n(‰4,€\˜RÕ° s°SÂÐÅrÏ nˆÉkX»JÒ° w9«awC@M•Y`ÀMp%hX@ÀÝàlÖ°€€»XF^Ã̪& `+Æ—b5, à®/–4, à®Ïp*/¬Á aw}Ä4Ï ÜõÑz ¸ëÉ' `(øcÕh¸ ‰z8Y°À߃烆hÌx„%D஫pÊšZWjÒ° w]Áô©¼j\†Æ•u -—RÕ° wᨂ†¸ ø,ã <ª×° w]€§ÖxÀ]ç«Õ° w7D `Æ!аþÍ8 ÓUyÕØZŠ†¸ XòÀ [€$*/’Ó°`l,âP pî½jX€»6† aAîZBØ£ò K(^ÃÄ5àaÙ*kÁª±H¡ñ€»Öa†5p×Ú\5,HÀ]v›¤Ì_4,€€Q°×° 25ç¤aAª<„|*/ž¿y`ñ 刅"¶–ý¶øÞßÛâ{pñ©‹ì±ó‚|[xo ïÿlá=r")4Pxß5.âfkZÒHG_Ož7”׬ò9u®g¢¼µî#Õãx£ç¥.8Óv*hÓotÈ{­I•õá:/.+EËŸ'ñ>ê¦_UÈ[…oJw×ÜŸ ƒÓú½ åÍÒ/+æ´·ZÚY:¾×Fï¬óâó.û½×Fï¬ó²žoõýüÝk£§Ãk%CTÚ'|@'ó§ÇwŸ?ýÅï~ÿ›?ým¾ûxøËϬ…DZԺ̟Èáÿd-ñïüü‚ùõãòã×=¾ûæà0*;Îä}5ÅÜ9 ´áCá®÷½µWZzõåë¯øÑ­¯i}íô¸ôÎean¡CïíùŒ¾–Eí7†¥èW~ÅïiÕiöKï—z­Ý¸<ìª.ãÚo«¿ÊÛäHS)[ï»Õ©KÜÿ,ÿ€fë^³óåIH+zl’¯šêsjOkoií&Éöa·p¥ ¸Þ~Xg ¦iÜžûö¼ø#$>¦tÞNÓF×pj£¿&Gö—ä°s,m&ûøx6<Ï’*WK–°•¶Kœmn-kZÕí52ÇɲPo'­c/ký“°Ä¤aXËi¶ß,ÛO ãºíù»UŽ8åà6F¹uþœ¿ªóº×Ë°'dî¶{›çý·•w‡® bŸC»ð.[êe?/CÎ$ÆÛçÂ͹èåǘÄüìWíÒþ5}·×W[#,ïûÝG1Ö²•Õ¹KÈ¥¡Ö‚PŒ[D¹)3•Ì vlm¿¯Ÿ_¼k~.ŒX,“ µù9>Fæ‹óð„&©•ðÖy–o\]¢ñ|ÐãEGž?¶&ÚZ,íý¤£Þ뢚ñèBò–Âço}XÜ毿ùæ—¿ú£p›<qîSw^ =áÄ–I¸ØaMÆV>"´ë°Ã‘k&2– __oÑ#m‰ Yi1~¼UvÁ'êRRå¹Uge«Òj7W‡«[4njÈ·£êS¸ !ún*Ю„VZý ´šwõ?îdŒÝmß=…vj$8MÒ›šç³“P]Êú8oÕæyžÿrš§â±Ê -ÁU^¶ÍX×Y¸Úd¬¼þTL"ÊمⲨ²cŽ¶tЄKAÊyÀg+ŸöÛuÚVöУvȸÂ.>³ÒÎ8]½;ë|Ÿ|ëK`Ÿ½‚}ö}w7Û#ÙeÅô`ú´å7Z·²îÛ[\ðZNÏ÷÷ÿõýÖð¾f}òÖðE†VÃú¤ .ª öL­‘“±m‡×,/"ˆî®³Xã1>_·¼;ë¼6˃Z¯Y^G˜‘Øô×<­£¥˜q}å ˜áÞ_àUÁ »2ß®¯+ßûY®ý~»{¿Öûa}R/Xùa±À&fŠ*Œºn9÷Õy%–3ÅæïR]¶œ[3ÒgaX”ëáöÜ`XÒ®­ÕõºK -t½ŸaÁNi§?‹öÆFHÚZÂ=} ˪‹ü-–ü,ÓõM’ÓÄéhÏñýªõ–4-‘O~—vZ÷ºõÞWçµY/â•«ÖK[íYØ[×ÎZšÅÒı>+ ³´÷´M>÷³{&Ç~Öe¶²¯ÛeËS¶¸Ç°ª²·‘Uí|Àf•ö>EF¶MoD ²¿ºê/Îø{o¡É ¬ ÀJv²ñ–g¾³Î«³P_‡Å(9q·–Æÿ‘,y`ìnæ›Li's8ǽiá,!<ŽUwÖyu–p#FÛmÝ­^ðr-¬ÂØüÇucu]לïy<{æ}X7f×ñݪV~à5ZÛý êѬ/û–%˾_úà°p´›VYÖvZ5Ž´gºü¬LÆf÷ZÙ}u^•]çþf÷ÙVº“cÿÜä -¢Î=ý*ÛioZñ·º?^°¦gÄWwÖymÖ”¯ÇW/·n´LaaYfZóÚüÒ¸óˆEêV•ÝãugWgU×c¢ç¯×Wà¿ e>êõ²ØËÊó…ÝŠ²ï¬óê,êzlõúgð‡öÌúï'(2ò`"tóXL{;n_ú°JûøXJÉ=wZÞ·ÐÇ'[¾èá•»§ð—¤§r‡>{õ~Õéšg½_s·—=ÒR"ñ©7±ßþ¼#-çírô¥Vo ‰û¾ÜYçÕ}Á$ãs¬>ý@g_v=¾Äá¥ÉGN¿¨ÝüE©þýÏ¿\ÐÒk<óí‹0ÏѾ8órÚg`®Øè݇`þ°ÞÆ#º‰|eª¾Vq¹ÃÀ›EnÀE‡ÏϸŸÝ°=&ùÖP° ÕÌ7—\:á¿[¢‹e¤5öï(]E½*Èw4wÓƒ¯oÛ•:¢’îYëB÷4½ô 3ÂÞÉ¿_‘ý´õœ£ýîA„<¯[×\Ãmr>Ÿ©ÝÀãÚ-l6ã<_ÓzLd8ÊõÈ·þÈõisMÑîx¡f»Üöó(µÞwkù -<¾þh¹ W<¬å?· ÿ„àœLêáx»›Ò62Ì8îÉO¾›”2ÑŒéo™¸¾µ£-r#Eè´" jWNÇ®ogÁžÈ®ˆÚGÃõc¯ÆKœl/Ú­)KÇ -5“;'óèì¬d¾ßµ˜°>¥! -#ú ÎI– Ί7É.XAŒçD+º›dO]Ç÷ Õ¥I¢KÕ91ý½¬Ïb:¯OtöÔ'•Ê·Jö¦ºv½´ „ªƒ{É1!4æI!ñ·äΈ_ÙÞ4a2_Ìß͵K7$åj/§NµÜÚZ3•G©2«Ö®ù)Ê4õP†âÚIäÚ™/¬kĆþvKætp̵-Ânüñt@*KgäöÍÈóÒqb…Ýô$1ˆv¹Øi/“šKW–f§ñÍFüïqPyÚGäøv²ù4;áµ9È[%Iz¨CšåYV¨Ë廿‹Ló¸§ÃßÍÍù=§l AqÞ~?Òÿƒ2ßà÷:þ¶¥wñãÞ´ð[7déÉøžír'™ïÝîılÑ“€ýIve–݆÷^à5Íêv{/邺Á•Ä8u(È~˜®wAh&^!žvZÌ÷›é°—ÇÐÇ (_ò֥ƒËä…é’¢I ÿž³vÔo©k¥úOÛqe^n GM.Úß+±%%`ñ•Ó™ŠØ*y¸Îõ½“Ëw+Êž0†B°Ùñ_žÑEx£Þfˆ¦ú_¥Ñ«U«é1([CæÎîpíO´Ï¾ÛÑxÌœ*ò_áíºRø‚ôl/Ü1Ð>NÞlŸ´ŸÿÐÐ -endstream -endobj -696 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 695 0 R -/Resources 4 0 R -/Annots [ 697 0 R 698 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -697 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb139-1) ->> -endobj -698 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 100.307453 101.433071 81.557453 ] -/BS << -/W 0 ->> -/Dest (cb142-1) ->> -endobj -699 0 obj -<< -/Filter /FlateDecode -/Length 3427 ->> -stream -xœÕœKÇ Çïó)æl@å*’õ8HĈÁ99H#­`@Î!_?vw=f†óØ•ll4ØÝi²ì*Ö¬š…½ÇëUÀ¯"Á•Rs’ýáÓîóλ=þ-%Ž.õüä¸^²‹¡¦÷ŸTÀÙå)§ýã¿N.ç⻿³û÷q°'Wk¢÷¿|T•°Ë%g U…Ê6T1ºœ)&C•‚Ã-Öj©`FÌBr®Ê0Cj‰– -fQ1Tf°äÀçª -3(±T0#Ô˜ Uð°#÷¦†x&C¢Kôdé(¸T*US—¡ ™,³KYB –®º”R,–N`K¬>Xº[bñ–¶—léláÄÞÔÁ*™-]†-„Ñ©†®ÀxW1u°Å',]ek1u:_r9ב.foéBp¾É¦+ -“”²¡#Ø’|¬¦¶Dödé¶^–œˆœK1V+éêfÏÁÒEØB”ÅÔÁL¾EJ°Åçd!+È)—,PÎN*‰*ì¤H±(@¥:É™- PNRÍØè(X `[¢$‹`‹`åš:ØÂU,0Á°XÀ [HØbƒ¶o±XÀÀ­ø,0x+>$‹ àÂLo±€A\.I,0 Wª Ìe°ÓbºXîÙbƒºY,``—¥$‹ î²o±@À]fÔ4u°l±tt -[,p—ƒÏ ÜÅ2"‹˜U?L à+ŽJñ Ü¥âÅb€»”L]vXƒl±@À]Š¸+rƒ»=Y,p—„’Å8Š¼™ €»@H´ÓØÀZ,@¼‡ŽØbs„´ÄbAwCEø3Ö4håB©ÉbAwCÁô™ºêBƈë£ìBJÕbAw¨ØbAwÏb±Œwˆ¨d± ‚»©-¸¨z‹ÜEÞ-À\@`±ñÍ×5uÕùZŠÅ‚îKd±QØù’˜ºìàHÁb`ì<òP‹ ÜEx¯ ¸ë#³Å‚îzAÚcê` ²X€¼:,[cM#Yuž@ -Kîú€¶tà®÷¹Z,HஆM‹)«€ŠÅè“Å‚TÄÕœ“Å‚T=tHùL]r¸Ž ²‡ Y¦¶H‹H¬]åZ,d‚-Ld± lAÊ`±«Ù·¹=€-ps °™¢ÅÌ•*b± Ç„ýFÕÒ%r%צ®@²Å‚œÅ!‹ØK¹‚Eo±€wš.Y,€Ð±X+lÁR±X€Pä -!3·t¶ ɶX€Lº,‚-È-*Øe&o±{I µ¥¯ûÌb± Hrš*Z,À2ÁN¤4u°˜°X€ùÑÍv´X€Í6›Øæ˜:ØÂQ,”BºÝ, J-äÉb|S÷›ÙbAõ°ŸÅ‚ê“Ó4Ùb0÷ j(Øo’X,ÀºÔýf±XPÙc¿‰-ž±n+'Ýof‹U`KDŠbê` ’¦j¬[0 ûMÐÉÒ%ØBU,Ô”t¿Y, ÍÀ~½y$Pt¿™Íãp7VÉÒ»ÈL“Å\`¿‰ÌÖÚÛ{€7fäg¶²èŽ³˜'舭æ‘{­²yfà_Ý#™‡0;Ë’ÌS„U(ƒ7 <ø‹|LΘ°ž>ÍGT î3KÖ›¬X‚ì¾ï9F1¾Pl=ûå§Ý·ï|÷?ýg÷ðÍrRÖ^ ÂRZàÏXT1ÝÙwÀísB"§qY¥¾gTQr&@q;rSüôßþüÍ‘Ý0ûÍqïaF÷DÕ´õfé¯hæù°ÿþí|YÏ6“¶­]Òã ,2-àFo?í¾ýþ‡¿þùÇàovÿøœ¾xß㈼„ “õ}ÖŒIÏÖë¨:•?h™ïþ¹ûzî“t›]5¡=îS» Öâß¿]ÆŒûüfdIëi㱃ÀÂ-Ú—xb•/ëmˆq HbpØè“B+wçålÜ¥u¾E¿ »s`B€Nq™†?½~ý‡?þmLƒ‡1B¥€¡ú>|÷*è¸ñ…÷²ÖÑé‘Ã*‹iý»ÈÊ&²õ½Èö÷a”Ã4®åhȾĦÕ]z;~ý‘¸õÝl ê^[}?Ù–ÿÆV¯ßc¿×‹c`û›ºÁæ=ð£DÈ{oùÛ}U^ˆ¿ «±¯ø›Ž›óæ‹?ðõqï×a«×F¹é"‡"úuÈä21n^2ƒ¨ª§l*‹5çjD"}Òá5 - mŠÑ )Ýp‹;뼿èB*vÕ/â1,élп˜…ð~å„©«“ŽOÊ|ŒQ9Ñ(·ü|8y¿Õ[ÖûÇͮƶU¦tŸmß}çK»~8ñï8Ýï° žƒ-V‹F¬3%UÓÀëžs_â9Ãlä€W<çÖŒ´Yè¥k»r ¼@@?ëë³ë.ºýtF;'4ÓöN#Jó„{úêžUWû—Höyf‹¾ñ0¢gôçþª÷Fž¨ç\e9›¸î½÷ÕyqÞ›®rï¹ùÇâ±OÍ•ú¬œÏ³î§²§u›myØOî£{U9õóØßVêÑ*m}Îyܶr—r'9æiÞpÔ_ÝÆ/^Î×(wV2X©A6ÞŒÌ÷ÕyqZ¯òõ×Τ¿Ô“;cOf~±)ØÌçÜn{û§³êÎ:/ÍøFŽÖf®œŒê…(·¤U¸7BÖÌØÂ˶®uëO¸&Õ½_¯-Ö¡æU›žuͶvßOõdÔŸûêž5—}·ö¡iao7m¶lí,u¶<Ò?<ý>tWaÛÁËæÜì^/»¯Î‹ó²ëùÜÿÃì>ÛKOì8½^ìâ©ídc±í°ÝoÚxXÔö ÞôŒüêÎ:/Λ®çW_oÝ>Ñ3'{’g¦m_›¿6wžâ‘¼*?ƒQ÷Õyq^u='zþz}ñWô̧F=™Î²rÀ<`ÀneÙwÖyi%×s«—?ƒ¿udîófûX/G nÔGšõî:}JØÝäf‘^qþ™bûln¯¯Ë{¡I}žŸËž0ù5ëGà—›éã:\ËÑcÚ†5mÇàuº°%'Z¦Pë†+­›—¸l¸ÖÃjù86DËauZËëaµnUN²}Š¶éÚû¥ÒŽÕ·þÞm‡ÜzÀ³}"wÔ~Üúžì‘íà¼ßCl÷p6Ÿwiy”#,óy ߤÏûï“8õ®\÷úøHñ,¡M[X:ì/Ô\¾%ñ¹—Ú¾8áõYJ}ŽfýVÅt±•ÿ¼Lø§]¨âtüuÁ®9ûE\¨] ñãNrC,âèN± -··¾·%¡ì²ÃN?M©§%9¶¡CíëIûú–b»­[5}ø@|+ÄËÇïkdž5S8ëÝ{6±~Q 8Þ®R7%¦f3„£A™ËŽGÅ›âÀ~Æs¡Ÿºb’fOÐËúÐ¥!ì¦ÏC¦éoe)OÓyMxØ¡[>•>šR}<¹5ÕF—|—ñdTíÒØJö ‘>O†è°3„¯|kZ0™]?Íš>äµ -Ks$éåj+gˆ;³ÜÖZì3•{©2ªÖ6òÔáê\úÀ²eŒ6iÖo>Mk™µy˜ÅIg Íµ/“ßЙð°‹ÒWâ?îb6JÇÁ -›ëÍBžÚíâ⇿ )2ém¨°4›L‘Ñß+*b—*y–7AºKécnãjt¢k³‹i–§N±F He§á -9wŸÇ+o”WèöÒ}ÄŽ¤ÓMò\›y -©cqè^×ÅŠ°6>•³Ð7#ÐÝÇîÊGâagìKÎÞ:Kar÷ØÛâÔÙù8‹sŸñ Ï,v{{»“Ï7áa lr*V×/­“!&ߣÝèlÃ…!}\Ämµv:é÷°Ú۱Ȭˆ{Øý¼[Âq¤Š7‰ƒ>‚?g]aÿ_”yŸídÿ—öÌ×ÇÉwZPgë‘xŽdú…­r§X¿ÀÕ„}ÙLB’ ûCÊ(›7ô8N4ñZFu?ÀÞJ†NÐе³0Ž1œÄÔ]—O#¯'£Ø™/›°×Kn7‡nXŸlVáb¾\–¡ã’÷S“¸Ò¢#¤C+4UÄÅÜ(.§ë°ìÈLuȹ“>ôj¿ÌSÁÚ×t1¥zÉC'#ÌÎM7ÙrS¤À<_Ì K˜;­GöF?{y}ñ¼o&§¶TÚÑÞ¥³´ß˜J;ðl)/—éø²Ç^l‹wŒPo‹§µÇ=ÉKc¤rt1ûè$-£ÚV ÎJ“uÚEÇd¾Éz‹¹Ù”¶jmX–;.æ(åžS éÏóHÇyVú ÆyVÒYYm·E¼ž-qO€âìÎyÜ%{.Y Yškw©Œ’Üdç}Ëqß-Úî§ÛaH™©ÕâYÉgñï9kÇ|ÄÖ*Õ^ËÉH(ã)ij ™‰—/¾û’"úÝ¥,e:*yrëg'ç'$íìdî Óá„Ùç ÿ…mÂ#õ¶bjªý÷vµêÍ[zÚ\|ÜÜ~ zùër¬¸õˬ[EýÊ:kÒ[ô›vÙÛÏ%.'uåèødyýTåC÷ -endstream -endobj -700 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 699 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -701 0 obj -<< -/Filter /FlateDecode -/Length 4782 ->> -stream -xœí]K$I ¾×¯¨3Ò&ñp¼$´$,±Äaºv„zü}>GfD83]¯žÙÝÛÓêéJ;‡ý…™i?_Yü—ÉN9—éxúxøt0S -ÿj‰ÕEeÿ ¿)­¡4[bÇLðiJ%¸/ü·¹”Å_ßþìð¯u{tS)ÑÙpü÷f‘ŸRNÉ…UÀ2Ö+¬¦”\ˆ -+Ú C,EcAŒÈÑž• •4Ä ç²ÂÊÃS²~Ï*Ã%K bØ’²rXgŒÊƒ †È;…gáô¨ñœb.®¨¼žMNãy?ÅD6XW¦cÈ K(Æj¼Y‚%2²ÏIãEÈâ£7*²¸œ¼ÆKÅA;EáeÈëÊ*²˜h¬Æ+~ -%©¼žÉ)ïy΄)dïƳv -°M¯òàQ˜¤˜žƒ,Ñ„¢ò KðÆi<Y?8|ÊYñVÇÞí·/@ç©<È‚É×ÀEÈbRÔ 41.iàRš¨8Ò@Àe?Q¦¬¡€Ëe¢”¼®„‰bIxcÁsVo K ¨!·…à¹*²øBxYP@Ãï!‹#¯aÚ¬Eø%S¬†xKÆF <b <×çHx@.L©hXà¹Ø©aèÂÝ“†¨ëCtxÀ®§5,ðÀ]OÖhX@À]ïQSåA°†@ÇÉÛì5, à®·&iX@À]¸‘Ó°³:Á£†°•Éål4, à®Ë†4, à®KXT^šàƒ^Ã!h+7p×ã4, à®#5,€¡LÀ£FÀ]@HÐÃÈ€Õ°ë=xÎkX€Æ&‡°DÂܵËŸâÓ@«Éæ5,À]›1}*¯L6AãŠßBË“±hX€»X¨¼†¸ øÌã'¬¨NÂܵ+µÆîZWŒ†¸‹¸!hXs˜, °¾MÖÀtU^™LÉYÂÜ,9 ° -O&IT^š`HVÀñd‡jX»XÞ‹†¸k‚÷Dà®!„=*²øì4,@\ÜVñi«“q@ -Ü53¬ñ€»Æ¤¢aAîò²©aALLpYÃ8! -vÄLSI)jX‹!ŸÊ‹®ƒ†É€Y*²P" XOÅ—¬aArÅ;§aAr!ƒ†ˆ¦b}«éd¹¨ùADŠɦ\ˆ4,H!"ƒV5^tSN€k•—Á³I”hÂRl5,@.5e8½†ø‰Ã% x–4,H²ÀU4,ÀR4e‡È\ãYÈ‚ [ÃDºàY«aAvÑ †Ùed™ÑhX€¹$T­ñÈpž™5,È'5,€› ÓRª<ȘаóÃÉvаÉ’M¤9*²ø@äì8ÝÌä YœqÀ69ßLYñiXPLœ8LÖ°0ž1›‘o:Ò°~ÉùfÖ° xƒ|)žâ·ÅGÎ7“†… K@ˆ¢ò ‚¦¢ø-0 ù&ÐIãEÈâ -iXPbä|3kX€0ù&"zuK s¾™Ôíàn(@&ÜEd5,ÀòMD¶Zno¼!!>Ó™™3άî@oÀÚªn`/V«¤î€/çHê¦ÄDf™£ºk€eLkÔmüE)°±TÄʲߜïÍùÞœïNçSì¾óŒC¾9Þ›ãýÄïžIáä)ò7åäã”Ã,n2SMéèÊä¢ãå%«|MË™(ï­»@åØ?èy©õvª[´ê7Xä½Æù¨Êzw/.k°™¿PâÔU¿ª× -_•î¦¹W„,Eé—øŒ…ÉÞe]Ø+}A¡÷;T¿|wÀŒÖc`ø[h"Êõ ,>W’xþøîãáç¿úÃ÷—?`¶Þ=þú cl=waŒËÆÀt Eü¦™÷4ÁÍ×”¿þÛñÝ7gúà³½nÖŹ*ìÌPÁï ¿ïqÍÝ K(nîî4ÊU1ZÙgîô8wkaž¦Ÿ\ûj\ -'t.òIçs“†¯¿²ü­[jiÁ.ãò·ÑÃÜ3—­>Íô&ñŽ¾”åðoUà2J.Wi›QqùÚÞ"CSxoãÃÒÆéJýдºÈn–zmliŒoU'ß¡UÚjµµHyh¤¶¼íÉ/¿¬ ·H´\×Ñ4XFdž0;$F“D=³._5vZFñãJn,0@è6éC³©ÙY›u†¾Û·=yÄöí˜e\ó˜…ªrxgÎÉaÆXVú>¡ÈÆÅ¢!`µÒvó¡ê¶Ï˹­÷Òr…)n¤7Ë‹¢NZÚ_ô8¬niëŒoÏ?ú¡k±ôçQÞaþ²ži«‹&Sí'ÌÞ¼¢c;úiº©2?µ9Z#À=úŸM¯¡µ—ñJýžÓ›âý|xTöY¯?,vÝì+,ãoåÛ·î¢ãVÝ÷¬¹ùQjmîuÀz Í®Í,¿ñë±mõØûŠBæe‰ -«åH·©n»çæiÑÍð‹‹ºÈ;]HmãÊkY«>ìý«BÅÞ;Vg.ÉN6ndŸ±umË _~õ®†4¾‰„†J iø€›ËÖ, Èy¨." º·Î«Ë%ê™ÁÀxё㯬 B¬’ mC!K­×Y5ýÒúÐåå´ÎzççÈè·ß|óëßüYDFljKA§4ÌôàEð0OÂÙKœLáÃK›\ש]–<žb㿾ܢó,#.’Òbx¾V›r=ë£*ϵڨRت´Ú—4V½ñÚï¯jÏóI:$tñœöz[ii»'©#WFä‘z>´¬èª6=Ï.ÕÓ ¯Ð&N‚³óá‡Ñ&e¯Ê„Ðá¼-†²höbŒžƒ°¿éTïðÙ&5÷¨9ÇÓzQ\xþ\жŠø4tás‡›N«&Ï€ïl€u˜@‘é"ÈÝXçsR½ïë‚O—°Î¼—KÕfÎÃÚÃÆR´”{^—7K¨ÙmV¤7·vµíÓŽþjHKóg¿$6n±Ž•Ü6mœ~`Yo÷‹ò%¿è6ŸF0ܹîe@ª?d3R:é4•8+_wxÉ'Y4ûfSÈ¡ùðÐEŸ¸±Î£ùDäSjç}âúÊ2o*ðŠåÏ|Žíñt†—g~ã­Ê|·ü]øÎ-üöûÝò—–Ï$Úâxdc›ÍfëZ±Ø|K¥û8hí×›[tQýðŒU¹Ò-Äó,RqW­ê¶:bUClò—¬ªi°£êvæÒ]H¢îf殡Ñ¥Ù›“Ƶ´E»0,a×ÎFöj‰qM[Yו¾Ô1¶­,¿éÓl-ïóW®Y_g,8tŒ#€©õÄô ¾­ÎÃYp|.>¤5]Á­j9ÏmkaÍëØè KtöNë|m’n¡Û1ôr]Þ3Ö™ÊýÖy[‡³Îr_åʵ³¬¦í²_ýªïç±â®f.¯Ëöë-f·¾Ý¡fT[¾ÙÈÕÊo¬u+ÓN.1ÖþyÓ×n•—8ù¼é÷ÌÔ£‰3Ö—Fü‡d–ïòÍöÚê~cG³¾t9fì«{ÃŒmNbçY½—^?K"¾ü‘,å¶1ž±¦WÄŠ7Öy8kº+Úg¡Å§ xf÷³wiÕrËjÔ­5­Ëôø»y¥­¿Ÿ³J¶ì†7ÆŸö8¶]=5‹þáãæ3Ö)bºÈwqaê¯íÝXçá¬óÿ(üŒ¬âëü2™Ç%ž±ÆÃ~þË-»57Öy8k¼÷=šÅ=Pæq“¿b÷ôµV›Å~!ßqs½{ø¢ÕÞXçѬ6_Ùcü©Yí9Kû¾ðøy-‹öýÂmø}Æ’GÜÉÏI!Bà}-ï¾±ÎÃYòåXµïTl-èiƉsñ[ÿ&Ff+­îf÷c¿msj‘yTO9¾¶Þ-Bðú7=4¬¤[Æ“bi7ìŒ[g¾@&vÆúÝ)ÝXçá¬ïJ,Jk­×Ù?ãËÛïú$þÝ”‰lh=7ŽÃ)»z”]¢,âNë¦b²ãç\¶ÖÛê<œµ^ŽUwÜ✈¯V+ÿ{+¿åß»b>´ÈoaÍy‹,#¦$¬nž§,_±Èë<šE–+qè—¾pD ä迱¼Ž—ÙîíG¶¿Ý¥ÿœ=ÍâîÏÓo¬óp–öãìi®¬ecÅgW,ûÆ>±'ÉO«§u¯YämuÎ"¯ÄŽwZËÿeŒøîþñ½sp·º¼±ÎÃYÞÛžå—Þýé2mÚWóó3ØÇê¼{òÖJfƒÖ\ùÊzsÿã.EÜZÝÏèwd çÃÜ|×'ÍuOóuãñV.ÛŽñv:+wZÚ{mÑhSöÑKʲïç~Ñz»q‘¡mq>HÁGÛŸ¿ù»¡ýiyN\ -˜‘ÀÏÈäŠxì\7®«E®˜Òþ!uí~æÝ#ÍÖ'‘Ñ$¿ Â磃ŔÄÏTÔÖçCDÖñ $Ž`ÀóRŽü<Òl<Ù6m¶*ÚÏÔ¬¯ÝøÔK-oâ0üpn~0ëüšq±”ÿT'üãÁšXÿõ.ÝúÔ|SÉõ͆ürà·&B&·ú^!3qùhz[dûÃvZòÓ6%}˜ÌòqÜ^̇°ç.´ÑpýЪñÓ,É´B¾>ÏqîX!¢f´{2ÞLv!ó›'òä—«ØEáš:q4H²ìhpT¼J¶ÞbØèn5y,?©¸«.b]ªÎŠéoe]Óy‰x: [¿¥¾¨T~Þ}kªi×™NóB¨Ò©¡•ìB}ž?¾cGüÊ´¦ “ÙùbÖø©Á317C¢^®´r -étPË-­…>S©—Ê£jiš¢ S÷¹+^¡Ä-ø‰_¥#|ÄøöqMæ;Àû\›,ìÆ툧R6Ú‘ë#[ö¥ÃÀ -šéI¢ívr6Ã^•O”ΟàšÆÏ\åÿg¨ÊÈS?Xê&ÅÏMW£öÍN^+IÒcGÒ4`)²B]6¥n³R_ˆ”ò º½t×ØŠ*T&èHgLo:vðX“m·ºNfkúéX)‰¦ î9tS~Y‘‡œ¡»j0½³h…¹‡Þî ÇŽ/’œúŒ[~v—··+l¾Oua£-™M?·NÙ™¾ÚÎqPä£/•Ü¼µ£¿Ø§}N¦­¸§Ã?u™s>8¾[9zËïtQ—=þe¾Áï?tü}{ÖмŽ;ÓÑÂul]‘åJÆoÊ7’ù@ØÝF Ød›GÙЬ¡¯ãÎ ¼¦QÝ `o%mGPÛ¹’†ÙuÓuÖ Í„ ÄÓF‹=ùܹ ö|éÛàøîk~üt“ -r8¸ÌƒçÇ’|M⊋Ž%\r¢".d£¸–!ÙJL6HÙIW=ËOr*<÷%.DÁ—~ðh,³²éF«£E{y!&+;-+y¡_í^Ÿ=ï‹È±yS;´wꋤö1µžNõõ2®/ûšãëÌÍy‡†z[^øžïAÎpZÐêBÚ¨ æQm)d§Ôh«NÛBÑá4Óh½ÅÔdŠKµ¦–:â¬j)õ˜bPÿ!5ä¬t%9+qW–Ûm+^–|€‚4ç4FgFÉKf…eíN¥QÒ7Ú¾oZ÷ÝVÛ£ AâˆLͨv%_…¯ñõAdZ©öSwFlÝÇBM6yçë›MŽBü2œDâak÷×¹¼wrþ¡ï²'LÇDÞ›dù˜º/`”ë ÑT{_¦^­uH÷)@Ù0·{lœ­/E«{‘uƒ¨_&NùˆžƒÞ̯nJæÌcäžvÛ'õç‚šo& -endstream -endobj -702 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 701 0 R -/Resources 4 0 R -/Annots [ 703 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -703 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 512.554475 101.433071 493.804475 ] -/BS << -/W 0 ->> -/Dest (cb145-1) ->> -endobj -704 0 obj -<< -/Filter /FlateDecode -/Length 4699 ->> -stream -xœí]K䶾÷¯è³3|_@C€‰ƒ1²HA;³Á8€Cþ~>ªÅ‡¨R‹Ý=»Ñ:ÙÁì´ªHªD~üXU¢Zê,ñó¥Â”!zGççN?ž¤ðVâßTbq0©¿Á¯·g%É «¢ öüC/|´Ú»óë ÿu‡mñ×Ó_¿8ýsYGµˆÑieÏ?}›Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ì°ž4­UfP –SÁ Ò:0ª3 yeÖª3´WÄ©`†ŠÖ3*%a‡ÒR²:"‰ŒftÊ -‡NwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¶XE$9l!<§s°Å8#YlÑÁNça‹FïDF` ÐXl‘N*N°1±º >¬uZZaƒ1’Ó)%,°iXfÉyF§a‹“6²:ØbÔœÎÀ§OXãC`f«N³ÛH£8…-Z{bu°ƒÏ1€v°EzÇQfH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHØbÉqL`l!Ì\V[L$Ž Œ†-(Àq1°E“á¸À€m há¸À€nIFÅqß’TŽãÂ…™’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]LwÏqëë4Ç´k(8Ž x×’x×Ôdu°æ¸ì(Œ -†ãï%=ÇÞÅ4Ò`Tpè8.V„Ar\@à]$q\@à]í±°:/0 ÇÞÕ—À­Üà]m¥æ¸€À»š´ã¸@àÉzà]PˆåÝØ‚å¸ë=tÚp\€Æ„†[Âq愈å™Ó`+¡BtXð® ->V…òèqfÞ¢—…r.r\`Á»X¨ Ǽ ú €ãVTÍqï*ƒ•šÓw•Ž’ã Þ…ß`9.„‚ÀqÖ7¡$ Ëê¢1Ž ,x´¤9.À*,d“°:/$ÅqÈXHø¡8ð.–÷ÈqïJk Ǽ+ n«ƒ-&hŽ à×@‡iËÌi8«Bj0§ïJ…ætà])}ä¸ÀwÓ²ÉqóI Ç0PÀ Ö¸@"zï8.pQB—Õ9cËq—XP«ƒ-ä‰ã8Ö"š8.ð¶­9.ð¶Àeจ -Þ7ÀÀ…¶ÀSä¸L&B$â¸À[‡x ½ÊéœÁƒ®Y]€NyŽ ¼'¥Xq\€XJLzŽ @ð"¹KÀ èq\à#lÁTá¸K‘ž9§S°N6Çðt¡SŠã‚ a ¼AŽ ‚ˆ2ä¸+4bIt5§#™âÌÀqA '’«Èq¦ "M0%«ƒ-  Ž 0>)ض øA°‰0‡ÕÁc‰ã‚t -7Ç!À-5ÇÀfŠ7=ÇQÂx|DéDr“9.C'%ÇQÄ›š8.À¼Lñfภ‰x!3o£q)ÞôD‚-. -«ƒ-pš"3oÁIˆ7ÁNœÎÁ‰ã‚è\Š7Çp3o£gS!Å›žM€wm3q:ð.Â×)7ØX|c•74X"8ÂjëPÆDØ ƒ_)iQø×ïNêlÅ%Zó±^"&mÏï~8ýâ÷_}õÛßý0z÷rúÛ/1Gž¤$ý«/UúLóß¿ÊU¹²ø… z-û¿("/²T'µ—ÛÁ¤• -ÇXȧ‚Ö^äVwýåo*ƒ5ñr¾ôùýüùiC7ÿt¦+óaþ;ëµ®å¦ßüç©ŒþÕßÏï¾:ýæÝ“wx‚IcDQïag¬Ê#ØùA¨y2eØÌrøRR71};ÿ ³NÖrýðÓË|ìÆÚÉŸs{4×#ß”Éõ©+3·gÃòÒ°¬vóuå:6ÖsMp“sÛn£íܦ]Úwê¶Ý[0NYö J82Q"Ê7;8¬s4 #Ò¹†ä~ÔÊèö=®˜^ÎÇ-jÝR–‘=Òι8(µDS9§¼‚ž»Ñr´þØ@¯¡›WðÁ:‡C/]çaÕph7 -7!§ãXûü9¢e§?6®ó–~š®ƒ–úÊãh­Î#!˜–²®£u¬ÎáÐzÝÑY]{1# ü}nõ~®ã-G³ éiílfÝb&„¦-ßµ¥×6ôm%S½\G"õíÌíkÕ8­nvpŸ[û6Ö¸˜’„Vˆö6VçpÛñK{þ鹦±Òûºê¦Ñ›Cz’ìêÚŸ£ n¯]Z¶{S(D󯿳:Û„/ïå@(Ä£IW?|X8½s;h¬s44éë¾á*8Œëžòé:N*Ùò×âZ¶@"uçì‘×F+/KtΔzŸ{r;ªÁmÜsæ&¯o ­úd”Ró:(m÷6VçpH»îÇq~ Å:eõkGãÿ¾ÙÒ7»6›ž—ý³aè;r„ƒu‡ÌŸ­mÛ!c…ÛŒhçß´þ]áÙcyfýiÕsͱé>ë¹N¼âËu«wBWŸ½âVîÉfÓÕÕ ²®õƒ[·»˜ÝïóŒÞ@c¸=Þ¬s84^÷ïÃwo,U˯bʆßúë¡æZ·fåÓÚO½†Ô~v³}·ÿnq©i|Ãh…BôÖ9zÍN®ñ†ÑhãIótc×+`5´+ª Û#¹àÉŒ¬6¶n}ÈÞV¿lk…¾6î¹zã3çß–ó0þðjf ®ì¦ñ]Ú†€¡ÞËÆ Ö9w|ÎGFõ ǧæ´R¦Ë$•™ó¾³½ÍF]Ỷ?îÍd{û}˜Á:‡C㎟ù1òU_íiŽ(¬Ï)rY¢ÛâÜu„±â«Ï&ªÛ@ìwÀë±;¾è£1ï-±í§àÉf{§R Ý<‚©ñ-•SIî x°ÎÑL×ýчïU¿gJtßs_}ЃØZ婹÷œ¶X‡0m¾Ž¸±:‡CÜÎýênu.ˆ¹Âmv(pâÛù«=b>9fÙÓÚ¶GÞržMi£é»tîû#Æ ôÚÛï Ö9zw6J†ýѽÇæ¢ãÉÕ}—.ÿÈåWèïî—æ?›U»úÃY¤Á:‡CáŽßù¨º1÷øóó õ~x”Úfäht4Xçh(µ;¹Îü­ûîä53Ã-ÿäo¡µ÷ç2—nìè½×ûàÎ_fç*›>Æߺõ ú=S]_Mù ~µwø¨ƒu‡Ü5^î&®ø%XF4Í<Ò÷~·#¬øi®CAïû:J·Œè­hìw´þnAZoÛ‡¦ÞÞÝRÉ÷GËõF]/#_.¾«¶Í#)é¡Ç=K¶ñ7Jç|tq½cu‡Þë>êÇÞ#T8¶¿gïÖ÷q¶r±¬'ÐíëÔÙcèbï~VqëÆê)“þ‰ÆöÍ•<ÜÁ‡cu‡¨sçynǬnãá­l¹“÷g×é -’>[Ÿò¯‰G±k|ËÑÁƒuŽ†b·ã ë–¼åâî_›è÷Œgt|¸ `úýhûÃ÷QÖÏ6jÛ¹×NœÞ{;üêÌí÷‘ë™c÷áoòÇ_ñ‹çnð«Ûûp?Ý#{êÃä÷{Yvnùš®ú*}ùŽ2Îï"w¬Îá;æk¤ôOñ¶#ÝqY›¯Yô¿Ã¬s¸ßy¾¥ÃzÏÜÞƒkÓ/ËÇùS&;ÅSÚÏë^7=Ο}­üˆòΟçvG¾: ?ƒÒ–ùê€æ+¦xð-®ƒÅ—o3pƒø¬s4|ù/éÞ1~‹¯‡x«1¹ŽÎŽþ8?KUÚÁg£gÛžgLO/ÏXþŽlÚ`Ã!êºw“PqÏȦìÏçÌ>Ù¿ª;îÄÖ9ªvv þ—yçæÑ}3¾™gÔNÜïïØ¥7XçpHÙÉ^µÏj¬Èacÿz¿/j$/Ë=YÂyuí½¤q59…¼'ɪ ÛòÂ7ÝWÊùÚ«Ù¸/UºãÛhë ­á¾,ÕLjá?nÝ[0’™»aïÓ⻣Ú=dýþˆþžÙÀ7-„æIÑïò¬s8¤Ž=±üPžñÖÝ$o˜—üü²fˆ¼ãIåÁ:‡Cä'x‚äŽïLú$3€y6þgƒà;²{ƒu‡à±}î§ø›ÞøªM›†|Æ£ œGolž qcŽPm/&¬s4ôÆǾIñMŸùT=ì®Å 4Þ‘w¬s84îø§»¡WO}ØÊ5[ß8ûßÜ›ÚïâN‘ÌÄeÌ÷à}»Ü;ž„¬s8ä^÷cþž¥OÐn··/ì-øõûjþ ï§¾ÌçÞ‘k¬s8äÞödÊè7J,PôÌ ¡É{¦ìúbÿ<ÇAÝžÑ)#Ÿr´/rõ ×ÍõÛ]9}&©©»þvØf ùèO#¤~3¿·Á[ ªMï¬Lo^ˆÍk -½ã$Áë7_ÿéùºÂkÚþíe§/±tóÐÌIóÆ}¥dù*0==9»t£È.uW"•:4éït(Ýèy¹C’ëTÖ]~§¶æÏS;!Ãq>_ZžSý”üôý¢};Ÿ»±gjÃ6×`ó5¬†ñÇ“›ÞÕ£¦÷µI„Òé…®gG"ÝsòñœÞ¤!•‡MM­Î5§×àþXJÍoÆ•éeyéEI—×æ6sù§ÿá¤"‰Ôÿ‰(.o±”“8è|Pů§ôSbÄDBŠ“pþ(K[¤rÁ"{ßzû’Æ -9Œ¥qcóGmóÕ¤ú6WKo—!™ ™éý*—3BÔtj-NW/…šÅéM°A˜ùÈS¬Ë6CX¤¶lm°VÜ+#¡] esº*Ö”íQéÍa¥ë\ÓÛ®SÍðç²Ú7ÃyMø|ÂiM/}e¥éý“¹©Ü»Z™iŒŠEjsÉ2 TƉ=Ÿá—27MÌ¢oF-½Åë" HTÊÅ\Ž=ŸØrsk¶Œ”/¥B­sÏWS*ÔM(ÏȦ>š¥>½Úº™#ÒäK±K#ÇZ†7z%|>Y*3±Š_OÖ3¥må -i3ôZ¡iÚ-â +^ª4m}¸|ÂÔ̲ô¤ôÿ…*l‘&æ™>(*Jï1«Gõ$inñ²“Z¹+¬C\(òµlÓ]Êû‚Ù¶¿TLùDº¥té±…´é²Fîc6/‘T!¥XÔq¢°Ü?…+[¡ÌFàtUl ”_âj§-S`Ï'sª»-íV±+ÜùÚŠ}q•^JWì-í6˜ÏÂçia£^œ òIªX˲ÚÕ“5ÂjH¡Š+¾Nâ<[ ;Mßv>¬“Œ[qŸOߟ¦eN«#>8£Ò;V[¯Kÿ2_á÷':ÿ1¿Ô벎kYØBn]ˆÛ•,½‘; ŠÓº³°L›F¨©¡ý*V¡–µ e׺ákªÕe%ö\RUEÛ -míÃF¬ tµ2MÏØ+Â箋#óèØÔûrhòÅá4&½.[…ƒörpªÎÔ%ùÜ4‰£T´.éÐ’n*â m‡Í cµlafd{’ÒõÉ~j‡Â¤s5‘MÕQ]fÛ¦³lºŠ¦\`Ó´ “jOö0Fß=½÷Ùd—g@’j/Ò×VZ.,I áñR3ºåaYsÌ9äÉ[{¨´eš¹gŠ“S§Fu-hqÐb´‘†Zm.`Û“R–-NšŠBÉ,+-úl“›«ån™®8°½ä‹OQ¥ß·=mÛQ)hÛQq«²©Ý¼âoÉȶpöõêd-Y|ÉÀÈ\[»H©–4Y¶>7-ÏWÛssT qÕ3•µš]•¼‹ÿî™;—:]‚+•¦Ìˆ -õ5˜X¨Iy£Í9&w'8¡ôrjO¡I•Ü\çzîd!ɹ“öLAÆH¯€· ^¡ˆûŠ¦©×ù ¢|µ(ÙKº­˜ÔP¥9¹Ê aætæ” *‡>…Š6N¯’–!¤W©{©ØTÑ´·÷ý"}2ýüpš -endstream -endobj -705 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 704 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -706 0 obj -<< -/Filter /FlateDecode -/Length 5044 ->> -stream -xœÝ]M丑½ç¯È³‘ùüs0à…=‹5ÖØÆîÁØCWö”E±û÷÷‘ÉRª²«Ç w¡ºR ~„ÈÇÁ ÄÔW…Ÿï4þ‹¤§Sðt½ýtùù¢¦àþ•«‹"þ#~ƒ»jEar:ùè®?妜 þúvÁÃ%Ïþvùï_]þº.£¯fJÉí®û1‹ÈN!† œ J)m‘sSÆyAäõ„[LIA ÈÐV ¥è$Ô c¢ ŠPÃRÐv+JPÃM’jèä‚ Ò -zh£”(ƒ"ŠÈA¦ÝäÑé^’=ù˜Le2Œ$³vò´Ó’,MÞ{%A—”–dº8M¤$t!ƒ$óÐÅz«Dt11XI ‹Aï$A¡ ÐEtQ^iI–ìäR$e 2CÜÊŒr“‹Ö*I¦õä€M+Ê0£0H>2]¼rI”Ag•‘dº~$xÂÙ£0[MžÝVY-Ét1&(ƒ.|‰Œ‡.*x‰0ƒ¦ÌK˜&J†$0ÑN)J,`bš(+Ñ€In"Ÿ‚ÄViÈŒ–ˆÀ*èâÈKL`5t!Ì\Q]l"‰ ¬.È qµÐÅ•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…šJâ ƵѓÄ” (%‰ ,8ׂ;%.° ]L÷ qëZçÄ´k)z‰ ,x×’Vx×Z”eЖ¸ì8Y­ÄÞµZ‰ ¼‹id$.À¨NÀ¡—¸X™LŒJâHâïš Ê„9h%. ð®q¸ÉrƒwSFâï2^âeÿ(Ñï‚Bœì@¬Ä°÷+q*› ܉ xW'˜?aNƒ­&“—¸ÀwuÄð‰²4é€æ-zyÒÞ'‰ x†ÊJ\àÀ» Ï(q8~‚E58𮶰Ԓ ¼«MR8ð.ü'qà0i8À¾MZº¢,M*Å(qï‚–ŒÄ°Â“Š`Q&IK\2žüP‰ ‰ ’òSv“%.C¦”ÄIG¬7 I\€y™×›Qâ‚dÖ›Xâ ó6YŸ×›Aâ‚DÐÅÁEeÐNSæ-8 ëM°“$óÐÅ$’¸ yŸ×›Qâ¸Xo£C1¯7ƒ.ïºf’dà]x¦^â\`½ ÏVZÛ+¯ ðÏdaÌ+Î(F ¨×Á¶Š!î…µ -bÌ@|óI @M¬,££0«j%† øþm8aŽ>ñ•lf ù&¦Á»okŽžÍîd›ãcûóåןa|¯þûåõW%RV4„’›à_a˜„ávð¾5nßúìøÕ Ù»2çfCêjiáfËjÁàå×퇕®P5+‹ÒX ù¼ú bµ4 î)µ–ÁX˜l%»®ï.sWåŸ ]Û-ëÚûˆ·Û;IÒõÝe>^×¼u.æº]YÉ;™?vð{»Œ´mW‹ÆcÈÊž-ôÁJÛ6SR„2 Ù)ƒåË|'H³ég*¿³È*¬°€‡Gè‘Ç&“-(hkE«Ì¿ùt™.ZÌqúvÉÔ‡O§a»~úéòëßÿðÿþî?ÀO¯—?ý‹RôY)ç¾ÿNã³3Ë߸üµó_°˜¢ü.éDËß°ü­ùk=~þkòâe.{ϧ†ö†zr~sB/,‰JÞ¢ßÒ&½Êeª®9o-¿©nÝŽï-ßow·.Ü·»Éºµ6jݺ÷VßÿÏõÓ—ß~Zƒ°¬žÞ‡ÛsE¾·ß®)ÂÕËÃâØðÆ×uþ<|yƒ¤•¯Ã¼Ô[d?Ðq;mj¡žzÍ꫟݃3m•û¡5ìë½¹½¾HÛ´oU=è5Loee(ç¨ -L¸IE“ÐC,Ÿ,ól`Öæ|‰d¿EF #ÖjÄÍP/'Ê8ê#œÂjÆ`Y¬íð[ÓAìùušÿ®È1¬ÑÔf…ÚÞÏÇÏäôÙ÷3éÉ2O‡>:æÒFž»ËIçÐ9reÓ%1=…Wï³µ{û†HæŽiF¥¼ª>Fò¹2O‡ä;Nì?#’÷Ðô„sNo6@Ïõlœð±xù±Ï^fÔ› ã,ªzízÌ=͘Àø»è=WæéÐ{ìÓnFkX²4ôpË8,s²Å漵ᨗÎ3+«h3;u¾ñ÷t7pŸË  /l¦2t‹3àn[2J ó;Ï¢ôd™gC©9öUw§Ľ0„Tn¨œ0 ©¢µ “f¿re¡ô‹7íŽ(ÞßÊz´}ÚA*óQMFS$º‡Ôsež©Ç~í×Zï_uõs›Y# -õy¬¾¦«[÷‘x?a]çèÍ´þº ÷«xõ8ìÉ2O‡ÖcßµÜë%e ~cˆáAÕji™+Fo`D­yeˆf>hCîMm#BÕ¯{]—ß cAM üîÄêÌÊuYÿ¾g˜mEçÀî“{Bq}ŸM¿ƒà"²'Ë<‚ýב¿ÆˆÒ*šä’jÏ<òÐ(ÆŸR7®Ñd|ÅQ¸A”f\ÈtÍNËf…´×Ö2Ìp«eýÚxü…åì‰z•‘lÕû¹ød™gC²=öq­°žÝl=åÈl{\Xë¸ÔË3nÊkCí>ª¨CÚøüh6–6í¶ìŠidL?å=Yæé0}'Ê;ØãlÓK¿†uîgTF½3ÖÍqs™Ù%¦Û?ç½äÍÜuáz§­%pƒW|dFFÂtËóeí¬ý%Z~Ÿ2~ˆíž,ótø½Ûð»ê瑧™ïZ<‰¨ÖñUŽî›˜:ãÛ>iR»±bØms`Œ¯,õ”øëAl³ËkÝÝwômÙÏ»íÇlm|Œád™§Cå˜-ï¹—e÷ó¥÷jùKKb”tœóätcyýý"ÎyNÅ^Çh’fþe@C\£d³6Ä…W«µÑ÷µ[Ykw3CdDÑñÕ“ež Qtì{º½uì0ºÛžUëýÑƨõßq„ OîÕ5"Kɺ4î=±Ââèim¦%ŽN•V`<&Pysl=¬õÈÎ*uO’›\!­{¨ÔZ÷Òû¥ßOu´åý§¥½¢\÷ÊÏ ÷ÒFZõ>Ìù)ës›G_û¥y¿j7„É'›ÏñXÚµËظ)ˆs?—>ü²­ÇÛü’[>Ha[Oé‡Ú·¾ôÓù=Þ=T¿—2Þõþò8˜™¯ÝòTä“P÷ŒÑ^çs½¯ë˜<…~O¹Ýví—ûŒK¾[eŠåZзÔ]ó¼2|›u›ó^è2µ?\µk}œï^ÒNÿÚ±V4Ó¹Ž{¨unû@/O&•²jÖ_Ùõ½ýØÚòLçeý5{²ËXD6õºÇùµ§¥o -V³Ÿü9¦o\ë õa¿¹±ßö9è ÿtÝ 8>Ï—ûq‡úÄ4èc–z9–ë|ý–O²åµž|p…‰Ú8uÇo9Yæ¡—«>ÐaqM_“¦è +‡2ÔÆ@µ^ ´eæj„Ý“ŸTʇ Vzá[ùTB -ß×h`œÇEjt¯÷JS,gxx/ês¯´óSr3©ôQñ÷’š‹bïöžÍ'dÀö{½w?`qçŽl “͇Iwt·7m]*o)?Л¤h -6ë~™Þ¤h0«"ÁÔícÑ-a­ã6FQä 0‹xÆ‹Na 徬âÊ!±{NÆÖˆçSŽR>Odh´ôäÉaðÂrÆ V,ó$‹³Æuå„…}®SŸ·Ašso·©Íæ£øâÇÁƒÇêsu—×K€Ù,ËöqãFz($£ÆÌÈ)nðç.æmQv Ckƒ¹Òã¦òìj¬SçÛ–]⌊Nͨ6[ÂâB0°Í¨4»e&WB˜M4¥äbÐCƒG³)fǾΠ{n6,ót³)é£Ùt*ˆN˦ƒUíU+}Û‘EÕ_Å¢!ÏÕ^Ù:ÜŒ å3±º ›‘~R1<âeôZª¯ÜPHÊ4„œÝ8=YæIPÕÕÎ'Ýì£jGö6ÑIâhbiOõ4»G_Òïñ=Ò~ÈË‹;6ã(ÄI[ʾ÷Ÿ+ót¦‡xñ)Ñt/ŒšGüU­¶×ÆM…Þ®œX_ÐïD§pVÈÐñÆ­»]~uæýèJÌ¿ü!åÜ=îDñ€³x¶Ð³áI«cwQ¿²Ž|9 4½À#ÃeƒÔ;î…V#üe6¶å÷k e]àä]†—-•Tõ/ï:7€þq9.8Œ¤ËgáçƒÝ;^®òn–;¬ÁƒíqYW=Q¶Ž/ ÊüE6^ ~µn7º`~œãve­‰!1·ù‘ØIËúR«þp\H”‡@蔈ÐÈ›Vu8KtbÙ)&˦m ª ôŠm¼ª¶áSΙÊåóf Û(jõ× ¦Ïj“)-p+÷°ÆŸ/¾œªË9ÐÊÃû1ù‹"®ž¦üvH×|îhT–t6]:Z_wJ–¯×ø¹åZ¾qCåC¸ó¬eXùÅ’ÿç2à?]t¢)÷Ù%.§ã«’\LãüvÉߎ@B2Qßj¾“œ—ªÕÇß i7°l˜Ò˜ÓºI-ûöv­ÌKLµ•wµX>µ’TÍd˹sÃB"Jz½MÎw¯&½$ço˜ˆ“]®|S%op´Ä^!ñ¼½Â^ðn²¶Š%ºm¢bÍõdCUO$n]ç{bSwfÃ_óbUiN%Þ.hÖŽ©obj>×¾VU{ר–f™R©¥ºš³ µq’n!ñ;U«& f“³Q˧ω±‰Z¾Tó I·‹˜o©Íµ‘ --WìESíù®J‡º­ã…´{$ä¯ÌasDÙúqœŸ`hc­"ÃÙ$Þ.ŽÚLìÉo„Ü®s…rz<Ѳz[rT/=5¯çO˜š5-Ÿ­šÿŸ©ÂµÔÌ<僦©|>r¿êä¹Ù’×ÄÓ}c’z@SèyYwéfyaq%äϤÛr·[¥².cé!Uõ2I5òX'놺–œ)¬öOãJž¨ªh®'»å·Ur×Óµ©êTkÌkw×êíɾqçOmÄu>ìºéÛêe˜¯‰·bØhLÎе‘žlT³v½1–Ø)ôäN£o%¹ÎÖÆN夗åcŸd’Ž]þr)fÎXgòÓ ÞêüÝ ÜëÒ×ÿCžðû¿ºþ{=,x¶ãF5¶0[WÉÜ’åoú‰'“ó7ÿÔÄ6mX¢!Fû=YÇž×U44;n ãkêÅU'öšS7ÕMÊ]ïC–lt¶¬gÜAâmèÅæÈ|íØtƒ=_ÚzsùiŒ|ÌtÕ -üvp»Ìv“|eUâ*gí&R2¬ .x¥¸d ¦®ÙJÍ HÞHëú¬?ñ¡°¹-vÁ܈|i»Œº™åU×´r, \`Ë/xŤy£i¥ ôÃÓë«Ç}QÙ×Sµ·Ô7žÚn,§6“Sm¹ôëËfsly°¡NÞÞC­.ËæžmNNŸݵ ÕÇ(K½Ø’ÁñF©¦­­†¢ÑÒTMk5†ª“_ŠÕn)wÅ^ -ͧè©á=íø¨´Nt|Tü&o®·Z¼æ-Ùæ9çÐïNõœÍ—ŒBšç¥[*õœ¶¦mÛ¦uÛÕÚ^ÙmPWÄwÏTõbn“ó!þ{dîÌe†(„”«þ”ȈŽýx}jÒÁ[¾1QEïÁ!”¿ô&Pd¡’w—9Žl#$5vÂ[ÂpLd­ -:÷¥¬Âé¾€UU¿S.–”xKïë!4ÔiNm"CåËÏJ ³ˆÚeÈKÅü]‡6;½1ESPZ~Þ?Gê^Vá“òóÿ´"Žù -endstream -endobj -707 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 706 0 R -/Resources 4 0 R -/Annots [ 708 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -708 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 307.623057 101.433071 288.873057 ] -/BS << -/W 0 ->> -/Dest (cb148-1) ->> -endobj -709 0 obj -<< -/Filter /FlateDecode -/Length 4677 ->> -stream -xœí]K䶾÷¯è³Ó|_@àC‰ƒ1²HA3m`6€Cþ~>JâCT©¥îž]hmï`vZU$U"?~¬*IMu–øù\á¿@J„½£óåý駓ÞJüJÌõ·øõö¬$yaUtÁžß'ñÂG«½;¿žð_wØ=ýã³ÓæuÔY‹Vöüó÷IEFøུŒ*B%•aTÖ -ïµuŒÊ)KŒ‘SÁ ëIÓRåaÅ`9Ì ­£ -0ÃWf©Š0C{Eœ -f¨h=£Rv(-%«ƒ!’ÈhF§¬pètÇé´.DY‡NyÍéŒΓ²ŠÓEᜳÓl±Q*Nga‹UD’ÓÁ2Ás:[Œ3’ÕÁ¼át¶hôNdt¶]ÕÁé¤âtÑ«‹ÐÉàÃR§¥6#9R›†ÕaFaœgt¶8i#«ƒ-ÖHÍé l!üp:ð„5>f¶ê4»4ŠÓYØ¢µ'V[0øh[¤w`‰ÄKhïEM è` - èyo8ÐÑ -rÑs<`¤‚N+ŽŒ„-–ÇFÁÂÌeu°ÅDâ¸ÀhØ‚[4Ž Ø–€Ž è–dTð-Iå8.0 \˜)9.0`\q\`@¹€Rä¸À€s ¸“ãÒÅt÷°®±Ns\`@»†‚ã¸À€w )ÉqwAMV[`Ž ÀŽÂ¨`8. ð®QÒs\@à]L#ÍqFU‡Žã`Eè$ÇÞÕAÇÞÕK«ósÐp\@à]mq ÜÊ ÞÕVjŽ ¼«I;Ž þ‘¬7Þ…XÞ€- XŽ °ÞC§ ÇhLh¸%Xð®ŠXþ˜9 ¶*DÇq婢ácuQ(gæ-zY(ç"Ǽ‹…Êp\`Á» ÏÀq8^`EÕXð®2X©9xWé(9.°à]ø –ãÀA(8`}Jº¬. -Cà¸À‚wAKšã¬ÂB0 «ó@R€Œ…„Êqïby8ð®´Æp\àÀ»’àö°:Øb‚æ¸~ t˜¶Ìœ†³*¤Sp:ð®TaNÞ•ÒGŽ x7-›8Ÿ:p\¼`Íq $¢÷Žã%tpùX8¶x e±:ØBž8.€c-¢‰ã¯a‹Ñšã¯a \Ž àˆ¨à}³ál\Øø€` ÂLŽ °‰ á™s:[àds\O:¥8.¶Àä¸ è€(ÓIŽ °B#–DWs:’)Î r"¹Š`š ÒS²:Øšà¸ã“‚mËq‚›sXl1–8.A§p3p\lÑRs\l¦xÓs\%lÇÇqA”N$7™ãÐ8tRr\U@¼©‰ãÌËoŽ ¢‘ˆ7â1ó6—âMÏqA$Øbᢰ:ا)2óœ„xìÄélÑ‘8.ˆÎ¥x3p\7ñ&²¹ÝÌI66õ324ƒˆF—Ë•zªAÆ3ƒ´+ÜWfŒî®íÒ´}éê^æç/³w }¶áÄ4ÚõÖÚ¿³ÎáзáˆÒ¼×‡Ñ_™Ë¥×»9¿—[l'Ë£”ÛKžÐRŸÿšŽ¯¿Ñ1ü>©©›ò øÅy•y Ä-9ÔvëÍb*}´‚ÖÆíTˆCeÐ),¿ŽÖ}u‡Öë¾ê¢{žkü«ÙÊÿÄpå!ÿÖóÐ³à ¿—¶ŸxDêêSaRÖ&l rg£!Roø¡oî/½±GÐØQß!oÆãqDíçiÛϾg;·ý㤙ۣôu‡´ë~bšã¥~`#žnUº6ÿghéP¼ºb©_1÷5‰Éts Ñ´¶[ˆÜWçpˆÜðoDË/ÒGüˆÙ]}:²ZHK.leÑwÖ9ò~ËY¾uö§ØÔµÏÆç+ÜgîÈ?î¬s4šë~_ALèzueC2צãêhë€_ë¤{³Îر¬¦9B V*}™Ú{nÚ¢Úf{E‡µeŸÆó&:+íºÉ†œ-JuЖ—É—aÿ -ÊîðùvÖ9Ê®û|»F·¥›F7¯h~ä‰Â™ºûë.ÉH2“¿4¡ŠÕMéÊäUuÒk]Ë ¿ßñŸ‡2+«£¹#§·³ÎáPsÝ/+#gæ#8ËÔv«‰jã½½¶ÕΞպŒq)Ó­¶ùÒȨv˪Ÿã×&Ä® }Û+±üˆÖÛý~V˶ô£qøùBj|LIB+ -D[ÛWçpÛðK{þaò„‹;nºê†Ñ›¢z–ìêÚŸcq‡p­]š·{S4DÓ¯Ym"˜'¹#ZAS“ÏóA(CÞm=7³³ÎáÐtÝ7\ćqÙ“»|ºŽ“ÖîõD0÷‰¹ûÊåœ=òÚhåeŽ®Â™²CïscOnç»jGAp'÷œyã7+o¿Ï±³ÎÑf÷=kØú%å÷…¾ÙµÙt™÷ÏV„aïÈî¬s8dnølw?i´ôoZÿnößÓ -ÏL£?¬z®96Ýg=Õ‰W|¹nõNèê³WÜÊÝÞU\¬Ø-²®õƒ[¶;›ÝOyF¯ ÑÞïî¬s84~"/µ¼²T-¿ˆ)_~믇äây™Å¬lî¼õO£]½7¾Æ¥WâßU.m|Ãh…B-ôî«s8ônäoÙ]½çqtÒÝ®~죆vE5a}$g<™‘ÕÆÖÌÓbÅÖî©­úÚX¸çê•ÏoÿÜ$F'oOpg£¡ÑmøœŒêŽÍi‹'Õºˆ(?¹[Úl³QWønö¼Ð™lgn¿³³Îáиó•b䫾ڳ¬ONÝðLámqî2ÂXðÕ'Õ­ öŽ{à;ë±¾è£1ï-±íÇàÉ{Ÿ3oßü:ºWÜø–Ê‹!$·¼¯Îá¼ó]—{ïU¿gLtßs_}§±¶Êû;žiÜYçhˆó÷«»Õ¹ æ -o´Ù¡<Â7¿;ò1–eÏKÛfyGÈy6¥¦ïìó#ã -zÍí÷ƒvÖ9z7ž• Û£{5ŽÍDÿ6CߥË?rùÃú»ûå{óŽŸÊªí›÷[öf‘vÖ9 -o|ŸúTݘ{üåù†z?+(mž‘Üí¬s8”nä:ð·î»“×Ì 7ÿ[¿†ÖÞŸË\ºòDï½Þwþ2;Ùô}ü­[Ï fªë«!ÿ±öUUwø¨;ë ¹aÃGãÝÄ¿tß0ÜqÔLïwO„?­{Ÿgáû:J·ŒèÍïk_y÷» ­·í»¦ÞÖÝRÉ÷GËõF]/3¼ ”Þ·Í[)éëQWžY -¿‰Îùèâz÷Õ9z7Þá^å·zF¨plÏÞ-ïã¬åbYO {®Sg¡‹½ûYÅ­‹·Lú76Û×Vò`ïàÃ}u‡¨ sã}î‰Ù]ßÇàäýÙuº‚¤OÖ§|ÄkZAqã[î}2xgáxÃÝ®[ò–‡ø¶€ÅóáÛ(ëgÉ-ßSf燯|OÒ2£¼ý>ÒÎ:GCfÜwþ&¬ñ]‘n)]zl&mº¬‘û˜ÍK$UÈc.VuEœ(,÷OáÊV(³8]Ûå×™¸ÚiËTØóÉœjànK»Uì -w¾¶b_F\¥âŠ½¥ÝóYx6êÅ ú!Ÿ¤Šµ,«]=Y#¬†ª¸Òèë γµ°Óð­àÓÇ:ɸ÷rúñ4,sÚXñÁ•ö=m½.uþÊ|ߟèü—¼ÑÖ¸ŽkYØBn‰Û•,í’vŠÓ®ÙYX¦M#ÔÔÐ~«PËÚŒ†²ŽkÝð5Õê²{.© -ƒª¢m…¶öa#ÖºZ™¦gìá¥ëÅâÈ<:6uÁM¾8œÆ¤-Ú²U8h/‡¡êL]’ÏM“8JEë’-é¦"ÚFqØœ0VËff&@¶')]Ÿì§v(L:WsиéÐTÕe¶m:ˆ«hŠÀ6íAÛ0©ö¤qfcôÝÓëáqŸLvy$i¡ö"}m¥åÂ’´/5á›–5ÇœÓAž¼µ‡J[¦™{¦89ujTׂf-Fi¨Õ¦¶=)eÙì¤y¡(t™Ì²Ò¢Ï6¹©Zî–áŠÛK¾øUúcÛÓ¶•Ò‰¶·(›ÚÍ+^ñ–Lq€l g_¯NÖ’Å— ŒÌµµ‹”jI“eËsÓüÜyµ=7—AÕW=SY«ÙEÉ»øïž¹3Öé²\©ü3dFT¨[Sb¡&å6ç˜Üà8„҆ўB“*¹¹ÎõÜÉ2C’s'í™0‚Œ‘^o+&¼B·MS¯Ó®ž|µ(ÙKº­˜ÔP¥9¹È a¦´ã *‡>…Š6Û;ËÒöæ^*6U4dï.³ôÉðóŽøÆ -endstream -endobj -710 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 709 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -711 0 obj -<< -/Filter /FlateDecode -/Length 5059 ->> -stream -xœí]ËŽìÈqÝ×WÔZÀPù~Æ,ÈÇ°`ÁÒBðâvÍ´£GÀÈ ÿ¾O$™™Ád°È®û˜A·Ñ·‹ùfž<d‘úªðóÆÉé)¥ƒ»Þ~¼ütQSô -ÿJ‰ÕAQÿ¿Ñ_µrqò:‡ä¯?’ÀÆ)fob¸¾]ðßpÈ‹¿]þô«ËßÖuôÕL9£ýõï?ÊÙ)¦•T*¥­ ò~ŠÑø ¨‚žpŠ9K*˜á£3n«Š0Ãåä%ÌpÆ$A•`†uQÛ­*à µ“T0Cg•V°C¥D QÎY#è´Ÿ=H:£§²É¢.B§£‘tÖN!:íµ¤ËSÁ'Iç`‹ÏJK:[¼vNI:ØâlŠ’.À¬u°Å¤h%]„-£“]‚-@Wu°E¥%]¶“ÏÉ9Q—¡S)¦­Î(?ùd­’tZOØ´¢+ -“¢ 3°%(ŸElñVIga‹Ã¤OxSV«¡Õm•Õ’ÎÃc¢u°“/1€ °EÅ QVÐD¼$q€‰qrÙ8‰L²“K.I,`Rž\ŒV¢“ýäBŽX¥¡3Z"«`‹wAb«a‹ÃÊu°Åf'q5°$.°¶g%.°`[´H\`A·Ne-qß:¥ƒÄ„ 3•ÄŒkSpXP. ”%.°à\ À‚t±Ü£Ä¬k}0XЮu)H\`Á»Öi%qïZ‹š¢¶À€'«“•¸Àw­VQâÞÅ22`V'à0H\¬L&%%qœÄ¼k"\€¨‹Ö •¸ÀwÇ)Hž¼k¼28ð®q&H\ Là%Fà]Pˆ—ÃØ‚•¸þ:c%.@c“AX"qïê ÷'¬i°Õ¤Sxð®N˜>Q—'1âºÅ(O:„,qïÂQY‰ #¨¿Ìj­[mXéª q]¦öMöºÁÞj?õéy¹Ø9V;?v™hÛNÿõ¼¤sw¯ƒ­uünKÛ™é^׶—q2;hµ¢ZÏÕy:´ºû¼–Ö³PG˜.¶Y®37 µ!S í *í})$èþ¹õ¡ÖõVˆÜ9g'õ?œ3Gœ©(Ê}d庿6n·¼Ú5ç§cƒC¨ºÔsuž©÷ƒº#4ŽëŸ£©Íðˆ"Æibùé#wæ-"‡•P‘ò5W\CÞpþgúÚEdï<]úG(=ý¹:O‡Èƒ˜pÇëŽ^¿ÍZÞÊwÙ¡Žxëk®€ýíÁF½¿|²Î³!ØĪŸÁ;hy²GoÛbÊë}Ÿ‹Ÿá;èíq(]"w[µ£ùÉ:O‡ÞƒØõpý>„5„¾gÕÜ;‡1*ƤéÂpN¢½;h| ÷x²ÎÓ¡ñ >£ýa¯?ÎRÙSWÄHøùf™õWÛþ¸pËkì—ñ;ÈMïÏœ¬ótȽÇ~ZŒõ3 4®ËmP¨?¿~J¼}70ŽÓXæ€sí¹Ö“už ¹ö\üÚ2IQÑá+Ý4°¼'e×9ErkD”Œ<åh_ç,~‰­ÿÂVĘIbu[ÆKò!ãx8Á/ m»†Èqœ7ÒRYÎôltp²ÎÓ!õ Vý(ÄŽu-ãÄwŒ:G©}™ëÓu¢‘ÓZC;TÞœ°kʼnƒëÜË¡¶²Ü/ìœÓ—Ý!î öxöd§CìA<{}¾8ïÓ#™§Ý-F-;h~ Æ=YçéÐ|?ÆýÔÝ¿Ò9rÖ™«¶+/ìú —ëD|ÅÔkîü·ÊéšýÇùÞú»âǸFt¾üJ–Ñçȳž¬ólèsqê?"Ͻ'Su›Òõ¹s-íËåvÌcÒ“;®“užÉŸ–sýE"ùsä -§7 çv6qø8¼þ8fË=Ž­†qõßzY|zöŠíÉ:O‡ÞƒCÇÙv-Ò(ãN§æ>*FŽâw…p«h3;m¾ñG¶¿óŽѦe¸ïÙJeè~ì>¯”>p_ÁÉ:O‡Òƒû -öW3ôÐÿ£Š6ŒW¿ÇïJÜY¥O»­»bÓá,ïÉ:φépò›_ì΂ú]¿†ugTF=˜ëø¹Mbv‰)ÇþïÍóÞµä½ï¬HW¥h žÀQñ=o4Æ3¦[™ï×ñPÁê0^¢Gáç)ã÷ÜîÉ:O‡ßƒÜ®€ßÕ8ßùV»Ó%ï`…Ǧã7cNĶ~£p/—âvÛó+ì—÷2`›«¼F°Ý/y`Aß–ëy·ýœmðïÏ1œ¬ót¨<ÈÙò‘{Y®~¾ôQ-ë·•1Kí ô³èëï÷òg*s*÷:f“4óð/Ò%›kaC^xµ[c_»ÕßZ<ú&ax ¿z²ÎÓ!êÜý®›]ÇÎ}˜«Ùã×wF£ÖÇ^ßshkD–’miÜ{b‡ÅÑÓúÌK5­åâŒç*oŽý±ûµ¹²{$貟|!­Tž¬ól¨ŒŸvÀþ)3P󨿇ܶû±[Ùʾ(²ôïzµp¸šûÜô%Dœ÷Väñµ©äñÎœ‹ûNÖy:äÄ}BŒäƽȰÞËèæ©*÷Õ{Y…ïÄo¾3d–VÏ -lùlÜwǵ›lÑëK_üœ<øý«­ Åí!a4ûy*wÊÖÙo‡ì Z1;z¹6©ÌþoÿŸÿþÇßóøªö>ÇP%njkoÇÓ•Ú´»}©¼1o䣷áY–Oœã#Å!öqKŸ¹·Ûm6.ýºÛº®v×;Ðmã6×ríسÙMó,œö¤ù°ÓH«òüù̽ê£G9²è¶ô–nª}OÏA´ôü¥}»ÌŠ§ü@ZF‘¢æï·íK‰¤‘oÛ)g^G=”‘ºgGJ{v¨~.îÆÎfÈÌ,-ØF¤  …¶gtö6×hëH«³êÂ2–Ë9Q¿í8,ç™–r·Ê˱`oi»–yeÈ6ë>ç+ Ë<ÔñðÕ›õyö¡ÇFòøf5ŽAÊf6×yµÍíèå~¤RWÍö+»>·q[_ÙìëÊêãÙƽÚû<Ôyªí¶ú '¾Þ-“d;¸'ß'3ŽÓÌ2uì2àܳqI¹ö9¬YcÄ¡7 '®÷Guôæ®™û6ö{¿x;wÇ!¸aÌÒ_3uÝQ=ñ3Xô’ËæMÒÆ«ƒ¨èd‡{øÃ!ߟ;FökDÎ8¦Ç<¸^ü¿eqž…Ýs˜T¦§‡=V"ã· -¸’²øö~“ÆæÉD©IÿzTÝ¥ò¸}zŸdÑQu¦ì1obõ{£Æ¿ýÔ¢ {8‚–g`;ìŽàqRäàœlŠ“¥W‡ˆçt8¢–æØÍ~`DªD›Œõ_iD]2X^ÉÁ·ÞÁ¤_Òg÷;uüay8môèÆÓ‹yèñ²™=ë¶ñÅa‘z¨Aïö9¨W= -¥}ç -å+ô¸Ð²v›8©Ž—.¥ÇÏŸ°4«ŒôNÿÏTá›”˜§|ЮAŠ^ÖÐz'´6›x=H\ë8i´‹½,.cÃ,/”PžH·•n#¶’²!cò˜«yDR<ÖbÝP×ÄDau|Wr¡ªF ».ö Êo+q·Ó·¥êUë,hwßÚíâиó‹c›qMoÞhö¶væ«ðV›ÅýT;éb£š·ë1a7 ¤ÐÅFߊ¸®ÖÆNåñ†ËǾÈ${»üõRÜ"UC[´`5½HŠG]úú(ó~ÿçâ®ÿQß\0ûq£[˜Æ­+1÷dôÚÁtRL¯!¬Â¶l˜Ð8Fû]¬S/ë+š7†ñµëÕU'öZR7ÕMË…¾!›]£-GxF±2Ÿ:7Ýaχ¶žm8éÕ*ðÓÁaê:Û]ò•5‰#*Ú]:´Î°Š8àâu˜»e+3 ¼“6ôd¿ãSa©/vÀÂ:´]纛åMWY9 V!°å¼a§y§ye`ôÃËë“ç}19Ô@ÒFíMúÆ¥íÄHÚO–ÚrÖ‡ÍçØ+ÔÅÛG¨µeÙÚ³-ÈéK£‡nuÀ1ʤ©W[ -xÞ©«²U§ÕQ4º€LUYk1V›ÂR­K9ã$ŽRl1E—þ•´ç³ÒÑóY ›²Ônõx-Z²-òαŸê%[,™Y൛Ôõ’¶Ê¶}»ußÕÛ^Ùi¸nHè‘©êÕü¦äCü÷ÈÚ™ë Y©Tý)™ú»~਎ÖØòúf•B‡8z_t‰¥JÞ]ç~îd›!©¹Þ¦crÖª¨éEܲ oPäckª¾¤[®–•xJï!5ÔiNm2CåM¬åª{IµÃH[Ezñ²¥ 7Ñû"£Òò%SºÏ®Ò'åçÿQ…RÏ -endstream -endobj -712 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 711 0 R -/Resources 4 0 R -/Annots [ 713 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -713 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 101.373057 101.433071 82.623057 ] -/BS << -/W 0 ->> -/Dest (cb151-1) ->> -endobj -714 0 obj -<< -/Filter /FlateDecode -/Length 4658 ->> -stream -xœí]Y$9~¯_QÏHk|„/iÅX1‚ÄCwÍ6õ"-<ð÷ùœ™>ÒyTuϳ0­šªŒðiþá<¬®_)üH‰¢wt½}ùá"…·ÿ†³ƒAý->Þ^•$/¬Š.Øë÷I`¼ðÑjﮯü׶É_/úÉåó<êªEŒN+{ýçwIEFøུŒ*B%•aTÖ -ïµuŒÊ)SŒ‘SÁ ëIÓRåaÅ`9Ì ­£ -0ÃWf©Š0C{Eœ -f¨h=£Rv(-%«ƒ!’ÈhF§¬phtÇé´.DY‡NyÍéŒΓ²ŠÓEᜳÓl±Q*Nga‹UD’ÓÁ2Ás:[Œ3’ÕÁ¼át¶h´Ndt¶]ÕÁé¤âtÑ«‹ÐÉàÃR§¥6#9R›†ÕaD¡“œgt¶8i#«ƒ-ÖHÍé l!üq:ð„5>f´ê4º4ŠÓYØ¢µ'V[Ðùh[¤w`‰ÄKhïEM è` - èyo8ÐÑ -rÑs<`¤‚N+ŽŒ„-–ÇFÁÂÈeu°ÅDâ¸ÀhØ‚[4Ž Ø–€Ž è–dTð-Iå8.0 \˜)9.0`\q\`@¹€Rä¸À€s ¸“ãÒÅp÷°®±Ns\`@»†‚ã¸À€w )ÉqwANV[`Ž ÀŽÂ¨`8. ð®QÒs\@à] #ÍqzU‡Žã`Eè$ÇÞÕAÇÞÕS«ócÐp\@à]mq -ÜÌ ÞÕVjŽ ¼«I;Ž þ‘¬7Þ…XÞ€- XŽ 0ßC§ Ç(Lh¸%X𮊘þ˜1 ¶*DÇq婢îcuQ(gÆ-ZY(ç"Ǽ‹‰Êp\`Á» ÏÀq8^`FÕXð®2˜©9xWé(9.°à]ø –ãÀA(8`~Jº¬. -Cà¸À‚wAKšãÌÂB0 «ó@R€Œ…„Êqïbz8ð®´Æp\àÀ»’àö°:Øb‚æ¸~ t¶Ì˜†³*¤Sp:ð®TèaNÞ•ÒGŽ x7M›8Ÿ:p\¼`Íq $¢÷Žã%tpùX8¶x e±:ØBž8.€c-¢‰ã¯a‹Ñšã¯a \Ž àˆ¨à}³ál\Øø€`  Ž 0‰ á™s:[àds\O:¥8.¶Àä¸ è€(ÓIŽ 0C#–DSs:’)Î r"¹Š`˜ ÒS²:Øšà¸ý“‚mËq‚›sXl1–8.A§p3p\lÑRs\l¦xÓs\%lÇÇqA”N$7™ãÐ8tRr\U@¼©‰ãŒËoŽ ¢‘ˆ7â1ã6—âMÏqA$Øbᢰ:ا)2㜄xìÄélÑ‘8.ˆÎ¥x3p\7ñ&dÄ° x÷%æ¨ÉÌJ²q}쟽üô “ïõ¯ÿº¼üdX)Ë -š€g ÑÝÞ·Âé‡s° †Ý“6Uêc5J§E¶d¦»ôïºü1³†~;¯˜bê ÿ $ÖÖ£™ÞÑèe³ÿüÃü2®mºT6B;—–30È4Ø0úðý姿øÝïóÇß^.þ RÚg|@±„ß„é“ÉøÛ')­5ŒÇ6é’ü%¥ùÙ_®¾iëÔ)̎ɡיªQÇä¿ø04)Ýìá%-‡!¦B{mš¶šÖ¾3Ë[Úzjbœœœ}H#g'iÑî”+›¢*c FÐ! -„®íÐ ¿þæ›_þêµäÚHŽ¢Ÿ}¥¾NM=}ûé[ß)M–Ñˤsãw*'uÝ:9dVÕ2rþAn&™Ê ó¼åXÍó=B#ýþ¢ìÏH,ƒhuì(k¶O~ÖŽµÌOL-2 š0X³8`Šháüun•“i öFL8ø±›Cç`žÓز1v¨Ãå~o0ß'‹Oú\±„×ÛŠ.Œú¬›¥ù8}Oz­'}þ|œ¾iúMMYºnŽÙ¤+cAwçAó±2¤ÍX¿Ulò#m1ŒSUZš‚“z‘¢ÞCÕÁ<'AU5n ª°–íØÌu-æ-<0`×sƒ,ÖÞÊ=™ó&mõÞ ûnnõlg+åt¶HtsÙ ];u±ç¨¦<¦«SöÈkòö¶û{ÚkÁºpîà~yçö|,ÏéLñâ)Ñ´Ã[r^æ>õ#0Ë3'NHÔêNt>7eRמ?‡’®Ø»‚NkîGç±<§C§Ûä×væZ +·v\Î~ÃØuÆõ\˜§-Ç=gçºuµaæ•Þæè(våôZ{›v5çZ~wu-fù–'_ºzWæ âM¬¡¯ú&èt9¨ÝÙýXžÓ¡oÛgìc’ÌQm¬ òÒã½Ôø—ÿ%¤;GMæ_ñ`ž³¡ÉlûŠif*­ø¼ÁgjÙ{[³–žf£‚V?OSfàãL;|Þ2KæèÆáó¼ä±~öäýùýæt6>K×Ðõ~Çòœ?"?ð QÅt¾Oä±Õ¦+h¬>œMwY­9˜çthÜñûΆ¸E‡Ü{*·OˆÚf½0]ïa¸v½ÚcyN‡Ú5Æÿ5Ô®!íSññËÜîšÃ1þæ‘LÕïLwéÁñÞ‹»æ9’iÛW]»:“üL½á¿åŸE+9o·ú1óßú˜º‰<†‘ÐÄøÜjxAD£+Wz¨¢¤ ã™AÚ•q¥å;Db+èÓáîHé`žÓ¡oÇ¥y«½¿2–ûk€-ÿŠD:Y­ñlÑÕYV‰¨ñ;•Qî¦ÙFë±<§C붯ºhÁžçÿj6ó?1\ùNÈ¿wÆ<õ(h¯ÂÊ DVŸ2ñ‹I7[…=DËs:Dîø¡ïî/½³GÐØQß!oÆãqDýõ´å÷«ôoYÓ´òþ8ý`ž³!ÍþwÖ4ghéP¼:c©ÿ]î³Íšdº'Ñ´¶{ˆ<–çtˆÜñïDËÒGüŒ«?¶¹îlµÞÒÞ -úÁ<§CÞÿ×,ß{õ§ØÔ•ÏÆçkÜ÷ÀúãÁ<§CàÎõjס¢;” ‹87 W{;Ýî­q¬“îy<κt7kJ«iŽƒ™Jߦòž›²¨–ÙÖQî•lÓ>õ&:+åºÉ†¼Z”ò¤»(ÀeòåSØÏ£Ì=àóÌs6”¹mŸïPï6½tWïæmº/ºp¦î¾×îÚ}ª¨buÓ·l÷®Ýî÷x×î -jXÓ;˜çt¨ÙöËJÏ™yÎVj»Ùdv§@‡€ÞÛ+çÐ=:ÝŠqIÓͶù†g>Q¹eÖÏñk³ÄΠ}Ù+±|¾Çü^?Ï=°Þw0Ïéü…ùyŸðë}´œ­=VÐÛ>Órtö>–çtèÝñ7¼ý»Ãxþ_ZvÚã"œ­5Hix´zyL}0ÏÙÐêw®C˜]{±¬lô+A©'¦' jÚÞéVk†ÎßlŸ4dW³û•Ÿ>~V˲ô[ãðÖ }ãcJ:öHíÁ<§CØŽ_Úó³N¸õDÀÐ{SÔAÏ’]û:W×Ê¥y¹wEC4}üxÌêlÁ<ÉÑÐ -šx^å`žÓ¡iÛ7\ćqÙ’‡|ºŽ“Ö®õΞédÜuåRg¼6ZéŸ0Íœ);ô>7öär>V; -‚7žÁ¹÷Ê›÷÷_ç8˜çtH;v¯aë—üØžýä¾ÙÖhºÍÛg/¬Ìs6d†Ÿí O:õþMëßÍîã{Zᙩ÷‡YÏ5Ǧû­§½ƒíÍÁú»BÃ5X7Ý£ìÆãṸ´Š­êJ¶ÎoÖGî°¬äðæaú®Âmxó°Ó§7§.MrÒºñS^éí¦rB†ÒTß“ßXœÖ$§W‚ÏÊ·SÝ=4½¹œƒÍç°èÆ.nØKB û Éäè´áàÕ‘H·~ûxMûWiHånSCC«ëJÎa›ÆJªiçF™6sJyŒÛ:6Sú†ÿþ¢"‰Ôþ‰Æ]Öä ^{׉_/i—=bÄDB'áôS–²Hå„Ev›zû”Æ -9ýŒ¥ðôÚäñ§¶ùlR~›³¥ÝHæDfxÿÿX1#DN§–âtöR¨Iœv* ÂLG®˜b]¶ÂZ µik5ã®XÙíR(›êªXS¶G¥mJÓ¹*,¦·M§šîÏiµoºsKx» ZÓK_YiÚ-•[WË"3Q±HmNY:„J?1¢Û…~%sÑ„Î,ú¦×Ò.3£0d QIs:Ft»°é¦Òlé)_R…š5æ–¯¦T¨›Pž‘ m4I}Úzµ#pGtî‡VìRä¾N› L]P‡nÞ.–ÊH¬â׋õLj[¹BÚ ½Vhšr‹8ÈŠ—*MÔø C3ËÒéÿ‘*l‘&æ~(*JûìÔ£ZI›E‘nI]Zl&mš¬‘û˜ÍK$UÈc.VuEœ(,·OáÊV(³¨®ŠmòëL\í´e¨ì¹2§¸ÛRn»Â¯­Ø—WiÓ¤bo)·Á|Þ†‰zq‚~È•T±–e¶«•5ÂjH¡Š+¾â9TcÒvEÙ*´§ƒÃPu¦NÉצH¥¤uJ‡–t“m¡8l*ŒÕ²™™ m%¥é“ýÔv…Iu5‘MÕQfÛ¢³l8‹& \`Ó´“j+3{£^oî÷Éd—G@’j/Ò×VZN,I áñR3ºùa™sÌ°?Q¼µ…JY¦{¦89uhTׂf-Fi¨Ù¦¶­”²lViž( -]@&³¬”è³MnÊ–›e8ãÀ¶’/>E•þ­miÛöJiDÛöŠ[¤Måæ¯xK¦8@¶…³¯g'kÊâKFæÚÜEJ5¥É²eÝ4¯;϶×æ4¨âªg*k6»Hùÿ=2vØ=¾¸TùoXQ¡nÓ†‰š”7Ú\crw‚sàJ›§z -ÍRÉÝy¶×N–+$yí¤­ Ý!Èéð¶bÂ+q_Ñõ:ípÇg‹’=¥û€Yª4·Ü‘mØD{X«ˆÊ¡O¡¢ÃV§2„´Õ¯—ü&Sé¡E³å“áï?ܼ{a -endstream -endobj -715 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 714 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -716 0 obj -<< -/Filter /FlateDecode -/Length 4929 ->> -stream -xœí]K丑¾ç¯È³‘ù~†¼Ø… ÜØ=,öЕ3ecQ³Àxû÷ý…R$CTè‘YÕcµí.dg*‚ùñc0DIúªð÷ÆÉé!¥ƒ»Þ~¼ütQCô -ÿƳƒQý>Ñ_µrqð:‡ä¯?’ÀÆ!fob¸¾]ð_wÈ“¿]þó—ÿçÑW3äŒö׿ü@*g‡˜bT^Pe¨”¶‚Êû!Fム -zÀ)æ,©`†Î¸¥* —“—T0ÓU‚ÖEm—ª 3LÔNRÁ }TZÁm”u0D9g Ó~hô éŒBÊ&‹ºŽFÒY;„è´×’.!Ÿ$ƒ->+-é'çD]†N¥˜–:£üà“µJÒi=x`ÓŠ:Œ(tRˆ‚ÎÀ– |u°Å[e$…-’<ámLI­†F·UVK:[Œ‰NÔÁt¾Ä&ÀƒDAñ’Ä&ÆÁeã$0É.¹$±€Iyp1Z‰Löƒ 9J<`•†Îh‰¬‚-Þ‰ ¬†-#WÔÁ›ÄÖÀ$¸ÀZØbœ•¸À‚mÐ"qÝ:•µÄ|ë”X.ÌTX0®MÁI\`A¹€R–¸À‚s-¸Sâ ÒÅpX°®õÁH\`A»Ö¥ qïZ§•Ä¼k-rŠ:ØK\v¬NVâÞµZE‰ xÃÈH\€^€Ã q°2˜””ļk’r8𮉘D]0­Ä¼kQ{‰ ¢‚Àƒ²DlqÑI\ÇzÈ6'‰ ¢-Ö‰ ¢-p$.€G0d ï[\ÀÀE\8ØOQâ0Ù²sD°C«Jº`†A×¢.A§£Ä1ºS±–¸k©!aÐK\‚È]’¸f@§Ä1à ‰ 0 ÉÀ3—t¶ÀÉ–¸ž.tZK\ l7(qA2 «Ì $.À µ$šZÒ9EëÌ$qAra WQâ ¬4Á”¢¶€&$.@ÿÐbÛK\€Å›Xæˆ:Øb½“¸ %CËÍ$qAJ°Å(#q°IëÍ(qAV°ŸÄY…Üd‰ @ãÐ)%qAÖ ëMã$.À¸¤õf’¸ […õ&–x¸Í6Ðz3J\lñpQDlÓ”…q NÂzì$él1ÙI\C õf’¸nÖ›ðèÅ@¢õfÃà]ŸÁL’¼ Ï4H\€¬7áÙJk{âõþ™¬L´âLbÄ@z=æV1d À½˜­¢3P _Z#‰A˜‰•e -bÔÓ*”Z‰aþ…?æœp>ñU"æÌé$3†…ƒw_×-™]IvýåO—_~Æä{ýÓÿ]^1FÊÊŸ†ƒ0¦vð¯0 LFw{xߧo€ehb&’" aà3yȈ˜›‘´8ÝÈHLôïºü1³†7Vokõ³øX½ƒC†qãÈ Ë×Þâ³| Á -‹#̶il6ÄN€üJåf‰óé NVÜc õ™ù‹agüõÓ—_þÛ·ßþË¿þ0úôzù¯_) ë×ßhúŽ÷o¯¦ãÛtæßUn¦oÀGëé÷­•WËy½Ã5TH:~\˜ëJ™.µ2ýdÏ,½c²Ìò½ÎóªÇ°ò¦²J9£î‡I7¥q¾³Á7[å¤y›Py‹vz=^—V¿þïë§o/¿ý4ÞèÞ‡Š%L¸LŒ´‰ÕcYÞƒÕ/Q,m· Úw›íºC-¡V»£ïVŸÐwaþ]a¿Õ×.ÝôÝC ØNP-ù«minÏì|üzýuh*á|zûu7„>O¶ØÎî~ˆ–rnm¶ů ¤ÅVäMÜÌs6àb%µ…\Bœü%¹”+ˆv‰ô­_Ñ!´öB‡êŠ€Øzé‘}•ìûózaHëmûžåë‘Ë'ÕÜ·'z«·Ó¨WŠ­#-}¦z -¡ì -zm¥P‡ŸpÉsÈ{è=–çtèu›¼»ÖË®ïµ þ#^á=YËzaû¹›ºÑ;Úv¼gçhªåKnÀ­¡¨ðÚ˜ÎÍÓõ£Jš7êhèÑ,ؾ6kÿËs:Dí8›}ë•ø¡ãGÝP6öÞŠ#WÒèÐñÒ^zÁ©üûr(ßã5­ ˜¹–Ê ã*hoåt0ÏéP¼ã@צßÙËCú ãœ8ﱊŽïï(?¯“¸2û¹"¿ÍË2z*ÇO|K<}ëFÑÊúQ".Ùúsíæ'ùá½w°Ã¯†ûŽ×Ióœ ™fÛß|Êc¾â?Ï=àW³úzºGö؆ä÷Çé³ákšæ7jº”§mˆ»È=–çtÈ=ækV¤t>Ú¬§;.#t÷è[åŠ'|±ƒyN×âÛ¾˜ï°ÞóA?VǵÎÍÐz*´™Å¤ûzÊîå~,é(OY½%ïü6•ûÂò¹–Ÿ×5®“iÆâi?ßë C-7L¶N <é>.ÇõàGœ‡Œ/€;Š¯cyN‡¯/éÙ>f}õP‡;.ˆs?¬œGgG<žeåà·5“m· ÓãŠWf,ûD4í`ž³!Ên{7„Šgz–¢?_3û¼ÏþT±ˆULƒ¶.†°‡ªcyN‡ªmÏãoÍ;÷î‡ñÍ4¢vÖýÖ?¾º:˜çtHÙ‰^±¸â[9tqϺ¢+¾îùÃ;qÙY4­_3¯Ž_Kª+.SðŸ›l+ú¿~èºR‰×nFãVÐÊ|)m†¬’¡#Ûh=–çth}.Jõ%Öð_ n,8™ë®$ÔÌGW'J,d‘î³ZnŽè¯™Í"i2R]óÑí~ñ.ª6‘z0ÏÙêv¢Vg|t+ÉÆ%¿¾¨Ù -"›çé†:¸ao¦?˜çtˆÜñ WfÝG¢úÄ!ÖÐ_kû*ã¾+~"ºw0Ïé|l[ß»¼‚–‡"ì+×íi†­¾Þ øëÚ¸‚Þæ‡ÒgÎa©¶·&?˜çtèÝñ]\÷ù „ÿl=í®Eþ‰¸ãÁé«níž>rÕv6 »ÖÃkwµÌ>EN×ì?ß÷Ð÷Œìˆüb#y}OÄYæ9úvüÔ¿Gž{$RµÎÅJéÆê\Ý㿲ºûRH~âëƒyN‡ä÷Å\¿J$D¬€q:¿?u\]ö~xß<ßfÓƒcw&ÊèÌ?=zÅö`ž³¡7îì í{«[µ¯”>±¯à`žÓ¡tg_Á#wGïÜ++=IbÜÛÙß9ýs?ã+¾r™zô׃yN‡ÔƒwýóʼÃÇvý¼ÄóyÏã•Öxõ‰ìÁ<§Cë¶ïZ{îuŽ’Ù^M­æqÕ2®DÙkÏtÞ@ZÚW?Û5˜æéƽ«}D¨øu¯óü tL¨c¿+±…2²T¹çàgžm£Í‘'÷„ºëgÕþ•»PÒ1ÙƒyΆà´ó¤ ž3Bw|T$•–ïxä©^Šj¹+;Éöl=¹‡£P|îT\ÚJNËb…´V×4Ìp«eíZyœ_—ëæõº‚dû8Ìs:$oû¸VXÏ.® ²g»klk\XÊê¸Ô²+¯‹ërŽÕ±ó¼*цþêw¯ÄÆhë´Ë¼3¦‘1ýD”÷`žÓaúà_lgA¹×¯bû…Qwúºú#þ^&1»Ä”‹{ó7úyíZòÚ=+ÒU)ÃýLà;¯xk6êý Ó³çÁ1hÄj×^âŒÂÏSÆï3ÏÏü:c»i'¶+àwÖÎ÷`Õ.y+Ü7íïŒ9àÛ>{GáZ,Å1ìÖ1ÐÇWØ—[°ÅU^#Ø =ëå6]Ï»­Çl³z<Æp0ÏÙP™wb¶¼å^¦«Ÿ/S«ºö=¶(=«ªÜC¹1“¾|¾—SšC±×>š¤Ù ÿÒ¡!ÍQ²¸ÖÅ…g«µÞ÷µK]×âÞ„ù‰øêÁ<§CÔ±ý®‹UÇÊ>ÌYïñë;ý£æß}Ïï÷ìÊê‘¥d[*÷XaqôÔ:óGMsù‘'ÿŽéúúØ~­g®¬æ'ž´~0ÏéPù¾=Gøgìrœï½6ëåükÈ­«»”Íì[ñ"Çú]‹¡Ž®îu.ê<έ¹mjy܇3Çü¾ƒyN‡¼¿Oð‘\¿éÆûغ†ÍT…ûÊ^VážøÅ1]diö¬Á&‘ÏúuwœÛ±ˆm\_úâç´3ƒo_m­(þnzÏFôèpOï¥7edöÚŽ -ÝÝ$;H]¾ä£¼*ãJ=ÄÁÇa ìÚt…sçr¤wÒô~ûû?üûüž…èqÛ?Ü—£Ã¦ÍïÓ£zˣѵfNݸL,äUˆ‹ˆ„º‡ˆ©A„¾ïËBêš{÷Ûž)m¸Ʋ¦ßc9©,]¦úz”ŸBôñ®Ÿ•ï§º™=cžƒ/ç°èÆŸ.a|·’߯§B´¡ð^ƒ(ró•Þç””uºt›Z_WrŽ¯-þ©¦šÞd¬èå†ôb«ûkŽÙÁ”þ§±Ã¼èìj"‘û[GÕ(N¦4ñÛ…Þ:ë±Ã -ä ˜„ÓOUËrº$¬²¸8¹Oi}y+ŒÎµpëËOãËÙP~_²ÑÛ€œ*‰ìø>œ{Å‚9ƒ^ŠéìÕ '1½¹7 v: -ՊͶOÛ -lwÅÚ*&ôK¡bÕ5±qÅMoz«Mš°šÎ›N³î/iMdݹ%¼]P­í¥o¢”ÞZŠ*­kT•YfT®R_RÖqµŸÑí"¿Q¥h‡Î¬zÖkôÖµ»0 ¹š.—t‚èvÓM¥ùÚS±¦J-k.-ßLiP·©6¼ Ûh’Fz9#Ê–Ÿsq (}­ÃYoïêHlâ·‹Bj߸Bù=.´¬Ü*Nªá¥Iéár÷_šEFﬢÿïTá«”˜gü¡]…½w®µJhlVñ¼‘¸5~úÙ™4ãÞ.¾ŒÓœ±ÞdüVÓ;q¹×¥¯ÿ4ßâó?wý]y Û}7ª²…©Ü:ó™ŒÞ žŠéêEX‡ Çh¿‰uji}ACÇa|íZvÕˆ½¤Ô•AuÕr¡omÈĦB×hËZÆoo]+VGæ½}Ó&ìû¡-'‡j,½¾¯X…~:8LMgÛ”|eE−¶)ZgXFðBqÈ*ÌͲ™™H^Imz²ßñ®°T;`nÚ¦smšåEÙx, \`ËxÁNóJóÌÁ觇׻û}29”@ÒJíUúÆ¥õÄHZ O–Úñ0Ìëœc¯tPok¡Z–ecÏV'§ æZ¸ÙÇ(“¦–mJày¥®Èf•–‰¢ÒdªÈj‰±Ø¦l¥YÆ3Nb+ÅêS4éŸyK{Þ+µ=ï•°HKå–¯zK¶:@žÃ9¶³S-eõ%“ ¯þV ƒ<먴*¯šúYødüû+õü -endstream -endobj -717 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 716 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -718 0 obj -<< -/Filter /FlateDecode -/Length 4732 ->> -stream -xœí]KäÈq¾×¯¨³€¥òùŒ=a­aA‚öAðaºvZ‚Ñk`¥ƒÿ¾¿Hæ‹dÉêy¨$y=]ŒÈGddäI2K_~¾Óø/’žbLÁÓõöÓåç‹š‚Sø—K,.2ûwø Éé䣻þĦœ þúvÁ«Ë±øÛå?qùŸe}5SJÞhwýó'f‘B A9•ÀRÚ -,禌óËë CLIbA ÈЖ ¥è$Ä c¢ÀŠÃRÐvËJÃM bèä‚ÀÒ -rh£”ȃ ŠÈ§Ýä¡t/ñŒž|L&‰¼žFâY;ù@Úi‰—&ｋ ‹KJK<Yœ&R²AâyÈb½U"²˜¬Ä Å@;IàEÈëŠ"²(¯´ÄKvr)‰¼žŠ!nyF¹ÉEk•ÄÓzr°M+ò°¢0I><Y¼rIäAg•‘x²~$pÂÙ£°Z ¯n«¬–x²HäAL¾„ÆC¼XAã’„&„‰’! L´EŠ -˜˜& -ÁJ0`’›È§ á€U<£% ° -²8òX Y+WäA›HÂk -HX`-d1d%,°@[‚µHX`·¤’–°ÀoIi/aàBL%aâÚèI ȅ)% ,0×;%,°],÷ aêZç„°k)z ,p×’Vp×ZÔy,aÐq²:Z ¸kµ -pËÈHX€Y`‡^ÂØÊdbTp×DEp׸‘&¬A+awÃ$Ï Ü5N ¸kÈx `(ðG‰Ñpâäp²`%,€¿ÏX ÐØd–HXà€»:Áý kh5阼„¸«#¦Oä¥Ih\X·Ðò¤½O8à.••°ÀwŸQÂ`üj$,pÀ]má©%pW›¤$,pÀ]Ä N˜äHXÿ6iÓyiR)F p°d$,€žT’ˆ¼0Á´„ãI!•°ÀwáÞ“„¸«œµxà®"„="²Øh$,@\–­°¦¬NÊ)$pWiÌ°Äî*’„¸ËnS˜`¢„pBl$,𑦂—°À'B>‘ç'\; ‚Á²Dd¡@ °ž’MQ‚` ‹5F‚` B LI#úÓÈsó‚,ˆ%,’M1IXœG>­J[Tæà3càA&, BtßrŽ^ÌÞ)6ïýù—_~„ó½þñ/—×_ä²ú£aü–<'Öˆï'ÞvÁ|¯¦Ü!ÃD°mر„ð=uXˆº°X6ÝXH¸b¸ÛtmôRdHÌ2k3yd´è©‚Æ\Y/Êúp//+ò?„DˆÞ–ýÊB>”Îò¿ëöà Øö ß;ƒ,Nöl¥/(ôÖ ÿùÃÁ±Qm7ø»~9X*’w„ÚÄ뇟.¿üÕo~ûoÿñÌ݇×Ëþ Øï¾ÿNó_¬D*ˆD8q¦9]þúò·ÒRç²0~E/3ºÉ×z)‹.ò/ýLã_n‹iäû5×Í4ø&ºá÷µ·‘û(rQ8Ñî§r}“Úüþ¿®~8¥Å4jñu°¬ˆƒbTé¬*.tå5áGåù® ª¸\f]Ç–_VŽ)m—ë<˜¢øÚ®zÁ$Ò Wê©eù¬Ä[Q„/ðãÐÙî‘Òó6q»-cÀ@³2ó¤ý¸mÇ[Ž¡ò>ݦUÆ59{OîÉ¡úXú¸ñ¸y>DÙx¿Ö+ -mç…æúÙX^K[G ³Ìa6äºF£®†ç‡:¡´_ôØí§´%Œ£/‚ÞO®_øÍÀ?–6Ý`è²^ãzìë…Ä} ÆR:°~¯.}»y9»#¯¿gÏû¶Leª®¶=È&é>~-å|o3ƒîcªs˜e}ííU[ZÚ‘.ZëR´ [æ}°“¦s_ô0ÚË=;’ïI}æëOeº®ƒbvW\Êõ¡O:¸×¢ÓaKŽ.»ŸÖÞ®îèhí;Aîo·¾E³ècö-Ë5RñõWr¨d{ðÉ7Nr¨Äûì&jãàYãÄ -…«Gë¼+`-ÑÔdx'ãl2œ9#R)*Ú„XT{UÓ.µuM^c‘¼:,‹cýú‡þå_?ÄXlž%΢[­Êr³CŒ5OÂÝ‘&ªÄ{¨««»ÊS[\>O±²ßï·hlB†ˆ‹ ´è^j#-ç[Þ‹òÕv~Js&ÕÞÓXvl•W{¨=ËúHü=íµ¶Bi»g¡c#²ð£–ïJ#:Ô¦åÙ¥¼©òm’¢)Øh¬û6Ú¤ˆü=DBètß]*šÝí€Ñr^o"Ù¼œñbcÜ^–NtàÚ{Aë6(䛲‰o¬:Íš¼rIUÀrÍĘ7S÷Aî\ÏI!¿Ö±¥í`ú8ºÁ圷¹¯9§VÙŠWWawW¥Üë²¼*®ºÙõ:5l]ÛÞºOÝûËa?ÍŸmIãL± ‡ÇöiÅ»}ãñœ__|Kzg}µµzà]ȶ¾Ò$Õ [”¥)%ƒ^u¸·¶(è¶Nj”Î7Fv×ÖÉ:O·¶¢Û[[Ç -Z$ÞÓÁ/æ½}¶ÙÛ^œù•·(ócù[øÆ~ýý±ü¥ò™†¶rz¶Ú;ªëÂt›¯[m´\»~ëŒ.†ðycUp·ÕB,Ï"%shUçê<‰U5±¡²=«ªlÈ»ž¹°D‘y5sGèÆF´7{s²º”ƒÖhçº%lÚYÉž-Ñ/i ë:èKcÝÜ[y§Ö–÷ùÞmÖ—lÁÎ4Œ£'m‰#ñ} >Yçé,ؾ ŸÒšp+[ÎkÝÖXòÚ -¬ôŠ‰Å~Ð:_†6I¶ÐõZ¹&ïë$ÿ¸už«ótÖéwñuô\˪ÚN[ï—×~ìw1sqY¶]¯1»ömº 9z]óÕJ®Z~e­k™6r cmŸW}m¼üˆ“¯«~ïø eß±¾ÿ!)懖£>òî'ë<õínjͻWÌXç$zžÕ3¸ôþYâË¿’¥œãkzG¬x²Î³Y“ßõë Å—<ÓÛÙÛóZ¦x£f­aY¦yàgO›?ÇKÖì†7ï_¶8v&»ÿöq³l~ˆéí Ÿ¬ót–÷ÿ{–_z÷§É´j_ÌÏïaß;öOÖy: <¸_½z×t“®¬,of ¯¦ÕÙæ'ŸŸÝ5/óuåñÓ¬\¶>çÛèðTæVÚ{Ú¢ÞæØG{Vr,ûqî—á¬µë‹ u·ˆëðSü|üë×ÿŽ•½#æ;YçÙ¬,íÇ|§fw˜¥‡f·z´ú²YÅL³ú{ï©ÝݪD^ù«Æço}jwõy~jW¶šôŽ=½“užÎjöã²þêõr;µ+o²xR`eëì¨SÏè¬vŒ[™•·­c8óæÓ{Ûm^¿æ¯ÃNèA×mßÉåûk®Åyéû}'ë<%ÿÅy_ñëcky6}ܱÞñ–“Þûd§³Þƒq'ÚÈr„ÈÿoÏZôñ2œ½=ÈúfêÆZÓã9õÉ:Ïf­Z܈>á^×AbÛÚXoñT”כٌӳڮÉ[:«€s|¥PÜÎ^oý¬h½mË|n"~nÃðwå¯à0Ž/÷ɤ4œÖìê°ÈÕW&·gG]õêè«å[•‰Û -|(°µ¤ÀÇÝÝ{§Ò|šóŽ«û’½•ƒRòŽëuɹL}3?P¦—§d`Þ§®¶üNf9ø"ôfz>¼Á«~(Fù¼>|&÷W‘ɇE l´öëÁƒ<‹Ã9Ê]y ›iüùâó±:Ý«|œ´á³ý¯ž&NŠCºòQ‘QYÒuÚtV´¾Þ©™¿áçVª|I‚âs“ùÌÌ<­ãE)ÿsžðŸ.:ÑÄúχ?åÍU&çVä· hO™¨Ÿ u@fbù¨Z[¤ÛT•vP†)­K"aQåc?µŠ_(?WGÃõ]­Æ ’ª…l>joîX ¢¦×[2^MºùKâdË•o¢ð!ؤ±lo°W<$k«¢ÛÕÐ]'ªòh>D¶©Îwb}T¦¿–5a˜Î=âí‚níšú&Rù(òÚTÕ®Qf¡R£ºZ²MµyH·‹@üNÕ¦ “Ùøìñ®31VC¢V.ÕrévË•Ö\›©ÐJÅ^5UÍwQº©ÛØ/ÐnÃÉn¿ådX#ÊÖK2Ÿ -ÖæZÅÁn̆x»8j+±“ß..¥]Ç -åªéD;´ÛÈQu{éT~;nþ„¥Yi|&ÿ?C…kTFžüAS3)>Ò¶_õNxm6òRI#Ý7Ô!IšB/;¨K‡ÐlvÔ—ŽJ(Ï ÛJ7-¨ƒÊzHU<©K²nV×È aU? +G¢ªB »NvÍ”ßä.§kKթ֙׃¹»Ön'û†o#9´×|>I“·µ;Ø|%Þ²c£5™M?ÖN:Ù¨æízg± Pèä£o™\WkC'þΕú±/2ÉãÞ.ºd7g¬3|‚“·šÛ£.}ý_”ù¿ÿ}¡ë¿×ó]g?nTC Ó°uA=9KK¥êOÞѱŸˆGM:Xcó—Ü©è=0„ø{JÅa«äá:û{'Û’ºw2ö„é˜ÈZ4]¡,Âé˜14U¿ÊP®–”8¤Ç l u˜ÛÑ¿¯*ïCæ ¢v8U䯧³ôFþV ´|H7oØúÅöIþù?¡S § -endstream -endobj -719 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 718 0 R -/Resources 4 0 R -/Annots [ 720 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -720 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 612.273057 101.433071 593.523057 ] -/BS << -/W 0 ->> -/Dest (cb154-1) ->> -endobj -721 0 obj -<< -/Filter /FlateDecode -/Length 4685 ->> -stream -xœå]K䶾÷¯èsÓ|?€À‡’ bÄÈ"99Ìôzl³Ö9äïç£$>D•$v÷ÌXãì`vZU¤T"?~¬*QMqæøùJà?¯ó>8«Ï—ϧ/'Îœáø7”˜ êïñëÌYpí˜ÁzsþÊ1Œtöü|ÂÍa]üùô÷ßœþ=¯#Î’…`¥0矈*­˜óÎqC¨T\(Be sNK¨¬`¸Å(Ì0NK½T9˜¡ƒ7” -fh)=¡ò0Ci'ÔR`†tBS*˜!‚q„JpØ!$礆p­•$tÂ0‹F·”N -f}Ô9è„“”N)fFPºÀ¬µÆS: [Là‚ÒØb„ÖœÒÁ­¼£t¶(«8©ƒ-Ò;Eél‘h@è0휢h@ô ŽâÅtRPD 8l1ÚRL lѹ¤¶¨ ).P¶ ÅJÁ©Å -l«Š èVó (.Pà[Í…¥¸@pa&§¸@q•·šâʔŠ-œ«À(.†»£¸@u•±’âÚUÚ[Š xWiÁ).Ðà]¥P“ÔÁ˜â°#SÂ+Š 4xW î(.Ðà] #Iqz•‡–â`…Iï9ż+=×hð®t˜HcƒŠâ Þ•·@ÍÜà]i¸¤¸@ƒw¥––â…8é €wA!†v` –âÌ÷ÐIEqNÆ$ÜŠ xWLĘ[1ქ¸À€w…G÷‘ºÀ„C‹ã­Ì„µâÞÅD¥(.0à]Ч§¸Ï0£JŠ xW(ÌÔ”¼+dàð.üCqàÀŠ 0¿1Á]RÞS\`À» %IqfaÆ=˜„Ô9 Š @ƌå¸À‚w1½Š ,x—¥(.°à]®áö:Ø¢¼¤¸~ t¶Ä˜†³Ê¸SP:ð.èaJÞåÜŠ ,x7N›XÒS\¼`Iqõšç,Å6pèàò‘:Ëpl(.pÊ"u°E;MqkTð8 [””8 [à2P\€ï› ` àBƶÀS¤¸LÆ|Кâg,â1´*¥³’yº&u:á(.pN3LÅ‚âÄRÌcÐS\‚gÑ]¢¸f@'4Å.À Š 01/á™S:[àdS\O:!(.ð¶À¤¸ÀK(ÓrŠ 0C#–DSS:Ícœé).ðÚ²è*R\€a‚HLIê` h‚âôO ¶ Å~l"Ì!u°EMq÷2†›žâïa‹ä’â`3Æ›Žâ‚Àa <>Š ·,ºÉ€Æ¡ãœâ‚ <âM©).À¸Œñ¦§¸ (Žx!1nƒ²1Þt [ \R[à4bÜ‚“o‚(…-2hŠ ‚µ1ÞôÀÍ@¼ žL øo:2]Þ5ÌDéÀ»ðL-Å8@¼ Ï–Ší9ˆ×8øg´ÒLjӓê5˜[É”÷b¶rd΀ƒ|cŒD& `&"Koɬ¦U('Óü L/8aÌ>Õ)* 88Ì™ÞÅ› Þ}Ž9J1µRlÌýüãéëL¾çÿszúÍ)K?ÂPZÿÂ0Ýmà} ܾ²èhÁ¡,„·Ô‰F¸PŒ Å)éÄôÿ—f–Ãðï‡Ë«|ù€Y|¼<È[ -„вGø:ä+‹¯¬ò‚sG˜m-ʨ #;rð+¹žþÝÇ€:Y1æ@óae>æKÃZšóÇϧ¯ÿøáÃïÿðWÀèãÓé¿åܘo¾ø«ýø׸æXT²Ë$“E‡•‹üè£C†Ï|üÕv*×\CëæZkçÕóó¦óärr~žáÚSáoüuã1©‹ŸÕ¤{hÊ|šþNr RßüóüñÃéÛs€ ^ã ’ˆµ;˜ê«r¦^JA7 ›røý4ý ËfÔ?L]– Ð@c€M‚‡jàah&8„¥lCÝ\³…«®ý4‡–~å†7Ð}¬ìIçùTìÈðUÄ’=íP³s»§a³ã 4Ñ™…Û)ÍÎ:ë hˆP¶–P”[ò‚Ï¡ôDêÅYoÈõ–t;ÈÌhdY/}Î(yê¿Ö€8Q¡Ð-õTÑŒœ¤ãËQ±9š.óö)×]A¦Êtf⣠ùèum#³¯Îá©79P7½md,cª½Ì{o襄ŒÄ;bä$’g¦Þ¦<[«æ³œê„^Ë©;¢+Ùµ5m6«¦®$µÕvyÞÙè~H#z•ÃÖƾ:‡Cã¶sw¾{ d‰R>>¿ÖŒßÚûÑÕ½®ÊÇ¥“º…Ôvt“m×ںǥ•k ¾oì¡·¯ÎáлíO^Ó©/ýqìe–3`2Ô3ªòë=9ãÉ„¬KÕ˵ÙÚêæçZ ¯²}ÁÕ+Ÿ)ÿ6_‡ð‡#«sf—•ÿhcâ]ívÐØYçhh”;>ç=½ú´íÏiÙôÎćR¼=§å2Oó¿yä<4¶WÈß⻺=öýß4V>£,p/cZp}u‡Æ?óbäM_íqŠ(*,#âÒ\£J]ç.#Œ_½›¨n±•_©"Bt{¾hgÃ!vǽ7æ½&¶} ž¼bTÌÊëJv(t¯ ¸ò-…cC‰ï!¸¯Îá¼íÞ›Ñy1Î~Kt'´^1úz=ˆµY^ñŠÿâb ?<`ßD\g£!Nmûœí윳Áuv(õpäÓø«-bÞœ?“ìqiÛŒ#oˆ)Ï&Ÿ£j»xíÛ#ÆôªëŸuÖ9z·}Té÷{w3ŽMDÓ‹ç.Mþ‘Ê.П¼Œ§ -iyÇ÷2k«âCvg‘:ë…;~çK êÊÜã¯Ï7¼×ûYAiñ»££Î:‡CéN®óë¶'yÕÈ°ó¿ùkhmý¹Ä¥ -rëF~‹lzËÚ3h怶­†üÇ -¿ê|ÔÎ:GC®ÞñQÃø4qÁ/©Ç¢õÄ#më'd4ͽРº]µ1{~ÔÑ£×¢±]=Rû»i­mŸªz{OK9Ý5×+±]†?¾«Œ¿Óue\&¼²`IWþ&>Zë‚ {èí«s8ônû¨¯½F(slûÌÞ.Ÿã¬åbIO ~ö4ñÚP®‰½ÛQEÍy4´h&l_›Éµ¹ûêQ;þfÛz©Úõ:ÕSCYÇÃkÙrËoÏ®ë $½[Ÿò¯iÅ•oÙ»:¸³ÎáP¼ãv ëš¼åìé_póËèø4¢`ø½ãéi^ù6òô¥E;(kG µí_3#¥ñÑf=ÝpY/Yô•¿Áë¬s¸ßy¹¥ÁzËÔÚ…{“1ž²ef‰™ìOɨ{)]¬“⯤WÑ;¿Lç}¬êéR¿¾V~¥.û0^# ù¼v²%qB¬ãÇq9ă/q4¾ê \/¾úê_;^Ò­}\õÕU}lG\DÎ}±>î¹ÆŽö8½H•ÏƒÏJN¶]&L/ÍXö†lZg£!Ên{7·ôlÌþ¼gö¹ÏþTÝð$¶³ÎáPµ³Zðæ«{÷ÅøfQ;q¿½a•^gÃ!e'{Uå_-rXY¿Þ®‹êÉËRo–P^]ý,)G\UN!­I2bŶŽ¼ðUÏ•R¾v3·‚Vý*èÎ:‡CëmYª×ˆá_ ×®-èÉÌ]±öiÈO´åør}DûÌl–I£‘êª7AŒdÜhë÷Þé¬s4¤º¾7–ïÊ3^»šäó’ï/k¶‚ÈÞTî¬s8D¾Á$׬ -~Ë@¼ÿ«Að Ù½Î:‡Cpßʾ{×ÓßýM -/üÕªM]>ãQ¾‚ÞêÍÐçÕöbòÎ:‡CïŽïú–oŒ¼B»jqå‹›nÈ;vÖ9ýŽº²zñÖ‡)\“£† ¿äÚÔvwŒd.kÖK½Ž]Aî oBwÖ9r·ýØ»¿gé­Ú¬¶£Ö…½¿ÞãooæÚvjËìqî ¹ÖÎ:‡Cîuo¦ô~£Ä E UÞ3f×gëç)jÖŒù˜£}â‹w¸®®_¯Êi3IUÝv=ÿÛ¾¸‚ÔžswÖ9Rw|ÕÂwL­X}[Ù[cì°k뽬¶ÎVõšo1‹÷ôº"Øpƒ?ÛYçhˆ ;þìNôx~ÞýžÌa£Å]¯eÍ7ø¸u‡æΕƒ7úª{ß%º÷Ôv6 o}ezæ^ÿ&ùô-ÀúÑôeËé¾zVD¾ÚH^Aß yÖÎ:‡Cß}ßÜó.yîšLÕ:7¿¡cuÿJt÷ZH¾á-ëÎ:‡Cò}9×w‰ä—ÈTœ>ûÖŒ ᇷíP×oÛlZcÐ÷fbFï÷Ó~Π£MÜk3îªí+2dw‹ì t¹ÙEÚ2âZÚ {Ž‹Í*†#ªƒ‹{³DÈ}ûÝ_þô·ï -ä†×réa;ÈÓë|éõi!xþBf9„A íØŒfhæØí±»K÷Å¿Ã2¼¸Üîilê!4Šeíø;œkú<œÇ'mº^ £bý¸ÅúÙùÍtíʞᦺ“îaÑ_NvØcH ûÌqë™q#Ú³Õ,®üsá÷5ò\i‘ºM -Î+5‡í{¿äRÓŽ¾~ÂÐL²¸wSü¤ -“¥‘y†BgHÅý×ÊQ¹H›Y™+k!OFàrEl2”Ÿgâb§ÉC`O³¢‚»Éç-b›¹ó¹»Üã"n¦—íÍç­0Ÿ„—abÓ­8Bߧ‹±äy¶+«„Å0B}Äi´fv¾Õ}úX5ã^N?†iN*#>X%âÞ°µ×%ÎÿE™øý×IŸÿœ6#çqÉ3[ÈÌ­3q=“ÅÄ}§8î,ž„yØTB©+Ú/báKY“Ðçq)+¾Ö¥:/ÄžJŠÌ "kk¡)mX‰e†®ªj³!¼4­˜™{û¦LØã¡J7‡Ë¨¸]² -õíàÐ*Sò¹:%ŽbÑ2¥C«eUõIqX]0ËffF@ÖÉMí×uW¨x­ê r#â¡*:]¦ÙúÔI6ÜEU.°ªêkQ_4Ìì!Œ¾yxÝÝï“É6€(ÍÔž¥Ïµ4ßX”f£¥j8´óÃ<ç¨s—ªÆžÊNNŵгƒ£•Ô—jSS_T'Ùì¢i¢ÈtO²|F—l²SµÔ,Ã{²•\ö)Šô§º¥MÝ+¹MÝ+vQ6ž7ÍxÙ[RÙ25œ]¹;^Jf_Ò2[×ÎR]Jª$[^[ϯfÛsuºb‹gÊK5³(yÿÝ2vÆ:M‚*•~†ÌˆðeûNLÔZ8%Õ9DwÇ[ ÑqSm§}•*¹ºÎvîd™!I¹“úJ覕âNo+&> -endobj -723 0 obj -<< -/Filter /FlateDecode -/Length 4981 ->> -stream -xœå]K$¹q¾×¯¨³€MñýŒ=a¯aÁ‚öAða¦fZ‚Ñk`åƒÿ¾¿`&ÉHfä£{zWyÝ]ÁG$ùñ‹à#³ô]áÿw¿’ÓSJ9wütûù¦¦èþ•«‹¢þ~¢¿kåâäuÉß"SÌÞÄp½á×pÉ“¿Þþã7·ÿ^çÑw3åŒö÷¿|%•³SL1*/¨2TJ[Aåý£ñAP=ás–T0ÃGgÜVa†ËÉK*˜áŒI‚*Á 뢶[U†&j'©`†Î> -*­`‡6J‰:¢œ³FÐi?4ztFO!e“E]„NG#é¬BtÚkI—§‚O’ÎÁŸ•–t¶x휒t°ÅÙ%]€-6X%ê`‹IÑJº[ Z' º[€®$ê`‹ -JKºl'Ÿ“s¢.C§RL[Q~òÉZ%é´ž<°iEF:)DAg`KP>‹:Øâ­2’·ÿ’<ámLI­†F·UVK:[Œ‰NÔÁt¾Ä&ÀƒDAñ’Ä&ÆÉeã$0ÉN.¹$±€Iyr1Z‰Lö“ 9J<`•†Îh‰¬‚-Þ‰ ¬†-#WÔÁ›ÄÖÀ$¸ÀZØbœ•¸À‚mÐ"qÝ:•µÄ|ë”X.ÌTX0®MÁI\`A¹€R–¸À‚s-¸Sâ ÒÅpX°®õÁH\`A»Ö¥ qïZ§•Ä¼k-rŠ:ØK\vœ¬NVâÞµZE‰ xÃÈH\€^€Ã q°2™””ļk’r8ð®‰p¢.NƒVâÞ5· ynð®ñÊH\àÀ»Æ™ q€2” €wA!^` Vâø{茕¸…Ma‰Ä¼«3ÜŸ0¦ÁV“N9H\àÁ»:¡ûD]žtD‹ ã­<é²Ä¼ Ge%.ðà]Ðg’¸?Á£‰ ØhÛz4S'”¥…MDÇÄai‚–\?3ùY>Ð`… <"€46ò  EÌ}”[%þûo ÓÅŠy¾]2óÓi8Gãï?þtûí?ýðÃ?üã¿?¾Üþøwp³jþqîûï4®}šÿº¸ü},ò庤}YdfIói–{»\»u÷þ‚êÁ/Ÿ™Þ/eš2Iþu°kÉã³çªíæîS/Ÿ¿@ÖzO™ì{Úôûÿ¼ÿøÃíw?®WfLoÃêµ,ß‚Õ_¢9Atnj€ÛgEæ–.aT¡Z` {´]w]íÚ -³ -ÕßÇP¶Å¦!’:TVPû:Ô÷Xä¼¾—uš:¤Zž¸®óÊði÷¥…rêu+O†)í,UÐaÒf´KÎàôbžg*f÷GHm„Ö=v•È~mÔÕÏmd(ÔèÔë‘Ôt˨\!+¯Ùê×m$ÞO\—ÙˆslçÇp¿zŸTµíIË2˜ûÒŒâ­×ò<ZÝ!¯¶ž{Y£„øµµ¨î­L|c«ûsCÏ \1†#jÍ Ctîò†ÜË3 D½¬óoб Æzf§^îkYT– oq棭ØÙ}ò0(­ï³ÙvÌÒ˾–çé|¼ŽüåGïÏz܆¤Úò¼«—"ãÏ©£=~ _qn¥2[)hñ£×Þ«kæ¸Õ²vm<þ™¥ü‰zÙArz_ËótH>Žq-CZCÑcÝSÏÙ³ ÏŽü?ra-kàRëX3ÜŸcuè¡þ!FmˆCÝŸÆR§Ýæ]1ˆi£ÞÎÎó<¦Íq4<úcòé¥]#Ã:3*£žôu‹Gü\&1»Ä”cýGý¼ñÿã1#øxã'ðCT|äÆxFÂtKóe¬í%z~Ÿ2~y¬KxqÙœ­:\Ìótø=Ž%ü®Úyäi»–H"-q¤„›˜ºÛ¾o™Ií®¥8†Ý6Æõ•¥š-µüƒÏXÙî—u`AÓl2Ì••#ãß¾Æp1ÏÓ¡òdÁ–·<³ÎóßÒªiùë–ý2Ë( ÉYôõç‹ü™Ò\ZxW“4óðŸ4¤5JÚJÛÝøŽÌqEªÅ¾v«kõnFÈ¢Þ±ºz1ÏÓ!ê8öô{óØ¡w·-»pšY÷Îèó6çÝqmÇfµè`鿧~¼ÕÚPÜÕPï牘·õ~»dçOlvôàŽ6©ôþï~ÿ¯ÿüï¿çñU­¼Bo ÓÆߎ·+³µ…h†û¹rÇ|½‘ÇÛYF?TÖÌÔ‚ÔC‹¼Ö™~Ißd|E…ÕWb&·Øù‰{émÙ%íc°¾7Uz¬´þ•ævš7÷—j?ÖV)wÖ-£èØÀp7­ÿUoÙÒjdõc±*,æ„•žÎZz®l±Ã.=æiý Í-]Zñ˶œ`éÐ%=س-§ÜCmÝPZêÈŽ”öìPý^J×û£ž03‹ ¶Ñ^²PöŒÜ^扽­ç^]û=Q½í:0”†ÅƼü ²½¥ìšæ…¡Þ¬ëœwH—~¨íá«·ëýìCäöõjlƒ†Íl®ýk™Û6 ðµÔl¿²ë{Û±Õ˜Í~ÑéÞž­Ý«]¬«b?-mS°Jv|ð白imƒÖ‡ífÆv{3]a¥~?Fñq_|Á‘mÁ ¶™¥<Žë:6ÆÈ1þl9rFU™¤W§g¾.åy×Á¿ i|;H§å½ŒåE‚ݸ”­n™C›;a·Â&•é™¡ÂJ5|³ß•E‡ïK46Oè]§¢P¢9ËíRy¾,Ñž³Ü>L٣ϤÜG-VÜçøØÓÖ³ôôbå°×zçK'wdSœ,=(+ÝÑikZê]WNп£5²D›Œõ¿Nkºd0ª’ƒÛÛÇ¢_¾ŽëƒH‘ƒð hÏ1l,‹½Ÿ×rœØ½€cëÐé ÜLϺ •––Ü!¹u%,OO7©dèTÿ!É]Ìó$Ó·ÎuÉqúÄ]׺ÏÇmžÕ$}\Îß;ª·wH‹§–äùIXõ©Øë‰ÄìƇÉÿ¸ý#-!d™]%lþÔuãâk›ÚØÐê`¡÷¸5=‡&ë)ÙÞÒ==ÀWQæ&]MÏ€y)˓಴¦§ÒŽqyÞ/ò´Vd¤èõ#5¶‰KèÅÂéÆHyÍ -ÉaXÙÛË>E=TxÄF1ÆÖÆ^[\¿˜çIz½±QÌú¨×/mS¸e[Ç.KŸêf˜ K³¾êVi¾,ýîv[>;V–alÖ( ‚Ì ‡žþ·l’2 !W·¦/æyTu³é)Ö}TíñÈÞ1'ù/ÇdOuÌœÝÇ;Roîñ-‡•¯ø÷ÓöÚA°içbš´u4w9Aðµõî×ò<úŽcÆ+嘋¼ôþ^bñå_ )×îQFS~G¬x1ϳ¡)ÇŠú…µâç>ÓÛÞ;òZfñF ­ãVsõÀ_fO[~¾ÅKÖÙ m×|ÞòØ•µž_?nÞA'‹é½³]ÏÐy-ÏÓ¡óo(ü†YÅ›V"¿iæqÔ¦;hì1Üå£ó<Oâ¾gCÜÍ<.!øyŒ}µl½ðêƒ6ó<jOÖÿ¿¡vi¿ØÎÐÞ zàI¯Eu‘÷ÙÄûj¦gòVÇáêÑÖ™9áV§ë„eïÉIÂœà>{aMÓmžûÎoÀvå4¤Q0küÃòÞ±èÑSžÞ¹N/Ëì5f t§IN V7²¶¯eºëáUXë½.I_8`ÓÝIànëwwºÌ×y¾ì{`†`ópe§2/{ÄõQ˜º;Vºf™ÉP³ÖCT_{s—²åPS9ô´×6íÀŸêûúA±#•ªä2åÈ¥šL±`­üzp‹Ù³:<–—ÙO¹‡M7þ| å]“º¼oX…4iC_Hpn¢ç-c¾Óû-“²N×nÓ¥¡õ}'gù‡Ÿ[ªå›½ì™^ôYº•_,é.þÓMÓ1[5þù-쪈Ë2Í ~½Ñ[ø v®)=“pù¨ZY˜|˜Aö‹Æ))­ŸÔò±c¥m¾ù£ñõn(¿¯ÙèíˆNÕD¶¼p®X"gÐ[1ݽšô"¦o2H“]®B3…+5a/Ðñ´½ÀžñT¬­bB¿*V]WíÑôæÛÖt¡ ›é¼é4ëþš3[sIø¸¡Z;J_E)½?½U[ר&³Ì¨Ü¤¾¦lâZ? ¢ÇM~§jÑÙô¬×è-´³0U ¹–.×t‚èqÓ-¥ùÖS±¥J=k®-ßMéP·©5¼ {°£Þ‘¾š…eëǵ˜N&·¾V‰áÆl„›wm$vñëÍG!µï\¡|…ZVn'ÕñÒ¥´g1ÂЬ2z‡'ýž©Â7)1Où ]ƒ½‡·_õJhl6ñº‘¸<4ÖqR h{ZÖ\:ƆYÞ^:)!=‘nKÝZl%eMÆä1Wóˆ¤y¬Åº¡®‰‰Âjû4®äBU@u]ì”_Wân§oCÕ«VYРÛÅ¡qç+ÇÖãš^ªÜìmå2ÌWá£867Š ú©VÒÅF5o×+cÂnH¡‹;¾q­ÊÛD–}I÷qûó­¸9c½¡“ÈÁjúŽuéûÿ"Íøù¯›»ÿK})íìÇjla·®ÄÜ“Ñ7ʤ‹bú†™*lÆ c´ßÅ:õ´¾¢¡ùqc_»ž]ub¯)ucPÝ´\è{2±iÐ5Ú²–ñÂÇЊ-ùÖ¾é{¾´õæèd5½Î¸Z… ~;¸L]g»K¾³"qEI»K‡Ö–¼P\² -s·le&’WÒšžìw¼+,ÕÅ.XA—¶ë\w³¼è*+wÁ’ ¶ü‚ì4¯4¯ìŒ~÷ðúæ~_Lu´Q{“¾ri»1’6“¥¶\†õeó9¶R®ƒ··P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«J«£ht™ª²Vb¬6…%[m–rÇIl¥ØbŠ.ý3oiÏ{¥5¢ç½6i©ÜêñZ´d[ä9œc¿;ÕS¶X2 ²Às7©ë)m•mëv뺫·½³ÛpÝÐ#SÕ³ùMÊwñß{ÆÎœgX…RÕÿeeD§þw8j§£5¶|3ŸJ!€C}¹Jt‰-•¼9ÏñÚÉv…¤®ðšÐ“³VEMß±(›ð -E>W°¢ê÷/ÊÙ²oém , ušS›•¡ò%[e²,µËHSEúN=KAo¢¯ŠJËO÷Ò2qZ-Ÿ”ÿÿ@_9º -endstream -endobj -724 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 723 0 R -/Resources 4 0 R -/Annots [ 725 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -725 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 401.373057 101.433071 382.623057 ] -/BS << -/W 0 ->> -/Dest (cb157-1) ->> -endobj -726 0 obj -<< -/Filter /FlateDecode -/Length 4701 ->> -stream -xœå]K·¾Ï¯˜sÓ|_@àC‰‚1"$‡ íÊk#XsÈßÏÇžæ£ÙÕÓ])-[‹ÑLW‘ìjòãWUì—ºJü}¥ð_ %BˆÞÑõñÃåãE -o%þ %&ƒú{|¼½*I^X]°×I`¼ðÑjï®Ïü×m¶ÅŸ/ÿÍåßÓ:êªEŒN+{ýù‡¤"#|ð^ZF¡’Ê0*k…÷Ú:Få”À!ÆÈ©`†õ¤i®ò0ƒb°œ -fÖQ˜aÈ+3WE˜¡½"N3T´žQ) ;”–’ÕÁId4£SV8tºãtZ ¢Ž¬ÎC§¼ætÆçIYÅé¢pÎÙÀé¶Ø(§³°Å*"Éé` ™à9ƒ-ÆÉê`‹Þp:[4z'2º[€®Àê`‹tRqºh„ˆÕEèdða®ÓÒ -Œ‘œN)aMÃê0£0HÎ3: [œ´‘ÕÁk¤æt¶þ8xÂ3[ušÝFÅé,lÑÚ«ƒ-|Ž´ƒ-Ò;Ž0ƒDâ%Ž´÷‚¢&Žt0‚Žtˆ‚¼7 èh¹è90RA§GFÂKŽc£` aæ²:Øb"q\`4lAŽ Œ-š ÇlK@ ÇtK2*Ž ø–¤r.Ì”0® Ž8.0 \@)r\`À¹ÜÉqébº{Ž X×X§9.0 ]CÁq\`À»†”一À»Æ &«ƒ-0Ç`GaT0x×(é9. ð.¦‘渣*€CÇq°"t’ãïê ‰ãïjÀê¼À4xW[ç¹Á»ÚJÍqw5iÇq€"À?’À» ˇ°Ëqü=tÚp\€Æ„FXÂqïª÷ÇÌi°•P!:Ž ,xW «‹Byô83oÑËB99.°à]8*Ãqï‚>Çàxª9.°à]eà©9xWé(9.°à]Ä –ãÀA(À¿ %]V…Œ!p\`Á» %Íq¼°LÂê¼Ç c!‡r\àÀ»pï‘ãÞ•ÖŽ xWÂV[LÐ ®Ó–™ÓV…Ô` -NÞ• -#ÌéÀ»RúÈqï&·ÉqóI Ç0P -Ö¸@"zï8.pQB‡Õ9mËq—XP«ƒ-ä‰ãÖ"š8.ð¶­9.ð¶ dจ -Ñ7›ÀÀ…Ͷ Rä¸L&B$â¸À[‡| ½ÊéœÁƒ®Y]€NyŽ ¼'W¬8.@.%&=Ç x‘Â%Ž `tŠ8.ð¶`ªp\W$‚FdÎélAÍq"]è”⸠hØ‚hã‚ ²L'9.€‡F.‰®æt$Sž8.äD -9.À4A¦ ¦du°4ÁqÆ'%Û–ã$?H6‘æ°:Øb,q\‚NéfภØ¢¥æ¸ØLù¦ç¸ JØ‚ˆã‚(Ha2Ç qè¤ä¸ ª€|Sǘ—)ß D#‘o"Åcæm4.回ã‚H°Å"Dau°ASdæ-8 ù&؉Ó9Ø¢#q\Kùfà¸aòMDôì’@Hù¦g— À»6‚™8x‘©ã¸È7Ùr¹½ñZøŒW†”qvÅ@‚z-|+»d Á½ðVž]3 ß”#±‹0™epìªÜ*”J²Ëü‹xŒfœp[}j—¨ààá3ƒO1-Ñ}É9j1³Pì¶>öó—¯ßÁù^üÏåé7ÃJYþS†Ò„ø -Ó@G ·Eô­pøÆa •„4XÔIFøXT ÅqÑ- ÷—þ]ç?&–Ãðï‡Ý›²û/~Û=&0Ó(¤¯ÃÚ`cñÎ*¯hpÚ ¼­Cub'@q¥¤Iáß½½¨£·5в٘‰d˜´½¾ýpùúoÞüþŒÞ>]þñ[ d}ó•JßþömAkÆßvüuô8n»q{,!šœÊú6†2Œž¦í!ß•ôP÷W¾Í´œz?O£q«§ÇQìÐíc[ZíØDãø`¿Ê¤€òfkú”:ªùÝõE鿧zœäºã Sû­_ê£oþy}ûæòíÛ)‡¨ô@8ž(‘•™Ìn«òÌ~ -¨"ŽÕY÷ß FÃåî}wûž í+Á¾ê‹P¡“Û9ýx‡ÏcÛO<Ó*ý.‚1ÉS†ØÖI÷pÛÎ:coe5Mbà©ôãØÞCÓÕ6Û}(9¬-ûî¶ßDg¥]7Ú0¶3ÔA[ -\&Ÿ>…ý (;óm¬s:”Ýù6n3J»F7{4ã‰Â™ºûö —d$™1^QÅêÆïAgº2Ù«Žz­k¹áóžÿ=”YðŽúÀºÞÆ:§CÍý¸¬Œœ™Žààé²÷꼉jó½} ¶ÖÎoX¼(ue:o›!ü§j·xýœ¿6+A¬íÛ^ÈåohÝçé«}ëœÉ_Xœ×!àPüu-g뽦‰÷¶zïuΆ^³#Þ‰öw!‡‰ü¿<´¬ôÇ+d8÷Ö ¥Y@«ÙŸSo¬s:´Þ5·x×>F,+ýJP‰wc×Èh:šIóx3ëW³û•Ÿ>Vó¶ôKóðë…¦‰1% ­(­!l[Ó!l%.íù‡Y'œqÓU7ŒÞ˜uЃd½k¿ÙÂ¥viÚî®lˆÆ¿m³:Ûd0ïä†lhMÍzžBòέ¡i[Ó¡é~l8Ëã¼'7Åt'-ë-ˆ`Îsç•Ë>{äµÙÊÓ]…3e‡Þ‡ÆžÜÎûjGAp›'÷œ¹óÌÉýç96Ö9Òhå/—¼l}ÿW›Ý›MÓþYË0èÀúàÆ:§CæJÌvø2£y|ÓÆw…wÆ8Žå™qô¯çšmÓýÖcx'–ë¼wBW¿zÅyîö¬âÌc·Èº×nÞîdv¿Ë3zv¾»±Îéиr>ø,|÷ÈRµü,§|bø­?’³ëef³²9óÖ_v÷Üø—Þɹ´‰ £vH5Öл­Îéл²Ö¸c4&gõn£“Îvõ°ÏZjÂòHNx2#«Í­™«ÅŠ­ÝU[3ôµ¹pÏÕ ¿_ÿºI¶‰]ºIC½¶³±ÎÙÐhWbΗŒê V8>7§Í®Të2¢|åni³]ºÃw“ë…®d[³ÿ<ÌÆ:§CãJœù -9òÝXíAÖ+§v\S¸/Ïg3¾úb²ºÄ¹·åË<nWbÑ—æ¼{rÛÏÁ“G¯3§Fv*t/ ¸‰-•Ã’\Cð¶:§CðÆ{]Žž«~-Îþœè>r^}c±äåÝk7Ö9âÜÊùêÎ;ÄÜávu(ðî{G>²ìanÛ„#d\dSÚhúÎ>¼$c\@¯Ù>hcÓ¡wåZÉ°>ºwóØœAôw3ôç]ºõGnýp†þî|ùÖuÇ/Åk»æþ–­«H뜅;o¦>‚ªk¿¼Øð¥ÑÏJ›k$·fG뜥+k/ˆ·ŽÉkf†›~ä/¡µç2—.\Ñ{4úàö_fçl5}ë62诙êújXÿXàW FÝXçlÈõ+1j¼MœñK÷D€áŒ£fz¿»"¬ÄiÝý<³Ø×QÚ3¢»ï×¾sïwAZoÛû¦ÞÚÙRÉ÷GËõFÝ/3Ü ”î·Í])é‘T ×,ù&ÞÄOç|tq ½Ûꜽ+÷p/Œòk]#T8¶?gïæçq–ÖbÙH »®S爡˽ûYÅùÙ]&ýíKžÜÛ|¸­Îéµo®ÜïÂ]1»éy N_]§;HúbcÊ—DM (nbË­Wo¬s:¯Ä£еgÝòO ˜]¾Ž²~–ìyrL™i\¾ðœ¤ÅÇMÉýç‘6Ö92öóð»â±&VüuñÜŽ¸º=×ÅÓ=²‡>Lq¿—åjÃ¥X3Ô¸Q¥G#+ãü*r·Õ9r·Åš)ý]¼íH¿à™á@,¶±Îéz|åþ–ëŸâ™­îK~6{<¾Ú¸­øÚVçtøZ‰’ŽŽñkŸúTJ–›)õp Y&¤qYj ’Ôu –µÛÒ÷àB“«|º O’ëTÖÝ>C[ãm;>$.¹o›ê'øø›~Ò¾÷ÝØ3´a›c°ùfÃøñâ†wѨá}dÒ!$Òé…¥WG"ym¯éý7ARyØÔÐÑêºPsxÍëÇRj|ó«L/ƒK/º½¶ÙËüÃEE©ÿQÜÞÒ(qÐy£ŠŸ/é-Ĉ‰„Þ(NÂñ§,m‘Ê‹ì|ëEìK+äø3–ÆÍ?µÍG“êÛ\-½=…d.d†÷‡ÜvÌQÓ©¹8½j§7aÆ-WL±.Û amÚ²µÁZqU¬Œl„v.”ÍîªXS¶G¥7c•®sUXLo»N5ßËjß ç=áã»5½ô™•¦÷+æ¦rïjYd¦1*©Í%Ë€P'Fôxa„_ÉÜ4a0‹¾µô–ª›0d Q)s9FôxaË­Ù2R¾” -µjÌ=_M©P7¡t<#úh”úôêæfŽH“NÅ.@kÜè™ðñb©ÌÄ*~¾XÏ”¶•+¤ÍÐk…¦i·ˆƒ¬x©Ò”<Þ~ajfYzÇOúÿF¶Hó ?H¥÷tÕ­º“47‹xÚI­ÜÖ!®ùZ¶é.å}ÁlÛ_È¢˜ò‰tKéÒciÓeÜÇl^"©BS±*¨+âDa¹ -W¶B™ÀîªØ(?OÄÕN[¦*ÀžwæTw[Ú­bW¸ó¹û2â*½t­Ø[Úm0Ÿ…ƒc£^œ òNªXËâíêÎa5 ¤PÅ•FŸqž­…†§|?ë$ã<îãå§Ëàæ´±:â‡3*½C´ºÔõ¿(óŸ]èúçüÒª›ײ°….Ü:·ž,½q:l§7Pga™6PSCûU¬B-k3Š׺ákªÕe%ö\RUEÛ -míÃF¬ tµ2MÏØ;ÂÇ®K óÒ±©û¶iòÁa7&½î,[…öp°ªÎT—|mšÄV*Z]:´¤›ŠØhÅf³ÃX-›˜™Ùî¤t}²ŸÚ¡0i_ÍFF¤MSuTÝlÛt– GÑAlÚ¶aRíNãÄÆèÃÓëÅã>šìò HÒBíEúÜJË%i!<^j†M7Ý,>Ç\ÓFž¼µ‡J[¦™{¦9ujÔЂ&-Fi¨ÕƶÝ)eÙd§ÙQº€LfYiÑg›ÜX-wËpÄí%_bŠ*ý©íiÛŽJéDÛŽŠ›•MífW¢%S ÛÂÙ×£“µd‰%#smí"¥ZÒdÙ|ß4Ýwö¶×æ0¨âjd*k5;+yˆÿŽÌ[n‚+•ÿ†•êká¨Iy£Í5¦p'8¡ôòeO¡Y*Ù]çþÚÉ|…$¯´{Âp2Fz¼-˜ð E\W4M=oÈä«EÉÒ¾`–†*ÍÉÙÊf\ΈʦO©¢Ã«’eéUá^*v©(]WÖ-Ÿ ÿóV]ó -endstream -endobj -727 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 726 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -728 0 obj -<< -/Filter /FlateDecode -/Length 4935 ->> -stream -xœí]M$¹q½×¯¨³€Mñû0ö @†½† ØÁ‡éÚm F¯•þû~ÁL’‘ÌÈÊìšžÝZAÓè©Ê~Dƒ‘Õ,}UøùFã¿äô”RŽÁ]o?^~º¨)z…¥Äꢨÿˆßè¯Z¹8yCò×I`ã³71\ß.øo¸äÅß.ÿù›Ëÿ¬ëè«™rFûë_ •³SL1*/¨2TJ[Aåý£ñAP=ás–T0ÃGgÜVa†ËÉK*˜áŒI‚*Á 뢶[U†&j'©`†Î> -*­`‡6J‰:¢œ³FÐi?8=H:£§²É¢.B§£‘tÖN!:íµ¤ËSÁ'Iç`‹ÏJK:[¼vNI:ØâlŠ’.À¬u°Å¤h%]„-ÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…A -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ³ÕÐì¶ÊjIça‹1щ:Ø‚Á—ÀØ¢b(3h"^’8ÀÄ8¹lœD&ÙÉ%—$0)O.F+Ñ€É~r!G‰¬ÒÐ-U°Å» 1Õ°ÅaæŠ:Øb³“¸ÀØ‚X [Œ³X°­Z$.° [§²–¸À‚oÒAâ Â…™Jâ Ƶ)8‰ ,(PÊXp®wJ\`Aº˜îQâ Öµ>‰ ,h׺$.°à]ë´’¸Àw­EMQ[`‰ ÀŽ“ÕÉJ\àÀ»V«(qïb‰ 0ªp$.V&“’’¸ÀwMRNâÞ5K€¨‹æ •¸ÀwÇ-H+7x×xe$.pà]ãL¸@™À?JŒÀ» /‡°+qÖ{茕¸Ma‰Ä¼«3–?aNƒ­&r¸ÀƒwuÂð‰º<é ó^žtYâÞÅBe%.ðà]Ðg’¸?aE5xð®¶X©%xW›¬$.ðà]Ä ^âÀaÒ$.Àú6i芺<©œ’ļ Z2`žT“ˆº8HZâñ¤‡J\À»X޳ļ«¼µð®r{Dl±ÉH\€¸:L[aN#X”SH:ð®ÒaIÞU*f‰ x—–M‰ B$IÀÀ Q°‘¸ $7åƒÄ!+èò‰º0áÚK\”%ê`‹‹NâÖS¶9I\ l±ÆH\ lAÈ q"‚)kDßâö¶.âþÀÁDŠ€É¦”“¸ ú€ý¼*é‚™R]‹ºŽÄè&,ÅZâ쥦„I/q~¢pIâ˜vÄ [0U$.ÀR4%ƒÈ\ÒiØ‚ [âDºÐi-qA2°Ñ ÄÉ$ì2ƒ’¸+4ö’pµ¤sŠö™Iâ‚äÂD¡¢Ä˜&Øi‚)ElMH\€ñ¡Í¶—¸›l6±Íu°Åz'qAJ†¶›Iâ‚”`‹QFâ`“ö›Q€` ">‰ ² -…ɀơSJ€ö›ÆI\€yIûÍ$qA¶ -ûMlñ„y›m ýf”¸ ;Ø⢈:Ø‚ ) óœ„ý&ØIÒØb²“¸ ‡@ûÍ$q ì7Ñ‹)DûÍ(¦ À»>ƒ™$x‘i¸Øo"²•öö -Äë#â3Y™hǙČõz¬­bÊ@{±ZE1g @¾´G“0;ËĬ–U(µÓ -ü‹xÌm8aÎ>ñU"ÖÌé&3¦…Ctßö½˜Ý)6çÇþúçËo?cñ½þù/¯¿)™²ú£ ”Òñ¦Énè[ãö-š†ßUùW,„Ô!#bîFjÐâ’t##±üÑ¿ëöÍÊrN¦£6öEr)Q6÷&*­;lŠ±?0´fv“ß]çÐäˆ!_Û-ÛÚ]Åûí¾’l}w·•h[hœ¼_ˆdäQá|Úl.ØËt?䇕Ma¦Rëi‚v€ë;«| Á -;c„Zel6´4o°©PnUøwŸ.`©ÅŠ9Þ.™ù–4V㯟~¼üöŸ¿ûîÿéß1˜Ÿ^/ú¥Üß~£ñêÓüêüòZ¯_××>ί  åÂPæ6”Õ;å«Þ¯Ûlõ3{_븡ìÒ†A»”Jí«õŠîà›Zh§^³öê{?Üÿ™¾´úö¿®Ÿ¾»üþÓdeÛ1ÏYÊdc;D‹Ö]\ž«ò%¸üpÌù.ë0Û5$ütòV¦õÐFÕ«ù[ÔÇÉŸþ? úÛß|é±M#í"ªSt¿'ë<€±uþêÞAË{]Ë´~Ìòú²´õA.rNØÃŒy.„ï ×6*¥|¯sØ–‡#ôž«ótèu÷ù÷pþÂ6„¾gÖÜ»‡1$|Òta¸'ÑÞ4ú¸ô\§CãAp: «½&y”ˆkêû ¿Ü(³þjÛŸ.»õò$ûõpìrYHŠ½sVÉPÎæ>rÏÕy:äÞc¿,Æú×å6(Ôï_oëE«#¬/›2œkx,JHqÙí¿NÖy6äšsñkõX}=:"|…¢›€†Ð¹ÊÜÖ9È­Au,¤^ñ>-Q£õ_ØŒk¤ñºÁâ2úà ëÒж{aˆý¼‰vÚãÎÓÑÁÉ:O‡ÔƒXõ³;V/ZƉïð:G©}™ë[¿å´ÖßЕ7'ìZqâ°FŒuÜleùº°sotO_w‡¸ƒØâÙ“už±ñìAôùâ¼/džv·xµì ù÷d§Cóý÷KwSe4j¼)ðhq3´Ëù°"Îõ¦ua5c~íð[åàvM;¯<¿®ø1®ÑÄ#¯?“eôÙò¬'ë<úìAœú·ÈsïÉTÝAçf§tc}îú×}ö2£Ö±Ù0΢¾ãÛA/‹OÏ>¯=YçéÐ{?¦ÝŒÖ°kièá+ã°Ó©¹Ï†Š‘£^:Ϭ8¬¢Íì´ù^ÄÙn>à>—à¾g3•¡[œ‡}í ôOœ¬ót(=ø\Áâj†§zú…!dÌ¥Hªh-Èts\ùK>eø5?9p,FUn2Ú%çz²Î³!ÕÝkÿþä`'`í5[ýÚGâýÄu›{Ï›Üp»wÐú@öd§CëýصÜë%eΞn®òªuÜɲ·‘¢µæ•!šÅ  ¹7µÍÕ¸îu]ƒŽ5%÷»“[¨3‹Ú²á}3Î<0ÛŠÍ‘Ý'„†çgÍþ°ƒàr²'ë<‚ïǯ#¥U6)0$UÏ<òÐ(EÆŸãÐ1Ã5Æ€Œ¯8 -7ˆÒŒ ™­´lvH{}-3À|·Zæ×Æãü¹Ü°ž¨×$§¸ø\§Còý× -ûÙÍ3¡§ÙáÛÖ¶.µìÉë湜c}è¡ÿ!FmŸ~|~o6–>í¶îŠiDLû²¼'ë<¦ýA–wXiM/~ ë<ΨŒz0Ö-ñs›ÄìSŽýßç½gÉ›¹3ÚÂíÎÛ•ÀQñ½ÕhŒg$L·2߯㡂ÕÁ_âŠÂïSÆï¹Ý“už¿¹]¿+?<Íb×öI—¼ƒ›Žs"¶},Ó¤vs)Ža·Í1¿²´Sò¯w2`›§¼F°Ý/y`Aß–çy·ýœ­÷ïÏ1œ¬ót¨<ÈÙrϽ,O?_¯ÆåÕ-Å(é4—!¹1‹¾þ~/¿§2§r¯c6I³þe@CZ£dó,lÈ ¯vkcìk·ºÖïf†ì êüêÉ:O‡¨sŸwÝì:v>‡¹=þ|g\cÔúuá“{mÈR²-{Oì°8zZŸyÉ£¦S¥Ï TÞûcŸ×zäÉjè‘ Ë~ò…´Py²Î³¡2|ÙgÎðOzçQ[òAý=ä¶ÝÝÊVöíD‘¥×s¨…ÃÕÜç¦/!â¼7#ŸMí Çpæ\Üw²ÎÓ!ï îb$7îE†ù^¼kØJU¹¯~–Õœ6þEÌY⟠lùlÜwǵ›lÑçK_ýžVðûO[ŠÛ‰4úy*Ÿ”­£ß.Ùq!;:US›TFÿ÷ø·ù?ðøªöÎâ¦6÷vVº²S[ø€v·/•7æë|Xm¼eôKmÍQ=­~çsÌDžâ!·Øñ™¯ÀK›º·SÊÞÖuý°ãn6‡n/¿R®øÿŒÃé(¬îð?Õûñ %‹?}V`ç¾½êþ,¾"{n3 -tXº«~=ócé˜×¥_»Œ“§ŒAZ|Hqô÷Ûv‚¥3èœÍm;ÅÕç¡øéž)íÙ¡ú½Ð˜´û£ñ13o ¶Ñy«”²ÐöŒ×ÞæÝ×uL]X|¹ÜõÛ®ÃfXlÌËkí-m×2¯ ëfÝçüLt‡ê_×·>Î>ôhIöoR£V4³¹Ž{¬mn} —O(•ºj¶_Ùõ½~l}f³¯óªû³ù½Úû8Ôqªí¶ú '¾~~&Évðµ}ÇOfã§]Þ©soä›ûžù* ÷oØû°æ‘›Þ0ì¸ÞÕÑãžñ»û§ÆxÛwýÜà/³ôÁçVŸ›CA²š‚-‡äÐ9«&iãÕÑ© çêóåi=æâ¬w>à¼ó‡MT Ù?×%t·cÝæ¼di…ñÁ’ô¡B™TÂó§¸Ç$‚FTÑÉ´ÞñT•'Á!;y‰N¦Ý⻺ºóË1‘Ñ£oO_‘A=fvêdsâa‘§UÚÛöwÕÃY…kfD“ôý06a[E:RUâEB¬ùaæDz! -Ë‘×6×ÛäWžÔˆà…÷~Þ¬T†/3c NË&gIà™¶!dœX€¬{Ð[þÔx þù¡µ_ƒkfÏ*¸ÎËàrߎÃøÓ%”£u9^…4iCßsETKOàc¾ÒqÄIY§ë°éâh}Ý©Y¾uç§VŠþ‡HÑÙüt.sV~±”ÿ© øM‰5ãyþÒ UÄXRý(~»Ð—¦8Aì\O1ˆI¸¼U­-§[Æ¢Ên`…8å±$¸_-o{Zƒ„ù­ñõn¨¾¯Õè0[§j![Žs;„¨ôVLw¯&½ˆé‹gÒd—«ÐL¡@² {ƒŽ—í öŠ‡bmú­P±îºØ¸j¦ƒÊ›ëB6Ó¹ë4þZÖD6œ÷„· ºµ£ôM”Ò×]Ô¦ªwj2ËŒÊMêkÉ6 ®“ º]á7ª6í0˜MÏF Ÿ…©ɵr¹–D·‹XniÍ·‘Š­TêUsõ|7¥CݦæxAvc©¿HߤÅ戲õíZL™«6Ö*1ܘðvñ®ÍÄ.~»ø(”ö+”¯ÐãBËÚmâ¤:^º4¦ê*LÍ*£#—éÿ™*|“ó”7Ú5HѱéýªwBs³‰×NâòÐXÇIÐ.ö²Ì]:ƆYî/”PžH·•n[I™Ë˜<æj‘T#µX7Ô51QXõOãJ.TÕtמAùm%îvú6U½jÍàî[»]w¾qql#®é üfok—a¾ -oeas£˜ Ÿj']lT[ízgLØ )tq§Ñ·"®³µ±S9ÓjyÛ'™´âÞ.¹”e›fCY¢`5}¥ ºôõÿPæ;üþ÷Å]ÿµž!>¯ãF5¶0[Wb¾’Ñ€¥“búB°*lÓ† c´ßÅ:õ²¾¢¡­ãÆ0¾v½ºêÄ^KêÆ ºi¹Ðw2±iÐ5Ú2Ïø;ÂÛàÅÈ|éØô{¾´õæ(ëE§ÏW«pÁo—©ël_’¯¬I\QѾ¤Cë «ˆ Þ(.Y‡¹[¶2“É;i®'û -K}± FÐ¥í:×—YÞt••»`E[~ÁvšwšWöF?<½¾xÜ“C$mÔÞ¤o\ÚnŒ¤ðd©-—a}ÙÖ[Huòvµ¶,›{¶9}jôЭ.8F™4õjKÏ;uU¶ê´.. SUÖZŒÕ¦°T«n)wœD/ÅSté_¸§=•æDÏG%lÊR»uÅkÑ’mçpŽýîT/ÙbÉ$ȯݤ®—´U¶íÛ­û®«í•Ý†ë†„™ª^ÍoJ>Ä̹΅JÕŸ’Ñ©ëj§£5¶|‘ªJ!€C}Vt‰¥JÞ]ç~îd›!©¹Þ†crÖª¨é+qeÞ ÈÇ -ÖTýº\¹ZVâ-½ÏBj¨ÓœÚd†Êw"–¬[IµËH[Eú -TKAo¢on‹JËŸ÷ O^¥OÊÏÿuÊfú -endstream -endobj -729 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 728 0 R -/Resources 4 0 R -/Annots [ 730 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -730 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 176.373057 101.433071 157.623057 ] -/BS << -/W 0 ->> -/Dest (cb160-1) ->> -endobj -731 0 obj -<< -/Filter /FlateDecode -/Length 4694 ->> -stream -xœí]Kä8r¾ç¯ÈóÃå#ø>XÃà ÜX ªª»vaÔ˜õÁß%ñ!*ôʪîUϺ Ù)Eð"?~Œ ¤¤ºKüý ð_ %BˆÞÑýåçÛ/7)¼•ø7¤˜ êŸðñö®$yaUtÁÞNã…V{w»á¿î´Mþvû÷ßÜþ{žGݵˆÑieïù’Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ì°ž4-UfP –SÁ Ò:0ª3 ye–ª3´WÄ©`†ŠÖ3*%a‡ÒR²:"‰ŒftÊ -‡FwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¶XE$9l!<§s°Å8#YlÑÁNça‹FëDF` ÐXl‘N*N°1±º >,uZZaƒ1’Ó)%,°iXF:ÉyF§a‹“6²:ØbÔœÎÀ§OXãC`F«N£ÛH£8…-Z{bu°Ï1€v°EzÇQFH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHØbÉqL`l!Œ\V[L$Ž Œ†-HÀq1°E“á¸À€m há¸À€nIFÅqß’TŽãÂ…™’ãÆ5ÁÇ” (EŽ 8×€;9.0 ] wÏqëë4Ç´k(8Ž x×’x×ädu°æ¸ì(Œ -†ãï%=ÇÞÅ0Ò Wpè8.V„Ar\@à]$q\@à]í1°:/0 ÇÞÕ—ÀÍÜà]m¥æ¸€À»š´ã¸@àÉzà]PˆåÝØ‚å¸ó=tÚp\€Â„†[Âq愈éÓ`+¡BtXð® -è>V…òhqfÜ¢•…r.r\`Á»˜¨ Ǽ ú €ãfTÍqï*ƒ™šÓw•Ž’ã Þ…ß`9.„‚Àqæ7¡$ Ëê¢1Ž ,x´¤9.À,,d“°:/$ÅqÈXHø¡8ð.¦÷ÈqïJk Ǽ+ n«ƒ-&hŽ à×@‡aËŒi8«Bj0§ïJ…ætà])}ä¸ÀwÓ´ÉqóI Ç0PÀ Ö¸@"zï8.pQB—Õ9sËq—XP«ƒ-ä‰ã8Ö"š8.ð¶­9.ð¶Àeจ -Þ7ÀÀ…¶ÀSä¸L&B$â¸À[‡x ­ÊéœÁƒ®Y]€NyŽ ¼'©Xq\€XJ zŽ @ð"¹KÀ èq\à#lÁPá¸S‘ž9§S°N6Çðt¡SŠã‚ a ¼AŽ ‚ˆ2ä¸34bI45§#™âÌÀqA '’«Èq† "M0%«ƒ-  Ž Ð?)ض øA°‰0‡ÕÁc‰ã‚t -7Ç!À-5ÇÀfŠ7=ÇQÂx|DéDr“9.C'%ÇQÄ›š8.À¸Lñfภ‰x!3n£q)ÞôD‚-. -«ƒ-pš"3nÁIˆ7ÁNœÎÁ‰ã‚è\Š7Çp3o£g—BŠ7=»\ÞµÌÄéÀ»ðLÇ8A¼ Ï–‹í%ˆ×zøg¼2¤ˆ3°+Ôk1·²KÜ‹Ùʳkä›b$vÑf"² Ž]5À´ -¥’ì²ÿ£'Œ«Oí•<æÌàÓEF ‚w_bŽšÌ¬$×Çþò§ÛoŸ0ùÞÿô?·×ß +eùOÁARðŒa #ºÛÂûV¸|ãV+! ÂÀGò$#|¬F*Ðâ´è–ŒÄô—þÝ—3ËaøOÌýý§†î¸lèRÙˆš\Z)~5"zèÓÏ·ßþþÿúÏüšüÓëí?~—Bt))Hð>éçV2ô $Ç„Ï똆ÂßýçýÓm}èHt¡ÅÔ0¯/U¡>Éÿih5SZÍÃù[ ~9üÅaŽ "U…Ù iè“YÞÓÎSóâààú?ëÄ¥ ð‚%-ÚœråcS”Sel¶:ubwÒvè‚úñÇøÇ«]€æüAý.uÁøMnúžÎS`ZÅÅâ“ŽK?áó²¢ £>ëfi>Oß“^ëIŸ?Ÿ§ošŽ©)K§îŸll´vüN:zdº»š¾_›´S>z™ò¨I~¤-dúð˜J]bR/RÔ{ :˜ç"¨ªfƒù6P•[0÷Тçr ‡y §Öí{nÅÚ[¹'sÞ¢­Þt_æv„ÎNÅ”ÓÙ> ÑÍe3tíÔÅ^£šò˜®NÙ#¯ÉÛÛîÏ´× -‚©pÁ½ÀôáÛCð±<—C°{ˆ/‰¦Þó:ÚSø±Yž9qB¢V'ÑùÜ”IKË‹èz¿‡Îcy.‡Î_‘øŽ¨â:?&òØjÓ4VΦ“Ž,ÖÌs94îø}WCÜ…"Cî=•—¯ˆÚf½0Ý - a¸­µÚcy®†Z³³Æø·†Ú5¤}->~ÛÒúá–óVù›G²©~gz€‡Ž÷^Ü}0Ïå¼í«–•ŠAÏ#O¬ùo¹ÅgÑJÎÛ­~Ìü·>¦n"a$41>·^Ñèrº’O5Èxfv`e\iù‘Ø -úÈŸŽ”æ¹úv|Qš·úÐû+c¹´z7æG"¬ÄÆ®"ðJÑÕUV‰LãwbVŒ2èt£}­Çò\­Û¾ê¢{žkü«ÙÌÿÄpå!ÿìŒyéQÐÞ…•ˆ¬>%‘&=‡öy,ÏÕI;~è‡ûKì4vÄwÈ›ñxÑp¶ž¶ü~•þ=kš¤ÏÇéó\i5ÍZ:¯ÎXêo—û¨Y“L«"šÖv‘Çò\‘;¾ãI´ü*}Äo¸úCÍ}g«…´äÂÞ -úÁ<—CÞÿ¯Y~ôêO±©+ŸÏ׸ïõǃy®†@»s¿Úu¨èãÃeÃb®MÆÕÞÖœë¤{ϳ.=ÊšÒjš#Ä`¦Ò/SyÏMYTËlë(ÏJ¶iŸÆz•rÝdC^-JyÒSà2ùú5ìçQfðùæ¹ʶ}¾C½ÛôÒ©ÞÍ3ÚôPtáLÝ}¯=µûTQÅê¦oÙ>sö©Ýîx|jw5¬éÌs9Ôlûe¥ç̼g+µÝl2{R C@ïƒí•sènŸ¤éfÛ| ©ç¿V¹eÖÏñk³ÄΠ}Ù+±|~Æü¬ŸgXï;˜çrHþÎü¼¯øŒõ>Z®Ö+èmßi9:{Ës5ôºqÃÛ?…ÆóÿþвÓál­AJãÕéó1õÁ<—CëÎ}è³kï#–•~%(õÄÓ”Ç52š÷fAÒóÒß̺ÕÕì~姟ղ,ýÞ8üõB×ø˜’„Vˆöv,Ïå¶ã—öüìn½0ôÞuгdg×¾ŽÅµri^î©hˆ¦ÏYm"˜'y ZAÓï«Ìs94mû†‹ø0.[òO×qÒÚ½ÞÙ;0Œ»¯\êì‘×F+ý¦™3e‡ÞçÆž\ÎçjGAðÆ;8gï¼¹xþ>ÇÁç{zõ+ßšÓOªuQ~r·”Ù®FmðÝìy¡W²ƒ>æ`žË¡ñà;*7}µgYŸœ:ñLá¹8wa,ø껉êVûÀ=ðƒy.‡Ø_ô½1ï™Øö[ðä£Ï™_ö¯VÜø–Ê‹aIî!øXžË!øà».Þ«þ(Îþ–è~ä¾úAbu–à™Æƒy®†¸¸s¿º› b6x£]Ê=|úÝ‘o°,{^Ú6ãÈ¢@γ)e4mgŸß1®üæ¨>?è`žË¡wçYÉ°ß»›qlŽ ú·úû.Ýú#·~¸@w¿üèºã÷2kÇæý–£«Hó\…'ߧ~U'×}¾á{½Ÿµßg>ÿûhó\¥;kïð·»“׌ 7ÿ^ü†cÖÞŸë~!°¢÷Qíw'ÏÜ7Z<ŸÔÒ\ÎË¿>à£Ìs5ä*¹ã¤Æñvâ‚`ºŸn9j¦ù»GŠ£Ö½Ð³p‚}í¦3]zú…í—¿ ÔzÛ>7ùön—J¾=Z²7j;Íð2PzIÜ6¯¥¤OêCK?MÛx‹ž¶i+Æ´¡@lv7(˜ÝM²Ñå^Síi µ±§ŠLûšp×@bôi뎵-ô—ÑÞÏrÓûKn<ÏTªÞåÖy‚áäÔ}C÷ÊaKúR»}Ø’ÀéÓ–‰E’\§´nü eMÇC9!3ÕTß“·2H>ƒõ³òíTwcMÛ#”k°ùÝøËÍ [Шa2é5è´OéÝ‘H¯…ùxOÛÞiHånSCC«ûJÎaw×_JªiÃW™ö€Kûÿ ÝÚžLé:ü益$Rû'ö7g”ƒxøIÜNüvK›s#&ú 8 §CYÊ"•ÙË-ý}ìS+ätKáiK…ñPÛ|5)¿ÍÙÒ¦)$s"3l2VÌ‘Ó©¥8]½j§ Nƒ0Ó™+¦X—m†°HmÚZ`͸+VF6B»ʦº*Ö”íQiC¬Òt® -‹émÓ©¦ûsZí›îܾÜP­é¥o¬4m«˜‹Ê­«e‘™Æ¨X¤6§,B¥ŸÑËþ sÑ„Î,ú¦×ÒæT£0d QIs:FôrcÓM¥ÙÒS¾¤ -5kÌ-_M©P7¡4<#Úh’ú´cs3F¤É‡s±K=ûZ†7z!|¹Y*#±ŠßnÖ3©må -i3ôZ¡iÊ-â +^ª4­¯ŒGšY–¶öIÿTa‹41Ïp ¨@*mÏUÏj%ilñ¼‘Z¹+¬C\ ¤ÔBŠ²½/˜mÛKɤO¤[R—›I›&kä>fóIò˜‹UA]' -ËíS¸²Êlª«b[ ü6W;mª{®Ì©[Å®pç[+ö¥ÇUÚk­Ø[Êm0Ÿ…/ÃÄF½8A?äJªXË2ÛÕÊa5 ¤PÅ•Fßq­…ÒþÑù°2nÆ}¹ýù6LsÚXqàŒJ[‡¶^—ºÿ/ÒüˆÏÝèþ/y¯ªqײ°….Ü:·3YÚh:§§³° ›F¨©¡ý*V¡¦µ eO¿—î;YÊ.+±ç”ª0¨*ÚVhk6b] «•iZÆn_ºV,ŽÌ{û¦NØã©É‡jLÚå,[…“örpªÎÔ)ùÞ‰³”´NéÐ’n2â¤-§M…±Z633²­¤4}²ŸÚ®0©®æ¤q#Ò©©:ªÓl[t– WÑ$ lÚ“¶`Rm¥qfcôÃÃëÝý>™ìòHÒBíEúÖJË…%i!<^j†S7?-sŽ~à?ÞÚB¥,ÓŒ=Sœœ:4ªkA³“£4ÔlSÛVJY6«4O…. “YVJôÙ&7eËÍ2\q`[ÉŸ¢Jÿܶ´m{¥4¢m{Å-Ò{&d™®²ìõ´pöõêdMY|ÉÀÈ\›»H©¦4Y¶¬›æuçÙöÞ\UC\õLeÍf)â¿GÆ»!—*ÿ +#*ÔÝ1Q“òF›{LîNpBiÏeO¡Y*9g{íd¹B’×NښЂŒ‘^o+&¼A÷MQoÓƘ|¶(ÙK:×ÌÒP¥¹ån“F˜isX *§>…Š6;$ËÒá^ò»O¦BÕólùdøû?ûdZ -endstream -endobj -732 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 731 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -733 0 obj -<< -/Filter /FlateDecode -/Length 4770 ->> -stream -xœí]]äºq}ï_ÑÏ®Ìâø!€ä1r‘…ý`äa§ï® cn€ë<äïçPÉUj©{f®µIv0;­*~”ÈÃÃb‘jé«ÂÏwÿEÒCŒ)xºÞ~ºü|QCp -ÿÆ‹‹Qý~ƒ»jEap:ùè®?e CHÎ}½à¿î’'½üñW—ÿ\æÑW3¤äv׿}É*²Cˆ!('¨TJ[AåÜ‚q^Py=àS’T0Ã2´V˜A):I3Ș(¨"Ì°´]«Ì0A“¤‚:¹ ¨´‚Ú(%ê`ˆ"²FÐi7x4º—tF>&“D]€N#é¬| í´¤Kƒ÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ éæK,†É¸ë§Ÿ.¿þçï¿ÿÝ?ý;`ôéëåOÿ -SÓ/Ño¾Ó¸vqúKaþ{›åóõ˜öë,3sšÏ“Ü©ùº”õÒ>ç44—mr˜Å´Í\³ÁÙ9ŸëÊOÍŽRwµKOeç2Çt´Lçü|=×½¨Ï/ï­ÔWê—l×ê7ÿqýôýå·Ÿ– =Ç ÖÙ‘Âl•9à.®Žey ®>NX†ÞõMWšÿ˲Æn Uº|v~Ùu»é“ÑqHšírGÝ—nˆ¸îž»·¾œrÍÊ«ðóK›ŽÔ%ÝŸÖsÛÕ©zèËÎÑ÷H8¶FS$ÚÁðÁ2å92é>¿vÓtmÁaúê¦nwû¿ÆsëQZÊrݽðúêhìÚÓ±ùJçÕ_˜ǹi¹ÍyÔ9X§­»È=–çtÈ=æhV¤tÚ¢§;.ËèîÑ·ÉOxbóœ®Åïûb®ÃzÏýX͸¶¸7ƒÇú6³˜ˆ_\›¬{™®%]ÎcŠ¯5ëmvÍos¹/,µü¼.MóŒÅÓ~žêÈ«…Z®Ÿm)œóÄi\ª¯ït"¾ óxŽâë`ž³áËìxIÏö1뫇úØO¸Èœûn}|ä>:;úëñ~,+Ÿ­™m»Í˜—»2cû8cÌs:DÝ÷n2*žéYë¾möy›ý¨ba«¸ÃÁû=TËs:TÝ÷<þÞ¼ópï¾ßÌ#jgÝoâã««ƒyN‡”è *~ØÊ¡ zÖ]ñuoÌÞ Ê.¢iýzœyuŽ§ûÂî±Øù¹ÉDÛ…û{ïµµýnsÙ»Ñ8­–ùRÚ IE“·†î¢õ`ž³¡Õ>¥úˆ5ü‡!A·ÏµµÌ÷hÜ·ßF¨#˜!.oM”XÈ*Ýg–®ß"pÍÞ=^µÍG#gåÈgTÝGê±<§CêNÔê=âŒ=Š§}t\òÛ‹šm ²ùw.™‡+á÷fúƒyN‡ÈŸpcÖ}$ªÿHòý^Û7÷Ý@ðѽƒyN‡à_õ=¼–‡"ì›öy†­¾Þ; ø˜Ïx„Ëè¥æ‡æ£åDXªí­Éæ9ziÇw=²ïóNÿÅú†}©Å=ô^‰Ð&Uç»{íÝ@ãqǃyN‡Æÿ´÷öû“®—Æ5uAl‡„¿_/³úJÙŸg.ëK};»\÷x à`žÓ!÷¾ûÖ½õ_¡ÝQ;é\Ø{ðë[üí»ñƒ¾ú4{œûD¬õ`žÓ!÷˜ÿZ#IAnÑá Ý4°¸gŽ®sŠÔ#ò9FûuŠâ»—7äç§rúHË[#^ÒÒ· óRW6?/±jçƒç(ÜûÜóœ ©nÇWý,øŽ¥-ãÄZ}qæâeÊŸ÷‰zN«õ­NÊM{W{v-8±›#ú<÷b¨5-Ÿ6î-ßÓÇ®7û„?{0Ïé»ãÏîÄ@Ïçç½Ý“9íjq×kÙ@ó>îÁ<§CóÁ“ƒOúª÷NOÙµ]ÌÂÔzxë‘–Åo‘ç=ûÏÓÙƒüwÁGND~ØHÞ@ßqÖƒyN‡¾?õ#Ï=©ºƒÎÕJéÆêÜ<㿱ºû ${î“\qÌs6$û·Å\¿I$¿G¬€qzôTÎÊïÛçïÛl>cpì±Ä ô2ÿôèŽíÁ<§CïÎÙо·ºUËCªTôÅO…p+h3e>Šø=ÛW¿85—éƳ«}D¨øu_—ùWè˜Q3Æ~7b ed©òÌÁ#Î<1ÚF›»Oî uûgÕþ§PÂ1ÙƒyN‡àûþë#_2’Ÿø¨H*-ßñÈS½ÔúTv”íéÏËr¾â(\!J3.d¶f§eµBÚªkæ¸Õ²v­<Î÷åºùD}Ý@²{‚‹å9’ïû¸VXÏ®ö„NÙ³ÝÛ–²:.µlçuµ/G¬ÝÕßù¨¢ ýîwÿ¬ÄÑ8Öi×yL#cú‰(ïÁ<§ÃôÁ'¿ØÉ‚ò¬_Å:÷3 -£îôuõGÜTffv‰)WÏæßéç­½ä­gV¤]©<†û™Àu^ñ½Ù¨÷g$L×4?.ý¡«]{‰3 -¿OùK·žˆíÌs6üÆØ®€ßE;ßy«žtIXá¾iÿdÌßöÙ' -·b)Ä°[Ç@_aO\Þ‹€­vy`»›ã.ù»^nó~Þm;fíã1†ƒyN‡Ê˜-o¹—y÷óenÕ0ÿ-O+çïª*ÏÐCn̬/¿?ÊŸsšC±×>š¤Ù ÿÒ¡!.Q²Ú ëâ‹ÕZïûÚµ®jqïIÂøD|õ`žÓ!êØy×Õªcãæ¢÷øþN?Ǩåß¾‡—Ï{veõÈR²-•{¬°8zjiŽ£Æ¥\\ñ˜@á;>v^ë™ÕØüžvfðû»­Å?Ìߤ:Üå·ˆåïÂN싹+tw“ì uý5ÞåË°¯ù§‡¢Ÿ1è¯(2¿BÏÆ+ G)äoÏÐûíïÿí_þð{‚sg¾LK‡Ñaóóá÷ù«zót5sêÆeb!¯B\™Hr÷dbjɧeaîš©ûÇcÏ9­Ÿ~DzæÏc9±,]æú2ôrþ¢“~Q¾›ëföŒe8v®Üê¾øñí z|ƒŽòqÐ&¿bïêiÈ‘ƒ®ù QYÒ¥ÛôØÐúº‘s|1áÏ5Õü®B•__”_]1½È]Ìé;ü§‹N4äöÏ$2½WLâhÊE¿^ò{åHV ÅY8Tµ,Ò%a•ÝÀÅaH}JëÊ÷¾ëT ·®|4®ÜMÎïJ¶ü}ÿ¤J";~ãýT± DN¯×â|÷jг8¿›/v¾òÕç‹Í¶‰§m¶Œ»bmºµP±êšØP±Gçw¹Ô¦óMXMçM§Y÷—´&°î¼'¼]P­í¥¯¢4¿¬UZר*³Ì¨T¥®¤¬BµŸÑí"¿S¥hBgV=ëµü^•I ¨¦K% º]Ätsi®öT¨©bËšJË7SÔm¬ /ÈÆ6š¥!¿l”eËÇ¥Øç(}­"ÃY oGu$6ñëÅ!µk\¡\ZVnGÕðÒ¤ùËå¦OšE–ßJ‘ÿŸ¨ÂUifžñƒ¦ -©üf™vÕ*Éc³Š—Äå¾²I- )´´¬¹t³¼½°"ÒgÒ­©k‹-¤¬É˜<¤b^&©JK±®¨«âLa¥}*Wr¡*F º&vʯ q³ÓÕ¡ -°—ʼfpwµÜ&ö•;_¹8Ô×ù5AÕÞZ.Ã|ÞƉzq†~,•4±Qu¶k•1a3 ¤ÐÄF_Gq­•ÆïÛ?¶A&͸·Ë_.ã4g¬3 ¼Õù­wÜëÒ×ÿFšïñû× ]ÿµ¼fešÇªla*·.Ä|&ËïHÅù©EX‡ b´ßÄ:¶´® ¡ÎãÆ0¾¦–]5b/)ueP]µ\èZ2±©Ð5Ú²–qw„·®«#óÖ¾iötiËÍ¡›_ÐS¬Â¿\Ʀ³mJ¾²"q•“¶)Z2,#.x¡¸d¦fÙÂÌ H^Imúl?ñ®°¹.vÁ܈|i›ŽÚ4Ë‹.²ñ.X¸À–_ð‚IóJÓÂÁ觇כû}6Ù—¥•Ú«ô•Këei%> -endobj -735 0 obj -<< -/Filter /FlateDecode -/Length 4743 ->> -stream -xœí]K$¹q¾×¯¨³€¥ø¾cdØkX°à}|è®–`ôXùà¿ï/˜ÉGfFefõ̬J’§ÑÓ•|D?~Œ`U²ÌUãç;ƒÿ•RŽ®·Ÿ.?_´Š^ã_)±¸(êßá7ú«Ñ•79$ý‰.ª˜½áú~Á«Ë±øûå?~uùïesµ*ç`¿þé3«È©˜bÔ^Pe¨´q‚Ê{£õAP£p‹9K*˜á#YÚª"Ì œ¼¤‚dmT f8ŠÆmUfØhHRÁ “}TFÃcµu0D9+èŒWN’ÎR¶YÔEèL´’Î9"o$]V!Ÿ$ÁŸµ‘t¶xC¤%l!—¢¤ °Å§El±):Ia‹…w² K°èJ¢¶è ¤ËNùœˆD]†N§˜¶:«½òÉ9-éŒQØt¢3 -ƒ¢ ³°%hŸElñN[Iç` áGÒ'¼‹) ³ÕòìvÚIça‹µ‘DlÁàK `lÑ1H€¤˜—$°1*Ê–$°É)J”$°)+ŠÑI4`³Wr”xÀi58 [<‰ œ-„™+ê`‹Ë$q³°$.p¶Xr8°--8Ð-él$.pà[Ò&H\à@¸0SK\àÀ¸.’¸Àr¥,qç:p§Ä¤‹é%.p`]烕¸Àv¥ qï:2Zâï:‡š¢¶À€•3ÉI\@à]gt”¸€À»˜FV〉ƒÄÀŠ²)i‰ ¼k“&‰ ¼k#–Qæ “¸€À»Ö㤕¼k½¶x×’ ( -ü£Åh¼ -ñr8[@°`½‡Î:‰ И²K$.ðà]“±ü sl¥LÊAâÞ5 Ã'ê²2æ-¼¬LYâÞÅBå$.ðà]Ðg’¸¯°¢Z‰ [TpˆX3Sä›Ì˜„è¾å½˜»SlÚûÓ.¿~Áâ{ýÃÿ\Þ~UvÊêøN¬9åmŒ7øJ•ö&‚mË [?R‡ˆ¹i@‹ó¦‰¥Ëm¾¶fi2,f› ‚™rg´è©‚ÁX¹ Úúp¯n«ã¸Õ{DoË~E# -ZçøßuûâÀH0œÐ¯MS¼dcÏVúŠFoý÷Ÿ.Ž­n»ÁßõË©HÞf›®Ÿ~ºüú7¿ý×þ÷ßbì>½]~ÿwà~ÿýw†ÿbþ˜ŽDA8i’y3ÿ óß*÷ZSšÊüš^'9|S®Yί‹~ÕÝ𚺼¶cÃôšÛ.m¢åùoèm·òC£ Þ6Þ&¿Í6Ýú½,l ݪöç±­ïÿóúé‡SÞΣ·?7Z ½qýº½Ö™^Þl©s› sÏaì’q‰”›·qç>Ý<@(úÀë·©=óã¶à8Æ)ûh›vŠ“æÁ,m…];B¼g‡î÷R”ú {ËàmãýÔ  %´Í¶¹Ï“;K{f¾Wšî·³ú_ëîùÒêµ/OÙææ±lõµß°ãÏ5j™·Þ¿Ÿ4öY®?ϸöƒOÌPnÆ7—õÃ\hv ø¯åÖ÷Å>õu^ro»~³¿ ÷µöa³) öV,˜îËÞ†92âJÄO?ëy\ÛòÃ}¥¥ Kü‡‹üŒßÁÞâ#Ýdz¼^ŸÕ»>Í.}fçyÕ±Ú9ð7ŸJ¸ázÇo>”pƒ÷ª‘¨[U'©2ùõ¢}ž=»Û£å<ßDrÄÛYà™ f–Iïu¹˜­ƒ9°ÜnüÆfæ·VOÞ!9,è•°l •˜Ìɬó%iØ7áºD{\§_Æ%©å Ë,¬fZZδi¹ªyÙ Ë¿XæuõKÍ“–}LËéÒÚäN}N›Îã’¬ßÃeÃ\ ,‡¨á2ëø\nƒhëHåìS4«÷0ÉïÆÎøâ7ÒeÞ‡ÛÅäÉ:φI -~“ÇÌ/rhÄa¿ÎÓ~‚¹ÝÑ¥¾ß`hUæÇùoÝ°³¾þþ8ÿ¥ù5 mYaŽÔ=Û1_Óíõ©ú]¾?ã‹2ï *††Ç£HÙ¢ê\'AU7;ë=Tý’ìÆ Ú½)ÙZÚAk¶ó ›vV¶$†¥l®ƒ¾Ä{¬;rnÕ§^#o¨»¶=>â/Á^7Ž£˜”qÄì>‚OÖy6{ó!^|J4ðVAÎ[MË—º6«¼râŒDkDçëÐ&É]ßC+×콃NGç¹:O‡NÚå×qåÚ «z;oW¿2÷S_q#—–eÛõš³k߶Û0F´M¯WvÕò+´®mÚØ5Ük{½êk³Ê<ù¶ê÷ÎÔ¢‰{èëñ’IþÀl2G«ûÉ:O‡¾ý˜±­î•3>¯ ódgCgø+Š¿ «8ƒÎ¯“yìùô{ çùQª3»5'ë<â¾gCÜe§¼ŽTnßµÃ~!x9%{¸ï}²ÎÓ¡ö`ño µ÷ö­øømiËfÏþ4ßAr;ù‘#"ÞGy÷É:O‡äýXµíT¬ô:ñĽø­½3f+µîj÷c¿­sê!ó(3aÈñ¥Ýð†ˆA×Þé¡Ž’†ŒWi'vÆÕ_!“ѵy8S:YçÙÐbQZz½Œþ¹¼~¯oä¿S™ÈJÖrãÐøLÙÕ³ìÅ!î4Ve,?°Ösuž­û±êƃkžâ«ÅÊÿ"påWBþ£+æSÏ‚ñ]X½ƒÈS9åøÉ‘t„Èsuž‘qèW—¾rD0ØÑ¿BÞ‚Çó„†GûÛ_ïÒÉžfŒçé'ë<Òþ<{š ´¬P|wÅ2»Ü—†=I~À¶|Zö‘'ë<"ÓAìø Zþ*cÄ_p÷' ï;{«´§ŽvÐOÖy:äýÿžå×Þýi6­Úóó{Ü÷ýÇ“užïW¯žsÜä‡+”•Í Ü› -\è£ÍŸ¤æç-ë^§ëªãO³rYKK„8¬Tö6·÷:´E½Í±öYɱìËÔoy$®¶fên×áOQðçÊß¾…ýwPö˜ïd§CÙ~Ìwjt‡QzhtëŠV–ªœiWï}j÷¥£JÔÍõøù›G?µ»z=}jWFMþÀžÞÉ:φš¼—µ‘sË\ìÔ®V“Å'VXÇ`GíœúŒÎjǸ•Y­¶õÎ<1ôÑvÛª_ó×a'H\A×mßÉåûcšÅyùû}'ë<’ÿÂâ¼oøëc´<›?î w|¦åäê}²ÎÓ¡÷ F܉öBŽùÿå¡åÀ_!ÃÙÛƒ¬OtnÐÏ©OÖy:´¼}bu]Ljmgc½Ä#1?™ØP3ŽÎj·f:,bÙÿøD¡¸›½ÞùYçÏfÛ–ýÒ<üû…\­‘›&e %¢ˆ­ôl3ú 4]S°U¸÷P@À9ñ W-.°ë>6oÞk—–í>”Ñü§kQç‡$æEŸHˆ ~7G=<ïù(ömÎÃéf D‡E SÁÝžƒu5«c¼–Oéf>8,òÇÈÈ‘î»÷Œ®ý<å±õ4§²f·çÙ-fÞyà2õ¹Þò¹’™/xÈIO‡v|îP(ÏøΔ7ò$/‡hÝ ™_¯ä)ýñô\Ÿíií׃B{‡•Ìï¢M÷°ÆŸ/¡AiÊ1Ä:$e,OÁ5âM–˜¯|ìeÒŽL6Sm®wj–owø¹•š¿ðAóÐ|þgÖñb.ÿsðŸ.&“bÿ—ªÊá캈Ë&+ñû…ç'ALÔO¹:³p~©[[dÚ¡YUv+F•×%Wz~ÙOÖ┧—Ö×»áú¾VãC‘pØzÅs`êX¢f0[1ß½Vfó$åæ«ÐLáÃ6š°7HcÙÞ`¯x(6NB¿ê¡».¶Tí1| ns]èÂfúè:3 -kã0œ{ÂÛݺµô]”ò±êµ©ê]«›Ì Få&õµdjã$ˆnAø®M³é‡QãÃi'aª@¢V.×r‚èvËÍ­ù6R±•J½j®žï¦t¨»Ô/ÈnÃés‘¿±e˜#ÚÕ—K1Ÿ ÖÆZ§7v#¼]<µ™ØÅï…Ò¾s…öz£Ð í6qÒ/]ÊO[N¯05«Œöäÿ'ªðMÊÌS^jâãyûUï„çf/4ÊCc’<`(ö²ƒ»LŒ ³£¿LÒBy&ÝVºyl!\6Èc®æ1I5òXŠMC]3…Uÿ4®…ºîºØ7(¿/ÄÝNߦª×­³`¸ûÖn‡Æï£8¶7|Ör³·µ;`¾ -oea£µ˜¡Ÿj']lu[ízgƒ°RèâN£ïE\gkc'þþ˜ú²O2iŽ]þx)ËœuÞòIZÁþê€1ê2×ÿE™ðû_ºþK=«vZÇ­nla·.ÄãJÆ_4“NŠù‹gª°M›Ahi ý.6©—õ m·vàkêÕu'öZÒ45M; -}÷á ¶ ºÖ¸Á3~Gx[y±2_:6}Áž.]½9>ŒO9®Váb¼\¦®s}I¾M⊋ö%Z²CE\Œârè0wËf2 ÇNšëÙ~‡Âq_ÃÅFð¥ë:êËìØt••»Š vãÅØ0™±Ó¼°G0úÃÓë‹Ç}69ÔÀÒFíMú>JÛ±´ž,uå2,/ÛšãÊ![uòvµ¶Ü0÷\ rúÔè¡-.FŒÒÔ«ÍüØ)UÙ¢ÓºP4º€LWYk1V›Â\­º¥Üq½[LÑ¥=íÇQiNô㨄MYn·®x-Zr-ò#œc¿;ÝK¶X2 ²0ÖnRê%]•mû¦eßuµ½·AÝÐ#SÝ«ùMÉñßGæŽx€µTªþ”“úéîX¨ÉDg]ùÂ>B‡çJ¤4l•<\gïd»CR÷NÆž0ŠœÓÑðW/Ê&¼C‘CSõkåjY‹·ô˜„­¡NsÛãÆËwo•=DzAÔ.#§ŠüU{ŽƒÞÄßµ‘§úÖÿb ¥üüf6Ü -endstream -endobj -736 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 735 0 R -/Resources 4 0 R -/Annots [ 737 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -737 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 627.273057 101.433071 608.523057 ] -/BS << -/W 0 ->> -/Dest (cb163-1) ->> -endobj -738 0 obj -<< -/Filter /FlateDecode -/Length 4678 ->> -stream -xœå]K䶾÷¯èsÓ|?€À‡’ bÄÈ"99Ìôzl³Ö9äïç£Z|ˆ*IT÷ÌXãì`vZU|”È‹%ª)Î?_ üçµ`ÞgõùòùôåÄ™3ÿ†“‹Aý=~9 ®3"XoΟ£@9悑ΞŸOø¯¹¬“?Ÿþþ›Ó¿§yÄY²¬æüóQ¥sÞ9nU€Š E¨ŒaÎIc • ·¥‚Æi©ç*3tð†RÁ -¥'Tf(í„š«ÌNhJ3D0ŽP ;„äœÔÁ®µ’„NfÑè–ÒIÁ¬2:p’Ò)ŬÓÂJ˜µÖxJ§a‹ \P:[ŒÐšS:Ø¢•w”ÎÂe'u°Ez§(ƒ-­‡-@—'u°…[.(]P̯5© Ðqïü\'¹aÆ+Å)Ì›ŠÔaD¡“¬#t¶Xn©ƒ-FqIélÑø¡tà £œ÷Äh•qt+®¥3°EJ§IlAçS -láÎR€Ä"/Q c:HM‘€ôŠi¯=ÅÒ¦S È`˜¶ÁQ< ¸€N -Š‡-F[Š ”€-#—ÔÁ4ÅJÂ$ ¸@)Ø"µ¢¸@m5ÐBqÝjÅ -|«¹°(.Ìä(0®òVS\ @¹€R ¸@s¸“âÒÅpw(°®2VR\ @»J{Kqï*-8ż«r’:ØS\vdJxEqï*Áż‹a$).@¯2àÐR\¬0é=§¸@ƒw¥çšâ Þ•S©s cPQ\ Á»Òਙ¼+ —hð®ÔÒR\ 0ð'½ð.(ÄÐîlÁR\€ù:©(.@aLÂ-¡¸À€wEÀôGŒi°>XŠ xWxt© L8´81nÑÊLX(.0à]LTŠâÞ}zŠ Àñ 3ª¤¸À€w…ÂLMéÀ»BNqïÂo0LÀ ¸óÐ%uñà=ż Z’`f܃IHc’ ¸dÌ8üPŠ ,xÓ{ ¸À‚w¹QŠâ Þån©ƒ-ÊKŠ à×@‡aKŒi8«ŒK0¥ïr¦tà]Î] ¸À‚wã´IquQ =Å0Á –X¯YpÎR\`‡.©³ ׆âÇ!0 ,R[´ÓÀ±fAOq“°EIIq“°.ÅðXð¾Éål\Èõ†-ð).“1´¦¸À‹õZ•ÒYɼ]“:p8§¦bAqÖRÌcÐS\‚gÑ]¢¸f@'4Å.À Š 01/á™S:[àdS\O:!(.ð¶À¤¸ÀKU¦å`†ÆZMMé4ëLOq×–EW‘â ¬4Á”¤¶€&(.@ÿÄŶ¡¸‹,6±Ì!u°EMq÷2.7=ÅÞÃÉ%ÅÀf\o:Š ‡-ðø(.ܲè&S\‡ŽsŠ ‚ðXoJMqÆe\ozŠ ‚âXob‰GŒÛ l\o:Š ‚†-. -©ƒ-pš1nÁIXo‚(…-2hŠ ‚µq½é).€›õ&žÔÑŠk 4_Væc¾ÄbXKsþøùôõ?|øýþ -}|:ýã· 05þ~ÿ†ñ³ÁïCt°8×?|ó•@Z㯵ÿŽ×@:¦Q£î2^ÛiZ3æ5a.‹uŲ&å¥:]S®«ê~erLóp•>^§²+{R9ŸŠ2Ö­K›LìñÓzµÚ%ø7ÿ<üpúöã<ƒGyOt@à*H³·¾,÷àí5`†åé -Ì„r3^ð9”nH]8é -¹Üìƒn–j‚(']Wå¥Ï"Oýu pÝ\OµÍ°I:>«Cé2mŸR/ ËiAfbðã=Γ«¸ìÌs4`bµ³ŠÌ¦·MƒŒbLÕ£—iï ½”‘HG\ ‰$™±÷±Ò/Y]«æ³ó„Rå>2*.Å.Ó’§,ù›U“WÈZk;/w2ºÒˆ^@£ÒûÑØ—çphÔë>­kÂoíýèê^—FåcÑ¥:ÖÚŽn²íZ[·¸´rƒ£.t\­£·/ÏáлîLîéÔ‘Ôãµw”™Ï€QÄŒªürONx2!ëRõrí@¶¶ºiY3ôU¶Ï¸zá3åÜæzgx6²zgöÊ}´1Ô‚®v[hìËs84nøœ÷ôêÓº?§eÓ;#Jñöœ–Óßð^ïg¥ÅOì^uæ9J7bwø[·=É«F†þÍÈ_BkëÏ%.mP£X7zTýyt΢é}ü-kÏ ™Ú¶âKüzƒÚ™çpÈÝðQÃõiâŒ_R%Dë‘GÚÖOÈhš{¡Au»ecòü¨£G÷¢±Ý:Rû»i­mŸª|[OK9Ý5×+±ž†?]}WÇzeÜØ©hôêÊßĤo­ 6l ·3ÏÑЫ×}Ô×Þ ”9¶}foçÏq–b±¤'P?{ymH׬½ÛQEÍy4´h&l_šÉµÚχy‡¨ ³m½Ôí~ê©¡¬×ÃKÑrËo®ë$½[Ÿò¯iÅ•oÉ5@[«¦Î<‡Cñ†?Ú®=qËÉÓ¿:&à¦=–Ññ銂á÷Ž§§yóiäÛÈÓ—fm ¬%äªmãY»¦üðÖ;ØâW¿ÿ9RgžÃ!³ï9ü.¬òÿ¿xn‡_]?‡küéÙCF¿ßñ¼ÛpÉ×4ÅoñC¡¬ÛBngž£!×ôùš)6éé†Ëê(x‰¢/´ø ¾XgžÃµøº/f¬·|@íMQ¸7×S¶Ì,1’×S2ê¯×”.æI믤WÑ;¿Œå>VùtÉ_×5¬“ãŒU§}¸Ö ¹\;Ú’8!æñ×q9¬_â>h|Õ¸^|õå9¾6¼¤[û¸ê«]}l¯¸ˆœûb}Üsíõp?ª*Ÿ•m»Œ˜V¼ ŒuC4­3ÏáµîÝDTÜÒ³1úóžÙç>ûiTÙžÄvæ9ªìÆnÁ_˜wv÷î‹ñÍ8¢6Öýö†]zy‡”èUW|µ•ÃÂþõv_TO\–z³„òêêgIyÅUÅÒž$#lëˆ ïz®”⵫Ѹ´šý» ;ó­·E©^c ÿjHØ»· '2·cïÓŸhÓ=ðùþˆö™Ù$’¶€ÔêM#7Úú­·G:ó©}o,ßgÜ»›äã’ï/jF#ÒÝð¦rgž£!Ò½Á${v¿å ÞÿÕ ø†è^gžÃ!¸ogß½ûéïþ&…~‡jѦ.Ÿñ(_@oõfˆ ès,Õ¶Öäy‡Þ ßõ-ßy+„v×âoˆ;væ97üÓ…Ýг·>Láš¼jhðKîMmwqÇ•ÌÀeÍ~©÷ñ _uÛÐyŽ†\¿îÇÞý=KoÐf·µ/ì%øõ{5~жS›fë+Ìnˆµvæ9r÷½™Òû]4TqÏ]ŸìŸ§8¨Ù3:DäcŒö‰ÏÞáÚ¿Þ•ÓF’ª¼í~þ·}q©7<çîÌs8¤nøª„ï˜Z±ú¶²·þÆÙa×Ú{Ymžµêžo1‹÷ôº+ÄÄÞàÏvæ9b7üÙèñü¼û=™Ã®7½Íá·3ÏÑÐ:wÞè«n}—èÖSÛÉ,¼öM”é™{ý›äãWûF~ìÙùj#y}7ÄY;ó}÷}sÏ»ä¹=‘ªt®~CÇâÿ…ÕÝk!ù†·¬;óÉ÷Å\ß%’_"VPqúä[3.„Þ¶C¿m³qAß›‰ è­üÓÞ'¶y‡Þ½¡mo5«–]ïª&T´Uï -©9,¡M.”¹ñ[¶ïÜqCÚ4Žý©©ºoÛç•QúýxŽ…3èPÏðŒ'Q„êXŒ ÍÍ$Hœ¢‘Ž¢8ÇŸjvĘ…CÂâ¶ÊŸá`êàâ™/Zß~÷—?ýí»­áåñ®ážØ,ÆËËuÓf¼N/ù Áó׆Ëa±>’¥½BÇ MááPš8þ6‹ÆM¡OWBð1­½þeŸ‡r|ZFŒõÅÅ~Ì7J¹«~R¾ë®ìÊ0Õ=˜t³nür²ÃÙEb8¿Ž[Ï„ŒÜž­fqª çx^’çJ‹Ômbhhq^È9 ü%§O -æñðÀxpÔõáêbLÿeèðÏ'4‹íIâzª'Ä^¦‹"~>ÅS]5!ÖšÉNqŽy.K‹”0Ë.àZÇB›RÆÇ!®Lú(Mº›˜ß¤lñ´ÍS"5œ7s­˜"§sq¼{ÎÄ(Ž'ãz¦Æ+›M16Ù a)P×iK%ã¦X(^ Í\È«êŠXêdˆ'©å¦³E˜M¯›NTÝŸÒJWuçšðrBµª•>“Òxg**µ®äY¦*£B–š”2wˆÎýDˆ.'BøOEktfÖW½O5» -}’ÎéBJGˆ.'2ÝXšÉ=år*_²†ÔòÅ”uåsò¡F©‹G}Wc„«ôq*¶±R_s_áF΄—“Ñy$ñóÉ8"µ)\ÁM‚^-TU¹YìyÁK‘Æ×$®Ÿ04“,ž ÿ¿R…ÉÒÈ<á3¤â¹nåªTÇfO©–ÛÌ:šj¡]I[5—p.c¶n/á9‘>’nN[l"­š¬’»Ì‹$•Éc*uY),µOæÊZÈ“¨®ˆM†òóD\ì4y¨ì©2+*¸›\nÛÌϵØåñ¾lo.·Â|^†‰M·â}Ÿ*)bÉólW*«„Å0B}Äi´fv¾í}üX5ã^N?†iN*#>X%♳µ×%ÎÿEšøý×IŸÿœ9»Îã’g¶™['âz&‹'”ûNq<±< ó°©„RW´_Ä—´&¡!ÏãRV|­Kv^ˆ=¥™AEÖÖBSÚ°Ë ])TÕ2fExiZ1;2÷öM™°¯—*ݪQñx¼d.êÛÁ¥/:U¦äsU$®bÒ2¥C«e•u¡¸¬* Ų‰™u%¹é£ýºî -ëª.*7"^ª¢Óeš­‹N²á.ª$pU}Q¬E]i˜ØC}óðº»ßG“mQš©=KŸki¾±(Í„GKÕpi§—yÎQçx‘oi¡\–ªÆžÊNNŵГ‹£•Ô—lcSWª“lRiš(2]@Æ“,—è’MvÌ–še¸cO¶’Ë>E‘þT·´©{%7¢©{ÅÎÒÆrÓŒ—½%• SÃÙ•»ã%eö%=!³uî,Õ%¥J²yÝzZwšmÏÕmèbˆ-ž)/ÙÌ,åMüwËعæi¢Tªô3DF„/Ç‚b¢ÖÂ)©Î!º;ÞZpˆŽ‡u;í«PÉî<뱓y„$ÅNêšÐL+ÅÞLx†"l+ª¢žÇUél“·´¯ˆÐP¡9>‹ )¦ÆPæ Ê—..MŽÖæÞÇ£åd¨(Ÿ6§'!”áçKWÖ> -endstream -endobj -739 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 738 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -740 0 obj -<< -/Filter /FlateDecode -/Length 3553 ->> -stream -xœÍœK·Çïó)æl@4É*¾€À‡1bDpAÖXk#XsÈ×Ï¿º›f×ÌήddµXÍtÕdñWENϺ³Åχÿ2;“sI‘Ï—§O'kR°ø·”Ø],êïñ›ÂÙYN&¸s8%“Jð)žOøoº‹?žþþÕéßû:îìM)Ñ»pþõƒ¨˜LÊ)Ù ¨ -TÖ‘¢ -Á¤äCTTÑÜb)š -f„Äžª3¸ä ©`{ŸU†ÄÉÑQU`†OŽ5Ìp%$Eå,ìpÞZUC,3yE炉ô¨é¼31_T]‚Î%¯éˆLLì‚ÓtÅÄCÖt [B±NÓسÕt°…)'Ma E²ª¶øœHÓ%Øâ1:EÑeØïʪ¶Øh¦+dBÉ̪®@gsÊG·Á„Ld5s&À7IÕaEa’bRt¶DŠªƒ-¬×t[?šœ”rVV«—ÕM–œ¦ °ÅûĪ¶`ò5ø[lŠ°‚ŒpIc€OÉpñ¬AÀg2œ9kð¹N‰4 ø Ç’4uÐy§€,l 5ƒ-Œ•«ê` ÖX@¶ €Æ"Øâ™4hËðܲ-Nc·l]ÔX@.Ì´ Ä¥Yc¹p¥¢±€À\;5 ‹åž4¨K!zì稱€À]bg50¸K„šª¶À5€Ž†\& î’³Icƒ»XF^cfÕÀ£ÆøŠñ9[ îúlYcƒ»>!¨ºd°Icƒ»>à´È îú`½Æw=û¨±ŽbÀ«fà.ôt¶° ï¡ó¤±´DcAw]AøSÖ4he\.QcAw]Æô©ºb\ˆ+ë£l\ŒEcAw¨HcAwϬ±Œ7ˆ¨^cAw!Rk:p×ùb5pyCÐXw0 €ÆÄ7ã,\WÕcKÎ ¸ ,yˆÂÆfDÕ%Gr cc‘‡j,ˆà.Â{ÑXÁ]ˆ4Dp×2ÒU[({Èk Ã²UÖ4’Uc=H¡éÀ]ë0Úܵ6Ü•°©± &ø¬±dÁ^cAÌlJJQcA,:¤|ª.\ÉB€,U[8±Æ$Ö¦PÉ ’‡-ä½Æ‚äa RÈLqȾÕíl»¨û†-È5€d&f)DìÇ0ªš.z“p­ê2t.i,H‰ B±ÓX€½”ÉXô x#é’Ƙc©À,E&{dæšÎÁ$Ù éBçœÆ‚ìa ²AÙgì2£ÕX€½$†ZÓ±•}fÖX9I5`™`§ Rª:ØLh,ÀüÈf;h,Àæ›MlsTl¡À rö²ÝÌ r†-ÞzðMÙo&ÅÂd| ŠFÒdÀ8tÖj,(.c¿éYcÖ¥ì7³Æ‚BûMlñ”u[(Ê~3i,( [RU[4eÝ‚IØo‚Nš.Â_XcA‰Qö›YcÒ ì7‘Ñ«GYö›I=.wC™4¸‹Ì4j,Àö›Èlµ½½xCB~¦+³ì8³zb`ހتX°Ñ*©gð•=’zh3±³ÌQ=5@X…ÒYõØÀ‚¿ÈÇøÀ„õôi<¢Šp‡„˜™“ÜdÁ²`d÷mÏÑ‹Ñ•bëùد?Ÿ¾þÁ÷üóN_-'eõÇ!AXJ3ò+,_0ÝÙ·ÃíS”Mëb,{Vaé6•n–·c61 Oþov¶ÂÔï—~©õ[·×~嘹†xDƆu9 L}f•/h°Åvñ5¢ /<‚“!“´¼+üûw'¸æfÅzêÙ.ó!±ýeÎï>ž¾þÓÛ·øãßà8ïNÿøµüð͇×à×Wþ C Án×¼éßã}ØË8n¯¶2y{¥õ;V,ü’¤fk»KÛµ^-¿µQ¾Lmoe¤Þ¡ß¸·½õÂ! õ>Lý]6ùØßþÌb»ê¤}Ÿ‹nºï6>ó}9¥zÝÚûæŸçwoOß¾Û;ß’ƒ®Î‡ôÂ;ÎÌOøë}U>Ç_ 7ņö†›Öaj®ópÿ4ü?\®¾oËjvAwÃ5Ý~5ݶ$Ç¥4¶×l û1Rï'íÛ¬cpçËt¿‹Ýº«Êy}u<Ù> G“ÈwÓWï¬óÚœ{¦›ÞJûhžùã0¢®²À†Ü\;Í~œ¼böÌ -®‡Á£K—7Ͻ u&±ûúïؼ†Â`§ÛîkZYÒÅç­8ÿ‚ն؜†û,ƒmyŸÍþxщŸïÁ÷ÕyuÌ·y;ñ+Ì¡˜qOª#?qäE³”~Nž:ÛÓÂªÂ«Ñ å¶JÆæ}­¯mø/ÀVƵqüýPfŠ'öáŠ'‡°ø¾:¯Î“o'¸4xZó¢Ë~¦^çÌnœù?³°¶5±”x(ã§ûã¡7õ?%¨ª iê{âù­Õ¸ôIǺ;Òè>_@çûê¼:Ÿ¾ ÏñXbú2®iðõ1ϨD}b®[>Ö6…ì)çþoÍó!þÏkdö%ÆËž#A˜²â[ÑhÎg4Ÿne~ÚçC‹¯Nã¥F”ñ>Uÿõc®+þÂÅ?uöpg×æ¿þv~¬ùïnœgN¹ë’Iä-Ô|eÌM'Ÿº'·Ýí®æ åŠÿ/e¯¤ðà»m ̇+[;²àŸÖ»Õ®VŠ;ÛÃvè_p²›Œë«%=Sðôü†;ë¼:¯¼óîF‘Ù•õuÕ¸½ò6¢˜%—×2"÷~Ó×ߟô÷RæžóŠÃQ’"üûÉòÞKÚ1݄ۜî™óqTË}é¨kýVÈzÁëu^GÝÎ=õ}ì4»Ç‘ݘæ÷³3ǼGªG\n´5{–Õmiì½c‡5zOë³l‡¨ybª¶Ï*7çþBgäíƒÙ+^Ù3A.Á„ZOyå}u^W>‘=~þ,3P¯Ë:k»Y~¢þ5Ïm»:Êvö]É"—þ¹Ÿ¡. ·kŸ‡¾”ŒóÖŠ¼™oñÆÎß—÷ÝYçµy=‘÷)9Ï{‘i½/£ë‡HUÙGu½+L›x9Ÿ,õ]t›TžÍûî´·ãpZtãÃ¥ßüžžˆàuuèݼøûí“Þ0áAžr—lËðÁqsÝ'‹<á©Ç™ëG·gù™]1n>ÏhR¾âAÙá’ä©q½o¿ûëŸøn8Brç?¬[‡%aCç/ëVnM©à’ºe›XáUÁ% ‘é0u‘×u[(S³N¿È½”ëïÒÖö~i'×­ËÖŸ¸žÔ—#ú´êw퇭ïÁž¥0ÜC¨÷p˜ÆO§¸<Ýã–'_…—%°ñ,×ϵ“.ö¶E»ÞÙ ì† -]Ü1ú¸ˆëjmtZ>CØÞöE¦EÜËé—Óæ<_ð&’“oeŒY—;ÿeÞâ÷_'>ÿ¥>¸Æqo-|cëNwnzÀ^/©Þº!y€´Z…‹ñvp™»ŽzH>MâJŠö-û¡".ÆFq9tXºe;3Å!ÇNÚЋý> -endobj -742 0 obj -<< -/Filter /FlateDecode -/Length 3203 ->> -stream -xœí[M·½Ï¯˜³Ñü(~†|q#„øä %Á(€œCþ~^õ4Éê™·²V>äàÕbVÃWl²X¬z,²¹áìñó*àW“àZëµÈùòáôñä]Íÿ¶‡Â&þ>5Ÿƒ—êrè¥åóRuµçXËùz¯»¢­~=ýøÕéßÇgÂ9ºÞK ùüë;IrµÕê3uˆ|HD”³«5æBD%8 ±w&‚¹J”GQ…Ò[f"¨!16"jP#I éQÔ¡F¬A˜j„ž+=BôžÊ ˆI‘ÈBvF/Lƒ+­ÇNe²P#“¥äJ•“uWJÉɺäî“eè’ƒˆg2è"©U&+Ð%•ä© ºÄV“UèaNd ºÀ»•A_|`²ž\îM„Ê:d¾Õö(‹>»ÜRòL‚ËðÍDeˆ(LR©D¡Kñ¹StÉÉG&KÐEðÃdà‰œjk$Z£Fwò)0Y†.1V¡2è‚Ég  tñµ0 -@9å%ƱV'= -#Ø’“&±@lÝI­‰Ñ@ìÙIé•ñ@ò²$]²Æ)@AäRtI]¤]PqAJÐ%Jb\À¶oa\@·â{`\À·âCa\@¸PÓ3.H`ÜÔŠ0.H \¸Rg\À¹ Üɸ tî•qAë¦\"ã‚ÚMÒ -ã‚ÞM<ã濾'© ºÀ€] --1.ðn -¾2.ð.Â(2.À¬:øaa\_q±5ϸ@À»±ya\ àÝX±PYuˆÁĸ@À»1clåïÆì#ãïF‰…qÅ<ÍÀ» ÌÓè‚e\€õ²˜ 1‘–0.ÈàÝбü‘˜[¹Ðza\Á»¡aú¨¬»Paq·°² ¥tƼ‹…*1.Èà]Ðgc\ŽwXQ#ã‚ Þ +5“wCìžqAï"oÈŒ à. `\€õÍ×¥²î|oqAï‚–"ã¬ÂÎ70 •UG -Œ @ÆÎ#e\PÀ»XÞ;ã‚Þõ9%Ƽëi•A—Ô"ãä5!lIL#Yu>‚)˜ ¼ëf˜ÉÀ»Þ×θ €wuÙd\Pª±1.€‚Ypd\Pš¸^ka\Pº‡ )•‡rf\P=€ Ê¢2è"U ±v=õƸ Fè’bd\P#tAÊÀ¸ëÙ7Ý@¸ ÝtA¦È¸LæZa\PsÁ~ Ve²]« k*k…ʸ VqXŠãì¥\CÐ3.Á;M—@ È‚0.¨º T`)r-"3g²]d3.@¦ YŒ Z„.È´Ø°Ë,žqVhì%aj&¯ûÌƸ Iqš*2.@˜`§ ¦¤2èš`\€ùÑÍvf\€Í6›ØæPtIY´u»Ù´]¢Œ à›ºß¬Œ º‡.Èøt_œ¦ÉŒ @ãyϸ ‡†ýfƈKÝo6Æ=yì7±Å#qÛSÑýfe\кd¤(T]4u·à$ì7ÁNLV K츠—¢ûÍƸiö›Èèé‘@Óýf¥ÇàÝÜÁLLÞEfZ €ý&2[¶·÷ Þ\‘ŸqaÓg£'Ô›±¶Ò#îÅjUé™ùê‰@Mì,[¡§XV! žxð/ò1yà„Ûé“=¢*p‡Š5³UdGX²û¹çXÕÒÕnçc¿þ|úú ßóÏÿ9½ÿj;)?êYƒ4ÙŽ³ýáƒ`{ˆ¼¶ø -¸!3½ƒhzÔ¹–{p;µØÀËÉÀØ–‚‚zìõˆc7Ø6Üt‡¼vÔ6ºôbFbàë ›ìHïàœWÝÙeµ»à5’«A× WWË:̾—Ó˜è¶eMJŲ¦A‡|0Àù‚ßœè\Ö¾æ:`uÙÏ.QC1çS­“m§ÈÌ2ëÿjìhÇk¬náÍeÍ+÷¡jªÊpGX·Ï£.¾=€Zðч,Ž¬ixËì.èºB|¨qjƇjßù¬º³; Z*Ô‡&º½ºZÖaö½¼Dîÿ%r5U×çÇ/„eÖ™cøÀòÉ ;ØÍØþ%ø^‚ï|EÿÕóã—gŸUØŒØâàÙ/Á÷|/Á÷Ìà£Aö¼”ó‰€| ¼—ÀûƒÞ秜ûý?½>A³íR þïâDÚö:@ßÒW=Ò<¿þpúú»þúç¿ÿ€ýãë÷§|£‡aø|Då=Fç}nø`ï)oñÑïa/_ðA}‘UÎñ&×g7ߥ~ûÏóëïŸÐGߪO}T…û.·&óÞüO¬»[ó¡ÃæÝ W«ˆý²KRôAŒEßåÆÔFovÀ‡ëÀÞïƒÜýí«ðÍ­çmpedz1F'FiÆmµ!ooßïÛæFÝå{=m/—ýù½YgïcÓ}×u¶ïÆ—~S·²ôÏë¸æ³ùÖ–{k³^6 –52ÿVÿÛåb´o ÓÑùË®IÙU(‡¾ž’L¿Jûhs¹ù—¶¡–?=¶S’}ëõŠÇv6k½ÙuËÆÿ¨)ú§ôðËÊÛ¬“0"ºé5›â%–NÚ!;Æ6íîÚïfæ‡eñ¶—ÝVþöÿV7ííŽˮ¿õ•_v]Þí¶Îwº4£ßh{ÌˮnjšòIûʽ ,UÝ<ûÖö,Ç›GëwXÐGèë-⇓wÚ1’lÄlöñ7›luÌœNŠ´v¹,jœÏÈb’{Ý侌}òÆp7~÷z?ÜîLúsÖ;p¥ÇÞͱò~êøU>}0I¡÷Þ,±\™ùE“z¼}½ê;¶Zi(©‹Å¶H[§3©ì†Øw³Æ¼Ì9\m›¶=œåÝ­žÎÔæ"»©·©è7|[¢Êr«ñý~ú·þÞìndBåÐ~6!7BpŸÚ9†<Æð0Oe{÷¶û¾4¢^=÷ê{÷³¾ol>IÓ6C‡óOn×j?ÎZûM[¯—oôÅëí®)ìõ?nþ+ƒ¸2Ö‚íVœßàGaÁדފ‹¬å7`÷¯~¶%a®O»œBÒìë®fÊÎï_×"–òøó>ŸÇcú¶ -ÔGIcàÖ1ñd °ŽÞ»°Ãz³´¹´—ÊT¹{ŸàjPlÝÕàzð7á¼ó#èMw Ž2ô zaš®,pªnMÌôº±šéüxAö8Æ»Ð+Eõ>ÛhjX+åÀ’QªO4šsBdÎ4=_ùÑ´`2§ÜÌšÞ -¸m8’Ìz}Ô#ÐåDëí­å9SuÖjëÑ>,¿TY®žÚ4<Á.&Ñ«zUÞĈOãëÖeεoÆo∭“ÌH\ð¶%{¬Wø<\Ï‚É´;áæ—¿,[²ÝTÍé;Uý}£ŠÉâe²Ž0 ©«®1W¨uú¬µWhžÔWÒµ§Å¨1™Ákê)IMò8ÂazÝ„•Â†}&WZÐ%ÐÝ‚ótåë^zæªpöÑY ÆÝólwÁerçÕÂuÎxÐK.SßÙ®ñù^¶…Mîauý6:Ypôsµ[p)RXð¢Ñëhì¤÷Ç×dlŽœ~9mË\L9v=´KAïlÚ¬+œÿ‹:ßã󯓜ÿ2ñnëxô“-âäÖlW2½áß>ÖÿœacÀ(†öÚª›‡7Ìu›&QÒªkI‡T¢yÛ(Š¦Ã¾4;¨©i;™¦WýÅNEÒ¾LÁ¤ZLK&k™µMl…©‚8Ù‚mX‚í´ô!JqxýîyßU.#Ô>Ñ«EçÀ„ÇÑ´˱8לtÖÂÞe¡ÙV2±—f’³Bc¥r(X5h[í²íTvèt,“.€ùÍëÐ©ì ³l#nÔJuæ ýÅZ:ÛY™FÌvVÊC]mw¬x3[J3ÊÖë_5g.ÙVìÓ•U3 ì±o9ö=VÛ³†,EÊÊLýz,?Ôü"þû’Ø¡Gã¬ÖøÙNFB[×ê°PK¨)¦í/%}+"zÙ½J3G%Ï~æK/uÙž0NRò5èß¼r®ôߘ¦ÆßÃòǺ§Czžž¼ŸH_d„ힶ7 ÛÑ,VÝ*êß8&Mz›þiFõO¼ØÐc =v)‡#”íç€lò} -endstream -endobj -743 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 742 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -744 0 obj -<< -/Filter /FlateDecode -/Length 4971 ->> -stream -xœí]ˎ云ÝçWäÚÀ•ù¾ã.ð`| 6Üð]³èʾecP=@Û ÿ¾OPâCRè‘Uåžô¸»©>Bä‰Ã %Qúªð÷Æ‘ôc -ž®·Ï—/5§ð/§˜dõïñ Áé䣻~f CHÎ}¹à¿ÅaŸüåòãÏ.ÿ;Ï£¯fHÉí®ý‰Ud‡CPNP%¨”¶‚ʹ!ã¼ òzÀ)¦$©`† dh­ -0ƒRt’ -f1QPE˜a)h»V%˜a‚&I3trAPi;´QJÔÁEd Ónðht/éŒ|L&‰ºFÒY;ø@ÚiI—ｋ’Ž`‹KJK:[œ&R’¶AÒyØb½U¢¶˜¬¤ °Å u’ ‹°芢¶(¯´¤Kvp)‰ºŠ!®uF¹ÁEk•¤ÓzpÀ¦uð(t’‚ÎÀ¯\u°ÅYe$…-„?Ižp6Ä(x«aï¶ÊjIç`‹1DlAçK `‰¬ÒÐ-U°Å‘—˜ÀjØBð\Q[l"‰ ¬-H qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ]¸{¸À‚u­óFâ Úµ½Ä¼kI+‰ ¼k-rŠ:ØK\v¬ŽVâïZ­‚ÄÞ…‰ Ыpè%.V£’¸€À»&*’¸€À»&`ua€Z‰ ¼kNA¹Á»Æ)#qw /q€2€” €wA!N` VâŒ÷Ð+q - ‰ xW' ‚Oƒ­“—¸ÀwuD÷‰º4è€ü­Qç;‰ ‚‚À²Dl¡@ °’MQâ‚``‹5Fâ‚`` B‰  I#ú§°pç[)J\&b"’¸ 8ùZUÒy3ĺu:$. ÅZâÌ¥†§—¸?p¸$qÌ€N“Ä!Á¸ŠÄŠ†h™K: [dK\€H:­%.ˆ¶ ”¸ šˆY¦W`„Æ\M-éHñ<3J\É*J\7ÁLL)ê` hBâôO¶Ä˜ü`²‰iŽ¨ƒ-Ö‘Ä1žnF‰ b„-F‰ €Mžo‰ ’‚-ˆø$.HÊ&K\‡N)‰ ’Ž˜o’¸~ÉóÍ(qA² -óMLñ¿MÖó|3H\¶8„(¢¶ hJ‚ß‚“0ß;I:[L"‰ ’÷<ߌ ÌÀ|½¸$y¾Äåð®K`&IÞEdê%.À曈l¥¹½ñº€øLVFžqFqÅ@zÆVqÉ@{1ZqÍ@|yŽ$.ÀLÌ,£W 0¬B©•¸l À¿ˆÇhÅ ãêS¿D净13>É· D÷uÎÑ’ÙdãúØ_ÿ|ùùG ¾×?ÿíòü³¼RVþŽ4Þ6 ½ýù‚Áôq­ïÄ/GD¦ ±M—´ W¿æU‹,¼]:1¢<°ƒfľÌå˜ÕÅ,ïªÓˆ5§ÔmôÖI'~¹`²€éBì\M۪녾•ÛÄíL^:i;éVUk©}o—ÑÑ_ú2Zk‚T†5ΊpØÓ*c9¸+Cj]­1¸LK—HÁ8Ôó®FOs_÷=Ôu²TýK׌ýévÞ‹3b»S 2„B_P`‚›‹yö\Òâ×J8ƒPÏ!ÔËü°Ôê4›„” !ÕA("õRì|CK­®öò"„ª´t«ªµŽÔ¾·oŽû⸩ó¿ëú‡@²}ë´sø,;䦓õíÖ·ý7çûæ|ÿfÎçù_¸®Üá|Áýw 1Gö7çûæ|ßœïNçì¾sÃ!¿9Þ7Çû7s¼{BNL -Kž/”[ƒÚÜhnPCž4ÒÕ¤Áxà ÊÓ¬ò5yög¢¼´n¥ký!ÏKµÕC^© Y½NcÞ«Œõ¢­wçyw[I+¾žÄ먳zE#Zwªï#“êu6 NE´œlìÉLïhôzê?>\Уù.0|'ˆb¾~Å·•^ƒ¿~ø|ùù/û»_ÿñ·è­Ï—?ý‚WoñÑøäÛ/”2ÏJ9£}œ>7kþýý_?üpÑÀ‰ªw}×;oÐðW´†±‘«œ×òýwúÓošjŒ£ÌééÛOßEË(Žiá\ŠžF9Ú>³œ¦²ø$F‹§4·I==·´¥l -Sš©Ç3éžGÁvw›òÞš}ùØ7ûŠ=ùw¸£µÒ²µÔZ¥³’K-V•³i5Ap›jóS5¾/X™C Kùv²Ø±õqõqìû™gÕ háa¡yaåÅÍÓR ÖnSÙ©Ó=ϱÅ6ŒAÔÜ“Ç¡vî¹Koד}ç1J|¯Å6F+þB¨sÀÛc4µ2c4 -ø¤!%Çaö¼Â]|b(™°æ¬(ñåö}|žËóhøD“îá³²¸Y|‡†ž0ð4%ó'´iËJÇ¿í¤û¸HóiúžäÆLúòù4}§.íÓ×¹^ã¯2Êß \£Î¡ìdžAY3€ÛAYa¤Êf+:U¦”“þ©ë­ÒÊŸZ/1`2šl‡²Ò[qÞ+…!©cÕ‚¢šö¶Ïœ¹>³]vÖ ³¢M å,Ø6GÄ~.+6©+·©îÚ9,õH%?RÏåy8¤ú]>”¢Ë‰]èÔš3v¹f1vϸkÑÛnŒb\—÷6·/ÛQQ> ß½²tK_½AÍëjhÞ@a‹ýÈ™Aû1û(<—çÑPèÏÅ‹µgúEÝ-ÎzêÖeè©KìÉžK隷ԑCѧ1ÿ83™—¿Œ‹ûúlܶuÆ“ÂľùÙ‘˜ï÷ßEÞÉ<‡¼ƒrÙ“aÞÒ+ôu=»É6~KÑ­G˜-¬xGÙßb÷ó~(ÈŸ7\=­÷Ÿ2ß2Oßçy€²¥—Ý+šºµË³3¢“y}çâÍ£kí$ÍR–±“´Š~O<ÖÅŠÿz<÷OÞ@i‹ ‘ut7ÊÉ<‡Òƒøò쬣¿J¹˜m,‘Ƴ¢ ê½˜³8/ÌQÐV­»ž^pY¿ -~t·F -÷ßkt2ÏÃõîÉ..ZuÃWól"Œq[ßF^ÉæƒaÝÓx,é8O™a½åèü6•ûÔ壖¿¯«>eѧý8ÖÁ†Z®Ÿl)œÀy∼<ãyóñÕ_m>‹¯sy _Z„X¯í䮳îêd?ƒiåÝ:ùÌy,ìX—Ç…j9üЗ™l»M ÎSÞJY¿Ÿö ­ïø](>™”ºíE+Ž“Àf½iÙ¸bµwåü)8É/²ñj€ŽxïÜ­gàÌOcó–çs3NÌ_ÖÈò¶ Ó]÷¦<7—â—ߨñ¡ûŸÚ¨‘Ÿ¡ócúüÀ|š®°qZ?~ê3 ^Õ Æ•Ó©>~Z•óó5ŒîAþZ¾Sõ¡þbOy°¾žƒ+ç°êÆ/Ÿ÷€Öù=ÊceøEAWO£)ðã ¼´%]ºMç†ÖלùõJ_jªéKŠ_ÂÀp¯cê¦ô_r‡¾èD·Þ-"¿Eeq4å ‰_.üvÄDmˉ1 §Ÿª–Eºî`Qd7#oóH‰pZM?Û6üàøÓ¸r6œß•l¼k1©’Èæ}{ÇŠ!rz½óÙ«AOb~ÃPìtä«)ü {¶©OÛ -lÅÚªNèÖBÕU×ĆŠ=šw¤¯Mç›°šÞ7¤5¡ëÎ=áí‚jíRú"JyZWŠ*­kT•ÙΨT¥®¤¬BµŸïÓ´~§Jфάú®×xwøQ ¨¦K% º]ÄtSi®öT¨©bËšJË7SÔm¬ /ÈnÝV0_™Öùˆ²åç\Ì;œÔ¾V±ÃY oGÕ›8ï͵NíW(W × mWnGÕðÒ¤¼Þ4þ‚kï­ÍÿT᪔™'ÿÐT!Åûã·£V ûfÏ©—ûÊ:$µ€¦ÐÒvÍ¥C¨˜íÛ QžI·¦®-6“vMÖÉC*æ1IUò˜‹uE]3…•ö©\Ù U1Õ5±«P~™‰›®ºªSµ2¯;¸»ZnûÊ/½8Ô×ü²ƒjo-·Ã|ÞòÀFK1C?–JšØ¨:ÚµÊ:a3 ¤ÐÄF_²¸xke'~[ùÙœLqo—¿\ò0g¬3¼‹·šßÝÓG]úúw¤ùŸÿ¹Ðõ7eS¹q7ª²…©Ü:÷#¿é-žó›ßŠ°ºM'4ÔÑ~ëØÒº‚†:ŽÓñ5µìª{I©+ƒêªí…®µa'6ºFÛ®eÜŽð¶hÅȼµoÚ€=Úrr¼+¿f X…ƒþtp›Î¶!ùÚ‰#NÚ†thÉtqЊîÂÔ,›™É€ì+©MÏöSß–ëêº0‚mÓQfû¢‹,ŸE—!°íú‚I÷•¦™=‚ѯv¯7÷ûd²/ÀÒJíUúÒK뉱´ž,µùÐÏë˜có†6Åy[ Õ²lç{¶9Í5ZhA³ƒ£4¶lS×WJE6«´ •. SEVK Å&?e+Í’Ï8Š­jLѤé[Úõ½RÑõ½âWi¹Ü2âÕhÉÖÈõpíìTKYcÉ(È|Ÿ»J©¥´E¶®›æu—ÑöÚ5C|‹LUËæV)_ůñqÇI)UùË+#:¶×«` &¬±ù¹*z!~éY nWÍûóì¯l¿Ý£¯ Ý1µ*h~÷±l éXÑUÞ‹,gKJ<¥û@Xj4·ÚTç—_æuǼ@TOù]·–ƒÞȯè jc¿Ð²YC˜-¡ä¿*X¤ -endstream -endobj -745 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 744 0 R -/Resources 4 0 R -/Annots [ 746 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -746 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 593.554475 101.433071 574.804475 ] -/BS << -/W 0 ->> -/Dest (cb166-1) ->> -endobj -747 0 obj -<< -/Filter /FlateDecode -/Length 4469 ->> -stream -xœí]K$¹q¾×¯¨³€Mñ|†dØkXðÂù`ø0];-Áè5°òÁß_d&ÉHVdUvÍckM£§;#øˆ ~ü"ÈÌbÛ³Á×wÿe²SÎ%E:_~:ý|2S -ÿ曋Yý¾S8[Ci -¶ÄÎ?±À§)•àR<¿ðßp)‹¿þã7§ÿÙÖ±g7• ç¿~bù)å”LPT*c½¢ -aJÉ…¨¨¢p‹¥h*˜9ºV%˜A%M3ȹ¬¨2Ì𔬿V˜á’%M3l IQY;¬3FÕÁC䢳aŠpzÔtÎN1WT]‚Î&§é¼Ÿb"¬¦+SŒ1dMG°%c5]€-ÁM[Èç¤é"lñÑU[\N^Ó%Øâà¢è2lº²ªƒ-&«éŠŸBÉDª®@grÊ×:g²÷FÓY;`Ó«:Ì( RLŠÎÁ–hBQu°%xã4‡-„/Mž>å¬ÌVdzÛo5]€-Î%Ru°ƒ¯1€‹°Å¤¨QfÐļ¤q€Ki¢âH#—ýD™²Æ.—‰Rò ¸&Š%i<à…ÎY¼-¢ÆÞÂÂÌUu°ÅÒ¸À;Ø‚x[y <Ø–€ <è–L±xð-5.ð \˜i4.ð`\Ÿ#i\àA¹€RѸÀƒs=¸SãÒÅtOx°®Ñi\àA»žrÔ¸Àƒw=Y£qw½GMU[` ÀŽ“·Ùk\@à]oMÒ¸€À»˜FNãŒêF €•Éål4. ð®Ë†4. ð®Kª.M˜ƒ^ãﺀ[Ð"7x×ã4. ð®#5.P&ðQ³ð.($èélÁj\€xó ±É!-Ѹ €wmAøSæ4Øj²¹D x×f Ÿª+“Mð¸2oáåÉÆX4.à]*¯qAï‚>³Æàø Õi\À»Ö#Rk:ð®uÅh\À»È‚Æ€Ãd‘h\€ø6Y誺2™’³Æ¼ Zr -O&ƒIT]š$«qÈx2ÈC5.ˆà]„÷¢qAïšà½Æ¼kiªƒ->; ×@‡i«Ìi$«“q` -MÞ5#¬éÀ»Æ¤¢qAïrØÔ¸ &¸¬q œ; b¦©¤5.ˆÅ@‡”OÕÅ ×Aã‚d  ,U[(‘ÆH¬§âKÖ¸ 9ØâÓ¸ 9Ø‚”AãdS±È¾Õål\ÔõÁdŠ€É¦\ˆ4.H!b=¯jºè¦œ@ת.Cg“Æ)Ñ„Pl5.ÀZjʘô€à'N—4.€ÐYÒ¸ Ø‚©¢qBÑ”2sMga ’l éBg­ÆÙÁdƒd—±ÊŒFãDh¬%ájMG†×™Yã‚LqâTQãL¬4Á”ª¶€&4.Àøðb;h\€Å›Xæ¨:Øâi\³ãåfÖ¸ gØâŒÓ¸ØäõfÒ¸ Ø‚ŒOã‚bâÄi²Æ qèŒÑ¸ ØŒõ¦# 0/y½™5.(Þ`½‰%ž2o‹¼ÞL‚-)Šªƒ-HšŠ2oÁIXo‚4]„-®Æ%F^of f`½‰Œ^ÝȼÞLêvx70“¦ï"3àëMd¶ÚÚÞ€xCB~¦+3¯8³ºc`@½±UÝ20à^D«¤î/¯‘ÔM˜‰•eŽê®Â*”Ö¨Ûü‹|Œ®8aÙ}’[TpHˆ™9ñML BvßÖ½˜ß)¶ìýõϧß~Dð=ÿùO¯¿™wÊê—E‚0—&äW˜®`¸²o‹Û÷h~7ó¿ÙBøH6"•n¤-®›nl$Âÿ;_ÿ²±†ÿ0wï[÷Q|éžX…Ç*cù:ZüÎ*_Ð`ƒÅ¢mD_³ ‡¼ÒЦðï?œÔÕŠe´] -ó/±&Î~:ýöŸ¿ÿþÿéߣ¯§ÿüPXFñWäQ°ÛñODr¿ûÎB‡¥oÖ½,×U‡ÕÍ\ÖÑrÝä!»¬í½ˆ¶¨·)û@ Dö‡oYöãÒ/‚Do7®6¬íÌuЖ-¿„ý¿û¯ó‡ïOø°Êœ=Î@!–ý)Æ;Ø:Vås°õ5 …¥è Hµ¡Cô®¡ ÿ}›¡ú¯çûð¢üîÝjÓe…p\ÊÌÓ‰þÖa»ÜPx`¨p¤¹‰“ƒuž (XiÜDÊeñh€»B\G+¯?×ë°^‡°Õ³‡ƒ_un[&¤u$Í2*}DPÕZ·Ú°ÑUÒ¶Lí›í¥ÁÞj?÷d¹Oâ«»Lµm§ÿz_Ú½Óë`kõßem»ÝëÖöÙOn­¾QT@Ú[LvœŠÝFë±:O‡VºÍky; -ÕÃü0«r¹­ ™Vig@ÐÜÞ×B‚í¿·>̶Þ‘;÷LZÿÃ=KÄ…—Š2¥ÜGQ.nûk~»àÕž¨®‰8£ê6RÕy:¤ÞNêî¡qœÿMm„G NSËH¹³\#²!p˜ )ßrÆ5ä ÷¤¯]Döô.ð#j¤ñn¤?Vçéy''܉ºcÔo£V®e»üPÇ(¼õ-gÀ§AùÛA°3ï_/¬ólvwrÕ/à´¼Ùc´m9å‹Èõ¾‚åŒÏ‚ðôö<”åa©voE~°ÎÓ¡÷Nîzwþ9„3„¾gÖܺ‡1+Q|Òtq¸'ÕÞ4>°÷x°ÎÓ¡ñN~:fûÃZ¥yM]; á—eÑ_mûãÊeb_ƒe¿ŽÝAn~ÿÀÁ:O‡ÜÛyìçåX¿B -í—á×ÏÉ·oîŒ~ËÜá\ÿÀ^ëÁ:φ\,m;II÷èˆð Š. -ľ'ï®KªD[DÌ;ò¼GûºìâÏY£õ_ÄŒw’Dݶã¥ÅѤĥ¡mzˆý|•!í Uì™ÍÖy:¤ÞÉU?*¹cõ¢œø¯K”ú—¥>?'9­õ7´ÃåÝ»6œ8Ĉ±Î­=ÔVVÆ…{ã{úº+ÄÄ>Ϭótˆ½“ÏÞÙ}¾<ïó3™§]-ÞÍZvÐü@Ž{°ÎÓ¡ùvŽû¹«)ù¤sä¬#Om7Q˜úÏω䌩ÏÜåw•ó3ûË»üsÃi‹&™é|ý™¬£Øg=XçÙÐGwòÔ¿Ež{ÏNÕ t^­”.¢Ïgi_oïaÉ2'=¸â:Xçéüy{®¿J$‰½Áé-Ø¥«<|ôƒ¬?úl}Ç€ÄlgQ_ñí Wä§GŸØ¬ótè½óbè8ZêE{e\éԽφŠ‘£ä[!’Ã*ÚÜN›ïEü=ÛßùÆjÓ:èG1Sº{Ïk¥¼Wp°ÎÓ¡ôÎ{{ˆ«;<ÕÓ/!ã^ꀤŠÖ™d®Þ üÖ{¸¿æ'A䨆&gCº÷¾ý±:φÔp;¯ýû“ƒl@´×l [©÷“¶mî=Slr'íÞAë{°ë<Zoç®mä^·(Ù¼«iÍv_µFÀ]ö62C60¢–ß«ß¼5˜·åæwWÇ¡š×½në_¡cEͼ÷»³·Pg–©Ÿ9xÇŒs̶Ùæ$îSfBÃó³fÿÎGPÂ#ŸoúuîɆÛùëÈ_ãŽÒf7) -$UÏ<òÐ(%sýVvÖíß—•|%Qx…(+¸PØÊIËÕ -i¯¯u¸/À­^øµñ¸|.7Äóºƒäü«ótH¾ãze={õLè)GvxƶDžµ­K½xòzõ\ŽDvèÈQUƧßãg%nÌƹO]wÃ4*¦ã»¼ë<¦ãÁO~‰7 êgýÖežQõÎX·|$,m2³kL9ökœ÷ž%ï}fE{*ÅsxŒaÈŠoE£1ŸÑ0ÝÊü¸Í‡f¬þR#Š¼O¿âÝXËÇ4Yøù~Õy:üÞÙÛUð»ñóÏ`µ7]ÊVdn:~2æ@nûè' -÷öRH`·ÍqE|âRßkQ¾0À#@1íã?yŠ|z_,ćZ—ç‘øÃÿí_þôG±OÉOûxMמµôßÙ®yx˜­ íìÝ¥l`öy©w¶\_Éײ$ß býE”ß aÑQ4íSl$Y©,m²-ã2ŸVùZ§¯ÿ×úÒþµïpY¼|Ä­|¾PwëòÃf¼VÜ -ëÎ)æ ÿ³[ﲌ=`ªeq5)nl |žŠçó4W[ü:*a¾Ó¥ ¾Cûãu;Ñóa3| áu;³ç>®¶…ŽÃ;r޳ìž_Gº¢cö¼[æ¯bl ¹X”¶gtÆ^Ÿïun;uŸÏö›¥Lë»tDivÌuÜR®£wDîjw{m¯ãÒfì·õuËÏÙŒ¾˜ïåµ·F¤¥i‹¬S}6Þ¯´³ÞkOÖ17Ÿ¤þ{õ{ëë²ÖYëÚÎg?¬§£¤€ |2,ŸoRÄa+-,Þ-r' -^ÍR89ó×æºïÑ$‹ìói•Ä' idÊpwŸ–ðTá9¿`W—”uKÜ.¯VÌeê©Cò²ºnrLd5$ñO¿É ³²¾ZGë°Ç>ló·ém×á™_ÃËÛ©²i?T*êöl TÖ×Cæ{¸ÆŸOq>ËΧ"š˜'ëøØddg§©œù®Œå‰­ÃfgGÛóNÍù°éŸ[©õüiÃGRòqdËáÔâb-ÿó<à?ÍÁÔ•¿ç³bÍ,ή^tñÛ‰Ï -&ELÔƒÀ1 ×_Mk‹l‹)UvAž—¦2–ô¡žå#õWêÝpýP«ñNdj!?Ÿb´t¬Q3Úk1ß½™ì*æó–óä׫ØL ±Ú aodÙÞ`¯xWl½Âp-4¢».vTí±|>_s]ìÂfºtÃ_˺$†ó–ðrB·~”¾©R>åµ6U½ëL“yaTiÒPK¶¡6NŠèrR„ß™Ú4a0›^ŒŸ•·sµr¥–SD—“Znm-´‘J­TîUKõ|7¥CÝçæxEvÉYâäÅ1¾þºsÑÆ¡³ãÆ] /§@m&vñÛ)$¥tè\aB…žzÑngÓñÒ¥|~Ñò¦f•ñIcüÿB¡I™yæ_,5HñiýªwÂs³‰·N’òØX‡4XJ½¬p—M©aVúËf£”gÒm¥›Ç6Rá2!O¥šÇ$ÕÈc+¶ uMÌVýÓ¸R -M5ÝuqhP~Ûˆ»¡MU€½v­€{hívqlÜù&Å©¸å£›½­]ù*¼ÌF1C?×NºØ™ízgBØ )tq§Ñ·Y\gkc§ùÜ‚õ×>É´ˆ{9ýå4‡9çƒ+ø%zË'ˬ˞ÿe¾Ç÷Ÿèü¯õè¼%Ž;ÓØÂ5n݈e$ãsïóA1Ÿƒ_…mÚ¡#Aû]ls/*ZwNð5õê¦{-iƒÚ¦•ÂÐ}(Ä®A×Y/<n/ƒ["ó¹cÓöréëÍ¡χ.V«p!o—¹ë|ÉgÑ$®¸héÐ’q!Å¥è°tË6f2 e'Íõl?É¡ðÜ—¸i_ú®£feÓU6ß…(‚ØË Ù0YÙiÙØ£ýðôúìq_MŽu°´Q{“¾Ii»1–6ÂÓ¥~¾ŒÛËsü™/êäíjmy1÷|KrúÔè©m.$F…4÷jk ;¥*ÛtZE£ ÈL•µSµ)®Õª[æ;Ϊ—RË)ºô/ÒÓAŽJsb£¯Êr»5âµlÉ·(H8§~w¦—l¹dVdQÖnRê%}•]÷MÛ¾k´=‹Û nH왩éÕÂUɇø³Ôv!´RõkÞ±¹6‹@M6yçç¿drŒàâ#àe±Uòî:·÷N®wHêÞ‰ì Ã1‘÷&YþKPº oP”û -ÑTý+QzµbÔ[zŸvOí½VðÎÐü§@æÇ(óQ»L¼Tä¿üã9éÍü ’±ú¾ûúf¤Í›-”ùëÿ­ -Æê -endstream -endobj -748 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 747 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -749 0 obj -<< -/Filter /FlateDecode -/Length 4217 ->> -stream -xœí\K·¾Ï¯˜sÓ|_€áC‰ƒ1"ć i,ÙVäò÷ó»IVw×ÌÎJò+^­Vš®â£X¯Šœîvg‹ŸOþ)äL)5':_ÞžÞ¬ÉÑâOk±¹hì¯ñ›ãÙYÊ&ºšJ<¿eBÈ&×ès:?œðÏîR68}ó»Ó¿·}ÜÙ›Z“wñüÃkfQ0¹äl£Âª`YVŒ&g“ÂJÎ`‰µj,ˆ3y:²2Ä Z¢Æ‚ä}QXbÊ.YbøìHcA WcVXÎBç­Uyįð\4 JOÏ;“JõUåeð\ö/“2¹è4^5)¥X4A–X­Óx²DGd5d¡P²ÆK%¤`Udñ%—!‹‡vªÂ+ÞUTd±É:Wƒ‰µ©¼ -ž-¹yÞFKVã9g"|3¨³hXP(.5,@˜`§ ¤Ty0¡aìÛí¨a6?Ølb›£ò Kˆ¤aA)ž·›EÂR ‹·^Ãø&ï7³†ÕBT|T› —ÉÆÁ³VÂê -ö›ž4,@\ò~³hXPƒÅ~[<%nkH¼ßÌT‚,%ŠÊƒ,(šª·À$ì7N/A_Išï7‹†(3°ßDE¯ Þofõ¸¸+IãwQ™& pý&*[moo¼1£>Ó™…wœE=1°€ÞˆÜªX`/²UVÏ ,À—÷Hê¡ÄÄβ$õÔiLgÕc üE=FLXNŸäU‚;däÌ’y‘aA¨îÇžc6 Wš-çc?|wúô%’ïù»ÿœÞü®”õöÈA -˜†µ}…µßž lQ×&A~¹ 2Ý‘`º·¸¦=±Z4âå$ÈØ–{ìÖŽÝ`it1êÚÞZÈ&¨±A~8a³€éŽãl;¦“DšãNò\Ƀ ÎEÏ©¦v4ý^NßÀÐïäS›•Œ´ÆA‡zÐÁùœmÎ.lË\§­²Ëzv‰ìˆnkk˜š-M$¬¬Íÿ ô(×+´.ÉÍeųîCY”á¶dÞ>÷¶øt n|h’·>$騚º·ŒéçŇŠîCEøPAë=9¦ÙvL'‰Ò‡’êCƒ:=§šÚÑô{yŽÜŸ%r¹Tç?çãe7Úkx«äÕ ÛèMèþ9øžƒï7|‰ÿäóñÂO -,V,±ñìçà{¾çà{bð©Aö´’óJ@>ÞsàýÆï)%'6…&PâoÊsâyq³5mÓHíöRlI}Wù>}nïDùlÝGªçñAß—ºàL;ª Í¼Ñaßk}Hª¬OîóÑe-5ó—à¼1ßÌ« -ùXãG¥»ËöMÈãaÏï_œ œvGþ¯dˆJû.ˆoÑÈ|ž}~ñöôé_ýõÏÿ - ñæôϬu‚ZGü þ¾´6züFké5~Ëò¹ñÜ£ÌôÏÿy~ñå•9ù¶‰1'OãÓ:,† Šß ~yªux(ÐƼÐ{;žÒ÷¶oVQÒ2­«@€qSØ'óRø·÷‰¿Ä÷¡t)äbå¢}ùü÷ϺþŸÖÿ;=.³sÛ&å«…Þ¥>Ð׶¬À>­cŒ•ô~iöáyb_qãì´ÐúÑÇ®šK[ùmêkkãÒnmR–üMÓ^Ó¼º>3ìêªý¾j?5Û®í–6$ŠÃî /¯´UCÃgêìc_Á¢$¬'dišê¾VW¶—u¥i]bÚ¬ ˜O„áËaÈ´ø/[…ÇsßÇI¿Oá{vŽãÈêÞÐäîÖ}#×ôzYÆir‹ë%Bnêšöú ÷Ä9-™¶‘·!Ì]n!ËuTqnú[ë÷fó}å_m:‰Vû¤m›noê4tJsìX]¦Õ§»ý6íòqM{oü4®c:¡ï˜ùû‘ø ÊÛ¹'NtüU柎¨/·²qú¸¯D. -Ò[æú·yg®§Íq¿Îý^ç ê¬òù™ Ü·×y?ƒv]å#dã8?N!rWäýà rû·A¢Ûëã9ƒ|h‰á Ó_a‰9w;ƒ¬’úË¢ém¤¬hõjF‚š ’hÛ\Xíªg•eìÍ®#oQ}Ñêí£îdž áº×ðÍ<ô«ßÉ$¾yû#ä¡ã8ǘ½)G»9ûÇÉ/DZ{8Ä¥ÄAmžîù=î­Ð·›XÄö¡8×-qJbÛa>-¢Ö¹{®Ö0rù|S·e¿þØÇ8•VºÌµ—;d/+þ¥…ÞÚÜ84Š›C#‘7v¹i -­úB?"·ðœKŒM]Ϙ¼¥›l¾‘í¶¶¸(9QÍg7çá‡6óø^Kt›ŠûâE;D 㤓oo¯oÝŒÁ_©òílÅ°b¬•Oíó^§£ëy#…š±^ªçû.­‰¶KûCHG}ÖE5ãÒ…8ä-ÑðÀa9“üÓ—_þág’lÚØ¿ƒþBÛŠÅW§«ÉØÊ÷ßï¦ë À~H#…<2š–ol†Gh£½œrŽDœ{*Ù%À,R‰üvÝKŒâi7FÓKÙŽÓWÐx¯·Ivèp$Ý©ËÃ8;9¥®‡ÎßÜ?W—«…ÌËu­ôqöJHÀ”9‚{Û;Câ¾>?wH yù®ó”cõI ‰v&ÜÕw®×D-kö -ag¶×;×|%ÌÞÑ~ç¦c¬½ÛŠÚË–Ùîÿßu-ÞñƒÓüÕ?×[Rv¥<â¢wöùå¸(¼†’¼ŽÚG÷Çuã%¯n÷r˜e|3Æ«RósÉü0Tõ6«ßˆùµéÛER/8ôÂùX˜ò㮕,ÛMڲܕ ZßÝ"Úd¼£Bôˆ+ÝÙçC¾€ü1ê€êÒ-⼺Ùnõ²ü² èeû±õ¬=H “`übÍdr¾ðΟoŒ'¶ƒ=BzdHpŸ[Ö+^æóôºÓËîëó ñ²)6¹»¼lg…ƒ¥òOì‰ù'öÄ|'^ñ¦8ðLJÄtµGo{Ó}}~qÞ”nbÖG³F¸ž<ßýy²=ku#QŽ$˜çéÂþ$>Ôõ´`=ÝW¾yðL­‘oÙ͸˒_¯O3刞‘ßä’ª¯U<5ÜìÑ&xÕñQª~kÐáÁ›­ú0$¿Æ(”³‡óÔÌOþ]ÓüV‚¿ásÜÐOÀ«8ç]·”¾ëÛmOBÆÙçëYŸ7Ý÷©7K±Ät¿;UïŸ÷§àm¾õ„¼xäy4Æï'_BžÍÉÏûf|wJí V×Þb`S1ÎókŽÎ‰L`»Ô3?5[l ×Í暢ÝùJÏör¨w£Õú¾(˯àLJ——I‰‹µý»fð·'WÉ°þÛ1q{·‹mäâûÅ$?œøÝ>¤‰æYó#d&®í ÙÊïhà&ßC¸k‰BÊ®çù6WWËGûj¸ìÝø™K²½QhO.+DôLîHæÕ[ãV2¿©˜°^¥!JL]fÆ÷1 ɶsÀÙñQ² Vã‘hÅt“ì©Ëãøyú¡º4‰Ct©:'ÌßÛ¢òw/'LöÔ•ÊoeéCuíz;hAU5ö–à 4ì¤ø&ÓñÛ‡&sð…ÕøÙö…Xº#ÑhW{;…t9©íÖÑâ°T­ÊìZ»æ§(ÓÕCŠWhñP澉±¡Ü’ù«„ak[„ßøñrŠ4"q’ÛÅÇÖqb…Ýõ$1ˆq¹Øé/“šKWB³ÓøÉ`þwŠ8¨Œ<탣áRütÿ¼š“plòVI’žê¦Gy¶êr9Ÿ•úrÅ*ítG롱 U¨LÐsíâ1H ðØ’ÝðºAfëúX)‰¶ é&9W~اœq„j´c²ä„»Ç1î$§’œ‡Å¿ªaÈ;Æ>߉—–ØhOf×/}’Iövd»9™ NÁ -“ïûj9Ìa(›¿¹YáŒú8C Õßê¬w«V]ÒÓpõ-;êY®½º³K¶¢q™y«Èoê \ô~Á`¶WžÐ¢õ$p{„Ò~þŸ¨; -endstream -endobj -750 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 749 0 R -/Resources 4 0 R -/Annots [ 751 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -751 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 265.954475 101.433071 247.204475 ] -/BS << -/W 0 ->> -/Dest (cb169-1) ->> -endobj -752 0 obj -<< -/Filter /FlateDecode -/Length 3999 ->> -stream -xœí\Ko$·¾Ï¯˜sÓ|É"øÀAâ FŒ,’ƒ‘ƒv²²h¬sÈßÏWìæ£{J3#­Ö+8^A«é*>ŠÅâWénw´øùÂá?&g˜KNt<½?|8X“£Å¿ÚbsQÙßá7Ç£³”Mt%q<¾BÈ&—ès:>ðßîrnþpøûoÿÞöqGoJIÞÅãOï„EÁdÎÙF…UÀ².(¬MÎ>&…•œÁKÑX#fòtÎʃ -G1È{VX 1eÎYbøìHcA WbVXÎBç­Uyįð\4 JOÏ;“¸ø¢ò2x.{‚I™\t¯˜”RdG%ë4^„,ÑYY(pÖx ²„¬Êƒ,žsÐx²xh§(<†,°.VyÅ&ë4^ &&Ry<Ë™ÏyÞF9«ñœ3¶TN6)e…ç!K²±¨<ȃõ/@ÂÆNÄ™•ÓêåtœÆ‹ÅûL*²`ó5ð ²Øœ4À 2‚Køœ Ox†˜XCÏÅPÎAƒ_¢¡T²†Á:ð¼Ó€ XÈ)iHd!œ\•YB! ‚‡,h aAÅSа m Ö¢aAÜ’-N¼%ë’†€ 1­†ˆ8‘† S*`nvjXº8îYÃ‚Ô 1y `7' p7³p7ôTy¬aÐÑÇAÃîg³†ÜÅ1ò`W ì0iX[1žÙjX@À]Ï–4, à®Ïp*/œÁ aw}Ä4Ï ÜõÑz ¸ëÉ' `(øcÕh¸ ‰z8Y°À߃烆Ìx„%Dà®+pÊ™ZÇ%iX»Ž±}*¯—¡qåÜBËÆ¥T4,ˆÀ]8ª aAî>YÃ`¼GõDà® ðÔ¸ë|±Dà.↨aÌÁ8À¿gaº*¯[˜5,ˆÀ]À’×°^ØX’¨¼l`HNÀ±±ˆC5,HÀ]¸÷¢aAîÚ‚† ¸k aʃ,½†ˆkÀñUÎ4‚Uc=Bãw­Ãk<வ¹hX€»â65,HYž5,€€Q°×° 1™’sÒ°  B>•— ®£†Ù‚Y*²P& X› -kX=d ÞkX=dAÈ a"S¢o5=€,05? È‚HQà ™áB¤aAŽ ù´ªñ’7œ×*ÁsYÂœÉÀ; Kơװo$\Ò°b€çHÂ\ ŽŠ†pE†="sç ‚l é‚眆ì! ¢A Ø3²Ìd5,€‡F. Uk<²’g²†LÉH¨¨aŽ 2M ¥Êƒ,€ °?’lG ü ÙDš£ò Kˆ¤a³—t“5,`†,Þz `›’of Š…,ˆø4,(6 “5,Œƒg­†Å1òMOà\J¾É”`‘o"ÅSÎm IòͬaA!È¢¨<È‚ ©(瘄|è¤ñdñ…4,()I¾É Ì@¾‰ˆ^- °ä›Y-wc2i<à."Ó¤a.o"²Õr{ àñ™ÎdÉ8Y­X@o„oUKØ o•ÕšøJŽ¤ &2KNjÕnLgÕ²þ"£3LXªOs‰*Á2|&gYdÁ± D÷=çÍÂ#Í–úØO?¾¼ƒó=þðŸÃýoj¥¬ý8µ5!¾Â1ðÛ};,?$$˜U2ö”¶2i.C(\‹l"Üü;žØH -AETôF”$÷øh×y¬ZòÅ:ï­›cŸWè<ï­›cŸ—1r‹‚€â†ƒ­ñËn¾T–y‘;`=r0àY-ËèGøf0%~š$}Z×/QuB›P¼D!p-È-mÿîÍi•bù®£_º»1$äùž|<¾yøòß|óû?ü[ùæþðýoªH¸ä÷«ß|søúÍ@z™ o§ úåt2j•ë¹Îðõ·ùÓß¾f€F°¹pžëß,é¼0õ…?ºõoZÿ6z´–xi‹géíB—ƬÐ[Û°ô~ç-~O ÞñiŸÒÔv•… Bº[ûµëûižÖçn×—×ù×õtùN‹lu¼Óà×±ÒÔ7/;q“êiV½h[4Ò$³{M´¿²#ÿ|œ'ý,´æiÚi\)K·]¨”>§Uê´Š›6r{"Y„8«œaÕ~íó¢ÙE®óqR¬¡V¦ÏÆi;^åIU“äðõË"U;ÖRwº­OvÊËÉ7É’OE[d“ñe}ÒXì°¢n…÷ë<ÍâÒzm'}»U×ëþÔ¾ëºû>„!¯:ŸbÉmn™S[÷ó¢nÃ~ý±±žˆÅÒWzöS¿~=Ý ;/òU9ß®mîÖ>q9Ý4ÏåÖu­ó¸u\ kïÓÆ”¨k·«=5ýÜý9ÛuãJóûs5hÒÎù‹º‹{Ý-H°Ì+ߊ.È5ì¥Îá¦vëY’¶Ë9XÖ õ­k) ºÉ2ö|gg*ú‹§¡'º¿¸¦âvkZðdœ±ù¼Ãïl|nƒ°Šr$dñìÙùxÅOßØçYaϧðÌòU#öñVwͲu±9ædÚwç²lÁ£Ó!¶EêÄ»é@Uè®èÊhgä¬v7äóZŽpsl;'Ÿ‡‹ªðtí§ö­ÿÚo1çm ÐuÔ‡¡«³qvr̺ì:½¿}®&×ö8]îãì#& Ôj{)n\6ùÛú|n“òFù%3 B3ùv[¸‹á\‹+ -µhd·mïv¦÷vÚö†Ú;3ìcíÍrŠÑ$ð¼ ¼|öw¿s}Ä—j)÷‘pÊŽ¯eI7öy=¦ÈpU µ;Õ¯Ÿâ—5×%0[ÍíNOÆT?K^nøpy5ýòkp[5^-`Ôƒñó`Wn¯(òEænÒê­qäD¥™E”¯®nAµû|LÊý)ü¹Ü2pÁ¢Ä?žYŠßø%|¼Üƶá´‚òžƒÙÞR÷À2äÜ/øÅ:*Þý2ÁŽ25k“›®¨Òêkz[ŸWb¡Cl„ůó~ ~n9+B] st[9kŠ\?UIKô>µ¶7ž_+_iýîGò(ëxlœó¢Áíå)¹?g¨r ð¦ôÕÚM!¬ïäé\’ÙBª¶fMnŠgC‹s¬–9ó(>öñ[©Àni}ìî›E®´ÓäIEÞ2ú¼lé,¹w}ö´Ï+ó´ÒYòù19ìXËóJgçcÿ•Îí×ÿ‹,Ù1¦v&—ØÂNe¯‹:K{ýì%2EG·—Dz ;ùŸR˾öAî溹¶<¦Œökyì£ÊcYn劽½^ÎôŸ]fcùz3Çág,³m'½Tfcyi5#’§ ÈÊ ŽMïÆ>¯¤ˆÑãÎñ’Ö2Û'¤W]´(rç?yJô¦¢ÅüZ°Ø©‘f5~?[‹ßå3´÷úî×)YšqçyE‡óq+:Àæ¿[o'ÎEªÈçK™îNî vµÉÌ:¿—¹Ý'xt»Û·CÊ{1ÒYn½×œ¨Ë¿[ÜB=hXª‡9„´ª (‡±©x5î–3÷z×»q¸ª;IÓÁ( ÝwµNÛ•l¯Ñ,@³Îw·nåiä°›ñ[d’gS#9c[ÃÙ6~8¤ú‰«ZùvÐË{Ž‰L})Gyl…m ׶ÍUE»ã#=ëÛ>ôVë ¬<Ã)Ïï,os˜.ÖöꆿIíÌׇ«m%³oƒüp‡ëI!#±ó7’…¸~´},r‡í¯œMÙ·„˳ëÇVâ—>¶ÕHÿغÉC€1ß®ä ,+DôLîœ,«·Æ­dyA›°^¥.JLMf \û€4·ŽŽWÉ.؉ωvšn=5yœ<ÐÖU—±‹>«ÎMÛßÚúÌäÜwÜɳ’]Þ>îdóxªŽöd1}n“ ²·ÝÛÉ&â  0ÈF*¹ÖŽNòþ—öq2Íãž?ª›ó!z)Y¤àäÑÿ9êrÇÿ¢Í7øý׎nÏš-~ÜÛŽ¾cë†<{2yQ ßH–Ç4b?6ÑÓûƒìx´Íº÷~ÂkÝíöÖÒuu;ãÐáDöÝt½ “fââi§ÅÈ|ìÞ ‡½\†¶8)ËSŠM*\ÌËÁ%^.ù8 ‰+i:\:¸ä§Ž¸˜Åå4a’măœ'éªùiÞŠ sMS!—aðh¸ÙyèF««˜š óÅ<0¹yÒ²‘GúÙÇë£÷}9µ Ôíú0Sû„ÚO§†z™¶—Ýç„Z7k‡wh¨¦³z3ŽÆ-hs1ÛèDåÑmmçI©Ñ6“6GÑá4Ûh}ÄÜdJk·¦–ºbVµ”{L1¨?ΚŽó®t%ÆyWÒY[·y¼-…ÅÙœóX-{,É --ͽ;•FËÐhçsÓvîæmÓ2h’FdjG·xÖòYø÷œ³³ôÙU!´Ví§VF§³á¨ÉåàC}ážå”€!$ïLÉÄS©äÉ}.×NÎ+$­v2Ï„í0‚ÍN^¨‹ðF¹Î˜†j¯UÔ»«.éi -xô1÷s†T†ê»³jÑ»ˆúe–TQ^•$èeyÃO¶N¯ÍÒúæݦ„RþüØ¢ø -endstream -endobj -753 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 752 0 R -/Resources 4 0 R -/Annots [ 754 0 R 755 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -754 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 606.123057 101.433071 587.373057 ] -/BS << -/W 0 ->> -/Dest (cb172-1) ->> -endobj -755 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 296.981993 101.433071 278.231993 ] -/BS << -/W 0 ->> -/Dest (cb174-1) ->> -endobj -756 0 obj -<< -/Filter /FlateDecode -/Length 4883 ->> -stream -xœÕ]K$·‘¾×¯¨³Ñ|_ÀB^Ø2ÖXcöAØCOiÚ¢e@òÁ¿`ò•™Q•U5-i<®®Œà# ~Œˆd昳ÆÏW‰ŒJ)Ç@ç˧OZE¯ñ¯”X]ö_ðýÙhŠÊ›’?ÿÀUÌÞÆp~;ács9;ýí7§¬ë˜³U9küù§OÌ"§bŠQ{•ÁÒÆ ,ïUŒÖŒÂs–XÃG²´gEˆA9y‰1ÈÚ$°ÄpÛ³2Ä°ÑÄ‚&û(°Œ†Æj-ò ˆ&rV௔$ž5*¤l³È‹à™h%žs*D2ÞH¼¬B>I<‚,>k#ñ\çÝe:"¶×9ç¹_›E! -JçøßyÿåHH9÷ yPø}…Ö†…déwX›a?Á%ÞK$½·Ò»ÏûÜñÐ’(íã•ÞIÚ¡¦äygÍÜŤ&„†ðˆØý”T{gw×ìÜïl{Y®óî²"üG„bÙ‹=^XG…ßqaíw†ß}8ÁZn¿„ó4Íð,ìt~8ýö÷þï?ýõÏø‡×Ó·ÿÁ©N­šÓžüûš¦ ~ ´úÝ[übk2ß}ý¿çßÌýp¶8h¬ûᦖæ}ZªóuiòãÒ_Síž^k7/•êµ®¢ÑÒ‹Ç|ý±Öez¢—>ìþrÞëD«}sŸÒ°G›»áOjÎÛáûÖß×fB¥‡ÚMÕ¼¾Ü!zZÄ+b~¬e^jVŧÚ^ëËÔaÕ~Lm×æQ§µë?Ö¡³ºÝ¤ž×1Üg›¢.£¯4»Èk¾ÛÓ¸œ±·TÇ_׺+2Å¥_¾?Åcc=6s)}˜©\ZtÊe‹nÃ2©n ›ÆÁÃØò™&éÎ_†Žèõæxàê¯Çc©öÑL+ŽÕôûE\wtT[‡`q¬Êìü&Å#ÚœçÑ:OÁc4ªQL—-Gip½uFÔ½C!j½.ªé—Æù./‚DFZ]@éß|óŸøŸJeÚü×_6…Ëò·P™ÞJÿX§àjwHtælݦ»†MeòkkÚ´f¦ï?I­½ 9Ù´–å[¯S•¿öÔè]‚4]Ûfzµî¦¢—´n§`1õÊ«eº[?t¹kg#ç¬ë®ó×ûûjr­—Úí:F_Y9+ÊÉÁØ¡«AôÂÑ’¸¯Î¯½$º¼Öð½ø˜%Ò’¸i¦ªµ Tý®7Söic–§)oh¾1ÑÞÖÖdøÖ@5—äçïöåßÍ”e“³g(ž<œ8Îh• èM“»³Î—crœfNP¡MîçYáïgÊ‹/WMñ¥Ocw¯zÄñ˜N›ƒèÛêùætMÎZó1»ÛêÆþZÌoçóÍñÌ·¡6–]îŠà´ofä4<‰Kòö¦éÝYçs"ŸÃà 7,÷Õ¾ÐíæoµœÅå¼]F·¨â²Åý­4š¬–Ö7gk»€ß»É÷€õòˆÖÛ-3ŽÐ£¹ÊÝzs %^«õ&ÁrIåìáòl:¼i¹)4+LðB ñ/î]U¾4»á–Ý~¶MˆÖ•Õ“\ýr² ¢À‡j¬!Ñ6L\BCõo]¶;_µo¶# ]ÂÒ¶NFˆ·¢·5LáZK,´|Ž¶[ùi ÎíuÝø>•6Òf- Ñ}Cñ"ƒ®õ·ÎÀeêcÖÁ²*îQ|˜ÿmÓͬ·0t3ëlÆ“ëõLÆw¹Ö]´¶ýZ¥]?ôÜ3yÔá ŠÝè»·­×sSpãr+äõËd…ò)&‘ø¸eôšÁíÛésX3=ã-9H_“C±<—àÚ·}W†«¦[ŠMNY®Ò¯Y<§{2^ËüÌv0%/ÓqÆë¦îÂv|òÚY~g½ñuK_øw-«g ª,mýšjGõ»”©ki¨iüûussŒ™ïÂ:«Ã­ÔL™×Pç¤aŽ»j¿ðóÙãrÞ í7yÊ^YÞº”H—³Kq¹U`½áãAž°³upé›åãu~™Ã¯Q±_r Ûä]ic`„a"å;g0§DìÖ˜÷ˆIšú·¥Š¶îJ°ðΩññœ•‰.Ù#GûÎ:¿vŒ×=•@æÖh^¹TCäm¦ÊOáø•lÜœBðuå÷²´Ùe¯Mƒ·*¤§ô¬´³èg(}ÝKŒ*ÃøŸ Ô÷e`ï¬ó7¨Þ7 ²Uý×pbk 60D.Èw,Ö˜}]‚ä²à.R± a”`…yÓݲÉ쮫íØÔ’°ûv¶ Õe#:’,bkp1ÑVE²×£Ú ºvXRíã¾S9ëáƒjÓZöEæ5ä,qÖš¸¢¡Ã¤Îë¦Ïžû; "7Å`èü3š$¶güÎ ïÒ$6e,e/Õ~R“äI¥œ\¾¦É’ÊjGS»3L†M¿-èË{Úá(} Šw|+ÙË¡†}žSLö {`Vؤ'5øeð>J¨0»Œ+j‚®¨ùˆ>ç̹œÊLåôçMœ¾³Î¯½y`aðãtâ2½NÉ÷å{ÙL‡KyUž&Ú”OÝ€ÕwÉhk±ïS8‹db¶Ríþù‘(ƒi‚yïk÷åùRGõéH1&D¢4‹Æì=[ ?””Åœ¤–^~á9|9Zè%ý™“Rqp¶|6²?tÛ'ô°ÈÁü5Ëß?Ev6›ÛwëÅ&ùõx.Ë=›ÈO”_;Ðg?-K¤ pXv-×]äé@W½aÛR1zuh‚­¡=+Ôöð~Ø¡.)†—’ܤéÎzßÛAšvp£ô÷R—äE÷gfVí·Gµ&yVÏ*å%Õ·Œáëí4þx -åͦ¼G‡Tîö$~™ öd~+É™wȤáJµi3EÑæ|¥fyéགÄûç×R”i/jùË„ÿpbO¹$~øXyg˜.ädÛÅ ¿øq$‰ÆQ²2ëWÝÛbÚÐ.@(„mÛ’Xþº~Ç×Ü8³áÛh¸¾oÕøY~Ò­+O³/ DÔ fOæÑke*™ß»—”«W¡‹‚í=wâhæ²£ÁQñlœžˆ~OÔSwƒl©Écø=-]ua»è³êÌ4ý­¬ÓtÞ"^NèÖm©o"•ßöÕšjÚ…Ùhn*wªo%û„PŸ't9 įtkš0™?Í¿3e!¦fHÔËåVN ]Nb¹Úšï3{©4ªæ¦ù!Ê0u—ºâÚe:âùE¢ÓáÛ…mf2Ÿ ìsÍ'î댥;ˆ—“§¾ùíä£Pڬо™ÞLtS»œô°—A埖oXšÆoœàÏ*|§2ò”/†ºIñCãjtÂk³“×Jšé¡£Ià›fGEÛ1v›õÅÒïË3èöÒ]c+ꤲ‰sAªƒÇšlºÕu2CXÓOÇÊ™¨›èn}7å·yÈéûRõºwÌdî¾·;È¡cçÛLŽ}Æ ¿¨ËÛÛl¾/ec£-™M?µNÙê¾ÛÎ&â  0ÈFß -¹­ÖŽNüè^û:™´ã^NߟÊ6g·âgøv³×eÎÿB™oðû':ÿW{…ʲ[ÝÑÂvl]‘çŒßšî$óûP±/›‰hi‚ýA6i”õÍú>ní„×4ªëì­¤éj:w&ú¡Ã‰l»é–ç»fü âe£ÅîÈ|îÜŒ {¹tmpü8.¿|§I…‹y8¸LƒçÆ–|žšÄ[:¸d§Š¸˜ÅåÔa’­Ädƒœ;éªgùiž -Ç}M“Á—nðhl³sÓVF1 ì拹a2s§y% ôÓËë³ç½ŠÚ -`j‡öN}›©}`Lí€'S]¹ ë˾縒Ch‹wh¨·å¦µçº“3–Æp-hu1ÛèDM£Z-àçN©ÑV¶¢ÃhºÑz‹±Éjµ¦–2â$j)vŸbP¿Ÿ5íçYéJôó¬„]Yn·íxÝ[rÝò³9Ç1:=Jv_2 ´0×îT%]£íû¦ußm·=Oà!Hž©Õü®äSø÷ÌÚ_#•j?%3bÒxé?¼d¢³®¼G^§€!į”¦TÉÃunçNö’–;™{2üN-çt4ü?È"¼‘SSí «e-é1©¡sû—÷”WB—`IõËÈ¡"¿Þ±Ó›øŵQË/ó)i N»|\¥PÊÏÿîÊ£ý -endstream -endobj -757 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 756 0 R -/Resources 4 0 R -/Annots [ 758 0 R 759 0 R 760 0 R 761 0 R 762 0 R 763 0 R 764 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -758 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb176-1) ->> -endobj -759 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 373.781993 101.433071 355.031993 ] -/BS << -/W 0 ->> -/Dest (cb179-1) ->> -endobj -760 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 354.834971 99.933071 336.084971 ] -/BS << -/W 0 ->> -/Dest (cb179-2) ->> -endobj -761 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 335.887950 99.933071 317.137950 ] -/BS << -/W 0 ->> -/Dest (cb179-3) ->> -endobj -762 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.046885 99.933071 260.296885 ] -/BS << -/W 0 ->> -/Dest (cb179-4) ->> -endobj -763 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.099864 99.933071 241.349864 ] -/BS << -/W 0 ->> -/Dest (cb179-5) ->> -endobj -764 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 199.152842 101.433071 180.402842 ] -/BS << -/W 0 ->> -/Dest (cb180-1) ->> -endobj -765 0 obj -<< -/Filter /FlateDecode -/Length 4700 ->> -stream -xœí\[¯$7n~ï_ÑÏ X¦$ê,ü°À‰ƒ,²È y0ò0nŸÙEpÀ›‡üý|T•.UžÎØël2gN© EQ)‰]öLøùÊâ¿ÌÖä\RäóåÇÓO'2)þÕ›‡Êþ#~S8[âd‚-1‡óBðɤ\Šç÷þÛ=ÎÅßOÿö›Ónëس3¥DgÃù/oÂboRN‰‚Â*`‘õ -+“’ QaEk0ÄR4ĉY bpÉAcA v.+¬ 1<'ë¬1\²¬± †-!),KÃ:"•AˆÙ;…gƒ‰PzÔxΚ˜‹+*/g“ÓxÞ›˜Ø«ñŠ‰1†¬ñ²„BVãÈ,3i<ÈÂ>'!‹žTdq9y— ‹ƒvŠÂËÖ•Ud¡HVãoBÉÌ*¯€G9å#ÏQ0!{OÏZ`›^åaEa’bRx²D -EåA–àÉi<Y?8|ÊYY­NV·'o5^€,Î%Vy“¯!€‹…RÔ +È.iàR2\k à²7œ9k(àr1œ’×`À•`8–¤á€' ž³x‚,£†ÞBÆÊUyÅÖ°À;È‚xY{ <Жa-xÀ-S±xà-“x.Ä$ <×çÈx@.L©hXà¹Ø©aèb¹' ; ×€‡e«¬i«†BãwÉb†5p—( "pWܦ†1 Áe  Aì4,ˆ™MI)jX ‡OåEƒç aA" KåAN¬akS|É$Y¼s$Y2hX€ˆÀ‹è[Ý@˜‹º?`È‚HQà ™É…YÂ"öcЪƋÎä¸Vy<›4,H‰ \±Õ°{)“±è5,À —4,€àYÖ° È‚¥¢a\‘É‘¹Æ³A¶†ˆtÁ³VÃ‚ì ¢A ²ËØeFÒ°{I¨Zã1É>3kX9 5,À2ÁNH©ò `BÃÌl¶ƒ†Øü`³‰mŽÊƒ,>°†9;Ùnf r†,Žœ†°MÙo& -AD|ŠFÂd ãàiXPlÆ~Ó±†X—²ßÌOØob‹§¬Ûâ£ì7“†…!K@ˆ¢ò ‚¦¢¬[`ö›@'!‹+¬aA‰Qö›YÄØo"¢W²ì7“z\Ü Ȥñ€»ˆL£†xÀ~‘­¶·'oHˆÏtf–gVO Ðà[Õ#öÂ[%õÌ€¾²GR &v–9ª§p«`ZR ø‹xŒ˜°œ>ÍGTæà3s’A, Ftß÷£˜¿Rl9ûËŸN_„ó=ÿé¿NŸ~SOÊÚ…ñ{Ž²±v°/9vÁ|¯Lmf!(쳬T¾TIÄHeˆiŒë±›ˆ g ‡[ÎýƒÝ - ™Ej‹p¦Ž7c³`1[>êÒ>_é I;Ô${ˆäm‚)MjBà #Î]Síƒu¾¸fç~‡’4YŸ®óÅeEp€ÄŒE°éWò^á»Òyùw>~8 -y\w¿ûpB ï¨Z5§IOÞ ².Ÿ?üxúú÷øçü×?@ >¾û-\DƒØ€´õï÷ß|e+3ð1/Ÿƒ]ÿÆõo£"ÎKYØñZº©ÏúZ–¡ð'ü^Zo?Mü¼´_ëK¹²þ£ýÞO2Mý7Éy™ÚÊc,µ~k[dÊßüûù÷i¶ÌšýnîðãVq}0k§]!"”_…¸l…êeóV™­ú¦>ÝP€ýá:OêÑ÷˜ÜÒzÚ*˜¥ÎeUJ\µg5Èz`„'ð[«|hJ–>Å.rÛ‰^BÁzÜxh§Ž±Mp¬:¹%GL×ä 1–:Ñm|¢s'ó¤Ê&ÇΑp£´-²Iû!/õ‡±O†Y–ö«a}Zûú¸ö‹:üq|åѤ»ê¾Ïûú™Ö6§….zÿ­¿ÚV·ÁµÌd{µ½rS·y?þ}_¢ù=.îuî×Ï›E·€O_üßoe¶¾þnl|ÐÈ߃sr+¬£6†e ]¶õáã:'aèéŠý:’£CDÞAi¿Éóûpõ‚1"8‡½_Z‚‡ /!tµcLw5Ï×yÉ®Æ8ÙÄclÆ'›D²T°‰=¸°Çþè¬ïòn´ñõ?|ûíßýý¿ ¿Ó¦¹.Kùü†_7Ldoì3g1£…6©^îñZ¼†m {”XÖ4¶Ø4üt:«þù:¿Œê¹õº¨¾?Zº¼1ßR=ɬB7y€æÚÃòWxš—jÞl¥çñʺj[YÞ¶wuRÁ9{ îiÿfÑÏPú¦4o°­-¥œaF˜.²½»)Ùƒu¾DˆúE dØÀ%,h~0— D·ä°¶Ü'‰ñ+m L®{µ;.Îì o»«ÎÃOfr§WÏú`uJ;Íñ4“ä29«-&¸Ÿ2ïQ%ût¯6ö%„ ´Ú÷ûÎu/¢WjK8Ð`_dþ®†¼ÃÇ".ôŠ†øm·ó®þ´ë3µóÎh˜àˆ†>¼¢I ñ6 ò!MÂ!븭ö‹šd}Ô”kš[ëÇS»3LÆ]¿«RoO»;Ê"BÐÀN³—»>¡ä”Ý+À¬°aM/j8Ê 5|SÒPa#7¡Ó ]´Ød¹I”›š\O×oãôcuþÚþ{ÈËBõŽ¢ -Ï#ÒÞ-ßËn:ìXÊ›ò<ÑÊToŽ0’Ð6b?¦“`Öjµïö-)'Ó$æ}¨Ý—纯 x§=LE€I•fј{ÄÅHÒG‰œJÖZúø ÏáÇ{ ]Æístñ•YKûŒÅœÃ•±†·Éá+1åp7TC –õ®Ü‘£‘ z]Ë÷äŽö0\,Ö,7FÙé¹â¹Þ÷¼B0’šS°Ü9IÖ§•=Åmðz¬Î¯¼¢ähÂÙ9}ß÷ü²D„`ãÈí϶ñ‡¦Ùb3D6ï´Ú¯˜'?hžsœyìùrÅD²\Ê’éÄrãWâ]y¬Î¯ÇDŠì›²¤lª&Ò°¬Ü›Ú@&zÊÖïš|Ì0&³:Ôn“Îûýqºo®hŒŠdä¨R­AäøÖiësl)ÝÚ¨=áµ-Û·'¼öózŸ½öu½?ûÀ{-Ö´~–4„Wä…”)iµÙ -¿º½Úûò«~üqï­Ìå#\4à‚çýÒün–J…+¦t­·t,IÀÕƒu~5p%;M‡¹âÑ^€«m“ÏÂÕ±ö—+MªíùÊ3¥´ö… ëØò3õ‚î'Ⱥ¡û!ëyd)òÄÌðö°ä•Û€ ö†-L—”ôy¹Œ‘ÏîãÒ3â"—±ïW-îsld‚ÂldÚȼ0'ˆk@t©0 Ro«X¾Sà­|F»·¿vu%Ž)L÷*!_¿ê<€¹¤ž§šÍà|͘«–·Áü±:m0ïw#ê%sÉY?[±ÓýG<.ìN[}>»'}ùTç˜- Î2´MɺY±v_æ›ÇÍ+0& àë浚Q½}o¦4gøk·üÇRù2N‘´÷]§UßWL1`×ÖÍŠ ¹$ ë¶)>Xç®)ÞÈÉùY,2»[IÓAë1Ÿcµ„î—¡–k°;¦®wëV)ï•mñ.¼8œR©ö÷@&MtÉ˱ØÇ’”. 캻݆=Ÿ› ô6Gó«Õ¯Ñ­ÞœïÐu×ò}Úåõ&¿ãz™¼<ö¶Î1Yi¥ÍãWj(žgÅ/Ws4.׉6yI}ÞÙžÍ]²e×ÆŸ’µFž‹2uš½RÏÓè(ui×-ô3ä;)$éoB±×òŽíTTµ4峬r·<¨Ocœ"sµÍ9iM•79{M^c~-/êØö/™%óV½ïëúŒcL‡õ©%êºäýx›ü›ÄÄI-·WûjùP›¤ÆÉ«¶qhc¸ô…É;ל®ËsÍ¥"ê9cÚÚ«™ e•?¬ÑO³µöü¶ö­à¡u7u:»25y§Ù!ÕÈéV»%íÚukîY³‰®“5Q¨åö¼±Òðm;g›ùÔóëÄ®ÝÛUÞš—××>ê^æyië¬ÍÛe‡en‹wuM_&™ž[¢ë-[Yó!4¶£ª³ÝëQõ1e'ï~}ݲ;ì·­ù×Æ1­‘i>¿·Î㕵ÔÊôÏaꋶksSîÑκóÝMcÚÏa³ÅžÏ¸ÇÈËŶ9{À‹c“hüÆ‹"&ùë‡÷ýÿÈé í–½vÿoæyË·Ìüˆ{Žíüa‹ýÇõKw)œåè2˜‹+eú_?#¹[äΑHÛÌ¿6u¶»lÕíyš”·mù|®)ŠI¾ ªíï÷qU=Æ°}óñeòdkú îæ8·ûö·ámzN›§²æòìâ†öyÔþÖXa¶éMûÍMòlü}Y2[–1¦ñ§S¬_´¶õesMnÌònãe^ÊYRç2y¶mÚlU´=_©YßaöS/%ÿƒDò¦ù–{Öùa-ÿSðOr1›3¬¯ ¢Jή= òûI^AÅ -™yxÔ;d!®©·…ý–ÛÑ.'+Q×¾¤†ÖËûñÕ„ÐF#õC«&_ fj…|ýrìÒ±BDÍhd=»’å5^Ö§ØE ±É âhç²£ÁQñ.ÙzšˆáH¤©»AvÜä±òÚ‡®º8ˆ]ôYuvšþVÖ¥i:o/'të÷Ôw•*/jM5í:ê4? U:5´’}B¸Ï“BºœâWÔšfLfçO³&¯`Xˆ¹÷r¥•SH—“Znm-ô™J½TUKÓüe˜ºÏ]ñ -í2EºIÞK8­òíã–,OŸkʓݸñr’ïÈÈ倫Òa`…fz3ÑOívr¦a/ƒŠ­Ïª*,ÍF“/°Ëÿ T„Nä©,w“’—PŒ§Ñ‰¬ÍNÞ*i¦ÇŽ:¬i@rö슶Sê6;ëK¾9~,/ ÛKwm¨“Ê&z*M<©[²íV×ÉaM?+g"5!ÐÝ ‡nÊïò3ô¥¨wídî¡·;ȱcçûLN}Æ­¼Q¤ËÛÛl¾/Õ±ñž,¦Ÿ['ƒì¨{»ÑÙD‚yÀè{%·ÕÚÑIÞ’Ø>ŽE¦yÜËéϧêæœNnH£·ò‚¬9ê²çÿF™oñû'>ÿS{#ÃâÇu´p[7äÙ“Éëóƒdy½b#öe3O°?È6²¡YC÷ãÎMxÍ£: `o%mGPÛ¹31 Nd×MW¾­84n/;-ö@æsçf8ìåÑ·Á¡/ïòhRáaóàùá’ÏS“x’¢Ã¥ƒËnªˆ‡¹Q{ÞW‘c[BíÐÞ©ï3µL¨ðtª¯qûØ}Ž¯×òmñ õ¶ü´ö|rÆÒ¡of¨yT[ „¹Sn´M§ÍQt¸­·˜šLq­ÖÔRGœU-¥S êŸgM‡yVºÃ<+ñPVÚm¯GK¾@a6ç4FG£d%³B‹síNåQÒ7Ú±oÞöݼíyAâˆLiT ‡’/áß+kG}ÿ‰VªýÔ“›Ç;Œà¨%wÒùúZjÊ1CXÞ,˜8OG%O×¹}vr> -endobj -767 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 653.523057 101.433071 634.773057 ] -/BS << -/W 0 ->> -/Dest (cb182-1) ->> -endobj -768 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.576036 99.933071 615.826036 ] -/BS << -/W 0 ->> -/Dest (cb182-2) ->> -endobj -769 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.629014 99.933071 596.879014 ] -/BS << -/W 0 ->> -/Dest (cb182-3) ->> -endobj -770 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 558.787950 99.933071 540.037950 ] -/BS << -/W 0 ->> -/Dest (cb182-4) ->> -endobj -771 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 539.840928 99.933071 521.090928 ] -/BS << -/W 0 ->> -/Dest (cb182-5) ->> -endobj -772 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 478.893907 101.433071 460.143907 ] -/BS << -/W 0 ->> -/Dest (cb183-1) ->> -endobj -773 0 obj -<< -/Filter /FlateDecode -/Length 2689 ->> -stream -xœ¥šMo$·†ïý+ælÀt‘Uü‚ øâ FÉ!Èa=XÙ0f¬sÈßÏËîæÇ̼+¯×$5«Èfñ£Vqä/‚ï¯=~󮔚“]®¶›¸_{»Â®þ;~r¼x±ì¢¯©Äˇ&Ðìr!§Ëmï‡âZý¶ýó«í?÷mü%¸ZSðñòëû¦2u¹ä,‘¨*T╨bt9‡˜ˆ*y‡!ÖÊT0#f ö¬Ê0Ãj‰L3,„BTf¨e¯Ïª -3BöÆT0Ãט‰Ê ìðA„ê`ˆ˜i :]¤'¦ Þ¥RC¥º ÏéT]Êæ£gºêRJ±0Á–XÅ3]„-Ñ› ÓÁÓ’™.ÁM*T[BÉÊt¶ÌN%º[°» -ÕÁIâ™®ª‹µ˜Q]…NJ.Ϻ ÑÅ¢*L罋؛Juð(,RÊD`K’X©¶D•Àt -[ ßLNDÍ¥o Í»UÔ3]„-!d£:Ø‚Åg ¶HN ð ׸ÄrvVƒ1„¢ÎŠFPª³œ•a Ôè,ÕÌ8 â¡ ž@¶DKŒêa‹Ás©¶h5Æ ° TaK0e,PÐÖ°[ ¸5©ž±@Á[Ÿ À…™ÂX  ®–dŒ -äb+UÆsìd,P@îž ÔÕ˜c»j%1(¸«æ…±ÀÀ]U´¤:Ø‚ ÌX::õE ÜU/™±ÀÀ]¸Q`,Àª:ìÃÄX€½âB)ÂX`àn(bŒ#€ê²ƒ*c»!bìäwC”ÀX`àn° °Qø#4wÈÃØÀ2༇.(c^æÂÆ‚îúŠãø4hå|©‰± ‚»¾`ù¨®:Ÿ1ãÄo1ËΧT "¸‹ƒJ "¸ |Æ0ÞáD ŒÜõŠ“šéÀ]ª0DpqCd,ÀvpcÎ7ç[—ꪓZ -cAw¥ÀX€SØII¨.;l$ÏX;AÊXÀ] »U ¸+†°‡ê`‹–ÀX€¸:¸-ñi«NHÁtà®x¬0Ó»"¹2$p·›Œ)7A(Œ0Ð! -Œ©˜«9'Æ‚T:„|T—Ê‘± È¢:ØbÙ X»ªµ0ä[4Æ‚` BÆD®zDß4=€-Ø.4?0Ø‚H‘±$s¥š1ä˜aV™.W2pMu:Ÿ r6‡£Ø3 —rNÏXÀ».1À è¼1ä -[à*Œ8Š\ ˆÌ™ÎÃÙŒˆt¡óž± Ø‚h± „‚,3 cNhä’˜j¦3iyfa,(–\  à&È4AJªƒ-ÀcÖ§%Û‘±É’M¤9T[4cA)¡¥›…± Ø$0`o¶|33T-ˆø ª$×ÂdÆ`:Æ‚ê òÍ`ŒðË–oÆ‚ª‚|)ñÛª©å›™± l‰Q¨¶ hªÄoÁ$ä› Ó%ت1Ô”Z¾Y f ßDDO¯JË73½.wc™˜ÜEdš P@¾‰È–åöðÆŒøŒ+KË8 ½1 7âl¥Wöâ´ÊôÎ@ß–#ÑK˜‰Ì²$zk€cJ/ôÚ@À_ÄcöÄ„ãöi½¢JØgfÉmnaˆîGÎ1«é'ª÷c¿þ´}ó‡ïå§ÿn¯_í7eÇ÷³úÛ— ~pÜÁa_Ã5ÔRK»±v5†ûòaûæ»þö—üû_^·ý ‹ŒÙ«H,øÁ3€'ÖžãQF,å,#Šð7»ºýo“ù£ &f¯o­îõxFø-á=~Ê©ËGëý¡íõzô+g?»Î›ö>NÙ®GyÆÌ×QÇŸ¶/å½?;ÿ¦ÅÖs öîw<êííǘþüïËË÷Ÿ˜ÓºÎi›ÆñÊ×ij“Ý™Û^ÿã¢ñ^oÛêùÓü`§üõK‡q¶»Þ/ç^/˸.ÝÃÔõ6ûs\ú’ÓÖsÚïêå·¦®=>ÌÝ2¦Ç%ì[±oX¦}cœ§-þ\²ï^à(‡«ÀÙ)MÒk¨uñ¼æµpÚϨÒÆëôSÈà¼wæ~zöÞðâßpQ¼²Ý‘ãÅq„À´+ÌC=¨ylÀ°µ/g;íØ2¾žuâ\ž6½mÛuoÙ—ñýQ¯Íäî¥iÙ‚õ‡‡-ÒŸ—~ïïÝôVËs‹÷÷­¹Øs·´­ÏØÇ𴌷´‡G~O‘‘j!elwèà§Ó¶.õÒB2Äkæû²ù}¢ýå-÷O>ŽZç‡Òî'Zlz|R±Îúy?láL›ÿ‡²‹ÅGñmkÇFÄ8OÂgŠ›ð|”ñ.äñáAvÝptL„h™ü³¸^œ?Åíò½8=Ki˜‚ ¥á|¡­uç gÃß{•EŸ…²t7ÅÁº=¾%kcêÒÓשóËò÷º!/Ëù–ðº¡[}”Þ¨´]ùõWõÙEHÔeºU‡4öšcAl¬]7"üZú« ‹9ô˪µÄé–¾‘lÔ«½]7Zï|[+•G­2›Ö>óÓ”¹ÕµŒ‰'²}ŽNinŸ&.>"ÚïÅ©­@_kD±sß„'áuCoOâÛ3©'+$ö­· -uyï™ûeJìŸS×ì²v¶ß*â6òìÈÀ{³–:ÎÒì¤ùæßOÒ*Oƒ:ÆfÀ[žu—éò9=»Î—/Bê7èŽÚcÆî¤Ë”-ò\»y R÷b?vÝ7„õù¬\…Ò@wSÇV¾Ý‰§q¸*6{ï,ùe»ÇñÞ)Nƒ·UœÇŠûv0ìï]ö|^÷ƒÍÅmë—ÞɧÝìlNÃ…)ž½íâî­ƒNí³Íþ8Œ¸×íçm?æ‚ÆPñô"}]£.ùê|Ÿ_6»üµçQÇ9dÐ" ¶Þ‰×“¬}Z>SÜ>íÂá6‹0Ø‚ý)öeÖ}7Œs<„…×6›Ë{¯éAýЮÂ8çp‡±uƒ×efâÂëÃ,Ž@æ®Í<°¢öÁ¡mx· -…u8(–©Óy$_–W¢ÔªÎ#Z KCÖ—¢¸tX§ewf¶ ¹v2¦¾ÙoëRhëk),aD+êÔÙŠ¥ -B`] ë‹Í¯Ö;{ˆÑ_ì^xÝO“S÷€&hÒÛ*kÒ<.Õ½˜î‹ãÌÑK+tç34Þ¥‹ïér¦kÌÐÂî -ë]¤e6;+ĵSë²»NûA1p™tÙxcî6¥³YŸ–}Ä…ÎR1Å”þ¼Ît\WeLb\W%=Õmïí'Þˆ–t@qÝÎyŽNfÍK"Kkë!µYS»ì¹o»ï»Ÿ¶—e6 I32•Ù,>Õü"þ}‰ïmn!X­þ½ßŒø2oqP›Ïtÿg2))!Ö>ÌV–«’ßÝæí»“ç’~w²ö„åp¦*Ù· ä&Ü ¨¿­X^Õÿe7«B‡ôû&à“W¸üòvÿ¿|D£˜[ªØþ L[Ð[Ú§×Yøeî~ Ô~ôî -eÿþ?>56> -endstream -endobj -774 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 773 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -775 0 obj -<< -/Filter /FlateDecode -/Length 4239 ->> -stream -xœí\K$G¾÷¯è3’‹ÈÌÈ—dù€#ˆ‡qÛk Í"-øû|‘U™ÕÓÓ3ƒ‘wG³Ý‘Èx|‘SUîLøùÌá¿Ân)¥æÄçˇÓÇ-9þµ»‹Æþ#~s<;â¼DWS‰çByÉ5úœÎ'üwu©›?žþò³Ó?ö}ÜÙ/µ&ïâùŸß‹Ã’KÎ V‹\0X1.9û˜ Vr –X«Å‚1³ç#+C ®%Z,ˆÁÞƒU Fàì‘U!†ÏŽ-Äp5fƒår8Odò 1oð\\”ž,žwK*ÕW“—ÁsÙ[¼–”ÙEgñê’RŠÅâ1d‰•œÅ‹%:f²x…CÉ/A–™<ÈâK/CíTƒW ¼«˜<ÈB‰œÅ«a‰µ0›¼ -•\Ž¢Jp‡Œ=³dYdEX0²ûQsÌfá‰fëùØ?¿=ýü›ïùÛÞÿ¬”õñ(A -˜†µ}…µ?œ ”‡Èk“"?‚\™^‘`º·¸¦kb;µhÄËI‘‘åœxì㞎ª®4ºšÎ!×ÜZ+Ùõ¢V¢È' ¨H¯È1Ž¶s:MLsÜIž+yTÔ¹è9ÕÔŽ¥ßËé/0ôG=ÆÔ&@%c[“®Hwá{Žšo ‡˜2×ij‡Íe;ºD ñC·75,-¶ÖRF¶¦TjÔËUJ×äæ±j‰Ùv¡¬Êp{²TϽ-¾ˆ;šä½ i:’Ÿî,c:'Û¦áBd»)*h}MŽiz˘Nµ %Ó…u.zN5µcé÷ò)pÿ'+™ºü;¿ «µ3×ðÁÈ'ƒLëMëþSð} -¾ŸXð%ù—ÏÇ//>%°^±RÄÞ³?ߧàû|/ >3È^–r>ŸïSàýÄï%)'ŠÂ%p’?”³œ»ÆUÜLK+ùìëâ“—å­ª|MŸÛ•¨­ûÈõ<¾Øu© ni'¼›7:Ô½äC2e}qŸ7’uê(F’¿'É9êÝz½³Ï›ëUÏ{¯^ïìóæ²ÊߪBNì®ìi -ù\ãg¥»+¦ŽÆ—Ó¼Í{¯ñïìóæ -ÕóÞkü;û¼…¬Ç³É_¼;!˜Û €ø¬¼0—ö§K¹£(ËŸ_Îï>œ~þËßÿá·þ=Æ|÷þô×ω¤€ äÚ7Dþ¢Xˆ×,Ÿï×Ϙ¿øÛùÝ—'‡Õиyð³y©læÕŠL¹Ÿå‹ÏÜçÛwÞf,+-ºí3mŸ¾I"máÄ_­tè¼]è[ÛÆïcú«9.ø%E/û¹!ÞÚ¿ÓÕøcl‘ëAµ¡MSnöim/sÜ&kšrjù›,÷ë¸^ë˜ë*—XLÏ!ãÓWÐóÕzÆÚiê²Y\dºlÖN›IÏ ¯Ff‚ës‡ÍF1mÞó~Ï}}'ù‹˜Üuu§é¢ë7µuÜ’#û§ä ¹ÑÿXŸØ‹LÙäî»DŒ`5Æn¾zYõÜäÜÖÛÆt«/t߸I[»4ei¶»¨1úõÖ‡Þotµ¦½ï+¿¿î;ü«ûßUDÛº­×ë_ãa?ŸÈÞõ*ë±õ¬ãqÒg N]Ž¶ÛØÍŸã\ çãzö~¿¶|¹Û^BßÖÃI­q7÷-]gêjàƒÆ†MöôB›>ãKæàÇnÿtÛ'äÎã>†´•ës—í3«XÊ·ùÎßÔO8èçÆzÄv·Ö#ü.ì!.lx}=&¯íš|îoMoÛõ°oó|µñ¶6q¿ËÔx›/sVzÞ|œ¯ír°ëM}Ń¾”žš<WX·OšóiY»Ïw\BH>ÊÞ‹ß÷ëg>r7:d—í3o<ÚxøðéóÊšì+‚»þa¥5¹ª’ërŒãŸòáè¦.8|ŽŒý{ê\àŠ¦“®¿t…3Ê?âEͧ}­xè±õ¾˜§N^ç7utÀêç⧭¹NßÞáàæGÍ·º½¾¾½^î×Ó:~e·Ú%^ùrÓ—Œÿ´^oé‰8ýjº9—«yüæ‹ç{þñËw­Š£4ϼ„ÚJHyÚÁåP|9; É- T•ÇKû¼ªòØ -ŽÅË}oX/&òrŸ-‘j!¾®B÷YWÕŒKâ·yǵ(ùÍ—_þê×RE‰¸ÅV*ð¥§îÛTª¾áÉ kZ¨Ê£WötÎmàS¿}90dè×ï÷×p·Mq”d¢Ó/äfáìBqÙ,Å,'iúD¢ø”ÅvfÖÊPy¬ En·ƒÝt ;ûüh(ÂËKŽÕ§;÷Úˆ¯øäÄžäƪ¨ öGò}Ïë5ëVGzå4—½S5Þkîóý:fmÛÝcë#.¢êÝ!©±ïw^D¬š¢ó¶ón»Gì™”BðŽîv•x¬Âä™–*w_MÚ,û„Ó§vc`s`yî Þé¨>ãôwöù>Ça?„ï'¹Ïøiߧ‡í7(ß×çNùLVô°÷]¾:×îðÝqt!÷ˆûš’¯ÏœH©³¢8åü¡Î‹Ö\´çÇsŸ¡³-§_ÓU½»—«å:4é‡:á¥çGwŸ e§üW­+¿ûæYT×wÏ—”Õ™Vç¯ùÜ6þÃìÿ¶gO9²œ]+DxÝÙÓqœ—=a;xJškyÝÙÓqìŸÖÙ“<0°_ÿu-7jr3iwîÔëZ¦ð°­-ª±ýZ¼ý9’ÿô‚ó¡›z ×zûÿ;Gº-ãëΆnê,|íÿêikÿ&çC7õ”¯õôÜ9R;Ú®=d _Ó½Æ~4؃¯¬&O‘¯ÄÒ‰G»ÚÛ¤ËÉl·‡¥òhUf×Ú5?E™®ÊP¼A»¨Sž,¯VS1B¡Ý“åaØšŠò ^N‘G$Nr»‡÷Ø:N¬ Ø]Oƒw M™Ô\ºªš&ÏàÊÿ+TÄAäi_—’çèçÕœDbs÷JÒô4P‡- 8γ­R—Ëyø¬Ö—+d´Ð­‡ÆvT¥2Eϵ‹' 5ÀcOvÃëY ¬ëg`¥&RÓMr®ü¸#O9ãÕHc²ä”»Ç1î$§šœ‡Å¼aÈ;ÆU>߉—¶±ñ5Y\¿ôI&ÙÓØíædŠ8(Lò„ÑÇFîÑ:ÐI^ôÖ¿Î ³vÜËé»SÛæ|ˆ^’圼ãGg]îüo´ù¿?ñùwýæóu÷4ÐÂlÝ‘õN&o„+w’å q8ÂF=+ØŸdWfÛؽaìãÞ+¼æÙ&°÷–n ¨\MŒS‡Šì‡ëz”fâ âåJ‹#‘ù¾¶™özúâ0M×t©p¡—ƒË2yanÉg5$®¤éÜÒÁe¯:âBŠK5a’íćԓ Õ‹ü¬Md.u¡Ò¹ “Çs›ÕCwZ[…j‚8è =0;=iÝÉcýêðúÞvßDN=„: }P5u,L¨ðljh—i9öœÐþ$ÚƒwjhŒTì…‘äÌИ©ï.´*j™Ý¶QOʶ›´o.@£N#æ.SÚºuµ´SKyä“úÖtÔVJŒÚ*éÐVÆí;ÞÈ–ÂH€¢vç> -endobj -777 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 488.554475 101.433071 469.804475 ] -/BS << -/W 0 ->> -/Dest (cb185-1) ->> -endobj -778 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 427.607453 101.433071 408.857453 ] -/BS << -/W 0 ->> -/Dest (cb186-1) ->> -endobj -779 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 115.110432 101.433071 96.360432 ] -/BS << -/W 0 ->> -/Dest (cb188-1) ->> -endobj -780 0 obj -<< -/Filter /FlateDecode -/Length 3952 ->> -stream -xœå\K$· ¾÷¯è³Ë’H½Ã‡’ bÄÈÂ99¬Û;6‚Ùëò÷óQUzTû1³³Æ:žAÏt‘zPù‰dWµ;Zü~îð'³39—ùxzwx°&‹ŸÚbsQÙßâ•ÂÑYN&¸s8¾%“Jð)øsv97<üã³Ã¿·}ÜÑ›R¢wáøË[a1™”S²Aa°¬#…‚Iɇ¨°¢3Xb) b„Äž÷¬1¸ä ± {ŸV†ÄÉÑžU †OŽ5Äp%$…å,äpÞZ•A,3y…炉PzÔxÞ™˜‹/*/ç’×xD&&vÁi¼bbŒ!k<†,¡X§ñd ŽÙj<È”“Æ‹…"Y•Y|N¤ñdñÐNQx²Àº²Êƒ,6Z§ñ -™P2³Ê+àÙœòžçm0!Yçœ °MRyð(lRL -ÏC–hCQy%õ ãWã'¥œoõâÝdÉi¼Y¼O¬ò 6_C!‹MQƒx\Ò0À§d¸xÖ@Àg2œ9k(às1œi0àK0KÒp€¬Ï; ÈB–ÀQCr…á¹*²Pa ÈC4а€²x& hË° p˶8 xËÖE € 1­†Ä¥YÃ䔊†Ì%`§†Ð…»' ¨K!z °Kœ£†Ü%vVÃʃ,0` €Ž†\& ¸KÎ& ¸ 7ò`W ì0jX[1>g«aw}¶¬aw} ò’’† ÜõKÐNnà®ÖkXÀÀ]Ï>jXC1À«FÀ]@HÐÃÈ€Õ°ç=xž4,À`Æ#,Ñ° w]Áñ§ø4Ðʸ\¢†¸ë2¶Oåã4®ø-´l\ŒEÂÜÅAEà.à3kXŒ78Q½†¸ë'µÆî:_¬†¸‹¸!hXs0€†8ߌ³0]•WŒ-9kX€»€%¯aNac3Då%CrŒEªaAîâx/Dà® DDà®e„=*²Pö ®n«ø4‚Uc=Bãw­Ãk<வ©hX»rljX“|Ö°DÁ^˜ٔ”¢†±Xðò©¼hp4,H„ÈRy…kX€ÀÚ*YÂä! y¯aAò!ƒ†ˆLqˆ¾Õô²À\Ôü€! "E €d&f RˆÈÇ U½É p­ò2x.iXÅNÃäR&Ãé5,À —4,€à9Ö° ÈWÑ°G‘É‘¹ÆsA¶†ˆtÁsNÂì! ¢A ²ÏÈ2£Õ°'4rI¨Z㱕<3kX9 5,€› ÓRª<Șаû#ÉvаÉ’M¤9*²P` rö’nf r†,Þz `›’o& Š…,ˆø4,(6 “5,Œƒg­†Åe䛞5,€_J¾™5,(d‘o"ÅSü¶P”|3iXP²„(*² h*Šß“o4^„,¾°†%FÉ7³†3o"¢WKYòͤ– €»¡™4p‘iÔ°È7Ùj¹½ð†„øLgfÉ8³Z1°€Þ€³U-X`/N«¤Ö ,ÀWr$µh1‘Yæ¨V p¬‚é¬Z6°À_Äc¼Ã„¥ú4—¨"Ì!áÌÌIYàŒè¾ç£]h¶ÔÇ~ùéðžǟþsxø¬VÊÚ¯ƒñGI¬‹¸/ØnÀ•©Ã1LÄÚ^Îò=£‹ˆÊÑ×’›ˆˆƒ‡m9ö7n+0ä‰B™º.ž§Ežà°QUIŸÚåÅ%… ^ˆÜ¶óª2Þj|S:’Ÿãþ*äØÅ ã:ï½;gŸWè<ï½{gŸ’uÒÀèA–Ÿ ×ûú¼¼^§yïÖë}}^\Ö˜äƒ[Ê=Nu«ñ :Õlÿðú€¨bùD#§mÆÑê#àðxýîðÅ×ßüí/ß}ƒ…¿~8|ÿ%Ž:¶6dkqDX>á}’Üt‹Áã”ç²ðø "—¿úçñõ«ÃׯëÚ©ƒ^–…ؽÔæbàSe®D“ºžØåY[º* Gò­*^‚5œÀH³aDçšã6ë¢À~é(tÈ„JûêmUäŸ_½úãŸþ>)ŸLpøês÷¥(kù/Ê«ô¸Òy¥'ü¯j¼8±G†VÅr6±Ì%$ã†2¹Î]ç{ØÊÁ3ïíÚ>oyÜ®¶×UÖ/·ë~¬o1Žµˆ[y§I6;Ý̧›ðEËuR5°È¨›.Ì6ü€‰´"Ýb¾¼š³h‰ÂrâjæuE‹îǤ^êÂE*0g“Ö½`ò.•fÀòÙ ¬ÓÉÛ«6gŸAŠbûåŠíÛ7ë‹&Û_mEhb'ÝfÒD§­ív›‹g×nö™sÛFí$¿œ,É“Ô²+Õ’\»Å«ù‰¼+v¶²5ÿ «…ÕõˆõýÐ|}€é†¾¶Åõ%V+VY6Oó¤‰ÏëûÄcœ:OX|¯Ëd÷c-{s¶/qÈÔÛðJ_|äå†Y¹ß·µÓú -ÓÞ¯×u <¼Uæµ?´ÃhÈÜûÙmûêݧÏ2IamãÅ: ïžÇ‰$Uù¤k?Ž]×µè©êêŠ$…3];Ö²ÑÇi¼Šlò‰g´Œ G»Úëi±“*çºÞ:¦[l¤íqmûvÕÅ*S³«n ‚€Ê;·Å‡•®‹ýO6«Øñ²ßÍ.›WuÎ×Ïk03Ï·`Ç:_¼¤çu^ôqèãÄ?Oƒ¾÷Ñe ’Äfý­õœ¯ÿaá]’§öñÓ>ž÷¿ O Ü<ëzvn¶‘«ºM纽hKÍFìä§nœÀMÎJS1kÆ«Uoñ‰ötÃŽ»=…5fj¶pÅk¼Ól)ÊõU}•¾â…)*©ëLkìv¿Äh—×#{xm=Î9¯¶l•1yiWçt{_o6Øì±÷‰‹î+ÿÍÚ&,ã/2]Ó»žÜjëÓYpnC.ìÿ¤§*Ï›3œë;Æiúëçbó ¬ƒÀóa‰0ýÃòŸ¤_|‹Ökèlj.}07­±ÃŸoϼ*k÷Ç«ºÚáûå˜ÁÞ/x»?O8ò$wóìç«úhº‹ÃÏm#4ìštzɾ›_‡ù[®ê,ç3i……K™T@Ò‘K­îÈk.QöùF&ugŸO¦|Po}p)»øäòAO“FX~qBÄ«¶È§þgö²Á - >6sxF9àþ^ -‹r[˜õµú°l$lRy»»ütgŸOÆ€°§OX y¿^ýi;ñï¨þƒ3œüéW¬?m'½VŠr³ÑbÀwןîìó©ÕŸ¢Ü»xÙö?ùúS¢h2LØ=¡þÔ ð#ןÂY>Pi~;gµÚÓÊ£‰?Ç/\‡šë?U^zJMªÞ@Ô^mäEëK© úØxéóêKûqžV_BüsI;Öò¼úÒ~ìßW})‡óõŸû -5ÙWÿ –å1mÞš‹»'èñ“®­\Õ]ÚéîEj0ö7^W¹ª³²ÓÙ³ê/ó™g?ºÊµ5w¾æ[õ©­ÐiýŸVž]y´ø¤O ÿùu™{ÎÈ­ï³qø¿¸½ØÉí:ÊUípø·Wo6üáu”«ºÚaöÿg½¥ÈMÉ[¿¹^oùv½/ ä1D¹G­Lwöõtáf“ÙÁþ>Àv_ÍÑÝq³M½0¤<ƒKùè‘”$·­járuç·‹ë÷M¾G=È®1B Þ\Ì6:Qóè¶6ó¤Üh›IÛAÑá4Ûh}ÄÔdŠk·¦–ºâ¬j)õ˜bPž5æ]éJ ó®Ä][·x=Z¢…ÙœÓX-{,™Zœ{w*–Ôhû¹y;w;mÓ2xGdjG·°kù,ü{Žï¨Èh­Úo­Œ¸<žlÄAÍ.‘§úeU6Ç aù¾Äy*•<¹ÏõÚɾBÒj'óLØÃD69ùÚ1]„G0ÊmÆ4TûJ2½[±ê’ž¦€‹ˆê3Õï©/×Q¿L’*Ê×L‘½Y¾#Yýñ¦ZâúÉê\B©¿ÿ÷ú¥º -endstream -endobj -781 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 780 0 R -/Resources 4 0 R -/Annots [ 782 0 R 783 0 R 784 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -782 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb189-1) ->> -endobj -783 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 458.176036 101.433071 439.426036 ] -/BS << -/W 0 ->> -/Dest (cb191-1) ->> -endobj -784 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 397.229014 101.433071 378.479014 ] -/BS << -/W 0 ->> -/Dest (cb192-1) ->> -endobj -785 0 obj -<< -/Filter /FlateDecode -/Length 4580 ->> -stream -xœå\KäȾç¯È³ ǃñ °±;† nxƒ=tewÙ0jïÁßCñ’ÄTªjjÆlª+EƃÁ ¿ )¥ÌUãçƒÿ•RŽ®·ï/?\´Š^ã_i±º(ì?á7ú«Ñ•79$ýž .ª˜½áúrÁ›Ë¹ùËå¿qùßusµ*ç`¿þã+³È©˜bÔ^`e°´qË{£õA`£°Äœ%Äð‘,íYbPN^bA ²6 ¬1Eãö¬ 1l4$± †É> -,£!‡±Z‹<¢‰œxÆ«¥‰g -)Û,ò"x&Z‰çœ -‘Œ7/«‚O ‹ÏÚH<Y¼!Ò²KQâÈâ‚Ó"²ØÄ‹ÅB;Yà%ÈëJ"²è ÄËNùœˆD^O§˜ö<«½òÉ9-ñŒQ¶éD< -›¢À³%hŸEdñN[‰ç áGâ'¼‹) ÞjÙ»vFâyÈbm$‘Y°ùØYt Àƒã’„6FEÙ’69E‰’„6eE1: löŠBŽ8mÀ³F§!‹§ !3…à¹"²¸L8 YÐ@Âç ‹%'aÚ¬E¸%„xKÚ bj ×¥@8@.L)KXà€¹Ø)aèÂÝ£„¨ë|°8À®£$,pÀ]GFKX@À]çÐSäA°„@GåLrp×%, à.ÜÈJX€]U°Ã alEÙ”´„ܵI“„ܵG€È‹ ->è$, à®õX‚trw­×VÂîZ²AŠþh1îB¼@¬„8ïÁ³N ¦, ­J¼`UŠ€k‘—À3Q‚Iá(6 —R N/a^q¸$aÄÏ„1C¸Š„8ŠT²ˆÌ%ž,²%,@¤ ž1$ Y JXlB–´„8¡‘KBÕ4ç™I‚DAq¨(aÜ™&RäAÀ„„ØN¶½„H~l"ÍyÅy’° %Ëéf’° %Èbµ•°¶Éùf”° kÈ‚ˆO‚¬ƒâ0YÂÀ8xZKXMB¾iIÂø%ç›I‚ì4òM¤x‚ßf8ߌd‚,!ŠÈƒ,š²à·À$ä›@'‰ ‹Í$aAóÍ$a 䛈èÅ’@â|3Šåà®Ï@&‰ÜEd$,ÀòMD¶Rn¯¼>">“™‰3Î$V 4 ×ãlKØ‹Ó*Š5 ðåI,@Ld–)ˆU«`-– 4ðñí0a©>Í%ªsˆ83SäEf¸!ºï9Çhæî4[êcÿøëå—Ÿqø^ÿú—ç_”JYû10~GkÏ.b3¶p¥Êp„±¶åó‡„|oèÂ"Ä]IÕé—›týÒ8ßí"(‚Ž­¾~úþòËÿúöÛßþçŸ1í§çËw¿BŒmµ&ÿëo >ÓmùëÍB÷®^üýŸë§oæC¨¨3×QÖóñÙFԄކ嚾֡Sº‰Ð®Ÿ××>6~óiÄP¬PE ×ùÄæ;¸Ê¢ó‡?þî/‹¶Ä3côÈ‹æÑ©X:o°´Ì£Ïþ˯ÛÜ+“0\ Ïo¹Ö<•éÐŒNöy“ýæÃ7Õ¢‰È©_m?*¶›xwb‹”?fCÞLÜ ‰·'OcÖ¹Ë|Ïk9hæ½Åà~µ^‡·c}‹yÔ>l"¦òn“lzûÆË%ƒ¼ËÊÆ ÃõOì,-K·0Uƒf-9¿\ûP ý¹¬hÑý˜ÔòžÌ%Õͤegï½E–Ý Ø„ŽÁ‡F²ÏAûŸÂö-²ÆÛן믛l¿Ú -ÓØNºÍĉîÖ¶Ûm.l®ÍºŸ³ËÎòçŸmnÑnùèIwýr²b›H®ëeÑŠMdŸÁoóQþœ†œ¶Ë±–¯ù¯¯^ÖÄÖÿÔ°fÀùŠžÆAÄ¿}¼8Æ*}u=ÌäÛºz™ÝÈdÆØÝ oûv¦ŽYŽ›ç¥}‘¡µ×Õ[ífÍcO¨®5©û»¦ ¿¬ Øf2cõ‹m­gƒxM£a¬xÖrkW4ìÆgýÔÛIÛv’…6ØuÛaÔ¼F²œ6N%ãÜÀ®yœà¸hÊ7æ÷ã,žQå eGrÄtO=ÖRvœ¦]®… ? 4!—Æ.Þp[Nœ"g]ïb¥Ëþê*{iûµê¢Yõóz¿èNSxíºöÑÏ•.K‹w ÏÚõí¶Ñl§Éq¨Û¼]¿G^ºÈ>n…¶óÈ…n7^èvXõ÷ò7ý.ÑGµµ4­Õ®uâýFO´È°øÈ‚x÷öHWd¶ºê{«'ÿ2#.(ë¾ µu œ˜1¢®?¼ÒØ_·_uy[ä>²£…Õ1¸m‰y­·aÝÿØÿí¡ÞœhcÂXKäx=¼‡Gë1¦Éƒ_ªû®…1iiWæ4{íöe¦} :ÏSå®mü2þÊÍ£¸Ù÷"ß¡®¼¤«-þ¯öÒS‘çó_ýäÃiÒ·ŸÎ¢æX‡Ïú%îµÏËßâ· Aw«cåéÊ«“ Ÿi|1VÛÏ möç"WÅ첆vR7Ÿ-‘á®vØ}»Ftñ¿ÎGǾLµç¢Ó¦ÿ0üyk_þ6á‡ßJ>Ò°¡­±ó«NñžöxÿŽxÒ16ßhþãŸÆ~x7éóËñzû¾4L¬kmüy¯üÆšŸŸÿHo~‡ý÷õÿXÇ8v(‡§Rqå^.‰vÊ„RX=]‡;ÙçÃP|F›`æg*À­'ü7Uà@É@¤Ÿ´Ç0‘-uäÓ¸“}>Œ~p”ýܸõÄÿ*pÑ~ˆ&柳·žô¨‘¿Vö:~)=0ú“}>ZŽq;°}®€™°ÄÕm¯ßRë67Õ*š 5»\bݵ¶JœqcÞm•n_q’+p;›|yĉ{?XâÅÚg3Gcj¿Ä•×klã´8wgy!6+²ÚðÕ6<ªýžìóA,oˆÍ_î¹oy; ëµ…ZÞ›­ó}j¶"ÒñãH×Q,Ž\ ç' évõåHåìS4› P.QjvCòñMƒG¶v²Ï±µŽr)Ø#[+ðmÉd‹ÆÝþzKka^ÏŒo ÙšU1­üÞÆõ¶ Q®[Æâ7¶-Øj©røú÷©þ í¶\^™ãŽ%D×Ï.Çš§ÌÏ[¹>ĆØ)ÆzMƒ_êߊ&¶Ö(MûýRÿ†ú9Œ¶oÃæ»'4Åý,yw;úY÷ys¶¹©Ít&Ùí˜Ï2­îàÜAÃ6n#ß?;KB¤G½pgy¹ã‰hf,?({lyçú|4Ë+]ß·¼­54m–là5;aÖý·»±²²f5Û¹Ÿ¦~ÛÌçË&Û9ˆ‚Ú™ÝåŒëu§úœuºC\<²ÎG»ÐO5#Œ³±èå¾Ã›žÏÏÕóñ<ÅôúK5÷­ôaÞ»Å͆y~OßylÚŒ÷ ?È#þòü…§”Ê—wŽ-ò\Ÿg‘Ç1[;鶚ä]_Uiô´£îþü;ª-¯±„³ëœóœ-¾÷õßÉŒ·Wôâ†å}ÞÞ¹ÙYìˆ)ðW§` -ˆ'û|8‹=Ž-ûζ]ùºÇ¡¾£nm5½¿c]aŒ±;Í…ø±ãäÓ>Îœ­‰-a[Oé(ÄŒ´Áì>·ðÄÕª=M´¼—yŽ–{Õ÷Σ;V8ÅŒg3œ“}>šý Ðü@ǵhí¸u›9[ùq6·9PÜ–ÿŒp\ÏG~ë—…µo‚^)p5ÏS¿'AG~/G7g»¿­ÕšU’þ§úŵè±Ûž_ÚÃßèÊÓ÷àºÝ>lòÀL÷ßškÏô_Íæúu­ Cò«\º–GP#Éó^¥‹Ÿ6˜kö¶~J dß|f×<ŶêX}b£lw9×t -£™C«Åô;¯5+µý‰3=î½{ -§ÌWŸÐéO¤ÍøíÎþ$Ïê)\«e »müáÊ—•Mya…IËo´ºR\ŠùÊ_NÚ‘iÛfŠ¢ÍõNÏò°z«új0Ío áoŠ/ï ›.jûʆ1™ë¿<êX^㣠9Ùv1È/¾L™h®Éühlßk&»±;âíâ©{â ¿\|ZûÚ7Ó›‰n·““ö2¨15Uñ“•Æ_çÿ¨ðÊÈS>ê&Å/rWcöÍN^+i¦‡Ž:$iÀPm'u™»ÍÎú2I ít{ë®±uRÙD¹‰Ç ÕÁcM6Ýê:™!¬é§cåLÔML7Ⱦ›òËŠ<äôÝU½î“3™»ïãrèØù2“cßqÃoåèòöq'›oÄ[9ØhKfÓOm’A¶ºŸvc²‰8( ò€Ñ—BnÞÚщß4Ø>'“NÜÛåo—rÌYç-?ñœá—LÍQ—¹þm¾Åïß/tý}{«ÁrŽ#ÖoóÛŽ­+ò|’ñ+ ÓI2¿¢°»ÛLDKì²I£­oÖÐÏqk'¼¦Ñ]`o-MGPÓ¹3ÑNdÛM×7iÆo-ö@æÇîÍ8°—Kׇi¿£I…‹y9¸LƒçÆ‘|†Ä7G:¸d§Ž¸˜Åå4a’­Ädƒœ'éªgùiÞ -ÇsMSÁ—nðh³óÐVV15Aìæ‹y`2ó¤y% ô›ÝëGï{94`j‡öN}™©}aLí€'S]¹ ëË~æ¸òðSsÞ¡¡>–›|Ïõ g¸Æ-hu1ÛèDM£[màçI©ÑV“¶ƒ¢ÃhºÑúˆ±Éj·¦–²â$j)ö˜bPÿ6kÚϻҕèç] »¶> -endobj -787 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb194-1) ->> -endobj -788 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 736.726036 101.433071 717.976036 ] -/BS << -/W 0 ->> -/Dest (cb195-1) ->> -endobj -789 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 409.229014 101.433071 390.479014 ] -/BS << -/W 0 ->> -/Dest (cb197-1) ->> -endobj -790 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 348.281993 101.433071 329.531993 ] -/BS << -/W 0 ->> -/Dest (cb198-1) ->> -endobj -791 0 obj -<< -/Filter /FlateDecode -/Length 4809 ->> -stream -xœí]Ë®$¹qÝ×WÔZÀ¤ø¾adØcX°à†½0¼¸]ê+Áè10ò¿ïC&‘̨¬¬Û-¹ ¸/ºoe‘ÁÃÃf[_~~Ðø'’^bLÁÓõöóå—‹Z‚SøSJl.Šú÷øÜU+ -‹ÓÉGwý9 lXBr&øë× þ™.yñ¯—ýÕå?·uôÕ,)y£ÝõÏ_²ŠìbÊ ª•ÒVP9·„`œT^/¸Å”$Ìp íUfPŠNRÁ 2& -ª3,m÷ª3LÐ$©`†N.*­`‡6J‰:¢ˆ¬tÚ-N÷’ÎèÅÇd’¨ Ðé`$µ‹¤–tiñÞ»(鶸¤´¤s°Åi"%é` Ù$‡-Ö[%ê`‹‰ÁJº[ ¼“]„-@Wu°Ey¥%]²‹K‘HÔ%èT q¯3Ê-.Z«$Ö‹6­¨ÃŒÂ ù è lñÊ%Q[œUFÒYØBø‘tà gCŒÂl5yv[eµ¤s°Å˜@¢¶`ð%0¶¨à% -À Z2/I`BX(’HÀD»P¤(±€‰i¡¬D&¹…| -X¥¡3Z"«`‹#/1Õ°…0sEl±‰$.°¶ €ÄÖÂCVâ ¶% Eâ º%•´Ä|KJ{‰ ,f*‰ ,×FOXP. ”$.°à\ À‚t1݃Ĭk7XЮ¥è%.°à]KZI\@à]kQSÔÁXâ°ãbu´x×j$. ð.¦‘‘¸£º‡^â`e11*‰ ¼k¢"‰ ¼k–QÌA+qwÃ-H+7x×8e$. ð®!ã%.Pð£ð.(ÄÉálÁJ\€õ:c%.@c‹AX"qïê„åO˜Ó`«EÇä%.pà]1|¢.-:Àã¼…—í}’¸Àw±PY‰ xô%.Ç/XQļ«-VjIÞÕ&)‰ xqƒ“¸pX4‰ °¾-Zº¢.-*Å(qï‚–ŒÄX…Á$¢.,’–¸d¼(Ä¡xð.–÷$qï*g­Ä¼«a¨ƒ-6‰ ×@‡i+Ìi«‹2` -IÞU#,éÀ»J…$qïæeSâ²ÀD‰ `à‚(ØH\à#-)/qO -:„|¢Î/¸ve‰:ØB$.@`½$›¢ÄÁÀkŒÄÁÀ„  "X’Fô-¦°pó‚-ˆ%.“-1I\œG>¯J:o–@×¢.B§ƒÄ!Ђ¥XK\€\j‰˜ô€à—.I\3 Ó$qAH°SEâ,EK4ˆÌ%†-²%.@¤ ÖD[ J\MD–é•ÄX¡‘KÂÕ’ŽTÎ3£Ä‘ü’CE‰ 0Mi‚)ElMH\€ñÉɶ“¸É’M¤9¢¶XGÄhrº%.ˆ¶e$.6s¾$.H -¶ ⓸ )¿ä0YâÐ8tJI\tD¾iHâÌËœoF‰ ’UÈ7‘â ó6YŸóÍ qA"Ø⢈:Ø‚ ) óœ„|ì$é$Í1Ÿðë¹:ß߯¬ßÓ~=Wç»ÛŠ$­¢m¿¢‘ -ßI•Óö:™S¾ŸŒ9B.‘e7aåƒ6G'ÌÔ'«|GƒÕbrÐêQÆ&“y07Ò3øŠþ›Oð}µb}”Ð/™ù;5Öo㮟~¾üúïúéoÿîŸ1˜ŸÞ/ÿöDjýëÂ?h\ÓûúÛùõwÖQýL±ê\ýXDtÛ¶Ñʛ܇aõ[_­¬ûRuµ ¹;}j¡8ÙlÆçö»Ùt¦¯r?ÊÌ÷8|ñã¿_?ýtùí§-ˆJ‚¶rbo£)=Àݹ*ß‚»¿ÜR:„Ûû:„ÎT÷MCHM^¡äl…êh½•u׫õ7’øg&î­þ6[Hµ¡.õìvxûð¿1›ô -éßÒ×M°ÁOýÏ¢­ý¼ýÜŸzÝf½½7šúèm°ò÷ ™Z5€Ù J9p<ÄäÉ:¯JmI°×D‚œvVÛ2Ýãê -ù!óÕöRÝTßlëÌ}»-±ºÄÐäѽoë×}à¸í]—Øg½µÝјUmF»-oëBí Àü¤Té²CrŒÐsu^¡tÈ›”Þâ¤eìm_~^.Myˆ·GÞ½zæËó¨±^XÊÓ^f¤rú7¡†`+›¹½½¸-³™v*;ûäïÞE0 “C.œWñG>Wçå|h6¾9 -èzÆ9/²Q§iß·£Àý̨Ó$Î\NœÏî!„£ržiŒ¯7h;ºç~:÷§ûhçkïûv€ÎD¥'ë¼:ãÒÿO_FÝoŠÑï!ðtì.#Õ°¸S›%©hò¾ê!ROÖy5¤š±jCÄ›ÀAqëe‰OfDöÍl딨 <ÇŸ<*ò™»´:Ïšé>:;ŒÜ×)… +³Á]$Žø’B\nï!ñ\—C⃘ôÁ(òåQ”ø±q HGÈÄUedoÛí+)þÿnÚfÏ.#lõÞ¦8tê¿´×fóg¡ms#>4M1¿üçê¼cÊÝΉ›~Ï;=ñÜ[ºiÓSÿ¡æñ:žåú(O+¦8ê÷x‡Å]ù‡ËÓûãQ?WçåFý8Vë±Qœ¼z”ßâÞÌ{ÍC+*L\óM“uŸ×kI—ë˜6§«Þbn›[m÷3«G£>ïKã&5¦œæeßÖ>òFHo×W[G¹iü¥ÞŸ¿œ×ËöË(³|ï$ÊNÖy5”Ùã8ëÿÂè~¥“óu±Ë²vðÙšjÛ­ÞoÝÓ,<ø~MöyÎ:YçåÐt+}¿yû$2žB¦_ѬÃ÷ægyUîu®ÎË¡ê8þùø|}ñ/ˆÌ§W½'Þ¥=Yçåu[½þþ/¬Ìö¦è{S'ë¼zèÁÞËl7õmäj»½*ž'Í9X‹è?¯Q<0çYâ¾ÔA{ÒóʇO•Ä§ëìYCÛ…˜w@[¹·)uÞùùokã¹gwÊöŸ|~‹Ã!ô\—Cèqv´¯½Ù˱Ãûß²~ø”iš»ü•ï1…¤ÍStª«zÛ•Ó.×Õ²ßǦ;HûÀûu'ë¼Ò<ïœ8a·;xçm¢§GBOõ'kzéÝ“ùÍ‚Íþßo}ÜäÝ×ù‰ýþ=õÔó‹»(cûZ¤Îe'ë¼Ê<·œß-ãO‰…§ÏÏx¿ì™ûǨqÓzGI:~ÂÒŸöL«ZY-ù3ÐÛÁ,h³Š=!zƾÎýOÖë³N¼·ŽÚþ„<Úi)ÏÿÛh÷Köš¹#ÊçhËhÿöwÿôÿò;öödf÷ì>÷G„jº÷&ë; -ò­e]È1G›óëõN>ïoÛµñFÌZd]>¯O~WY)§G;ôÞV±zj¿ýiôÚG[Ñ»ŠÔ>Úµ}=l(eBŠßO9ÚsGó]åÒ>óG»ß~íxüµÊUÉxœÉyø¸Ü{nû¶"Dûj¢ç¶y•¿¤eó!Õ6[ÇÎe_Çá/ý‡};Þæo°åSöí”{h¾õåžì°ñžjÜKö}¿¿<õ)ž`[>-Ã#\òIh»`ø¶b£ØYï·´Y߈m¸(e¿T_¸1>v—í‰bªv¶6Úu­“³Ð"g÷´c¬wu;Nêgßì8ô­›ï̯ýÜ2›y5î×ìæŸKë3«-n×òZ?áïæGÅ°¬+ŽmõÃmصŸ»|ÞÛÎùüЇaö!=ÀDWÙÿ¶ÞßÑØ®O²«M¾­LmUcå*¿é×·wîÛ¨õ±Z>zä¯}”úˆÖ6‹}z?oŠßêu/ª6}®ú·ZÆm×€¢Ó«®qÇÃИ3wæóUéçmâ2W«Ñ·aÅç‘Ÿ‚žý”çœÍ{ž®î}¾×ݥܶYwŒòÞjùªNU]Û m7j]2æݧ,+ö'fåÑr¯ïÛyº_ƒÏ¬¿ÃgòÚ»åŠuŸóÄ¡¿vümÚø1§g츶>p|Ü™+ZÜÒõÕ_w±ò Ðy1 <7Ì»ÏcÎŽv¥5˜ùiÏó÷¸£]7^¬÷Úô}]UÃ'm>´9|äϹýG~ý8Oú#ÑŒ›†E¶4Ÿî¾DeÔâmùfc>YL…à|‹ê\}ò;&|®Ûki‰Îâå/PÝyÕ­,;üµ¿uîv˜ü¢R>eê°…b…2ÒºQ¾Âa›Nœz¡TLƒD\Äà–ä0ö^L|$”‰z'È» ŒÓSùÖi>ÂË;*G/èd—PÒ~Ñ:Dퟸï} $£h I%ÄôÛŽ;þÊßOÚ¼]8í8ô~ÞFïnÌ6ÅÚ>Þ”OéÒ‘”‘Á[W×¢'Æ̵å oŸAåóãR>©iê´Œì=ÐGÓœÏx:õÃ=Ù“u^d·l`?…#ì«·ú×2ì³=‡Ís+ö¶éî»wÞìÏ’Ú8ü¾@LvùðÍ|’DbçYtç?,òÀ×ûÓ/ڗ߯zúîþÈh2Ÿè(*Kº ›.ŽÖ×;5Ëy¾¿ôRõˆ_•OýË'>­çÿ²‹Zþ—2à?_tŽ§Ô: Öã8UcúºYüõ’ ÄDc‹ì8 ëGÕÛ"ÝwÜšì6 KšKbªªúqlËåù»~Ìëë¨ïZµ|L©VÈ–ƒbÖŽ!jz½ç»W‹®â|¤m\l½òÝç›ÍŽ‰— ŽŠÅÚ*&t{¡bÝ ±¡fÎG u×ù!ì¦s×i6ü­¬ l8„· ºµ³ô«(Íi¶¦šwq7™eF¥.u­dêã$ˆnAøƒjM³ëÙ¨åãÈVal@¢^.µr‚èvËÕÖ\©ÐKÅQ55ÏSÔsÖ|_vc[×!ŸÑÍ戲íãVœwUûX«ÈpcvÂÛÅQŸ‰Cüõâ‚PÚ ®P®A -k·‹£xÒü•ƒõ¦f“åÃœò¿+U¸.ÍÌS>hêʲ«ÑIž›]¼u—ûÎ:$y@Se™»t³Ü_:*¡|&Ý^º{l#e.còšy™¤:ylź£®‹3…5ÿt®äBÕŒ@wCì:”¿nÄÃNקªS½3¯Ü]owˆ}çί\úˆë|º^···Ë0ß„·²°Ñ,ÎЭ“!6ª¯v£3&††xÐè×"n³µ³SùÎhý8&™´âÞ.º”eÎXgr’ç­Î‡Åò¨K_ÿe~Âßÿ¸ÐõÛédë:nTg Ó¹u#æ+Y>Z<žç£Æ›°O&4Ähˆue]CC_Ça|M£ºÄÞJêΠºk¹Ð 2±éÐ5Ú2ϸámòbd¾ulÆ‚½^ÚvsèÆæsíšU¸à·ƒË8tv,ÉWÖ$®rѱ¤CK†UÄo—¬Ã4,Û˜™É;é®Ïö -›ûb,ŒÈ—vèh,³¼é&+wÁŠ ¶ü‚7Lšwš6öFxz}ó¸W“}›YÚ©½K¿ri¿±,í„'Km¹ôÛ˾æØ’ï·É;<ÔÛ²lîÙ䌩1B Ú\pŒ2iÕjÇ;¥&ÛtÚŠN©&ë-†f“¯Õš[ÊGÑK¡ÇCú'îiÇG¥;ÑñQñ»²¹Ý¶âõhÉöÈq8‡qwj”ì±ddž×îR%m“íû¦mßmµ½²Û aˆ‘©ÕÜ®ä‡øï#sg­3íBH¥ÚOÙÑqœç‰…št°Æ–ÿ¢EEïÁ!”OÙÙVÉÓuŽ÷Nö;$mï„÷„áXÈZtþÏvd¾B‘+XSí?â‘«%%ÞÒs¶†Í©ÝÎPùßÊf]Ù ê—!§Šù?W±9èùLø ´üžÕ¿a³…R~þ6),\ -endstream -endobj -792 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 791 0 R -/Resources 4 0 R -/Annots [ 793 0 R 794 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -793 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 228.873057 101.433071 210.123057 ] -/BS << -/W 0 ->> -/Dest (cb201-1) ->> -endobj -794 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 167.926036 101.433071 149.176036 ] -/BS << -/W 0 ->> -/Dest (cb202-1) ->> -endobj -795 0 obj -<< -/Filter /FlateDecode -/Length 4072 ->> -stream -xœÝ\KÇ ¾Ï¯˜s•«Š¬`øÀA¢ F‚ÉÁÈA[6‚U9‡üý|¬îzt7gvvµräh±Úi²,ù‘¬îw¶øyåð_fgr.)òùòþôádM -ÿj‹ÍEeÿ¿)œåd‚+1‡ó{!P2©Ÿâùá„ÿv—só‡Óßsú׶;{SJô.œþAXL&å”lPX,ëHa…`Rò!*¬è –XŠÆ‚!±ç#+A .9h,ˆÁÞg…•!qrtdˆá“c1\ Ia9 9œ·VåAËL^á¹`"”5žw&æâ‹ÊKà¹ä5‘‰‰]p¯˜cÈ!K(Öi¼Y‚c¶²0å¤ñ"d¡HVåAŸi¼Y<´S^†,°®¬ò ‹Öi¼B&”̬ò -x6§|äyLÈDVã9gl“T< -›“Âó%ÚPTd d½Æ#ÈÂøÑxÀ‰@)gÅ[½x7Yr/@ï«<È‚Í×ÀGÈbSÔ d—4 ð).ž5ð™ gÎ -ø\ §D ø Ç’4 ëÀóN²%pÔ€dax®Êƒ,TXÃò 4, ‚,žIÃÚ2¬EÃܲ-NÃÞ²uQÃàBL«aq)GÖ°€¹0¥¢as Ø©atáîIÃêRˆ^Ãìç¨aw‰Õ°€»Dè©ò Xà£!—IÃî’³IÃØU;ŒÀVŒÏÙjXÀÀ]Ÿ-kXÀÀ]ŸT^2ðAÒ°€»>` Zäîú`½† Üõ죆0ü±j6Ü„=€,X ïÁó¤a3i‰†¸ë -ŸâÓ@+ãr‰à®ËØ>•WŒKиâ·Ð²q1 pŠ4,À]ÀgÖ°oQ½†¸ë‘Zãw/VÂÜEÞ4,€9‡@ÃÄ7ã,LWåcKÎà.`ÉkX€(ll’¨¼d`HNÀ±±ÈC5,ˆÀ]„÷¢aAîÚ@¤aAîZFÚ£ò e¯aòðඊO#Y5Ö)4p×:ì°ÆîZ›Š†¸+aS˜„ೆÐ öÄ̦¤5,ˆÅ‚‡”OåEƒë aA² @–ʃ,œXÃ$Ö¦PÉ$YÈ{ ’‡,H4,@F`ŠCö­–æ¢Ö Y)jX$3¹0kXBD=­j¼èMN€k•—ÁsIÂ”Ø ; PK™ §×°o$]Ò°b€çXÂT \EÄ"“=2sç ’l é‚眆ÙCdƒdŸQeF«a"4jI¨Z㱕:3kX9I5,€› ÒRª<Șаû#ÅvаÅŠM”9*²P` röRnf r†,Þz `›Ro& Š…,Èø4,(6I“5,Œƒg­†ÅeÔ›ž5,€_J½™5,(dQo¢ÄSü¶P”z3iXP²¤(*² i*Šß“Po4^„,¾°†%F©7³†H3Po"£W²Ô›I=.î†dÒxÀ]d¦QÃ\ ÞDf«ÕöÀò3™¥âÌê‰ôÄVõÈÀ{­’zf`¾R#©‡•eŽê©Â*˜ÎªÇø‹|Œ˜°œ>ÍGTæ3s’E¸#»ï5ÇhFWš-çc?ÿxúâ-‚ïùÇŸÞý¦ž”µã'ŽRXK­%Ç.Øoà•©ã1*L$Û^HŸÓG„Heé‹ë¡›‰PŒp[ÎýƒÛŠ ‰Ef‡d¦®Œ7ó¢TpØ+Šª¬OîóB²1ò3¤DÈÞî×ë}^\¯ó¼÷êõÎ>/.k¦3jYËÛyU!kü¨t$ÿÎÇG!>÷Û7'äïÞöëWãrÚôD‘œÏç7ïO_|ýÍŸÿø·o †7ïNß~‰ðÑ 6²ë¯^¹/×Ïo%i6æ…Üú7®=XËyi {²üÝB‡nêõ¾¶ÅõWŽ´¤-ÿ°ð„ÆÐ[?áÉï~›¿öm2¤¥´©ýãVŽ:Þ,ÿ?Îo^ߥ·2ëíÛ¶,çí4½]EsCYbv·ª!̪ ~j“–ñÛØM]ö;lo—Üú5V5 =ËØ—¯–EÆuuq^–X/#‘@„Y×E¡©WæXT)ã¹ïãD’¤­ Æ©k UžX×|KŽ˜®ÉaÇZêÖòØæàEתlr@-”±«9ËXe•s]ïbËžÚUöÚö‡U«LÝÛþÆ!‹ŒYålc´ëµ}·Ò§5mÝcìõ¡o·“fGMŽ›ºÍûõï]MtAT7=o]ËÇUÎîRK;÷ýÞvWWvOÐyÓå •ßtýnê“Ç> _œýp•%^Óû-½y{ÐÛ~±‹¾?¢‹¶—ñöþÊ®6†´•ëê?—õošü"Ýæ×±nÈèÜms ô´®ÂõMù½Îóó2f•Ï}§êm½îûÅ ÊWþÛµM6ÂÊs ÓÎ>& -¶ÔqÊÖ¿æ=¾žnêz¸ÊZ»ÂŽ¾vÝ7«{»ú”¶FÁ7ñq$Ìã÷Ýò·âÜx ¸¬Óʳ+Op}ZøB“ø$øíß -í¦žØ\÷¢­ërÔUÇ’`{lé±ng;¡ÅˆÙ>®øJÇnqìUÕß5Œþ èk)Ížoêê€ãuÜÕ6ª-Ó¤§ïo¯—ÛuÃÅf—³_¸Õ.§µUßâIßwŽÿ˜^ŸS·tFžv:[r'»‰½-øúMMèiTsr'²VrCÝ%ÊH]651°sðÔ>ϪTÖÜßx9ZÅz /GQÖ[2ÊŽ}AÀmÖE5ýÒQèòÊS(W¼­Á^¿þÝïÿ:U²Ýk5À—V¬a‡™ôÕ K4¶ÈM‰Ý„-«PW–Ôb1‡muÑeh×ï¶×å« ØÄ^‰T»`+çØû¨ÖAš‘TG½’è]3 –#ºR+B¹s×Ç›tgŸÏÆ€XŽú]Ê.>Ù€¸ÕA¼ßÄ«{Ù¸b òúíÄÝZb"­&¼L²Ùiì'o†3¹ÌÖëÆ»F…в§ ™jëUÞ±Š’Ç&ŠÜ ÜMZwöŠÑËýãfÀÄ:Å1ú;û|Ì Ê§°ý½aûöíúK“íÏçn²™4Ñik»ÝæâîÚmûIFkžó‹Í­Úí'*r;½Þ%+÷E}7äüÔÇQÞuÔÆOcΖwµãªÞ¶L¹JËc÷õÈsÏŽÜN®æµ÷¨¼Ì*ÿv³«cF9a";­Ðm5[³?Éênž,E_ä0t‹ç,Ç©–¾Vy=0ó‚w=nÙá¦z¸)o ×äµ;Ÿwu{±àc‚ñë;a¸©Ó¼_÷ËŸF(c~¶' ·t•ì^W×N"„üØ‹:ŠBö§7×ã÷ëù´§ «lŸíéÁM]ñc{ÿ²§ Ãî?ÿÓƒ›z;àêÿæ”!ËSÐ[[ëzónmÁöÓ»@“o­sõñ†W“mŠÌ¢«–¿‹?ù¼Ûÿ+q䥱c¾ Qû¯¶ÕÚ͘næ Ùïu÷˜Œ·î¸4_Õbt·ù0é½îÇýT–7i6”š§^~¡5O;5åu[F4原úž¥£©½k\æ~‚–ó^ËÝOËðÛ%N¯R5 5*…Íê®ìÀAKÿ\Û6|ŸsÀ<Í¡ìD³Õ>fÚÏ}¿VP·î´ò²÷‚ yþð£3öã8 íî»\R¸&ÇGgâDZï¾/ùq/¸”ýú·–»ŒÙôÝ×ùˆ×Ll¯wŽîš=âAŠ‡ºûÆ7ï—Ë÷Jzö æ+›ù+)ë¾~³>U_{µç ¯1ÆâK™ž ìçy6yäøîøa{ ëìvjmÏF‹~Ën&y6Õ©ÌÚÛøáëãÛ®¾Âcc6ÎË;¾çÈFŠ®TÎòÈx†¯»¶m®*Ú¯ô¬oFè­Ö—¥­¼?%ÏÎ/oROkûuÃß#ô±‰-ØÕm%gß.ùá$÷ÔX!3ˆùYˆëGÛÇb×p£]N\ö-)»~QZŽ„—rËfô­›Jvd'b8í4Ý {nò8y™¤«.b}V›¶¿µõiÚÎ[ÄË ÓÒžú Rå•Ä6TÓ®·F“P¥SCkÙ7„û>)¤ËI!¾²mhÆfvþ´kòbÇBÌ͸·+­BºœÔvëh¡ïTê­òèZšæ‡(ÃÔ)wÅ+´Ë”É&ù¶ƒÉG,µ[²$h}¯mžìƈ—Sàüp -IiVØÐLo&Ò4n'g;ìePSnª‚k6š</ÿ/P:U§~pÜMJ^mWcñÍNÞ*i¦ÇŽ:¬iÀqm'u¹”ºÍÎúrÙ*ít{ë®± uRÙDO¥‰' ÕÁcKvÝê:Y ¬é§cåL´ML7È¡›òÆ<ä ÝUƒí“E7™{èãrìØù0“Sßq'ï)uyû¸“Í7â¥6Þ“Åôs›d½íÑnL6‡`…A0úPÉÍ[;:Éw/´ÃÉ´ˆ{9ýtªaÎSðòÜ@$'¯ÝÎY—;ÿm^ã÷Ÿ'>ÿ©½ç±Äqo;ZøŽ­òÉäKòdùÒ†Fìn3=O°?È.¶¡YCãÞOxÍ£»ÀÞZºŽ ®sgb:œÈ¾›®w4i&Ü ^vZì‰ÌÇîÍØË%µÅa’7„šT¸˜—ƒË·ÏNŽ'$íìdž Ûa˜È&'_[¦‹ðFyœ1 Õ¾ÒLïV¬º¤§)àê+¦ú{põ{kêó_õ€¨_&)åkªH’Þ,ß®‘¬Ó?âõ7oŽPêÏ“¬õ -endstream -endobj -796 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 795 0 R -/Resources 4 0 R -/Annots [ 797 0 R 798 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -797 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 582.273057 101.433071 563.523057 ] -/BS << -/W 0 ->> -/Dest (cb204-1) ->> -endobj -798 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 521.326036 101.433071 502.576036 ] -/BS << -/W 0 ->> -/Dest (cb205-1) ->> -endobj -799 0 obj -<< -/Filter /FlateDecode -/Length 4101 ->> -stream -xœå\K#·¾ëWèÀ4É*¾Ã‡1bd‘ŒÖ²ÇF0`Cþ~¾¢øjuI£™uÉ´RWñQ,¿z¨[îhñ÷™Ã™É¹¤ÈÇÓ»Ãûƒ5)Xü«-6•ý-^)åd‚+1‡ã;!P2©Ÿâññ€ÿ..×懿ýæðÏmwô¦”è]8þò£°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ,±1BbÏ{V‚\rÐXƒ½Ï -+C âähÏ*Ã'Ç b¸’Ârr8o­Êƒ –™¼ÂsÁD(=j<ïLÌÅ•—ÀsÉk<"»à4^11Æ5C–P¬Óx²Çl5daÊIãEÈB‘¬Êƒ,>'Òx ²xh§(¼ Y`]YåA­Óx…L(™YåðlNyÏó6˜‰¬ÆsÎØ&©<œ(lRL -ÏC–hCQy%õ ãOã'¥œ•Óêåt“%§ñdñ>±Êƒ,Ø| |„,6E p‚Œà’†>%Ãų>“áÌYCŸ‹á”Hƒ_‚áX’†dxÞi@@²Žƒ,Œ“«ò Ö°€³†Àxê5,À]GðÔ¸ë|±à.↠aÌÁ8À¿gaº*¯[rÖ° wK^Ãxac3Då%CrŒEªaAî½ "p×" "p×2•Y({ ×€‡c«œi«Æz …ÆîZ‡ÖxÀ]kSÑ° wÅmjX“|Ö°DÁ^˜ٔ”¢†±Xðò©¼hp4,H„ÈRy…kX€ÀÚ*YÂä! y¯aAò!ƒ†ˆLqˆ¾Õô²À\Ôü€! "E €d&f RˆÈÇ U½É p­ò2x.iX¸b§ar)“qè5,À —4,€à9Ö° È‚£¢a\‘É‘¹ÆsA¶†ˆtÁsNÂì! ¢A ²ÏÈ2£Õ°¹$T­ñØJž™5,È„Šà˜ ÓRª<Șаû#ÉvаÉ’M¤9*²P` rö’nf r†,Þz `›’o& Š…,ˆø4,(6 “5,Œƒg­†Åe䛞5,À¹”|3kXPÈ"ßDŠ§œÛBQòͤaAaÈ¢¨<È‚ ©(瘄|è¤ñ"dñ…5,(1J¾™5,@˜|½ZÈ’o&µ\Ü Ȥñ€»ˆL£†¸@¾‰ÈVËí-€7$Äg:3KƙՊôøVµd`½ðVI­X€¯äHjÑb"³ÌQ­À­‚é¬Z6°À_Äc¼Ã„sõi-QE˜C‚ÏÌIYp,ÑýÈ9f3ºÒì\ûå§Ãçoá|?ýëðð›Z)ëÆOkbs‹/Øoà•©ã12LÛ^H_ÒG„He -é‹­è&BÂÃÝ–ãøà¶"Cb‘Ù!˜©+ãͼHöŠ¢*ë³û¼’¬SG1C@ôv¿^ïìóêz]ç½W¯wöyuYIrDä²–·óªB>ÕøIéHþ÷žØ| àb›÷ÞÍ¿³Ï«+t÷ÞÍ¿³Ï«ªŒD*g[Ê3Õ}^]¯ë¼÷êõÎ>¯/+’^ø|™âéCõTãW·“Jpíƒþ}‚|.’çÎkù<úÈ<ß7þÛÖ&œÇï2Už;ód¡×1¸ŸZ›8×U¯ÓylÎ_þýøæë+º+«îªº5UqÞ¶áú”¡½Û9Ý*ª¨¯/ÓcžÏËûÃù¤|‡‘éÔÞSãÙÆûOg¾Ð/ò q±"‹¦`Rñ’U#U²%ÃÓ_Â0÷YϪ—ŽÂ‘¢1œ„·•ÿðõ׿ûý_&* ¢røò3'&r:¿W³ó vñ~Þ„«"…´Eê«Ê¶£5¶ÕÇnmìÜæî2ôë‡íuH]lâðIW]‘gùJ{U_¤I=¨þ¢áÛëäS0\j&_ÂÅÀµxrÓ€îìóébäRvñÙıÑùr¯Nì-#¹¶%–‹‰‡!ùîkÚ˜mî:ßÃV^y/1¸/¶ë~®ïl­˜ˆk¼Ó"›]ƾßxár¥æÉÖëÆÛ¼Gè̵̂iEãŽìi‡¤^¾.ò]ËŤug¯=À¯°Ü¥ët†7þÎ>·~ Û'©²^·}û¶½h±ýf+3\ÜÚÓ9†ÛÚî°¹xqínR»È?.Kb“¢{Q-É5ßëú9q=¼ž²ú!ËVÆ~ŽºßŸ±S?ó—1U_Ût5öh1D×Ù?õø¡; -Ç—¡w7==nèqÊi‰WÛÉééD÷$×í´Ü£fZÕ\£­kÒ†3Z íõè½k7m-hôéŽS‹#²b¥ÍÕ \V¿®¼†úßw§¸Èá—öUÓ§[Q'–šÏ‚%:MŒYlj$ßzÈ5ûq6P¬ë¾!ÎÏ59ì\ËF=£pªlr‡UD -ï´»ž–“‰f[oÏÄøíÜŸž•ÝÊ,.“׌TÞ¥}=, íEP³ËhÛ<ï÷öáL÷'Óoƺ¹t©¯Íœ—2öL$ê{Ó3Æ¡ëËþròiY÷:æ½:ÉS/—¼Ú¯gFn;Ÿ ÉF¾–I=¹ÿÓVÎÅ…›º šnûžÑ Ôó âù§tðö¨gÅ›ìq)Ò [^ÎÏ-ï™f_“¶·#+¯{tS¯i§×kgº¯Å.x¹…êܽêV_ÐýÀ3ÏõT*®ýöêR”ë›ú*;}]«´bÞ5þ9b¿¾žO¿`xKOqç;>¬°ØÚ@Å°cÒsª†â êuhUÆ!õ=¶*a«&7õ³÷wV÷Ñßý¥·;™¯˜)¶"Ó­ùžiÞ% Ë]q)äúº,·+«íó³*¦7÷hïsþg*«m¬gWLoêkïK>éÊj²ñBÞçTVå9ë·hwWVïìóÉÆG| íû®_YÝNø_ª¬B熳ƒHµ²šåY_¿á¼»²zgŸOÆ€²¯Ï1yûkWV·ÿUVsÌr×d*¿feu;é­ÊªÜdÙ XîgWï¼mô÷õùÔ*«Åæ[¶ÿ«UV{ìÔ슚­ù¶ÛŸ|…Wî?µ‘`iÏ«ðöÔÇ®î®õÇd÷qð3ê4j]ô‰ZêÈi6{v9éþJoI«º¿ÛìèV#}ô‘Ys϶šzÝÊ+¿—;ƒ°yYéUèZíVûm»µ5Œä±^¹ß³,wÊèz²ÉHµ¿¯¶ßKutwYm݆”gÚ)=©$¹ \;25Eýñì zäâÛÍ1U¥!9JeI½Z馗Ææµ²@?Õ‰ôíálB÷C­Ë~E»+ ÕùZÉh-=nÆï©à"O?fc ¡¯a·ï±>Îàê#mþËyyæýÙHFŸäËYy‚ØõmsUÑîx¥gý¥€÷£Uûñ+Ïʳ$ç_X.Zû÷uÃß䮋ØOc}Ð×Vröýb’’>°BfžGú ²ÛG;Æb7¢ÓNðÅɔ˖pt¶}œ0"ÞïüQ¢ÓÙ?ônr>ÛÞˆê-èç‰"zF·'Ëê­q,ËgCí*QBì2ƒ8äµípv|’ìÈ.Ä°'ÚeºIöÜå‘;—úÇ2ö\ngꢯªsËö÷¶ný]ÄÓÓÒ%õQ¥Ê#º}¨®]o¡Ê †Þrl}RH§ƒBüÌö¡›9øˮɃNgbî†Ä£]éíÒé ¶k£…±Si´Ê³k隟¢LS§<¯ÐN‹«Mòë˱Ô?nÉòÝÛØkÄŽÓnüŽx: (âùñ’Ò:L¬°¡›ÞJ¤eÜAÎvÚˤ¦ÜU…£Ùiò˜ˆü†Š0¨‚<õƒãaRò¨×¼š“ÈÙä­’Vz¨Ãš§ÙvQ—KiØìª/—­Ò^@w´ÛP•-ôTºxR<¶d7¬nº~V®DÛ…Àt“†)?nÈSÎ0Žj°c²èscÜIŽ;Wr;îä¹½!ïw±ùNVr?­ä·HúÇyÈ4{:ü|¨nÎSðR"‰ää1ô5êrÇ£Í×xýãÀÇ?õçžÎ~ù^ŸßlÝWO&?Z’ï$˘tâ86 Ñóû“ìòlº5 ?îý‚×<»Û ì½¥êw%†©Ã…ì‡ézG‹f âéB‹#ùн™û|I}q˜†ä‰¹..Öåà2OM—|\†Ä•4.\öKG\¬ƒâr™°LÉ6bŠA®“ Õ‹ü¼nÉ\ËÅFÈ%MO7»ÝiuK„À´^¬³['-y¡_|¼>xߛȱŸ¡hÔÇ•:&Ôx:•êeÜ^ŸCµZÖïÔЋ–³G#È™Gc†¼¹Xmt¡æÙ­5ë¤Üi›I»£pší´1bê2ÅÖ­«¥®8«ZJ#¦˜ÔŸWM‡uW†ú+q×VÆíoDK4 °šsš«³³åˆ%³B‹kïAåÙ’:m?7oçîÞö¸,ƒ§ qF¦vv »–/¿—œõ¡(­Uÿ«•—ç“ÂpÔìyª?þfsŒÀ–ßïHœ—RɳûÜ®ì+$½v²Î„í0Ld““ŸñÓEx£<ÍX†ê?ñ§w+V]Òópõ‘ký¶ú;NµÔ] Dã2Iª(?ÛFôfùµ™dõGÚz%õ¢„Rÿþl›R& -endstream -endobj -800 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 799 0 R -/Resources 4 0 R -/Annots [ 801 0 R 802 0 R 803 0 R 804 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -801 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 698.673057 101.433071 679.923057 ] -/BS << -/W 0 ->> -/Dest (cb207-1) ->> -endobj -802 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 637.726036 101.433071 618.976036 ] -/BS << -/W 0 ->> -/Dest (cb208-1) ->> -endobj -803 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 295.229014 101.433071 276.479014 ] -/BS << -/W 0 ->> -/Dest (cb210-1) ->> -endobj -804 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 234.281993 101.433071 215.531993 ] -/BS << -/W 0 ->> -/Dest (cb211-1) ->> -endobj -805 0 obj -<< -/Filter /FlateDecode -/Length 4920 ->> -stream -xœí]K$¹q¾×¯¨³€Mñ|  ÈÖ°`Áû`øÐS3-Áè°ÒÁß_°øJfdVvÏ.ÞAoUFð$?~Œ`f²ôUáßÿ‹¤—Sðt½ý|ù墖àþË)VYýGüwÕŠÂâtòÑ]f KHÎ}»àÓå˜üíòüeG_Í’’7Ú]ÿú•Ud—CPNP%¨”¶‚ʹ%ã¼ òzAS’T0Ã2´U˜A):I3Ș(¨"Ì°´ÝªÌ0A“¤‚:¹ ¨´‚Ú(%ê`ˆ"²FÐi·xtº—tF/>&“D]€N#é¬]| í´¤K‹÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ é)èàò‰:¿àÚI\”%ê` ’¸Žõ’lŠ[¬1[à2H\`IÞ·ÀÀEŒ¶ÀS”¸L¶ÄD$qApñzUÒy³Äºu:$.,ÅZâÄRKĤ—¸¿°»$qÌ€N“Ä!ÁL‰ °-ÑÀ3—t¶ÀÉ–¸ž.tZK\ l7(qA4Q¦W`…F,‰®–t¤8ÎŒDò »Š`š ÒSŠ:Øš¸ãÃÁ¶“¸Á‚M„9¢¶XGÄh8ÜŒÄ[Œ2›o‰ ’‚-ðø$.HÊ/ì&K\‡N)‰ ’Žˆ7 I\€yÉñf”¸ Y…x!ž0o“õo‰ ÁEÔÁ8MI˜·à$Ä›`'Iça‹I$qAòžãÍ(qÜ Ä›ðèÅ-Èñf· À».™$xž©—¸ˆ7áÙJ±½ñºÿLVFŽ8£¸c @½k«¸e À½X­‚¸g @¾#‰›0‘eôâ®–U(µ· øþm8á¾û4nQyÀ!`ÍŒ™0-Þ}‹9z2»“ì¾?ö×?]~ý‚Å÷ú§¿]^•wÊê? ð[òXð´O&a¼ÁWK.aÂÙ6¼±…0ð#y؈º‘´X6ÝØH,ÅXnÓµ}Ñk“a1Û¬áÌä–Ѫ^„ -ce½hë»ó|'[{qœŠ•ÞÛù~=™ç»÷ëXïÙ~=™ç»ÛJü±¬¢±^°œdä£Ä­³üßuûå‘à¡^BØ¢cú”Œ=›é;½%ŠøtÁŠxß÷×›X Ö7ߧŸ/¿þíþåŸþí­O¯—ÿø‘w¾”¢¨ï‚ñ'hNÑ Yùî þÀTúËoþóú駱Þ<ô -‘xZ×ÃE# Q†‹J÷ñ¥HG/w9W•Ó~½§¡b½ÓBIç»)\f6³–Q¯KõZäC“j9¹YŸK:)oIÃuUûr{ù_‡6ÅM C‘æ.r®4) =Žb/Mw}š™~–»TÌv¥kSÌ]–¿£åihÆÐE¹É¯½¸›ëPÔ¦·2‡®jCwºªØœÛBÅÎ×ahÒPwiƒÖG]Ê_×}z -rJª ŸŠ>HCÚû$÷ßK)·ÌN“ûÀ¿vàîF Œc[¾µÓƉqaûÎnðÈýr+Ÿ_êÞ.{OŸë=hÖÇíѺ×ÀLin‹Ê,S1ש·”Ðð®‡q RÏç¢és‚Ë¿ÛtØOnÓOºÌ‹0ácÀÐÑ\cóøooþ綿“x -Ò8¼:ÝŠ§fš1{Ø?êg*·Ìc(ÈðçëýÓryæÎoùÚÝe/gœ¸ºÊ¼¶ƒõ:ÇÛøúaüœ4ßûn³&| /´6§5ïçôŸ‹Œ;;ôÓ—ãöR½®ÜVں¶îx®6çùAC?,ÿ¨ŸÌ†çõÿÇùèÐDõÖë:6ð}õ”~û){Š¶Å4øÞûÞ|[1w4ñªã’} 5z—ïÍó!½8“h‘BR(m2¼!ƒ([¥vö0©Özïšv©­köF˜?بìpþþ§ŸþñwÿÚμT¸ßü ê·ûg†ÃÈ–kÏû ìV˜ü¢oÍOVÏS:4¾Â¡”KÝÕ†zýº¾v¡Ú€Alîö®—móÝpŒ½Ýl $y¢îø´{⥔r¨Á÷o½£¼ïv “yž@(:Díß òENó îVl-!©„f]qR]»k™¥î\ßëÚuÜëv8ÓÛw‡GÉó’ýâ»î6ئ†²Ïƒ—îÛ夌 Þ²z¸êQ ^ÙÝŽlܼúm¼È$¾M7UšGvôd}09Z”#þdžo Éÿ7°Åêûêeô'Œû¾î>å„97¥­ø±&Í©±Œ¢W5¶ºMr[ýåuþ,·k;æ2Ûµ^ç³æŽ8þþm}²ƒ8¯+z =“ðNö1âÎåyÄu³ƒ;BÜß=bγ Ë7wY°1\èqBÝh,¸Ù¿–”\ zªðˆ±d76‹jÑ–‚÷ðx2Ï“à±1 sþ9ªä(±ö¸Ý^ϲêräX£M&S¢c–å¿[¿žÓpùºE÷ÓXÍ;®|~.Ÿ^Ð1ƒÝî×Y—ëØA‚uT±£ç)™GÌt2Ï“ ¡›õ¡X{ðKù,lbÊ^¤®_ÊgÙ'ÍŸ•y>è£{84ø†_ûš[™É½L¬h‡4ƒŸgæ2_e†[ï#ÉlXËme¤µ0û—\wÝ3Ü /5>A¬µ$ ß>FÞ¹<φ<¯9hFCíÍ)¼g$ô:ÿ<+”UÔÌuòÍQÑa ¾mëÊR“Óš'ÕË03œPÍûU˜%fÚ‰ˆç^7Ž£äg4ñC‡è<™çéÐiyñF¡­jZ(gBôý~ÀÄM¯çëj^b*ñì ”d¤ê}”>Œ‰gÞ¬œç¶òÍŒSybßý/Ç÷ŘU;Fä¹ãÙçdžgCaxàg>Ñj-" ®¶vªS hýD¿¶5Û?¯ÖãŠ_ó%¡í“Ï+ù­úuÈ÷Yè#·µ£¡Ù¬Ë¯m5z?Fƒ_iÜ’å›w‡>™çé|ì‹6*¬{uäÀG;ŒßÎ3O8“>ê‘ì¬Üað-9yýœÌótˆ;ö5y®EGóù=|&!¥îðlâñ¯—ô͸K£»neÃÌ£3ŠfNÊo—wm£©yÿ`•Ø«<™çéPyìOnV§i~¯8ò6Zœz|B]æ?÷ðE¤>Ø©~¶¨kå5TݸòO~©#µ~päÇ=ŠxÂà7ò1J»‡÷ùNæy6„ƾfx#Lˆ“V²—múyÅÌ{‡n‹¼½|÷Á߇ë…Õ\ð”îîe¾7êšï_núd‡w÷?°ïy2ÏÓ!øÁ¾ç£K>Ý*®ž{|ä¸)}áïkÏ\N#Ÿí!dDåNÃv­Ðvàwoî¤ß†zŽž!™ûùv€Îø¥'ó<:ýÒÿ`zÞoòÑ÷xÚwßAêàwž½»y2ÏÓ!õ¯Zñ"pдÓ-ñÉŒÈæ£M»?Ù+ïãÏ1Êré9Ð3þ¬™Ú!={9ÖµóÌé)wîlî"±û—â¹g}Næy6$¦>éƒQ<äËQ”ø±Ý‡"†‰«Vwʈ¶•”ŽGs§`,G˜=›ˆ°æîǵ­?—7Þ=˜ËÞÙOÝ?4Œ¦Èg7>@àÉ­¦óñšÊÃ#5|þöÕÓÂÈéÊǹEeI×aÓ¹£õu'g>µü—–ªd®ølS>×î~ÊùpQÒÿ’üç‹N´pÿó¬¾:¬²8šzÑÅo~Ó—1ÑbNŠYX¾ªVéš°Én Ç°¤9¥u‹*_S+œ_Ó¸åI{~W³ña`¤j"›ÃºW,‘Óë­˜[¯]Ä|pw\l¹ò͸p© {4¦íöŒÅÚªAè¶B5T×ņª=|¬FýšÚ˜óYÕô±ëô0ü5­ Ãp oTkgé›(åã‚kQµwj2;•šÔÕ”m@¨“ º]áªM̦F]¼ cµt©¦D·‹˜®”æÚH…–*ö¬©ö|7¥CÝÆÖñ‚,÷Q‘þ%‚aŽ([¿®Å|XRkܘðvqÔfb¿]\R»ÎÊUèB;”ÛÄQu¼t)Çî÷oü:c‘ñ‘uüÿ;U¸&eæÉ_45Hñ±“ýªWÂs³‰×4Ê}c’z@Sèi‡îÒ!4ÌŽý¥£Ò3é¶Ô­ÇVÒ¡ËyHÕ<&©Fk±n¨kb¦°Ú?+G¡ªF º.v Êo+q·Óµ©êT«ÌëÛžqçÛ(mÄ5Ÿ!Úìm嘯Â[^Øh3ôc­¤‹j«]¯lvÃ@ -]Üiô-‹ëlmìÄ¿‹P¿öI&­¸·ËŸ/y™3Ö>ÍÀ[ÍGb^—¾þ7Òü„¿ÿºÐõŸëŒ÷uܨƦqëJ<®dü -ñ¤˜P¡ -Û´„†Úïb{ZWÑÐÖqc¾¦ž]ub¯)ucPÝ´£Ðõ>ĦA×h;ôŒ;Þ¦^lŽÌ·ŽM_°ï—¶6ÕX>½³Z…‹±9¸Œ]gû’|ŠÄ'íK:´d†Œ¸ ÅåPaê–­Ìd@Ž•´®gûi -Ëu ƒÁ—¶ë¨/³cÑU–[1$ lÇ‹±`Òc¥ie`ô‡§×7{1Ù×ÀÒFíMú6J[ÃXÚO–Ú|é×—mͱù`‹:y{µ²ì0÷lsrúÔè®­.FŒÒس•n¬”ªlUi](]@¦ª¬•ªM¾d«Ý’[Å^ -ͧèÒ?=íÆQièÆQñ›´\n]ñš·d›äF8‡Þ:ÕS6_2 -2?ænRê)m•më¦uÝuµ½Í nˆïž©êÙÜ&å‡øï#sG<@TJUÿåû©ÅX¨Iklþ!*½‡ÿ–@ 8l•¼;ÏñÞÉv‡¤îŒ5a8²VÍ?)&›ðEz¬Šª?7&gKJlÒû:@Øê4·=î5ÿ¦LÞ{ÌDí2p¨È?!eÙéüËAÉÇ¿æm |Áj %ÿû‡°0 -endstream -endobj -806 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 805 0 R -/Resources 4 0 R -/Annots [ 807 0 R 808 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -807 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 638.673057 101.433071 619.923057 ] -/BS << -/W 0 ->> -/Dest (cb213-1) ->> -endobj -808 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 577.726036 101.433071 558.976036 ] -/BS << -/W 0 ->> -/Dest (cb214-1) ->> -endobj -809 0 obj -<< -/Filter /FlateDecode -/Length 4510 ->> -stream -xœí\K$Ém¾×¯¨³€MŃñ  È°×°`Á ù øÐSš–`ôXùà¿ï‘ñ`f²²»¦[R Øiôt%ÉøHFV¦½ü|gñ_&»ä\R¤ëíÇËO³¤`ð¯¶Ø\Töoñ›ÂÕJK°%æpý‘ >-©—âõå‚ÿv—²ùËå?qùŸm{uK)ÑÙpýóWf‘_RNÉ…UÀ2Ö+¬–”\ˆ -+ÚK,EcAŒÈÑ‘• •4Ä ç²ÂÊÃS²þÈ*Ã%K bØ’²rXgŒÊƒ †È;…gáô¨ñœ]b.®¨¼žMNãy¿ÄD6XW–cÈ K(Æj¼Y‚%2²ÏIãEÈâ£7*²¸œ¼ÆKÅA;EáeÈïÊ*²˜h¬Æ+~ %©¼žÉ)y΄%dïƳv ðM¯ò°£`¤˜žƒ,Ñ„¢ò KðÆi<Y?8|ÊYÙ­Žw·7Þj¼YœK¤ò Œ¯!€‹Å¤¨Avи¤a€Ki¡âH—ýB™²†.—…Rò ¸Š%i8àÏY ¼,¢†ÞBÂÎUyÅÒ°À;È‚xYy <Жà-xÀ-™b5,ðÀ[26jXà¸ÓhXà¸>GÒ°ÀráJEÃÌõÀN <@Û=iXàº>D§aìzÊQÃÜõd†Üõ=UdkXt\¼Í^Ãîzk’†ÜÅ6rÀª ü0jX_Y\ÎFÃîºlHÃ òÒ‚=è5, à® X‚¹».§aw¹¨aeþ5îB‚ž@¬†ˆ÷à9¯a[Ò pׄ?eO­›KÔ° wm†ùT^Yl‚Æ•} -/6Æ¢aAî"Py pð™5,Æ/ˆ¨NÂܵ‘Zãw­+FÂÜEÞ4,€;, €†ˆo‹5p]•WSrÖ° wKNÃDáÅd ‰ÊK ÉjX0^ òP "pá½hX»&x¯aAîBÚ£ò ‹ÏNÃä5àaÛ*{ÉêbBãw……5pטT4,ˆÀ]›ÄÄ—5,€€ ²`§aAÌ´””¢†±ðò©¼¸à:hX ¥ò %Ò°‰õR|É$Y¼s$Y2hX€Œ`)Ù·Z@¸‹ZdA¦¨alÉ…HÂ"ê1hUãE·ä¸Vy<›4,H‰„b«aj©%cÓkX€_8]Ò°b€gIÂT ¶Š†EKvÈÌ5ž…,H²5,@¦ žµdY jX]F•†ˆÐ¨%¡jG†ë̬aA¦¸pª¨a¶ *M ¥Êƒ,€ `.¶ƒ†(~Pl¢ÌQyÅÒ° gÇåfÖ° gÈâŒÓ°¾ÉõfÒ° È‚ŒOÂbâÂi²†€qðŒÑ° ØŒzÓ‘†Ø—\of Š7¨7Qâ)û¶øÈõfÒ° d HQTdAÒT”} LB½ tÒx²¸B”¹ÞÌ Í@½‰Œ^=È\o&õ¸¸ -Iãw‘™F pz™­VÛoHÈÏtfæŠ3«'Ð[Õ#ìE´Jê™ør¤@LT–9ª§«`Z£à/ò1:`Âzú$¨"Ü!!fæÄ‹,Ø„ì~Ô³™¿Ól=ûó/¿|Bð½þñ/Ï¿¨'eýÇ"A¨­ ù¶+0w@öm±|Ï®ŠÉjÌÓ¦2ŲÂvÌÆb!àñ¿ëñÃFVˆÊ¢7*¡ÈÕ?ÏfÚÄÀž::¡ FEà8JNYîóªÈ 9A¹ŽV—UèHÌ;•¤ÉúpŸ’uê¨pà)æÛõúÆ>®W9ï[õúÆ>%«ö,Ü´š“S2Ä=F“¼€Ë_ˆú`—Ü`å;òÁˆ6¾8ŽŸET>†6ÿñ‡  ´I±žÒK!>2:‹ÐèÂõ‡/¿ü—ï¿ÿ§þèé‡çËïÿ(N¿úÎ⯠øEÞ@n½öøìøÏø{8 ¯mPFÃôÔøqösà9\;æ}Y¯5÷és9Ÿ@»µq¿ˆ~4û˹ªÌ Ù"Ú>­s@Ì9nl²ôµò:pøî:|¸'ã¯þëúÃ÷—_ÿ°u’ZÛT'!”¢ÈˆCø©_½­Ë{üê/áN¥œºÓ§7߃2R“ó˃2ŠµqC¤øÕ]‡ïËt€˜“§c§¾óÆ>ŸÍyPŸy5í¨+8ñ ¦]wzncÓ¸ý;/5ë³e˜_fzÞö§ÖgZë|¼Þ¾Ê×é·ö·I»~·Ýì:Oçw:}ÝÊ4Ú=mé¦&øW¼l¦^ÌÛª€7öùt^vž¯Ñ.2 ¯*GOqjŸ£m÷¾3¯궞Æ2H‹o<©4ïpǨV£¥ãÞNvAßUÝcÝcò ì°ßØuêچ׎ã"¶6jc#¬=.Å ŒÎ_I±.Wkÿú7ÿþ¯¿ûÍ´vEwÖÎØû=ÃVòuU¼ö†fÅÛÊ ‰s¾××ë=·q‚XUší™ï¾Š$¬4znóÖâpŽÅr!gÞƒž¦Œõo”ó¬Z|“Ú¢TÛïûêBóóá+mf;WÅ+%á_URz¡¡®qd&¶ÒM­!dÆ)#ÀV‹ÄcßÚ*c[^”ëò†OÒ=“ª­Ë7m‡Ès¬ZçñìŽãDÏ·ø«,Çqª…kN3×Xåöëoµ¦°Hµò³°Š.¯Ï÷ä5sÍu\šÖ¯2Xu üÕ§ˆ+eì*³sëÍÓ&ôµéJñÔÕÞ;Oíëîý;íyÒ/úÜvÅ«ŽUÓÆuÝéœoÝ©NÃ~Ýgë±ö|=ÌïòŒÜÑ(cÒÚ®Êg×þÝNÔjâ~]uÔûÄU÷•ÿÔÚ„uü.Så5ߣ$ôLmü½]v=ÕW:èKè©ÊóÔÆës†ö×Ìù¤¬Õ·Ú:ù<#`hÇaÏíÌû¸v<–ÛùEZÏ*\iãºÇ*=·ö´¶å3 >ƒ¨r!×m¿ÿV{l2ª2õ_ñ¦£žÔ]•ƒ®ž¶Å6`¼]£Á½Hp/ -¼7ôê·cíô×m–î|2tl‘~wgšç3=‘Ýë©ëwŒCs=AÝÞìG}?õ=¾L߸Í}þp¾^ê×Ïm¬¶†Î˜læZûþY±áT_¬~«¯éõÛ±ïT^”r[y«>7ß‘2‡õºãGèû¢ÍUç1Mú&ËÜ3±ºç¿®8PyÝŽ ÿƺÚ\ôÀž1R.¹_…\Ãæ7a_a‹pš—PÙë«ûû˜77,ùr\/r瓱ßéßÚ‚Úx»8ïv1©êâiæûª1ð=V_oYñWkc ú•ˆó{GoëóM·¹>°\ CÞÄßñ ïj¹XÓ–}©ØÊ-õÐs5Ô½‰¡%SbÙMÜÓ3Û·F3Ìr«—SãÐUò¾nKBÚT¾¯À;Ž³Ipc]ÉÉš{r¼»p;Ž]õ}›žÑƒlO´éiÓ{ï{î¾8é@-ÞzÂó–ÂQ)üV{ï ”SÝúƒnÅ Ï­ßMŸóÝþ7‘|D‘Ø­~w6o8›·ê½~í>ÿJ?Þ|]yó¦ëþ†ëþf«¼Ñº»Éz¸|_¾ysøsÉõÞÄ|n?·oýþÇëlsƒÿÞÔ§\e]½Ëÿ?Pgk›ýõöÙ)Ž¥=ŽÉ"Xâq#vs?ǘââÞo”Ãÿ{ü%¸Åä%Tß c“Ï.¿rÀÿÆ>Ÿæ€Ÿ0 6e>àßÖ‹¯ìCÜÅ~®~7á8Ø7kZåz÷-öê!»ê˜.-Ñf2N=WÇ-¢ß¶Ç÷RÀ´_]ÄÏáñ4àp›W›¼â%ÇgûóMW»{òi« Éïíòùê`¢’øQWM û»Š5 ÞÌæ›ì­O6¸¾Ñ[1Sï♹áy£w‹¯Çøb÷oø¹qÈ,@#šC![ç{šÉ®,rÆø=Py6RiAÈÎ $ÌøÓ%ÖG¶m}m‡‰y±Žßëu´p LåʉgãÉv³Ùªh{½Ó³¾ í§Ñª½ Íð;Søyùõíi⢵ÿ©üNj囥fÝVëËŒL%g×/&ùå D -™hÞy…ÌÄöÑŒ±ÈŽ»*v¦¥ì[kLû8o½0­ù.èìz7~ȘLoäëc¶ëÄ -=£=’yõf±Ì/Ë‹oWqˆb—Ä9 ɶsÀÙñU2ÒNA G¢ÓM²£.åH ÕÅI¢KÕYaþÞÖ%aÎ3âí‚iýžú¢Rù5D}¨®]gÍ ¡Ê †Þr„†Òí¢¿3}h‚1_X_æ°sw$íJo§nµ]- K¥Ñ*Ï®¥k~Š2]¿ºrŸv·'¿áPìãûÇ-™ï† [›,üƈ·K ±'ùå’Ò:L¬0¡»ž$z1î g3ýeRSîªÂÖì4~žÿ_¡" *#Oý`i¸¿Îb^ÍIxoòVI’ê¦Ki¶ê²) Ÿ•úB¢´gЭ‡Æ6T¡2AO¥‹Ç 5ÀcK¶Ãë™!¬ëg`¥$š.¦›ä0\ùeCžr†±Uƒ“E+Ü=Œq'9ì|‘ä4,nùÝ$CÞ1®ðùN¼ÕÀF{2»~î“L²3#ÚÍÉq -P˜ä £/•Üwë@§úxDû87™qo—?]j˜s>8ÎÔ£·üª-™uÙëÿ¡Í÷øýï ]ÿ­¿ÛaãÎ ´p[7dÉøÅŒùd~Qc'Žm#ˆŽìO²Í³mèÞ0â¸s¯iv7Ø{K;Ô®$†©CAvÃuõB3á„xÛiq$2ïµÍ Øë¥ï‹Ã4žß -ҥ…\.óäù’¯bH\qÓÒÁ%':âBŠK1a™’mÄd‡”“ Õ³ü$Máy.q!Ò¾ô“G3ÌÊ¡;­®B4A -ìå…˜¬œ´läQ„þæíõn»7‘cßLÐ>¨/’:ÆÔx:Õ×˸½1Ç_ù¢oÞ©¡1–{Ï$gn™ZÐæBú¨ æÙ­5rRê´Í¤=P ¸ÍtÚ1u™bëÖÕRWœU-¥‘SL꟤¦ƒ´ÊPbV‰‡¶­Dã2q©È¯¦öœôf~£f2Vÿ&*µß/›#”úóÿÔõ« -endstream -endobj -810 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 809 0 R -/Resources 4 0 R -/Annots [ 811 0 R 812 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -811 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 426.873057 101.433071 408.123057 ] -/BS << -/W 0 ->> -/Dest (cb217-1) ->> -endobj -812 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 130.126036 101.433071 111.376036 ] -/BS << -/W 0 ->> -/Dest (cb218-1) ->> -endobj -813 0 obj -<< -/Filter /FlateDecode -/Length 2870 ->> -stream -xœµšK¹ Çïý)ú¼€µ¤H½€…6Hd‘EÉ!ÈÁéxvŒxsÈ×ÏŸÕ¥GuÓ3~lÜèq©’Xù©n>^¯ªr¨µ•¬çËûÓ‡…’ÿ¶‡‹Mý#Þ%™´„Ä-×t~o)¡´K>?ðçærmþtúë7§ïás ­åÈéüË;S©„RK¡ä¨TÄâ¨R -¥Ä”Uæ€GlÍSÁŒT4꽪À m5y*˜¡1VGUa†ha¹W5˜ «§‚ÜRqTL°ƒ#‘«ƒ!¤*ÑÑq -“ž=]äk‹ÍÕè¸DO'rQNìéZÈ9§ê鶤FìélI¬Jž¶¨Ôâé2l‘,äê`K¬E<]-³Ó]…-ð®êê` ebO×$¤VU]]ƒŽj©÷ºH)¤*BžŽ9$ø¦¸:D)GaK¦Ô\lIBÑÓ lQ¼<8‘¤ÔêDk´èöt ¶ÄXÔÕÁ,¾G€˜a •ì!ŒKb)A[T±JЪգ@¬-h)âa ¶4·âq@ˆ¡‹ì@¶$Í „a‹"r]l‘¦ $Â4ðX [¢ŠÇmÞâ±@€[¥Æ ¼Uâì±@\˜I Ä•šÕc¹p¥æ±@À\;= ‹p/ Ô•”£ÇvEköX à®(“ÇwEp§«ƒ-p` c®â±@Á]a* ÜEEXÕ?Ì à+!ÖJ Ü•Ôc‚»±` pu% Åc‚»1á¼܉¢Çw£Æ챎Àr³pI~:[XØï¡‹â±…ˆ´ÄcAw¹aûsb´ -\[öXÀ]®X>W×̸·˜åÀ97 ÜÅF% ¸ |V`|ÀŽ=$p—;µ§w96òXÀ]ä ÉcÜ!0Øß\×Õµ@­V Ü–¢ÇìÂ*HâêJ€#±ÇÀ8òPÜÅöÞ<dp—’ˆÇ‚ î’"íqu°EjôX€¼:„­ÓHVEÂÓ»ÄXaOî•æ± ƒ»¶mz,Èűz,€YpôX«†VJöXA‡”ÏÕå€ëä±  Èru°E‹z,@bš´ê± DØ"1z,(¶ eðX€Œ 4Föí–°îâÖ -[)z,ÉBmª JʨÇ0«ž.ÇP píê*t\<”¢[1{,@-*‚Þc,]òX3 cõXPlA¨x,ÀVjDfîé¶ ÉöX€L:f5Âdƒ j¬¨23y,ÀZSí锬ά ªæ`©¢Ç„ *MÒÕÁ`ÂcÖÇŠíä±ÅŠM”9®¶HRµF+7«Ç‚ZaK¤è±¾iõfñXж ãóXÐ(K“=ãÐy,h\QoFõX€¸´z³z,hB¨7Qâ9qÛ$[½Y<4…- )Š«ƒ-Hšš·`êMÐÉÓeØ›z,h9[½Y= Í@½‰ŒÞ=¨Vo÷¸ÜM dòtà.2Ó챨7‘Ùzµ=¼© ?ó•Õ*ÎêžЛ°·ºGöb·*V#¹‡0•eÍU(™Üc‘鮧OëU†;왵ØC6„…"»5Çl&iv=ûå§Ó·o±ùžúÏéñ›í¤¬¿Î/š­°N"±a¹«°u§(0‘kGÛÌ@Ø÷·˜ ¥MPÜÜÌDlÄØlÛy|à£Á°×,f¤2Ûsé:,êÆBIv-ýÜ[~uK‹„]™Ûq\×Æ—¿hØ¿óýßHéãbïF}cÃZ úaCo ÐÚæ´˜ú™·üÓI¨-‘¬d´’ îˆX¤å¤‡Æ¿y8!Î÷á¯GÈã’%u»±%)æ6ÒùáýéÛß¿yóÛßýÃ><žþövÔèš^¿b|ÖËõÿÄ»<ïrÝåÿÿýüðæã㢈C„RËí8® …äzë6µ¥Ë}èm¸Ç£ºêÞííëQ§ýúñx½™úÝñ1Rœ§mç-Úñ®»,¶ÑÒ÷öØß?LºØìçýñóyÛY`ò6áßÿð§?üå‡9á(ÿ)ýo1kÍ:³vÿ\®³„Ê{»N¦3ùãöDשŸƒF;EjV¯Ý º-ì?_w›nŒÝ­û±ôÂIÙ>>ëúŸxÏ×ëÿÃóí´úק·û[×ß}Ådæ'ÃgÊ"—£ïŸË7×¼† ÖáÇ}ÂFFçdGðÆç¶ìjcò_lòÂ\ßïg¾aÎÑ‘Ñ¥}ÿ„©Š>KÙ<76ï®îl“áªÁ#yŸ$Ë.Õ ﶷénÍW·W ²€³É´ ß!A{ä=,¯kò¨{Xä%DòÞO퓾÷vŸË5´´ÞôŸö±{¶>Òò ©?ÃëÛeüpÊ[éÁÛñ¡äC]ŠÊ¹I[—v¶rµr_6Þ&šÏ¹sûVïÃhµÑGvögußõ[Àåboÿa[ð÷'F©`óoap=”§MŒÊ#ÝŠŸNö¥Œ:bäjñÅ&Ü?ÒèK¹7²ËiÛèo["TiÿØFç¿×¶ÍÎûS¿Í’eÔƒ±_Y \v„¸3ó½Øžžïbûb«Ù¯ò0TÂÙ¡®mg‡óÆÅ,´Ó½–á¦8j·‡í dL]žÂaú:u¼,o˲œÏ /' +·Ò'WjÇ齫>»(7ºL£Ú¦Þr,ˆŽurD—“#|E½kÅbý²jv(qÖîH:ÚµÞÎ]Nn»½·4VªŒVuÞÚúÌOS¦«Kïȶ9ڥž©_b„¤<Š³­@_kTˆÓoâðrB­wâ§S*Në4YA©»Þ*”¥ß!®4ýeJQHïS…Ðì2+éìïiH<ÛÖáRv,3¯æ ›C|œ¤UžuÔ›Ö2Û.ÓÅ¥ Ÿ]ç‹+9í º£õ˜±ƒt™²E^Z7Ï 5àqóðº!6„õù¬\…ÔÀpSœ†+?ÄÓÎ4B5Ñ,óâîiô;Åy°ói—±âlglÃÞÑïâó]xÙ66½›ë×>ÈG»ÝlNÃ…)ž}ÚÄ=Zìwýã 2oǽœ~>mÛræhµ^¶¯ŒÖ¬‹ÏÿE›7xÿë¤ç?ö3Šë>iÐ"¶ÄëNf?0¨Ÿ(¶tá›EuÁþsmS÷†±Ç¸ðZçí4ÁÞ[ò (í*Lsq®Y–™IÏ/7³8™¯]›¹a_/¥?†;ÝêVáb}\Ö©“¹%Ÿ—.qeMç–­ÆåF\¬âr°MËfšC®ƒŒ©7ûu] -±±–‹%°K™:ÛìÚu—mO±4A -,ëÅÚ±ò:h;ØãýÅáõÕë¾›œ{˜t }HŸVéx0“àùRÙ.óñrì9²Õû=xç ¾d‰=IÎ ™ZèábõÑEZçm{ƒ´ª]v´oQ—K·)ï·õiÙž¸º³TFN1¥?¯3ÖU“˜ÖUÉwm­ß¾ãlIF”Vw.óéh¶¹dudy½{Hu¶”.»[c÷Ýö¼<†NCòÌLiÞ–îZ~ÿ¾$v®÷ÜœBx­úk;á:Oõ±Q+‰²ýP“jÎ`ˆÚwíEërTòÙ÷<vrBÒÏNÖ‘°AE¨°ýäÖ7á Šö²béªÿ׿­‘ûHŸ7ýzä^a'CÛo®¶Ãºí€h\+í'–bIoµ_†b÷¨h;²÷åp„²½þyšç -endstream -endobj -814 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 813 0 R -/Resources 4 0 R -/Annots [ 815 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -815 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb219-1) ->> -endobj -816 0 obj -<< -/Filter /FlateDecode -/Length 4003 ->> -stream -xœí\K$· ¾÷¯è³•õ ^€áƒ_ÄH€E|r˜íݵÌXç¿Ÿê’Īb÷tïÌÂÏ z¦‹dIE~¤Tw´ø}ãð§3¥Ôœèxútø|°&G‹Ÿ&±:hì¿ã“ãÑYÊ&ºšJ<~bBÈ&×ès:>ðgs(Å¿|søÏúwô¦Öä]<þþYL.9Û¨°*XÖ…£ÉÙǤ°’3b­ jÄLžö¬ 5¨–¨± y_V² {V…>;ÒXPÃÕ˜–³ÐÃykU±DÁ+<M‚Ñ“ÆóΤR}Uy<—½Æ Á¤L.:WMJ)GÐ%Vë4^„.ÑY](”¬ñt )X•]|ÉAãeèâaªð -tw•]l²NãÕ`b-D*¯‚gK.{ž·ÑÄ‚ÕxΙß *…IJYáyè’l¬*ºÄ`½Æ Ð…ð«ñ€1äR”hõÝÁ§ñ"tñ>“ʃ.˜| |‚.6' A†qIß³¡êI_‚¡BEC_ª¡œƒ¾FC©f ‚uày§A°Ð%RÒ 8èBˆ\•]B% ‚‡.а èâ)hX€¶oÑ° nÉV§aAÞ’uIÂÀ…šVÃ‚Ä %‘† Wª`nvjXº÷¬aAꆘ¼†°¨$ p7³p7œ©ò  X࣠® ¸œÍpaä5,À¬øaÒ°¾b|)VÃîúbIÃîúŒ ò²A  ¸ë#† enà®ÖkX@À]O>iXG1À«VÀ]@HÔËè€Õ°ù<4,@cÆ£,Ñ° w]EúSbhe\©IÂÜuÓ§òªqWâV6.¥ªaAî"Q "pðY4,ÆdT¯aAL­ñ€»ÎW«aAî¢nˆÀŒC aò›q®«òª±µ "p°ä5,@6¶IT^6p$§aÀØXÔ¡$à.Ò{Õ° wm AÂܵ„²GåA—P¼†¨kÀCØ*1bÕX¤ÐxÀ]ë0økm®$à.§M Rf‚/@Aƒ*ØkX -™šsÒ° U J>•— Ž£†Ù‚Y*ºP& PX›jÑ° {è¼×° {è‚’AÃT¦:TßêòºÀ]ÔõATŠÉL©D䘰ƒU5^ò¦dÀµÊ+๬aAÎdŠ†XK™‚ ×°o¸\Ò°j€çHÂ\¡ BEä"S<*sç  Šl Pé‚眆ÅCTƒ_°ÊLVÃdh¬%ajG–×™EÂBÉp©¨aÂ+M ¥Êƒ.€ 0?¼ØŽ`ñƒÅ&–9*º„H”ây¹Y4,(ºxë5,€oòz3kXP-tAŧaAµÉp™¬a`$騚º·ŒîçŇŠîCEøPô–Ó”ÝI¢ô¡¤úРÎAÏ®¦u4ûž^#÷‰\.Õùç¸ÿ¢ ìÊ:c Ÿô€¼d+» Û¿ßkðýÉ‚/ñO>î¿Ü|Ra1biˆ•g¿ßkð½ßÁ§Ù}%ç…€| ¼×Àû“Þí%ç~½ÿÃÛ4k7Õà%CTÚå¾JŸyKóøöÓáÛþÛ_þñ3Öo?þùµ®àãð!Þ–ç ÚÖzþàا3ð=B†ò":á¼¹Xñý„O£}ÿ¯ãÛŸ.èÁWÓ‡Ü5wÑNÃ'z|ʹ›ˆnb:7å*&{ÜÿófbMl%¾QÀûÄ×k}(½eW¾ã¾›“ô /ºåZþwz<ŽeYzw¦7#d…¾È¶‘|íôvó4Ôhí°!ùî6\×£µËõK»EÛ§Ù^“óë1´~O oÓ?·Ñ'.>,4¡ûy¼wX›¶Öî‹4{oÇuïöÿÖtkË7Ë`$ö´h“5Òª„!E†…Þ:ûP³útï÷í¤À[Ü|ž³…ÝbÓïŠÁÛKzØ9î‹ç4›ø³+ºñí4É’OUi»yîiiSÄIk¿ÎÙï6lv\yåbágo›žF±{äÔ½}8ŸÛ=ŸÏ™Q EÀ¾/Ýó¥×O=Üu»ÓÖ6 S]¦Ã‡5l›­®ÒV«h_ô–>»…¾§Úl²eu]î$ì¸ó9ªÏô›t˜ÙÚÈû1œõ¿jË´µ¥ª×âû¢Gk·.ú<Ì9n²ËØš|O Ý¿ºl:#rK%blr.º=Ò2žÓâŸ]¯BkºÏ5úÆ—·¶éò[Ÿ¦%K4?ör|WíXvv¼ÁC/Åæ[¿[ù€ˆ›Ž7M×*ìwGlÞƒÏÀk6Ä€76¼/˜æÞ/ýXb¢çž®C÷—EŸ~n×ï¥m>,Ç$ò½=Ë_û}º¦‰³&™UÔí{·ÞûµwõÊë‘ëšaβ8–õDÞ—×ç½L–'. _ ËïÛ¹/ËGG—ôxv–ß·ýˆx g íÈLñBÖöʋϼ»äG[T½jÛ°ÿȾÿêÙ±÷ý:²{+„¸•ÜíQ±ÊtOGeº?"GeÞóD·t¯QFÛW÷sô ”•„ŒR™½mà -æb»·Û°nmø2ˆ‘øîÔ@Œ};÷!FjwŸ~ÄØ·ý,ÄhÑ‘ Gô¦™«K»ª/[TVa£+þ»ŽÔ«6,ÛqÞ“›G?[» §Õ·­0‘¦×ã}«ãDZÕó4ùr¾Ïµðí”ùÙ‰§¨oÔ|åš@âôðæ•÷M„yù!'Þ}~ÄïÛ¹/â‹ —ôxvÄïÛþê5•9}:߯õ »r÷Uû­¾VŽ/pŒút„•éÍ/±£8Ö%u¡—™cG$rþ~ëu?Cc—p«ß&wû ]ÎOyï9ï>Þaá²µð¥=˾KÀxá…U$µ~Ú|î*nTï}ÜØ·Ó}¿éÓb㪱\ÒãÙ¸±o»Wxc›û}'*îY'é÷xŸÝìè \Ý`W÷$™-›¾›Õü‹íjåþ„óÖÜÏ̼[Ðwzúnà -ié_ìfqÜP!ÜŒ—,»mÜ‹,úá¼;¬ÎÑÀÀ^Llž»ÇWmXw6T°·ûå°ÁÃ2ÿQ÷ßmõØ}rµ¾Ü¡â¿Üw;}Gäñ¡îâ.z ùrÍŽYccÈ>¨®ÈHÈBÑËWÛ®_B K›ÍÉKe°RqqåîǷˤí{{ŒüÈtª¾Vqòr“ê "×ïcUîY^zßßáúÃ[iT4Éï @ñd¨f¾Å^»¸Ù.f~à =ñã$ˆù}ñC§¹º/Ž³`FÛq´K<õ=‹g³2Ýü_Ç}ÇuéƒþabŒô·Ñ~¡ÄÊ6†ØÇ°›ÆχÔqíqA›Šqžß'pLdØCr=òã)¨3ÉõisÍÐîxáÌö†ÏCjy1ƒåg5ù9ó[ÄÁ"ÿ¹Mø'”dR/ -ÚCÔ¶‘‹ï“üxà‡èI!ÍÊâ 2—¯v´En*v:¸Àë7’!»|ÕLˆý«}4|~ì§ñà d»Ph·÷Ÿ;Vˆ83¹=™Go[Èü"‚bÂr”†*1uAœ ’” Ο$»`1î‰Vt7Éžº>Ž\¦K“8T—¦sbú»¬Ïb:¯Ot¶ÔG•Ê?÷¦ºu½´ ”ªƒ»ä˜ó¤ønŽñíM&sðŬñCdgbéŽDC®v9…t:¨rKkqÌTRežZ»å§*ÓÕC†Wh'Qñg~³Šˆ,]}ŸIæBu̵-ÂoüŽx:D‘8Éíž½tœXacw=I ¢ÝA.vúˤ¢p\L…Ðì4~‡ÿž¡"*#Oûâh¸?F7f'›ƒ¼6’¤§:¤YÀQž²Â\.çá³Ò^®XEžAwH‹­¨Âd‚žkWAj€Çšì†× 2CX·ÏÀJI´] t7Éq¸òãŠ<õŒ#Tá콳䄻ÇÑî$§’œÇŒ;~&rè;Ú>߉§–ØhKf×/½“Iövd»Ù™ NÅ -“ “G3Íʦ;­Bˆ ò@6LNvZWú(Jqx={Þ•S¦hÔGIcê<ÚaZŽœŽ|ЃwZh´Dì…QäÌИ¥­¤ -j™§-QvJ¶ê´'Š ÙN-æ®SZNëfi#.ª•ò¨)&õ7ié(ge1ÊYI;Yn·g¼Q-…QEéÎyŽÎNÉQK…–äÙƒJS2tÚ¾oZ÷ݳíQ ƒ¦"iV¦vžw’_„_;êÔšTÿm;#®Ì§°‘¨ÉåàC{±ž-)Cˆß’©ˆ­’»ÏùÒg€eOŽï© -ÁfǯHÔUx£>ÍMõ×'ê§U«é>\|œ]½ïݵwdµæÛÑ8̼TäWâ.z ¿É'Û ÷ÁÓ²V[(í÷ÿ"Dx} -endstream -endobj -817 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 816 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -818 0 obj -<< -/Filter /FlateDecode -/Length 5439 ->> -stream -xœå]K$¹q¾×¯¨³€¥øˆà0t0 Ã^ÂäƒàCO«[‚Ñk`åƒÿ¾¿`e2™™Q•¬šÞQÞÙžé ¾"Éà>Ò-þüàðW&gr.)Òùõ§ÓÏ'k[üWs¬jòïñ“øì,%îÄÌ矄’I…}ŠçþÚ<öÙ?Nÿþ«Ó­Ë¸³7¥Dïøü×7I¢`RNɲ’Td]P’˜MJž£’Á+–¢% NäiŸ”À•ÌZØ ï³’”ÁF äÂ>©€ ŸiI`ÃNJ’³àÃykÕ40b‰‚WÒ›ˆNZšw&æâ‹š–æ’×ÒB01‘c§¥c䬥xáb–Æà…‘ÕÒÀ …œ´´^B VM/>§ ¥%ðâÑ;EIËàÒ•Õ4ðb£uZZ †K&RÓ -ÒlNyŸæ-Î!X-Í9ÃÍ ¦aFabRÒg«aw}¶¤aw}‚ -PÓ’Á p×3^AÓÜÀ]ÏÖkX@À]O>jXA1À«ZÀ]@ëæxÀjX}44,@eÆÃ,Ñ°€»®@ý)she\.QÃáSÓŠq =®Ì[ô²q1 ¸ E4,`à.à3kXŒ7Ш^ÃîºM­¥w/VÃîÂn` ÆÁаúÍ8 ÑUÓŠ±%g ¸ Xò@ ›$jZ2$§aÀØXØ¡Dà.Ô{Ñ° w-‡ aAîZ‚Ù£¦—½†°k†i«Ìi«Æz …–ܵ#¬¥w­MEÂܵ©aALBðYÃ0h`{ b&SRŠÄb‘“OM‹ϬaA² 0 KM/”HÃÖ¦„’5,H¼ï5,H¼Àdа)ַꀈ‹êx¥¨aÌäB¤aAâ ½ª¥Eor\«ii.iX¨b§a|)“1é5,À1—4,Hs¤aA*àSEè"“=,s-ÍÙÀÒEšsd^` jX}†—­†ÐÐð%ÑÕZYñ3³†™¢SQÃLxš@J5 ¼&4,Àøˆ³ÍÀù³ 7GM/IÂœ½¸›YÂœÁ‹·^ÃȦø›IÂbÁ ,> ŠFÌd ãH³VÂâ2üMO`^Š¿™5,(ÁÂß„‹§ÌÛ¢ø›IÂBà…a¢¨iàFSQæ-0 þ&ÐIK‹àÅÒ° Ä(þfÖ°füMXôjH ‹¿™Ôpp— IKîÂ2àþ&,[Í··^N°ÏôÄ,gV#ÐËЭjÈÀ{¡­’3°_ñ‘Ô Ø„g™£5€ZE¢³jØÀaÑ.ѧ>D! :3'yÉ‚iA°î›Ï±d W²]âcýóé×/P¾ç?ÿ÷éýW5R6ÿqþ@Qk¸±ø‚á\™ZUA®Dª‚ÁGÊ©,L:Àât&¡Š¡n˹ýâÖ,ƒcáÙÁ˜©oF}»ð†*D×»Ë|¯ûnÿû/'àË%¶Ï]Bøñöüå§Ó¯û»ýç?üu~y?ýñï ôd-g o?¯ø=‰•„ÿ¡6?Ì=\ÒÜŸ~óç/?ömy+îІ×mIõ6\²ÿö ºªÆt Àž%úqé*ï¤L®Æ\[c®­wï.òPçN} -'V ^ ž½”ÇÔ…}ni×Ñ<·zéƒöèaaOì®»ýŸ~üñþñß–n—®¥¯øÉÓïoøA%5Á~êv? K¾Ðiª÷ËPH:Ç Âvùýk×߯œDS¨p1aàW)õ°÷ÙHÙ¾¿ï.ò}ú›æV/ýÝ]àÆ®K·:ÜŠ$%Ê¿ùÁÉ ¼^þe·¡ÓDÓóµN…}E0¹Á°=êÌ›Y¿¡×­ÀñM°Rà´ ,Pp›±¡"ŸYŸ1Ü ßðçP–¡µánC—§¡Lø÷\W+g‰jQµ*V•÷8v½4|ë‹m±+íì‰ÏW„)U§W±Caº™õ³„ÉÃ[ñ9†bëâ†-0bŽ8,ó|â ¥¹X¯ÃõלÀò$^ïk1#¿;Þüë×ÏõÚ×ÑB˜iòqÃæ`zY("¢ÌJi~Ó…±®”@çd¾cìÇÊü­Ưشh^ ª0Bÿ3>û×Õþ±Ž¦N&A888$©Ø‹Rçñ°Ãp"¸÷^-ͳE±ã-jZ¾"È … ¿^Z A"·…c¤ÄóˆF„ü' ÄšhD{¥[2<”D”â!„ßÎúY,›’K®®ÃJ>ƒežÂeå9Æt‹ ­¡·Áy8¶ –Ù½ndÌ2(•³¹8­ôË/¨\^Ž0¢`TaLø ¾—Ø*²Ð,?ºÀ‡ Á–"A¶#¿õÓžÙäè%¢ OÀ@y{äç –yB—€˜MtÅÅ܈E^Dlž ³H5àŸÄ°º³ øz$B¾†Þ!“v*oë–›µQˆÜ üA{¹Ÿ8¥=YzÙý}çÌ“¦,~ mò4õ7üÞèѹiSÌþjúoÔìü¯¤Õ ?O~»áqn/\á'ëmÎü­‚/½àdYˬkZD&©Hìòö,+ó4*<¨1ѯEŸêº×/Ãxš¯š¨:æý¨tfC˜u¬•>n»ÌjYÜUJ×7¢q«Pk^‹ÏõÚ(Ö½°”Ú^$*µ ´¤àÚµ‡·£¹LØw}âî´âDÄ¥šÛÝM¨´™H›çmz«çÆ$¨¬pÉ]}3oÍþ¿²›ëµg}Ò’&d‰ÇŸ)¬ýˆgp{Ò–yšIKÞš@ºF{DzqØEÃl¿Ú[ø^ãâwèÿ€fké³¥._5Íf± SÙmŸLÿ6ÑÚ‡×Ä,È~T¡ÐY–øs®ËÕ·Ål¬ÌóˆÁâKVöÀªžÿÿ‘ÙxCM|r'6¯>Á ‹Éeh”u·i4‚"»œ•Ò‡Ú”e¯g&­ôaÛìØ$ÈŸMJé!mÊ)à;Dµý難*8êSš£)x–¥tÙæBLGæÞ`™ç™Ò²=/ø̬kŽ ú³oÝÔ½fß¾ô=fŸÒöK÷FÃÆŸÆÅä« ø`A¶ßã!iõ¼^Ñ+Ùt¢ ùìS6.Ëéš#!+ó¶eefœ×J· °ò†ŽWJÙ‡E§µ¯}¸Ä•Ú^&£àýÊT,GyS -psIç×»UnOõ±2Ï3ÕYNP¹…ô­\49âÒ+Ðd®Óá]†àsÚºÕ|¦ááf¼Å%\wÏ­èfŽrWE¤˜Ïì‹Öñѱ±"Ï#*IŽ´‰‡õ©»uµcqÒœ£ ©8ÙÐ2º‹{°ÌÓt·\“ÄrÒkd×ÅÝßE+×ÍhÑÊÕÊÂðºÀ¾Þ{BìK_E‘áSp´ÄG•~º†5Lè!‚P@Á=ÀQ·j_Ú½Ï?ã¨Ò‹=ð]}æÃ=’]4ÁñNpç=AùÃu%ù$&­¿‡6vua8E†Û_ÔmÎ~`ĺÍÙz_ßµ:pC A$'÷Í ŸÚ,ó< è唩 iD}(®š¹¹„³µýy#bÛSÇ>Ãð±Ñ ÑØ”mÒ8þ_úI¾kïhñehÊîkMC?ñnÇOEè\=ÿ]]ïÃá•‹Î׺ÎáÀÊEĨÖkÙí-ŽÃÊe‰2Æ)Ij×îƒ,ó<à#×Ñy²ñÊŽ»O8 »nâÞSûÒ÷œŠØ—¾÷0¬Öþã‡a•Ú^ñÊêÃ/vöÆ—ür9RverEq“Ü=¼-d°ÌóL®ëŸxe1/áÙØÄØv÷ŠÍ`në|_çmÃ÷ªc‹ëzÃ}õªcfýÆÉö§}éCˆèí„Ú}Û㧺3çHì´}`­žkÆqN†|)$ßk(rw6‡£õÛÁ2O3…äþEXó`SWPŸeoÚyøPV‡õJ•Ç-[¡´âÓ±¬ïi¸ãêD÷‘7îìo¥ø¹:?[åcà$Wgµ_©‚ªb;<ø,ó"“.Vc.ÿbç+UæúýtËr’K Y¾0%w—îÒæ† ‡Y€ ò­Þ—|v›Cë[ˆQ¥|^MÎoJè(Éä_”Kˆ%(îß.÷MÕ“êñÄ‘N5{$PN—[nÝ4Q} ¤OÞÌt›®¨4éÛz{îÛ‚ÍíBãéöÜx·ÓåÇñòSëš~¯õäyŠL퉀JùWÛnå]ÕÏSÛ?µîÞçwØ ãϧXoÖwõë*6f± e¯S$#‡û¡å6ÿl¡Pçasµ£ÝùJÉúѺŸ[.ù$+Ÿ¶‘=uXû‡)ÿÏuÀ:‰-ý/P}ùæ”­äì燅üq’oŽ‘B&šïF>$ qúÕ¶º`>ø íª.™²ÍØØé×v)t½ØN ;¿”繘Ü×JvÎTO°M +D”ŒnO–··ÆMdùnæõô+r¢¾— -©Ï»T¸<$»`;"kn!{šùqòÖuq!6Öû®sÝðÏy}ê†óñõ„fÖú¡RåkQsUsïzÛh¡cª4*Ï9Û€P'…ôzRˆ?عjP®¥w£&ßܸó,HÔò•9ŸBz=©ù¦Ú¸Tj¹òR´Ì=¿°²ˆzÈ­ãZí£‰šäC”Ý‘{¾çqèÉrÝlk›;¹ñ;âë Z•vä'%7/Xay½žºz9ÛE^ª¸ˆ—ß05gš|±@þ¾@7ª OýÅQ)Yå^ž–Fdn6òº“zzl¨CZ8JKÞ®»\JMfûþrÙ*ùt[îÖc+j×e]nŠnUÇk²kR×Èasÿ4¬ì‰vfÍ-dn¢ü±"/|r›ª²@=£ëÄ[½ 96ìüèÉ©¸“OÈ4~[½ÌÏÄתØhKÑÏs# Yœ‡Y|Zcqa  °ý¨äy¶6t’«Uç_—I¦iÜ×Ó_NUÍÁööâŒÅàä‹h½ÕåÎÿƒwUâI².*©ä»‚xè+Åc×`Y8[±)Ù7Òº^ø§~(dDÿЙò–4ZÔl_õL«oÑe ú‡¾br}£eÅÂôÃÓë›Ç}b9Î3@¨ Úõ£§¶j<êc\?6ꎇyò.=Ôê -ÝÜ ÍÈY¦ÆbZÐê¡—ÑŽš—bS¶jtV .@³3­Õ˜fžâTlî–úÆYí¥ÔlŠ…ú—¾§¹•Ö‰ÜJÜå•zg׬¥Ð îÅ9-og—œÍ–Ì --ö¥•–œa¦íÛ¦uÛ³¶=w¯A #q±LíRŒw9¿GæŽúÅ#-×ü§FF\^>ZE- øP¿CnsŒÀ’OI&Ê]¨äî2·c'ûÉ;é[Âp -Á&'_”×Yø@B9N誚¿6¯+V}¥û:@ -0·ÿ>Uý¤0þ›Dí1‰«(_—¨^ÎòáÓd*ªa £Ð*„Rÿü/C<Á€ -endstream -endobj -819 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 818 0 R -/Resources 4 0 R -/Annots [ 820 0 R 821 0 R 822 0 R 823 0 R 824 0 R 825 0 R 826 0 R 827 0 R 828 0 R 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R 835 0 R 836 0 R 837 0 R 838 0 R 839 0 R 840 0 R 841 0 R 842 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -820 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 766.923057 101.433071 748.173057 ] -/BS << -/W 0 ->> -/Dest (cb221-1) ->> -endobj -821 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 747.976036 99.933071 729.226036 ] -/BS << -/W 0 ->> -/Dest (cb221-2) ->> -endobj -822 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.029014 99.933071 710.279014 ] -/BS << -/W 0 ->> -/Dest (cb221-3) ->> -endobj -823 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.081993 99.933071 691.331993 ] -/BS << -/W 0 ->> -/Dest (cb221-4) ->> -endobj -824 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 691.134971 99.933071 672.384971 ] -/BS << -/W 0 ->> -/Dest (cb221-5) ->> -endobj -825 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.187950 99.933071 653.437950 ] -/BS << -/W 0 ->> -/Dest (cb221-6) ->> -endobj -826 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.240928 99.933071 634.490928 ] -/BS << -/W 0 ->> -/Dest (cb221-7) ->> -endobj -827 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.293907 99.933071 615.543907 ] -/BS << -/W 0 ->> -/Dest (cb221-8) ->> -endobj -828 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.346885 99.933071 596.596885 ] -/BS << -/W 0 ->> -/Dest (cb221-9) ->> -endobj -829 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.399864 99.933071 577.649864 ] -/BS << -/W 0 ->> -/Dest (cb221-10) ->> -endobj -830 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.452842 99.933071 558.702842 ] -/BS << -/W 0 ->> -/Dest (cb221-11) ->> -endobj -831 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.717735 99.933071 463.967735 ] -/BS << -/W 0 ->> -/Dest (cb221-12) ->> -endobj -832 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.770714 99.933071 445.020714 ] -/BS << -/W 0 ->> -/Dest (cb221-13) ->> -endobj -833 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.823692 99.933071 426.073692 ] -/BS << -/W 0 ->> -/Dest (cb221-14) ->> -endobj -834 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.876671 99.933071 407.126671 ] -/BS << -/W 0 ->> -/Dest (cb221-15) ->> -endobj -835 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.929649 99.933071 388.179649 ] -/BS << -/W 0 ->> -/Dest (cb221-16) ->> -endobj -836 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.982628 99.933071 369.232628 ] -/BS << -/W 0 ->> -/Dest (cb221-17) ->> -endobj -837 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 350.088585 99.933071 331.338585 ] -/BS << -/W 0 ->> -/Dest (cb221-18) ->> -endobj -838 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 331.141563 99.933071 312.391563 ] -/BS << -/W 0 ->> -/Dest (cb221-19) ->> -endobj -839 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.512413 99.933071 179.762413 ] -/BS << -/W 0 ->> -/Dest (cb221-20) ->> -endobj -840 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.565391 99.933071 160.815391 ] -/BS << -/W 0 ->> -/Dest (cb221-21) ->> -endobj -841 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.618370 99.933071 141.868370 ] -/BS << -/W 0 ->> -/Dest (cb221-22) ->> -endobj -842 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.777305 99.933071 85.027305 ] -/BS << -/W 0 ->> -/Dest (cb221-23) ->> -endobj -843 0 obj -<< -/Filter /FlateDecode -/Length 3630 ->> -stream -xœÍ\KÇ ¾Ï¯˜³—YEÖ |à Q#Fçä°šhm«rùûùØÝõèîÌìJN¤Åît‘õ`³Èduü‘ðóµÇŸ"Þ•Rs’ãéÃáã\Ž„K]caÿ€ßž$»èk*ñøA œ]®1ät|:àÏYsîþtøëW‡íÇøcpµ¦àãñ—÷Êv¹äLÑ`U°È³ÁŠÑåb2XÉ;Üb­ bÄ,A.YbH-ÑbA ¡¬1X²çKV…!{±XÃט –'Èá‘Ƀ $ÂÁàù蔞,^ð.•ªÉËàù,³KY|ô¯º”R,O K¬ä-^„,ыŃ,Â%[¼Y81™<ÈJf‹—!K€vªÁ+ÖULd¡DÞâUv±“WÁ£’Ë%/Pt±0“ÅóÞEØ&›‹…Àx‡ˆ,,ˆÀ]ψÔ¸ëC% "pyC´°æà< ßœ'˜®É«Žj)Dà.`)XX€(ì¨IL^v0$oaÀØòP pá½ZX€»™-,HÀ]¤=&²p  ¯nkø4’UGHañ€»ä±Ã¸K”«… ¸«aÓ‚”•Š…Ð! ¤"®æœ,,H•ÀCÊgò’C;ZX „È2yE²XX€ÄÚU®Å‚ ‡`aA)ƒ…È\õȾÍò²À\Ìú@ 2E €d®T rL¨Ç U‹—‚+pmò -x>[X³8„boaj)Wàôà¦K@ ð¼XX+d«XX€PäJ@fnñ6ª©ž-³lDÝ6ÀVb>á@÷8Ä EûTù5óßM»(:oV¶O¿y­ø„hZW:j y)?¯+þ®!_Žâ³>~Š•‚©øª«h‰S wq ¯¯wýõìVÑ‹Å+äÝèz×Ï•nŽåô¸4/inÍnImù–„w ùò’¤ O_ô¸²Ø&öºäeòòýwe/^O“<•ê­Ñq‹‚jðqû,Ϧ.½*V}¤m¥tœê¯Pƒ>?Œ(ºTß}ÿç?þøýÐ@_Mƒ€®½"]([dV^ZûÄÖ'¬Îèÿa§P Ã@n§ÉÐ'qÌË íU»sÌÿ»b—WMbJ…MÃò~Ý*}¡d6® ƒ{¿}n§±¸ã]<ãå½ÌYn7‘Ç)‘šÆöìwëßäëôw/0)}|œbØ&µ™NäÉ|òv½™ǵ7Ó’ÇEæÕqÆ¢ -;¸Mõý¢‹ŽŸ3?¤š/6¿ûÆ|JÙúkX¡x¾f…ôp˜<¬;ÒSðÍ"ZKÑewVWi¿x©—T鮵_`u¢ÃÏ[]·¨¼UlÃdu‹ÇlÖV9.-éq†°_ðšÅaf=\îKÕîòÅÙ[•kövu¿Í®.дfo㨩+T’¹ï¾4DïlŸµ±–9îm»É7›YmxAÁÍÆG ä~n°ÙT]ƒ ¢Z«Ati§ ½Ï×nóåÑGÞoózÃ÷äL¾°Ÿo±áÓÆ£ëë®>°Ùú=*³Ê—}èqb§.ô¦™®í4i5©é~L<f5›§ÒéÂKgYkÑ“ÆÉKíØ2¼wž'±>Ô—Î.çYîëa’Û_“#±<' Z,GžO¥f$òú"¤è„—s/–Dëø>o,"·|c³¦f›õ.Èxº”cµ´µßrÍc Õg·L?P5¶ý~Æ;dç:û ©Ó¤çwÓØwWuÏõ±Èš-nëäÑ^î}ŠqîO—r}ê}Ík /ŸîwZ¿§Þi›3®6Û×ÙöÉû}~Øž|e­`£¾õ«Ïƒêô ­Çœ›]nĘËÇn­ <ú³nº1¥¾òŽ°JNâ³;¼_ÓÆL¡†pRàÝTU `C¥«¹lnÖ@óýÚO-zñmûWÓVúRù¤i›·ëæ®óV†‡ JNÕvóÇÉ-Òp½§{ˆí.¶ñã!-o;øå7Bu郾Lâ4^äzÔ7, -±ø¶m~Q´?>3rù"ÁÇÞkûnéë†úªÉúŃ©±õÿ¸løD ä>-.,ïÓB.¡5ùé ï‹AÁåY‰Û%õ¹Ä÷XÕh'$QÙÕóžHQh»Mó–õ2Äv7:>¶azJ'Ô:ñò„z]Ø bdò—d½{r~#ë»ô(d·Vê¢ÄÔdqL(sß1áx“ì™&b¼$Ò´Ü ë!pëúeí{b}VŸ¶¿õ yÚÎkÄÓËò9õɤjÖ¦jÚ Ôi< U;5¶ž}C¤ï“A: â×Ô¦lfçO»¦ïA­ÄÒ Iz¿Úú¤ÓÁì·ÍûNåÞ«Œ¡µi~ˆ2LKW¼A;MI_Ö/M>BÜ.÷dÍ?ú^S™ì&\OÄc¹ ?b6zÇ›éÍDžæíäBÃ^5—¦*¸f£é[$úw…ŠØ©Š<Ë…—nRú&ØhEÔ7;y¯¤™ž:ꈥ/yôÔåsî6;ëË2ú+èöÞ]c;ꤲ‰žkOAªƒÇžì»Õu²BXÓOÇÊ™HM,7ȱ›òÓŽ<äŒÝU#õÅ’ŸÌ=öy9uì|šÉ¹ï¸××úº¼}ÞÉæñ´69'«é—¶È ëS³f>}±‰8( ò€Ñ§…ܼµ£“~U©]'³"îéðóa scÐcÍÄ^ßRŸ³.üú¼Áï?rüS{-jã:Z„Ž­;òÉô;MåN²~Ç©»ÛLÄ ì²/£olÖÐãx^ËNØ[OßÔwîLŒC‡9tÓ ž'ÍÄ+ÄÓ™{"ó©{3öÚävsúà\_¨kR¡1ßšeðx„äã4%ZÚu„tp%Lј'EsZ°ÉvbªA΋tÕ«ü2oëZScJ#´Éƒ'#ÌÎS7ÚrS¤À<7æ‰ÅÏ‹Ö<†Ð¯v¯OÞ÷MäÔ<@©Ú;õi¦öSj<›ÊK3í›=æðr®Þœwh¨ÏÅ“ïqOr†kŒÔBvÙF'jöq^Tm·h .@£Fë3æ&SÚ†5µ,w\L-åžS êϳ¦ã¼+]‰qÞ•tÑWçm¯gKÜ 8›swG£gÏ%‹AKóèN•Ñ“írmٯݢíqº ‚¤‘™Ò/z¾ -ÿ^ã;똳S«WûYNF|/#P‹Ïxùn8•”¼¾ ’> -endobj -845 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb221-24) ->> -endobj -846 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb221-25) ->> -endobj -847 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb221-26) ->> -endobj -848 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb221-27) ->> -endobj -849 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb221-28) ->> -endobj -850 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb221-29) ->> -endobj -851 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb221-30) ->> -endobj -852 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb221-31) ->> -endobj -853 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 605.596885 101.433071 586.846885 ] -/BS << -/W 0 ->> -/Dest (cb222-1) ->> -endobj -854 0 obj -<< -/Filter /FlateDecode -/Length 4350 ->> -stream -xœí\K$9¾×¯¨3ÒÛ~IhH‹`ĈÃLí õ øû|áL?23ºªºvW»ìöôtWe„ápÄç§3ÝÙâç ‡?™É¹¤Èç˧Óç“5)Xü«%6•ýGü¦pv–“ ®ÄΟ„@ɤ|Šç§þì.çâO§¿üìô¯mwö¦”è]8ÿûƒ°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ ±1BbÏGV‚\rÐXƒ½Ï -+C âäèÈ*Ã'Ç b¸’Ârr8o­Êƒ –™¼ÂsÁD(=j<ïLÌÅ•—ÀsÉk<"»à4^11Æ5C–P¬Óx²Çl5daÊIãEÈB‘¬Êƒ,>'Òx ²xh§(¼ Y`]YåA­Óx…L(™YåðlNùÈó6˜‰¬ÆsÎØ&©[Ö°€»>a PyÉÀIÃîú€!h+7p×ë5,`à®g5,€¡àU£à. $èádÀjX€õkX ¢`¯aAÌlJJQÂX,xùT^4¸$ Bd©<ȉ5,@`m -•¬aAò…¼×° yÈ‚AÃD¦8DßjzY`.j~À‘¢†@2“ ³†)DäcЪƋÞä¸Vy<—4,H‰ –b§ar)“áôà„K@ ðkX -d«hX€¥ÈdÈ\ã9È‚ [ÃDºà9§aAöÑ †Ùgd™ÑjX€¹$T­ñØJž™5,È„ŠÀMi)UdLhX€ù‘d;hX€äÉ&Ò•Y(°†9{I7³†9Co½†°MÉ7“†ÅBD|„ÉÆÁ³VÂâ2òMÏÀ/%ß̲È7‘â)~[(J¾™4,( YB•Y4ÅoIÈ7N/B_X£ä›YÄÈ7Ñ«[YòͤnwC2i<à."Ó¨a.o"²Õr{ à ñ™ÎÌ’qfuÇÀzÖVuËÀ{±Z%uÏÀ|%GR7 &2ËÕ],«`:«nXà/â1>`²û4oQE˜Cš™“ ²À-Ñ}Ï9F1z¦Ø²?öï¿Ÿ~þ‹ïùïÿ9}üYÝ)k?bAœ0Ùö³ýé… =D\'òÈ‘éŽL€éVà÷ĺkQ‰—ÓDF”tpb±O[:²º\éSw±æZz’m¢^¦‘L䧒d¤;r½ìèn&ÆÑî ‘>ÊñŸà‡Ë®ÎÇ…'e맔_þíüöÍÉàJ?iöŸœ¼ÆÁ¯)9OYD]¤ûò ÷‹&áôמíB«¹é»]?¿^¤²"1¿_ˬ4Ì[i/~û¬4¿ÒÖök[+ËzM“fÊ:ú«æÞ­Ÿ«F«&wmVÙx7ŽUÛU–ûuXö:´ï'=ñÔg4‘Õ^Ö™Škóqn–Œ%×Ú¥Ðfx± iCÆá¾>¶In}Èñšc;UïVÙB•ïšÉ?'‡z®úçU¯—Å:ƒSe“cVѲEi[dóqÛ<µ9ÙOóñùltÑKýž†ž8;á°³‹Ë"ã°ÕÑÿ°ê8LváÖï½ý«z+û±U»÷“g¯ú“v›=îõg?®²¶r{Tp‹½oÆ°¶£Ëµ6h L¥½ÄŸµÁ>có×ÉÇÓÐY+[ù+†ØôzMŸäöú «>»L«_µöœ» Iî1Þ‡„a Ò B¸ŽS_­ß÷ʸ&+k}-³·«ÃÍ{_ ý´×¾ª­õº4Ž‘ÎkB×N³«V«cd¾Õs“ävW§ÍRr¾{x>k¤ÖŸ0«ÚûUœg¹Cÿ-àü±¦“†×ñŠ9>'Ç7ÆùcÛ?œç¸Ûç¥Lí3.uhç ߶oÐãš>óAŸ×°]m#Èé•M‹¿žýé«·5« ‘ŸÉù’ó&‘ä\ÖdSÒΙÈKë<”Ó­ ˆñrø ã5T¼±&Ø’-ï³Ç­×E5ýÒQèò8¬#OK’ò›7o~õë?$…?ìBÖР¸Akƒ¾õúc™Ÿí¼ W+r„p×yƒƒ%Ìض»@ØîiðÄsæň¿žÊõQx_^—NÎkçÌuþÒ…·j9ä‘mÒjßî;Ê™a'玵ëˆøV rª%d1 -]·®'»ykú¶[`±6}Kv–g -Š“s(è/ŽªÛÄ­ÚÙÃO2GMëwé e(—5Íwûêß­ÖäÌ1åè£ÖÚ»)TÊ“×\ñ* 4ä·ÍÞÞöõú,¿Ø n4Â_e#ö.`»¯Î÷ lCÞœáL¡`4`;ÆŽ«ÁïÖA‰QkœJëz¼Ÿ²õÓ^¶y˜²ƒÇ¦î1—5r+ÛÞܪ¬òûî–!{ù|Œ;uÞå–“ÑÜàPû&$ÈáüL®äðP߶ãñÞ˜LqÞFRûŸfÔnµÛ!µÍÂîzÏïí¸gœµ=6ÊÝ€ì0#tËYï«óƒqVyr@Î"úg¢ÖU}Ó \Ì€ßÈﺸËœÿu6§Ô¾Ýw†‘ö­vO¶Çãsíx‹œ¸Ø‚ÕM“bY›: Ý’Ê“<Ûˆ‹ôˆF<ò7y: €ð€F`C¦H4®Õï§ynQf[+o´[`Ø.OW4ä@#¢‰÷D4J‹ÆŽ­îa»Ãõ6 Q®'®Ð‹%Pö´Úï–qVkØG¾ šÜ€Y0º.Þuèé·7ÄsÕœ*Ö“ÚÅ´Û>/s9'œûÄPßØ8nÈs•Ež`ÚuZ·åžIÚb¶ úä9e' -Ë7àòÎ:ßä.Òw‘»EXÓÔl·jz¬?m{UÏÚçrû*o½qIÛ‡½÷òë–Š£XQÂ0®XQ·4¶?ÚvL·¢y; Û±Ñ8[§¹·íðš%y¼v±$^G|Àî«òC³Ÿ„Ðàšý¼MëóǾo–'ÈB‘'Äõ[¥ÏlÁ¯Q¯ÛïJ¶ßåÁ¬1 n¿ËJKë¶î÷¿­žS‘£“ß?¶­~lçeÛêÅ…çä°c,m«Ûþñl«Úíÿi[}ï ßÏ-Óö:¼û–©Þ^q»önl«ÿq}d+…³döX‰cñ¥LO€õUõf‘«h[yŽg‹mƒ4)ïjB¸/»%ÉãÏ…&bÖ>7«Óܦ¯,¡W] Ö…Á‡azêÞOP&¼#QÙœýù¸LOM`:ÌLðæ_û{·NÇe¸ñ¦ý°ö=ÉÓܳ!´1¦ñó)ÖÇt]}UƒE’í¼¼ËéÙÌK9Ë£ÁÙ»6m®*¹°^³¾ës/µ¾ËÊ{2äé:­óÅZþsðOXÝ´õ¬¾ÀÆV2¢±°'?$Èg…Ì<Åd!®_mo‹]_cí‚0QNJîJ -¨­_ÇB,‘ÙòÕ‡6©Z5y°K´oWâKÇ -5£;’eôÖ¸•,/ʆ֫ØE ±É,§C{ƒ<— ŽŠ7ÉŽìD G¢ºdÏM'/ 誋ƒØEŸUç¦éoe}š¦óñrB·´§>©TyõLkªiAm£Ñ$TéÔÐJö á>O -IŽÒˆ_ØÖ4c2;š5y€!æfHÜË•VN!]Nj¹µµÐg*õRyT-MóC”aê”»âÚe -V“¼ÕnòKíë–,ñPŸk›'»ñâå¸{â ×ãÓÇÒa`… Íôf"Mívr¶Ã^5å¦*¸f£ÉãÏòwŠÐ©‚<õ‹ãnRò -ƒq5:ßìä­’fzì¨Ãš§QvR—K©Ûì¬/—­R^@·—îÛP'•Mt‰°{Ó±ƒÇ–ìºÕu²@XÓOÇÊ™h›ènC7å§ yȺ«Û;‹n2÷ÐÛäرói&§>ãNÞGÑåííN6߈—º°ñž,¦Ÿ['ƒ,;ÅÍ|zgqPä£O•Ü¼µ£“¼c¯}N¦­¸—Ó?Nu™ó¼Ü8ˆääõJsÔåÎÿE™7øýç‰Ï¿kçþ—uÜÛŽ¾cë†<¯dò2¾|'Y^Î׈Ým&¢ç öÙåQ64kèë¸÷^ó¨n°·’®#¨ëÜ™†'²ï¦ëMš Wˆ—{ óMçf,ØË%µÁÉmyD“ -ópp™Æ’|žšÄ•K:¸ì§Š¸˜ÅåÔa’măœ;éªùyž -’¾¦‹)ŒK<ËìÜt£ÕQLEÓ|17Ìnî´läQ„~ؽ¾ñ¼¯"ÇæBíÐÞ©O3µL¨ðt*Õ˸½ìkÕ;Íy‡†z[4ùõ g¸Æ-xs1ÛèDÍ£ÚZ Ìr£m:m E‡ Ðl£õS“)®ÕšZꈳª¥ÔcŠAýǬé0ÏJWb˜g%ÊJ»mÅëÑõ(ÌæœÆèì(ÙcɬÐâ\»Sy”¤F;öÍÛ¾Ûj{ž†ÁC8"S;ª…CɇðïßQÒJµŸº3âòxjv‰<Õ—Û#0„å½t‰ó´Uòâ:×÷NžËܦÃ0‘MN^O­‹ðF¹Í˜šj¯®Ö««ée -P¶†Ìérõý¤õ6LÝ ê—IREy1IЛå-ŠÉ>óˆ¯Û(q³…RþÁ=aè -endstream -endobj -855 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 854 0 R -/Resources 4 0 R -/Annots [ 856 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -856 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 432.754475 101.433071 414.004475 ] -/BS << -/W 0 ->> -/Dest (cb225-1) ->> -endobj -857 0 obj -<< -/Filter /FlateDecode -/Length 4386 ->> -stream -xœÝ\KäÆ ¾÷¯è³WXU¬ä Aâ AŒ,’ƒ‘Ãl{'F0`ç¿Ÿ’ê!‰Ó­níw0;-²,ùÉ–dÏ„ŸÏ-þËlMÎ%E>_¾=}w"“áßÔbu1±¿Äo -gKœL°%æpþV>™T‚Kñür›˱ùËéŸþ³îcÏΔ çï? ‹½I9% - -«€EÖ+¬LJ.D…­ÁKÑX#$v¼g%ˆÁ%1ع¬°2Äðœ¬ß³ -ÄpɲƂ¶„¤°,AëˆT!fïž &BéQã9kb.®¨¼žMNãyobb¬Æ+&ƲÆcÈ -Y K°Ì¤ñ ûœ4^„,>zRyÅåä5^‚,Ú) -/CXWVy…"YW¼ %3«¼å”÷³†ÀxƒÕiX€»Öã¤ÖxÀ]ë -iX€»ˆ‚†0chX€óÍX‚骼b¨ä¬aAî–œ†8… e ‰ÊK†d5,BªaAîâx/Dà.ï5,ˆÀ]b„=*²øì4,@\ÜVñi«†BãwÉb‡5p—( "pWŽM b‚Ë@@ƒ(ØiX3›’RÔ° !ŸÊ‹×AÂD @–ʃ,œXÃÖ¦ø’5,H²xç4,H² dа)Ñ·š@˜‹š0dA¤¨aÌä¬aA -ù´ªñ¢39®U^Ï& Rbƒ£ØjX€\Êd8½†x#á’†<ˤYà*à(2Ù!2×x² ÈÖ°‘.xÖjXdA4¨aAvYf$ pB#—„ª5“ä™YÂÌÑH¨¨aÜ™&RåAÀ„†ØI¶ƒ†H~l"ÍQyÅÖ° g'éfÖ° gÈâÈiXÛ”|3iXP² âÓ° P4&kXHÂb3òMÇÀ/%ßÌOÈ7‘â)~[|”|3iXP²„(*² h*Šß“o4^„,®°†%FÉ7³†3o"¢WKYòͤ– €»¡™4p‘iÔ°È7Ùj¹=xCB|¦3³dœY­ 7àlUKìÅi•Ôš|%GR‹™eŽjÕÇ*˜–Ô²ñæêÓX¢Š0‡„33'Yd[0¢û–sôfþ•fs}ìû~õ„Ã÷ü¯ÿžž?›*eõÇÂø=GI¬ƒ¸ˆ+ØnÀ•™†ã©˜„ø~#B¾ºˆ©t-@q)¹‰ˆ8ˆqØ–sû`×C^‘Ø"”™ÖÅã´È,6ÊGUÒ{»¼¹¤ð,äõTJçuE•ñVã›ÒyùwÞ¸!¤CbtXÈ[ßVÈÁÔ€¶y™÷°yëóöö9Ì{Ø@õysY£xŽ¿lþ­Æ?–…&`Ýa!o5~c!}SŽ“2’4d¿èƒG¸4O_T ¢ÞÙå-öœŒ“˜?¢•/Nb$|Èn‰Wûá„ãr™~þ&¦]ZšŠ£aèÖÑù÷§_ýñ‹/~ÿ‡¿aÚϧ¯~MÄŸ~ó¹Åßç¿–¿õ:.ü´\?ãï?Ͼ¸27b*’8¯ç–é§?õáë°B~¡Õ)}çᨤàú5=´[èAùß\NŠ”ˆ $°Þ žouØdäÅÚÊnuŽR&³bï:OËá[H‡¸ö êÕÚe‹.›-«º¦µ~ý'ðè€ä,EtĈ¼î×’lãÃéÖp«3R„¯È©ÔY@žácÀiýŠÎÄ®Bµ«[ƒI a¤‹Ê`O]±Íwž¯û}œëÆm Û¯mðÇYÐß}X#T–ï,²L))µc]µ7IJ&.¤” Y¼ -f 6Švl.vÛÅy×Í¿êØüž×é²´©ã†Ž@mÜc222^æµl[c›d•ß§[Vìäcp1nÔyÈ#6cñ}ï›` eèìmÉ᡹lÇÏ[C81™¯^ØQÚ`gÅÒº ›ë-¿cuW•À7Å)‚DBk²ÅŽø¾z°ÏûqV©‡f¨Àê‘몾i6fC8¤ö°šâ Z©tYÊÅ*½oσab´Þáipûëã8Â^*8Ø4)惩ÁÐ-©œ—oñq‘шã8}'€p¿F`C¦ ƒÓz‡Ã>×Ȳž”7Æ-0l›ŠóW4ä*@#”‰GBJ Âö£na»Áõ1 ¬rª-Þ¯?KðÙI…qßûi^çd Ûp·B“tñÔ §U–Äsã"A<Ù÷äSÙ"lŸ|õwùëŸþþ—î«.Ï{ä0Ê"‹Ì¹|Nóø0_á ýy’k^}ŸTlçBͤ2ýú¸<›¡Oîȱ¢°| .õù!æ‘®9J×PÓò\Öa@M¬Â6ÛPyí“÷¤nï­½]¼ÌßaEN¾m|ÝŠš…¤ÙBpžOó¬¬h -uëÉ“¼{ ┓ÝLxÍ‚ÒÅS8xçt¬Ë»³Ÿœ¯ÚÏhbYßÀ( ’´ËÁ<ö‰É:˪5Ø\C%ü†ásµ„\¦0ª¦åï׳åÌÞÈV-zðÈ ó79ǾO}c™cׇç9šWÙ†0nÃW¿~E[7öûJç4iXeê+ë©‘Ô’6myÑ~S¤Es±Ï-©”ãÁ-LýysÚ\v˜0®·8Ã+LÐO¦Žã8ÑË÷§rÞ~œ¹HµÈ§5]‘ƒ]~Mêk+hë›,röAE6¹W3"öD̸›–Ô1,sŒ:«Þ0y•üÆù/ k™>§®'®c‰|V=[îèy}÷iÑq]ë€ñ¡Uo¼]ÛäÅn‘iÐߌUºþèy‘µ¶«}C—ôºùìì}³.[Ç" ¡Í1âÂC?¬5<-¼Á7¦Tþ²Œñ¼Ñi¬4 VÚGZó˜Wu·: ±ËÕ‘f©ž¹K;k¯ˆ7ãÏþÛmzô¯íY v^n”9\}?ØççN~Û1˜å†sGz¥êÇ-»¯'ou÷½t÷Þµµ¯¼ï{ß[z×uûSÔÞÐÛP|@oCõýA½ å÷WôFôPý]íàC&æˆæxþ`ŸŸغ¼È¥ …B·‡Xèû8ri÷©ƒÎ{,׿ÕzÞ¶´)Øb¶›m:äî‘,ÁŠÖû&ÔDkÍô`=4·#CÉ99v½AÜ!Í!yeþWJûºg¸O7%Ès^nH»Um:Øçý¸q‘‡rXJ5;7~øûz¼°?”±×âÝ[ÆÞ÷¾§Œ­Ì}Ga?!H†ðVÅöåÑ/ ¡²{D#Þóˆ÷kÄË÷„ERmîÇ ûòØV‰œJ¾¢¡» û’g›åØý¨öå¥{ݯ?†%ÔØkßû§*ìG¯ˆšù ûëI¯•eå9“6ööyo…Ù˜â5Ä}×…ýdÓ5+zûÂþzÂk”ØUk8ZØ?Öå½ÙO -éªý܉&? °Ÿåþ~DZD÷ös·Ì_\q¿Êx¸,/Ou%Î7D,%ÁçA¦e)׶Òe-!>/ö4ÿuy£ƒ8Œ¹*‘îõò¶%ø,O±¬¼÷±ü~œûJð¹Ä×ä ¾–ÇJðû±9%øb·k{×%ø•ßÐTv?æ/]ϺŸt_/Û_Õ¥ßêòXyùü¦eûé)±•,7Êö_.Ï¥p– -bÞnºÿ¬>ÎÔÎ×›Mnœ§õ Úßµ¶›»ä×a -†”!$Ï꽤ˆk¸Ü]uºé²~ëRæ l:ª–ãÁU²‹™|àpøVÇÒâÚq0‘²¤2 ªŒ{šæ{Z¶ãÒ¡`5~Xæä©.ÞÖêvÛøÝ)NÏœÚé½³±N^LtŽl¼ìK9Ës®™È¿Ó¶ŽKûï¦ ÿ'%›XÏÆém,4‘—…-ùå$á>+dæ~ÀÞ qùHm,¶í¼®´ Fä©Û–ÇhùØu‰Ñæ.ÔÕHÿP»ÉŠLµ‘Ÿžœ'Vˆèíž,«'c²¼Ñ(¿\Å&JˆUfû€<¶íöŽ7ÉÖÓ@ {" Óu²ã*•'à›êb'6ÑGÕÙaûk[—†í¼F¼œ0­ßR_Tª¼G¥Uµë¨Ñü TiÔP[¶ á¶O -érRˆŸSš±™?ìš<>s5$níJm§.'µÝ2Zh;•Z«Ü»–ªù.J7uŸ›âÚe|“¼¢mðòõãš,1UÛkʃݸñršneÙ’_N!)­CÇ - -ÕôF¢ÆmäLÝ^:5åª*¸f¥É³¼òÿ ¡Qy¦–›IÉóøýªO"¾ÙÈk%ôØP‡5 XN½í .›R³ÙQ_6“Ò^@·µn[Q• ôTªxR <ÖdÛ¬®‘ª~VŽDªB`ºNÍ”_Vä.gh®¨Mí`î¡ÛɱaçËHNmÇ­¼\¡ÉÛÆl¾/ÓÁÆ[²˜~®“t²Ü ^ͧM6»`…Nî0ú2‘«·6t’ÆÕÝÉ´÷rúæ4sÎ'_?Doå]AcÔeÏÿC›/ðûïŸÿ\NŸÏqG -\ÃÖy<ÉäÍrù YÞ4W‰Ím¢ãö;ÙæÞ6Tkhç¸s^sïNØkKÛÔ6îH ]‡Ù5ÓuÖš Wˆ—[ óC÷¦Ø󥯋“¯\äµU*\ŒËÁeî<ßäó0$®¤i?Òå®\7tÄÅ8(.‡ K—l%¦ä8IS½ÈÏãVx™k¸Â¹ôÇý˜‡®´iC„À~¼f;NZVò(B?ì^?xß‘cõ¡6hoÔ—‘Ú&Ôx:ÕO—q}ÙÎ?}'P·k¨åßó-Èé®ÑC ^]Œ6:Psï¶4ã¤\i«IëAÑà4ª´6bª2Å¥[UË´â¬j)µ˜¢S¿5Æ]iJ ã®Ä][·žx-Zò- -£9§¾:ê-[,™Z{7*÷–¾ÒösózîzÚž‡ep$öÈ”z·°kùþ=â;sŸMBkU¦ÊˆÍýu.8¨Ù&ïüô†^Ê1CX^²–8¥’»û\¯ì+$µv2΄í0ì=%+ïZÖEx£Üf CÕ÷0ëÝ -©KºOJi¨Ãí*CÓË6§/d¦Q»L’*Ê»uåÙϜ啀‰¬þ /e”´*¡L?ÿLçE= -endstream -endobj -858 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 857 0 R -/Resources 4 0 R -/Annots [ 859 0 R 860 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -859 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb228-1) ->> -endobj -860 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 446.531993 101.433071 427.781993 ] -/BS << -/W 0 ->> -/Dest (cb231-1) ->> -endobj -861 0 obj -<< -/Filter /FlateDecode -/Length 4391 ->> -stream -xœå\K$· ¾÷¯èsË”D½€À‡’ b$È"99ŒÛ;6‚q€uùûù¨*=ªŠÓÝ3;6Îf§‹Ôƒ¢È¤ªªí™ðó…Å™­É¹¤Èç˧'2)þÕ›‹Êþ3~S8[âd‚-1‡óBðɤ\Šç§þÛ]ÎÍŸNûÕé_Û>öìL)ÑÙpþ郰؛”S¢ ° -Xd½Â -Á¤äBTXÑ,±1BbÇGV‚\rÐXƒË -+C ÏÉú#«@ —,k,ˆaKH -Ëä°ŽHåAböNáÙ`"”5ž³&æâŠÊKàÙä4ž÷&&¶Áj¼bbŒ!k<†,¡Õx²ËL²°ÏIãEÈâ£'•Y\N^ã%Èâ ¢ð2due•Y(’ÕxÅ›P2³Ê+àQNùÈsLÈޓƳÖئWyð(lRL -ÏA–H¡¨<È<9ç! ãGã'‚O9+ÞêÄ»=y«ñdq.±Êƒ,Ø| \„,”¢ð #¸¤a€KÉpq¬€ËÞp次€ËÅpJ^ƒW‚áX’†ž,xÎj@à ²Žx Yž«ò ‹/¬aw 4,ð²8öx -ÃZ4,ð€[¦b5,ðÀ[&5,ð\ˆIx ®Ï‘5,ð€\˜RÑ°Às=°SÃÐ…»' • ®ƒ†‰@€,•Y8±†H¬Mñ%kXdñÎiXdAÊ a2S,²oµ<€,0µ>`È‚LQà ™É…YÂ"ê1hUãEgr\«¼ žM¤Ä¡ØjX€ZÊd8½†x#é’†<ˤYà* ™ì™k< YdkX€LÍGTæ3s’E¸#»ï5ÇhæŸi¶œýôýéËßó÷ÿ>=þªž”µ ã÷¥°â"®`»W¦« I.ðÙV !àkúˆ© !-`q=t!Šn˹°[‘!±Èl‘ÌÔ•ñ~¸%¤ëÝBÞhüÆBú6/’ bHƒQ_ ‚ˆ¸f6àJD}a—·ØsBŒ¬*¢•/N¢ õñ¦ñoÞŸHëôËYw¿´>4¹;ºut~ÿãéËß¿{÷ÛßýÓ¾<ýý×Düá«/,þ†¼üå°þm×qå§õúÿq~ÿîÊÜ@_*Ršlç–éP ?ŒáÛ°B~¥µ)ýàŒ(¸qÍßMíVzFþ«ëÂÉ1b”¤.áÂã­ÎABGFå¡­ìVç(V’˜C纾5€DJdV°U¯Ö®[tÙmYÓ5mõë?€GwHÎrL‰(ŒÐör¡Œ1Y²n ·:#¹C‚€ªå•: Èä| HKžÑ™ØUhvuk09Â@ vQìa(¶ûÎãu_¢o—߶q{Ãß÷ëÌÍ¿~¿Å¨,çÂÙ(<"+Òµ")óUX»¯Ë«`í Ѭ‹‹$ i;‚lÔáìq«úŽ «Íû±ßÝOÊø|ز «\ž¶8N[1÷ãï]vrØÅî-¿÷ì¿;ù鲶iýw¶º7I¨ö° JIá~O`»³Ïçcr’‘¡6«šÀ«=êÔ|¸ÇÙ#Q5#ù}¸‰— Ilœwj¾ ®Q1£¾·…’Òûf¤N>ã«æ†¬à|ì}_¬°J<ïMl`[ Ý'1}Ò3»É[«“Ýìmè9LÇ¢äTRdà”.%Ï·\ú¾>ŸK#±rì=ƒêÍŒoÅFOY6CÞe€6Èí.®Ç ‡Þ·çŽÐ9’$9t8Îý09þqr0Lìä A‘bÉYz|¸%•sd¬]ç×hĹzàJ¬õ¾=·—Û÷¸HÚÜßNÆ\†ÛBx2„l…ö†3kȵȉ,7ÒÒúúP­ Ž£î»‚ò­”=¶”ýú[n÷Ú Ç‰ÇÞË:«5ì+¡<¦„‹®‹‡ž=ôcñÔ¸JÏÓÁŒ<ôª)W}óëoþô‡¿~3|³†5ц„¢,²Èœëç´ìËužÐ«\ËêǤb/ˆfElu3©Ìc¿Ó3gKƒ:y΋ôå<ÞÙçS~ŽJÞÕ<‹’–ׄà²MZÍö¥ý><å­7VïIÃÞ{û5 ±þVäP^±¢n!i±Äâ%<ÎVTÕzr•÷hAlJ €¬Ý„×,C7kÈâeø|+¾Þ×ås³ê5ûy!šXÖ÷¿˜šš6Iúåd >ÈCtØТZƒÍ-QÂo˜>—ÕZv©¦Ï´þýn±œÅ‚Åz›…¯ÞÀ‹Uõöqë1•ÖSîÉV¯rT+u;m­ÖZqp7F•…wr7kŸ¼UJ˜¾FžúçA/ ËÁf%ËÓ–ÐqxxÆ¡áÑÆ*·8ÔôYõáÖµ5lùT,ÙåkÁy:ÎX:äsû8ÒÇ.Íÿ¯êÜíõ²ÇÚ—Z>;cPËk[î^ÛÌëKÊZ¯åó<ÖÕö>´6—©M ‘_^†iYž'¾Ó.ÿ'xöRº_×y¯ë%Ë9®¿žGNò· çmP®Èsðo€rÇq^†r%Äçäød”;Ž½9i/Óî³­f»Úì«Ì»ldnvØXQ­µïãíÖØQbªšÛï![t7õö: m® Å®¡œm(û@› lŸÍ/·nÇ>ö •×ñóìÃ͇ïNº»¢/UWM¶ÖîÛQE4d檾ÊA_W²ê±:»Çi=ë kö£EÆ9"´l½ë}_MÅ­>êX»(µÉ×v6ô\5vÔé5½Y²{Å<9KÚ.rjAb,¨—RŠS>gL#¼ÆH&ÞT2íÓ —ª¿~¿>„[¿ZÎA^•—‡¨Ëôôy¿Õr³É[+ívÄñà³Ý=r»½c…!å{"|>ËÃ(%É«Ïݯ’ŠÛµê;.§r¾©¿,÷ãæ»®ù–[R·%üa­xiµÑGªjËzW›'S™2°}e^ç{>–Ÿ|Ï÷$g¸ÆH-xs1ÛèDÍ£ÛÚ Ì“r£m&m¢Ã…<‡ßh}ÄÔdŠk·¦–ºâ¬j)õœbP˜5æ]éJ ó®ÄC[·E¼ž-ùž…ÙœÓX–=—Ì --ν;•GKßhǹy;w‹¶çi<‰#3¥Ñ-Z¾ -ÿ^ã;KŸÝ)„ÖªýÔ“›ÇÛ÷Ôò*‚óõ )Ç aùNœÄy:*yqŸëg'Ç’vv2Ï„í0ì=%+_©‹ðF¹Í˜†j_›©w+¤.ée -PŽ†ÌÑád¨~7Z}6·õË$¥¢|¢—¤7Ë78%²úì¼£äÍJýù/PýB -endstream -endobj -862 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 861 0 R -/Resources 4 0 R -/Annots [ 863 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -863 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb234-1) ->> -endobj -864 0 obj -<< -/Filter /FlateDecode -/Length 4891 ->> -stream -xœí][¹­~ï_ÑϬ•Dêû A² Ä8yXœ‡qï8A0àäáüý|T—.UžÌxœ ^ïxºH](ŠüH©Ô²;ZüyçðWfgr.)òñôéðù`M -ÿÕ«‡Êþ~R8:ËÉWbÇOB dR >ÅãÓmçâO‡¿üâðuwô¦”è]8þóQXL&å”lPX,ëHa…`Rò!*¬è †XŠÆ‚!±ç=+A .9h,ˆÁÞg…•!qr´gˆá“c1\ Ia9 9œ·VåAËL^á¹`"”5žw&æâ‹ÊKà¹ä5‘‰‰]p¯˜cÈ!K(Öi¼Y‚c¶²0å¤ñ"d¡HVåAŸi¼Y<´S^†,°®¬ò ‹Öi¼B&”̬ò -x6§¼çyLÈDVã9gl“T< -““Âó%ÚPTd d½Æ#ÈÂø£ñ€RΊ·zñn²ä4^€,Þ'Vy“¯!€Å¦¨A<È.iàS2\[Ö°€»>!¨¼dàƒ¤aw}À´È ÜõÁz ¸ëÙG `(øcÕl¸  z:Y° ÞƒçIÃ4f<Ò pׄ?ŧVÆå5,À]—1}*¯— qÅo¡eãb,à.iX€»€Ï¬a0Þ ¢z p×"µÆî:_¬†¸‹¼!hXs0 €†ˆoÆY˜®Ê+Æ–œ5,À]À’×°QØØ $QyÉÀœ†cc‘‡jX»ïEÂܵHÂܵŒ´GåAÊ^Ãä5àÁmŸF²j¬Rh<à®u˜aܵ6 "pW¦†1 Ág  Aì5,ˆ™MI)jX‹)ŸÊ‹ÏAÂdA€,•Y8±†H¬M¡’5,H²÷$Y2hX€ŒÀ‡ì[]@˜‹º>`È‚LQà ™É…YÂ"ÖcЪƋÞä¸Vy<—4,H‰ B±Ó°k)“áôà¤K@ ðkX -d«hX€Pd²Gf®ñdA’­a2]ðœÓ° {È‚lPÂì3V™ÑjX€µ$T­ñØÊ:3kX9I5,€›`¥ ¤Ty0¡aæGÛAÃ,~°ØÄ2GåA -¬aAÎ^–›YÂœ!‹·^Ãئ¬7“†ÅBd|¤ÉÆÁ³VÂâ2Ö›ž5,€_Êz3kXPÈb½‰%žâ·…¢¬7“†…!K@Š¢ò ’¦¢ø-0 ëM “Æ‹ÅÖ° Ä(ëͬaÒ ¬7‘Ñ«[YÖ›IÝ.î†dÒxÀ]d¦QÃ<`½‰ÌV[Û[oHÈÏtf–gVw , 7 ¶ª[Ø‹h•Ô= ð•5’ºi1±²ÌQÝ5@XÓYuÛÀ‘ñλOóU„9$ÄÌœdnÁÈîûšc£ ÅÎûcÿüëá»ßã_ÿuøø‹ºSÖþˆmqRÀ4fÛÌö§‚å!òÚ8‘Ÿ@ÎÈL7dL·²×¸%Ö]‹J<&2–¥@'û´¦c5˜+}êym+=É6QOÓH&òÓ‹¬H7äFÙÞÝLäÑî ‘¿ÒkH»ßKùÕûº¨–ð»°aÎõU‹œ€H²]||ÿéðݯÿðÇÿùß? Í÷?þÒZ—ñãdÃQ^yà|fРoðãñ@{\øt¦ñGüœð—ßR'~ÿÇ÷?\CN*t9¤khÍé.›öñܽ?›qNÔÏU½“…xE»žrkÕåïß¹_ŽAÕß¼ô°ð‚[~Çåw£‡ó@¤¬(€?œéUÒ¤ÐóVòó³(¤õQëäu½mÿ´üø!Oˆ8ÚZOÐRn*¿ž¨¥?}²Þ¹ûõÌ[=ÛÒͤ·‹Ð¤_Ûf3.ÍÇU», t« Ð䓶ÎmÈXÝOûv"ÉË9p²o§ê÷a‘-Tù®ÈAÞ^’Þ‹•VÝ-¶PçØŸ-X‘MEË>¥íj3ÒV™mê²=‰MT=ˆ;f[kvvÖ[kGd®ÎºÐk·ÈÝìyÑó°½aw­ü5@We>^Õ;ou#õ›^Ck+-í]ÿm¢ÃJ[ì¦! O~ÝõW–6ݘ©[?ÛÅ~‡~¥ž¦ã:öe™‡Þy™_.“ìK]·—æõãh;„«ú‹;ý•Iæ´—¿¡nûÜü«ÉXËò u}äen?LÈ}ZìÇ.í•aµÞìËiy^l$(²õ2<én)¿³õ­Ï<.z ›±äi|ñª.³f‹m~ÚZÛÎÝ¥nG©0Pþ5"U›]þ8E³ÙÛleãš^Û˜Û-£ÏŸ' -1oõØaXýˆ°Íû%Ryžt—&YíÚÚk«‹%m~…ˆµo§#/m]µÖàø’_±ömW›,Ò\Úzн±Gž]šÍ-èw Å·9a­¿Œk‹J×RU-M Wç5Ðv̵¾´÷Ó@¿s66ÉÚ¢jGóÉE¶Ùg‰>ÜÕŒ$$2Ö‘§.ÏÙ†'T_Ú¥8éét¶¡ öç­WL‚Ò¾¥sù_¿Çº¦ª¦œÙb1“åüœ¬``†äýu>ík¡ç×yÑRhY/‡06CÅËA k‚-ÙòvYäÂYú£wÔå]iã»ßýðÃo~ûç±Jê¯AI ü:à±·W“¥Ê¿‘,¹–ô|˜¦B¾K°,1å8ô%Çf -¼ª ²è75ñ°óªô™Uþ3Á­×óDôGG¡‹ëⵉ°âo¨äªo.Xj±rCçͪë’R}2(ÄN–­7”yµè(qÝK -¸"/Û£;£ Ðp]°»ª¼ÊÎÃkL÷;ÆzrÅëÓ=Ì-t÷tábãANœ³œøY7>CÜåÚ1ÃüR ¯ÔvvH‚M7¦”LÈ.ÛpÛ˜®}-c’S¢™%ŽÕ/Y@A¸%ÙuÞž9%ä062`@‡ñ*Ô,£e¦k3c¿1»°ùí×Ï’aö¬ñ’˜P)’`Ęw¦—/q1sJíð¨còˆÂV¾/÷Œ¹¿¯ÎÏ0†¼ äCNc“0hþ¹ßû×Íþ8G'‹!ܘ8øR*¶ ­Þ·y{Ú‘Rqfòjí°,|xmÆ[Ô´á‚yBfVrqÇlb!’S¼×ãžoÇ4¢laKªiD{A-rž”¼œÏ½é,W‹¾„gK&—Pƒ—"çú}¼•ÜYçíA8¢qŽ!”ž¤5ôv8§Û™Áðîu'÷er‚ÜÙjúûÚ_1¸<܈‚Yu©xRÇ%¹Êys€.à@–/]…TRºið׋¾šÁ#Tb¹“Dz\¾T“«_—ì¾:oÐࣥ·òÕX5g)“¸;ý]7üÜôw_û¼3ÜöÍ6F'7œÜ’çPtÃŒ9Ö¯K¦4É×ë¼Û3cËÁ­‚kk²sòánµk7o»ÂÆÉ›>f¸Þb©©—äKãØ,„Úžá—ÎËTNÚõÖ¥Î&­h¿…÷5úlV¾Ú‡š%3Q”×òõK'Ô¨p_7“²dQØ©è`ðÓ¤Þ -÷¸Ã½V]TÇþx«v†¸‚Vûvß…±Œ/š*µëˆøþ,Xë1Ÿ°6Ÿ»€fßÚCݘ]o,¥áÚµÓcÝ“êõv‘6Ž°yÞò{;WœìfVÀˆ‡¹dRgüæbU¾»ŠKꌻÇ[µ“7^6Óµ¿9?œÅÏ2Gm¶›îÆÊk ÅbÍÑFº?y¸³Î›‰â†Å’ž3Ü·Ø k›mšûqÂîñîní=¾¦„v Ly˜q3ñºó~Wôñ{/Ý׈¾õ‚'®Ûä»þnFß }ÿFt‘£Éý ívx»æLÄÉžeÔF!/%_'v·µóEIä ýŒÅ7²]Ÿ÷D|ù檷9… Ð&dclå;—×]ù¾:oÇ•YÖ-Ù'ûÕ"þº‹çFü}íçDü}íçFüôï½5Nn[ÈZíDøêèË1Šíz¾`ém|¸#:ËÝ>%b¡®Jxºà“‚B #ÁʉS ·öî¬óvÜA.$“íÒð:‘mÕÜ3Æ.g¶$y£[ Ílлo›ãØVj7TþJ÷&R“ÄŒâ(¾hlsÜÜÕž_˜ÝtùÙ%9ÐÚMYêåVN^}ê-H1¾¥è!vÆxN}ïÐ ¼Y.è Õþf˜rÁá‘ 'hXîÞ÷7wÖy;_äµŨǿ—¾¿Y7û:ïoöm>çýRû ß߈—Ë• ™ù; ³ÜépÕ<î¬ófÌ£ÞŠá]$D­×´M»³„›Ä )ÿOËmI^ع©3_ÊtùE×øÍ"7\%W¿¤²»XA9Nxyí“äþ;a—$7»hßû÷rdÖOGÎå¸9µmåüµ‰z0u •~:ÂÜNDõ”Ó¡Oý~0­Å.gz=Äm?BÝ>oÖþ$«’úÓðUûí8ø$O;žÛÇÚ¾ßNãçC¬7¹zK…m8/×Ø#’y)G¹)[ i›6WíŽjÖË?÷Rò7HV®”ë¡ê´ÎKùÏuÂ?$Íý‹©žïî´•œ}{䧃ÜÝÊ -ù¤¿“,Äå£ím!¢û í‘ïˆmJR0vù8ŽëÒ8_Úh¤~hÕÄûضBTo•9w¬Q3º=YF!Ëý·ÙÐò»(!6™A ò\v48*Þ$;²1ì‰vên=7yœÜ—ÖU±‹>«ÎMÓßÊú4Mç5âé€niK}R©rëfkªi8Ùh4 U:5´’}B¸Ï“B’/îˆïlkš1™?ÍšÜ]v&æfHÜË•VN!j¹¥µÐg*õRyT-MóC”aê”»âÚi:ÒžäBïÉG,µk²œÂîsmód7~G<äçŽ\¿8º/VH°'ÒÔn'g;ìePSnª‚k6šÜü$Ÿ¡"tª Oýป”ÜÞ6žF'⛼VÒLuXÓ€ã4ÊNêr)u›õå²UÊ èöÒ]c+ꤲ‰žJO@ªƒÇšìºÕu²@XÓOÇÊ™h›ènC7å§yȺ«Û;‹n2÷ÐÛäرói&§>ãN®âëòöv'›oÄS l¼%‹éçÖÉ KÂÝ̧w6‡`…A0úTÉÍ[;:É1˜öq8™qO‡¿j˜ó¼$¹K¹´þ†³;þ?Êü€Ÿ¿øøûöçs÷¶£…ïغ"Ï‘Lî!Ïw’å^òFìn3=O°?È.²¡YCãÞOxÍ£ºÀÞJºŽ ®sgb:œÈ¾›®¹š Wˆ§{"ó¥s3öù‘ÚàÐ É%xM*<ÌÃ!9óÖy4BòqjORt„tpÙOñ07ŠÇ©Ã2$[‰)9wÒU/òó<rpc~˜Òy¤Áãf禭Žb*‚˜æ‡¹avs§e%"ô‹Ýë‹ç}96j‡öN}š©}`B퀧S©>Æõc9t”‡æ¼CC½-š|z’3\c¤¼z˜mt¢æQm)æN¹ÑV¶@Ñá4Ûh½ÅÔdŠKµ¦–:â¬j)õœbPÿ6k:̳ҕæY‰»²Òn‹x=[¢ž…ÙœÓ%{.™Zœkw*’Ôhû¾yÝw‹¶Çi<‰#3µ£ZØ•|þ½ÄwÔK&´RíOÝqy\þ‰@-çÐ<ÕÏÅæ!,Wr'ÎÓVɳë\ß;¹|õäܦÃ0‘MNþe]„'0ÊmÆÔTûW{ôjŪCzž”­¡s»+A\ý§ê=-uƒ¨?&Y*Ê¿ÄB’ôf¹@>Ù W„ð²²ÞB©þ (Ó -endstream -endobj -865 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 864 0 R -/Resources 4 0 R -/Annots [ 866 0 R 867 0 R 868 0 R 869 0 R 870 0 R 871 0 R 872 0 R 873 0 R 874 0 R 875 0 R 876 0 R 877 0 R 878 0 R 879 0 R 880 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -866 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 393.004475 101.433071 374.254475 ] -/BS << -/W 0 ->> -/Dest (cb237-1) ->> -endobj -867 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 374.057453 99.933071 355.307453 ] -/BS << -/W 0 ->> -/Dest (cb237-2) ->> -endobj -868 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 355.110432 99.933071 336.360432 ] -/BS << -/W 0 ->> -/Dest (cb237-3) ->> -endobj -869 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 336.163410 99.933071 317.413410 ] -/BS << -/W 0 ->> -/Dest (cb237-4) ->> -endobj -870 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 317.216389 99.933071 298.466389 ] -/BS << -/W 0 ->> -/Dest (cb237-5) ->> -endobj -871 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 298.269367 99.933071 279.519367 ] -/BS << -/W 0 ->> -/Dest (cb237-6) ->> -endobj -872 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 279.322346 99.933071 260.572346 ] -/BS << -/W 0 ->> -/Dest (cb237-7) ->> -endobj -873 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 260.375324 99.933071 241.625324 ] -/BS << -/W 0 ->> -/Dest (cb237-8) ->> -endobj -874 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 241.428303 99.933071 222.678303 ] -/BS << -/W 0 ->> -/Dest (cb237-9) ->> -endobj -875 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 222.481281 99.933071 203.731281 ] -/BS << -/W 0 ->> -/Dest (cb237-10) ->> -endobj -876 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 203.534260 99.933071 184.784260 ] -/BS << -/W 0 ->> -/Dest (cb237-11) ->> -endobj -877 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 165.640217 99.933071 146.890217 ] -/BS << -/W 0 ->> -/Dest (cb237-12) ->> -endobj -878 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 127.746174 99.933071 108.996174 ] -/BS << -/W 0 ->> -/Dest (cb237-13) ->> -endobj -879 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 108.799152 99.933071 90.049152 ] -/BS << -/W 0 ->> -/Dest (cb237-14) ->> -endobj -880 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 89.852131 99.933071 71.102131 ] -/BS << -/W 0 ->> -/Dest (cb237-15) ->> -endobj -881 0 obj -<< -/Filter /FlateDecode -/Length 3174 ->> -stream -xœÍ›KÇ Çïó)æÀe²Èz†$ -bĈ‚äd#XsÈ×ÏŸ=]žá¾$±×«™&ëÁf±~Ūîå3áç+Æ?U9ÔÚJÖó݇ÓÇ…’ÿm%›ú{ü–tfÒ·\Óùƒ ¤„ÒR,ù|Â?W—kñûÓß~sú÷±Ÿch-GNçŸß™J%”Z -%GÕ "G•R(%¦ì¨2Übkž -f¤¢QoUfh«ÉSÁ ±:ª -3D Ë­ªÁŒXX=Ìà–Š£b‚‰\ !U‰ŽŽSÈpzöt‘C®-6WW ã=HÈE9±§k!眪§SØ’±§K°%±*y:Ø¢R‹§Ë°E²«ƒ-±ñt¶Dx§9º -[]ÕÕÁÊÄž®IH­ªººÕRou‘RHU„<sHˆMqu˜Q¤\]„-™Rsu°% EO'°EñãéÀ‰$¥Vg¶F›ÝBž.Á–‹º:Ø‚Á÷3l¡’=`ã’Ç€XJÐÕƒ@¬´jõ(k ZŠxˆ-Í­xbè"{ ‚-I³GaØ¢˜¹®¶HSa -x,-QÅc€¶ŠhñX À­RcÞ*qöX .Ì$âJÍê±@€\„RóX `®€ ÐÅt/ Ô•”£ÇvEköX à®(“ÇwEPÓÕÁ°ÇÐ1WñX à®0 -îbEÕ€8Ì +!ÖJ Ü•Ôc‚»±` pu%`ŠÇwcÂ-x+7¸E -îFÙc%€?äfà.’üt¶° °ÞCÅc i‰Ç‚îrÃòçÌiÐ*pmÙcAw¹bø\] \àqgÞÂËsn ¸‹…J<$pø¬ Àø€5z,Hà. VjOîrlä± »È’Ç„C`$ °¾&„®«kZ­ ¸ ,EX…UÄÕ•€@b€q ä¡ 2¸‹å½y,Èà.%Ü%EÚãê`‹Ôè±y t˜¶ÎœF²(‚žÜ%Æ{:p—¨4ܵeÓcA.&ˆÕc È‚£Ç‚\5´R²Ç‚Ü:¤|®.\'… H@–«ƒ-ZÔcëФU%‰ÑcA‰°)ƒÇd¡1²ow{[.îþ@a 2E Y¨MÕcAIû1xÕÓåj®]]…Ž‹Ç‚R4`)fØK…ŠIï±€–.y,€бz,( ¶`ªx,ÀRjDfîé¶ ÉöX€L:f5Âdƒ j¬ØefòX€{I¸ÚÓ)Ù>³z,¨šƒ¥Š 0M°Ó)]l&<`|l³<`óƒÍ&¶9®¶HRµFÛnVµÂ–HÑcbÓö›ÅcA#Ø‚ŒÏcA£,MöXŒCGä± qÅ~3ªÇÌKÛoVMûMlñœyÛ$Û~³x,h -[RW[45gÞ‚IØo‚Nž.ÖØÔcAËÙö›ÕcÒ ì7‘Ñ»GÕö›Å=.wS™<¸‹Ì4{,Àö›Èl½½=¼© ?ó•ÕvœÕ=1  7amu ìÅjUÜ3|mäÀLì,kvO °¬BÉäø‹|Lo˜p9}Z¨2¡`ͬÅn²aZ(²û±ç˜Åäb—ó±Ÿ<}ý‹ïùÇÿœÞÿf;)ë?ŒàͶ±N6EbÃpWakN·Bî ˜…0ðS꘥M#XÜÝÌH,ÅXnÛy|á£É°Ølf$3ÛéÚ/v -Œ¡’ìÛúâ:_ÈÖé#;+ÁD±5|q’n¬5&ôüúÌ:_ܯk¿ÓIž­/®óåmEc„ܽѱ_ßÈ' -?iØçÛ/O)HpžmäS…¿°‘ÒûÅ .¶gK;ŠlKv PZr²Xú²_bÄÑ媥¤E[ÛlìÊH…ûæÌïÝ_ž ŒËÅløWáÙHç7N_ÿáõëßýþ/èöÍûÓß¿±í‡ý¾úÇùÍëGZC†œ…*0rhÍPdz÷ê+ÞšøöÍÑg5Å–?×ËϪñI^þ%œÛ°ð0@š]çj_ð™âþ‰•JëC¾Bè#W¥Ö`øNz¼ègxçØ ’6›m{²Mž2ìYU~}“Ä"<ªDz` ëe5ïŸ?ìƒúļÁ.¸$Ëî\fÞS³ÎöLµ±W;áÿ^iÿìV^õ@9‘ù#ï=åó²úòv*+ØHnøö»?ÿñ¯ßMDµö-¤mº[ßvDÈÒÖ§yçR&õ2ñòüÏWnÀÛC“X7ôci ,?`ϬóÿDöŠ=I¢XÌ—¡²Ç‰kpÝÜ»ýs'‰QwP%uƒ2ß,!òöŠDÉo7ɱœ¾ß?ï®ì¹;†ZÚåý~Ò¸—„`´Íe­ÕÁ=Ô’,áVöï{8Jº\§=õýæƒËD›F{üÒì óªÓmL -×VGèÙc‘í8éñp}^ÏIr~‰¨ Ê#QKoŸŸ·—é‘Ò#b“õ¨Ñ¥ž#ÎÊ¥«õsKVžÕ÷ ¢N’<u#¢Ê·ÔgØu–ému³ã6â»ÞT _uøXÄÙ¶=z°¹~Vúô¼*¿ºx³ÇõÇÛ£ãÝ=÷ý¾Ç/ Ý${¿Áv¾m92þz²Èþ¹=`èÉÓ™¯’•cØ¡I{¹Cá†Vì<ì¡ ‹ï.ÈÛVYà,bE•¼O ;ºSÃ-~Û^¦*_иå(t L Z}w)Ç´mÞƒøýe91ù¶ÊçËïÀhÞÛÙÛ+ÿÛ=Øïö¬ ^µŸö¾{tŸ@ãR¿‡W×Ãøñ”·s]Þží2)ŽöòÏ9k—v¶³äJ¢ãƒ7GóùšÛ+SG©ý-*²«v¨~yÅj¹ØËÜüÉ›ó¿…îåÚÄ5ö‹)¾?Ù/êˆUC|¦Ø„ûWm)÷‚Cv”ЮKbzÑþµÆmÎ]¾ÆÔïÆê§^ÍrU¥^H¶³¸KÇŽ53ߊíî)ð.¶·†jý*SRî6C8ÔµìlpV|RÌB‹0Ý -iénŠ£v{Øž2 ×å)¦¯®ãeø{ÙX–á|LxwB·r-½w¥–@ô¦ºw# ™,Fµ!M½äãäˆîNŽð+êM+sè—Q³'>aí¤£\ëåÑÝÉ-··–ÆH•QªÎª­{~š2C]êp¼#Û|´K‹½¹Ì’þõ(Î6}¬©.qo„w§¤c&Nñý)§tš¬ ÔCoÊÒîWšñ2¥¥vWajv™—Û¿T¤!5òl_XGHÙ3¯y5;±¹9ÄG'­ò<¨£žXË,»¸‹K1»ú‹+9å º£ôðØAº¸l‘#=¢Ñtð8ŠyDݺ+W!u#ÐݧÊ÷ñ´3©šht–y ÷4Úâ<Øy¿ŠËq¶˜ÃÞÑîó]x·-lz-¶Ð¯½“)Ž4V»ÙÙ"œ† -S<1z¿‰ûlt²—2û×9ɼ÷îôÓi[梤h[ø,lïã¬YŸÿ‹2¯ñû¯“žÿÔ]ÖñHƒq°õ ^W2{{³>Slosvá˜6‹0ê‚ý)æ:˦ cqáµÎê4ÁÞKò (í*LÓ‡‹8ŽÐ,‹gÒ#»+/ŽDæsÇf.Ø—Ké7Gv”reëíà²NÌ%ù¼4‰++:—th5.q±6ŠË¥Ã6-;˜i¹v2\oöë:b}-Ka—2u:—Ùµé.Ûîb)‚XÖ‹µaåµÓv°Ç1ú“§×gûnrî3À¤íCz¿JÇ™tÏ—Êv™—cÍ‘íL¨OÞé¡Ñ–,sOF’3§ÆL-ôp±Æè"­³Ú^ ­j—:í ÅÀdÔe£ÅÒmÊ{µî–펫ë¥2rŠ)ýiõtZGe81­£’oÊZ»}ÅÙ’Œ(­á\æÝÑ,9rÉêÈòZ{Hu–”.»í[}÷Õö¼Ü†NCòÌLiVK7%?‰Ÿ2w.u®N!¼Rýg;á:_™ÀB­\$ÊöW0Tsf{â†-yѺ•¼¸Îãg'·'$ýìdí ÃT„ -Ûß3ù&ÜCÑžV,Mõ¿uò«5roéexðÝ“[… m/´olÛѸ,¶U´¿_Kz«½v[ˆÝ£¢íÈŽQÞŽP¶ŸÿaUÐÍ -endstream -endobj -882 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 881 0 R -/Resources 4 0 R -/Annots [ 883 0 R 884 0 R 885 0 R 886 0 R 887 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -883 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb237-16) ->> -endobj -884 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb237-17) ->> -endobj -885 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb237-18) ->> -endobj -886 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb237-19) ->> -endobj -887 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 681.384971 101.433071 662.634971 ] -/BS << -/W 0 ->> -/Dest (cb238-1) ->> -endobj -888 0 obj -<< -/Filter /FlateDecode -/Length 3342 ->> -stream -xœí[K$· ¾÷¯è³•%‘z†|q#ñ!Èa·ã±ôXç¿Ÿª’ÄêæÌÎì:ÈÁ³³3]"õ (ò#¥R‡³ÇÏ›€?•ƒ«µ•ÌçˇÓÇ“w%yüë5…Îþ ~K:ÏÅ¥ÐrMçB âJK±äóõ„?7E]ýzúñ«Ó¿ŽmÂ9ºÖr éüëOÂbr¥–â“Áj`ù@+%WJLÙ`åà0ÅÖ,ÄH…#ß³ -ÄàV“Å‚c5Xb—@÷¬1b l± Fh©¬à!GˆÞ›<â™)¼\†Ò³Å‹ÁåÚb3y¼P¢Å#r¹pHÁâ5—sNÕâ1dIÍ‹— K -ÌÞâA¦Z,^†,”É›<Èk!‹W K„všÁ«ÖUMdñÙ‹×È¥V™M^Ï×RïyÑ'—*‘·x!¸Û$“Â"åbð"dÉ>5“Yùhñ²0~,p"Q©ÕðÖ(ÞMž‚ÅK%ÆÂ&²`ñ-ˆ²ø’-€9Á% b)Ž[d b%Ç•«…±6Ç¥±%ǹ Èðb°€€YX»ž‘ö˜<ÈB5ZX€¼<¸­áÓHV@ -‹Üõ+lñ€»Þ—faAîJØ´° !ÄjatÈ‚£…¹²k¥d róà!å3yÙ¡œ,,(„È2y… [X€ÄÚ5jÕ‚! ÅhaA‰)ƒ…È\ ȾÍíd¹˜û†,È-,’¹Ú˜-,()c?­Z¼]-€k“WÁ Å‚RØ! °—rNoaÞIºdaÄ/°…¥A¸Š…E®Fdæ/@$Ù Ó/ j„,È-,¨±b—™½…ˆÐØKBÕ½ì3«…•³“TѸ vš@J“Y`}d³,,Àæ›MlsLd¡ÄÔe»Y-,¨²D-,€mÊ~³XXЖ6*aMœù`€ñßMd-K[k]ö³KÔC ǵÆRËbë%R«lUzÔóUZ×än²jŽÅ¶¡¢;*‚pG²lŸG]<Ý6´ÈGÒtdMÃZæpAâŠaCÕ¶¡ªl¨¢ö-9åUw§‰Ú†²iC“º&½†ZÚ±ô{yõÜÿ‹çJª.ÿÎ÷Ê´3çðÁvÈGì 7¥ûWç{u¾ß™óeùWÎ÷/p>-°š±VÄÁ²_ïÕù^ï…Îg:ÙËRÎGòÕñ^ïwæxÏO9ï÷ûx{‚dýR >;æÚ_È[ú"Gšç·N_÷ßÿø×°|ûpúÛ7Þ‡Šß€ß"ÇòøŸ½gП)mÏ ¼”¿ýûùí÷Œ!oÊçÒ-zòÌh¶O~·wå÷Ï Ýn]††w|Þ¬"ö½Ž8Ëe€³¼“TÇ¡~û&|³„O‚–ðÜöÓÆK{;L¨òE¤ÙŸßíuÏVDçI½>C]n[ü°×W¼÷qoåyéXÏ×ßêlÓ¼’ã²7e<Sw7ŽÞ†w/ûÊ&{¾þ½|ìscÕW]4iç/»ä}*ù08'–e ýˆ®êÖ‡ÈþqßO&9ЖK÷ýôù¼[ó|OÈAÑ?&Ç®+.K'iNq³tC6¹<“=ÇÜŒ¾ûz_6{êrÒÞWÞ~;OéÝ?ìõ†LïÖuYª²¡½¿Þö²Ùœ%s¯Ÿ·2«>º]Æãx}-‡< - ËG6›Ý=©s¾Õ‹èº·›²tÿÔضoÞèmèàý+½æ°Ó†L¿ÚiÔ{®/ ¦=!%Z–O#dZ³áù -ǪMôç÷Kë»×½ùˆ¦ù›%íÏé'~;á€Pü È}?/CNü˜_Œ ÷}÷(øXÔ¬,þ9Þ›ž×GÄÛÑæf.³¯¸Ë¦äÓÞ,Þ.{ÝѾ×{RÏåVáVû‰¤¼t ÃÍwÞ°¾ÑÙîåÒF€! „M»Î.ÿD~Øuqk'» ~÷v%ÐïJûs’»¯¹ÅÖÔë¤ýmÃ3ª<ýBÂxù´~ÿªiªZ7t)¿Yñ¹yWje©bÊñ'üÖ]ñ²e«L%ùë·͘–úº ¼WªÞO[½ào2߇Í$…Ù¯ [׳µ4ñÝn^ÊŒý'µÌÙ42fs¸[ƧÜßù‡~ïËçêB”‹áçÌÈòä¾ÍYîTOƲ…®èp~¤e¿NÿqÖÚoØ{¹t'.¶ë÷ª°×ÿØü¢»<âP¿ ë;¹ÆQXäëInC³Af^Áìd!î~öÅaÆÆA»œÉ®ë¦&%ç÷Ç@)ǘÆl¤}Íä-5‘8JâÛÀ-s¸'Ëì½ ;Yn”WG{)OQ°go“¸:d]wu¸~’È+bº'z5Ü"Gò¹4U—qŠ®UÔòº±¨å|ŠxÁsÌwQ¯&U®†v‘K)¡Ú¤¦Qs.Ïu2H²-¿#¾ñ£kÆbN¾Z5¹ ´ë0$žõÚ¨g.'³ÞÞ[š+Uf­ºš¶¡ù%Ê2uªSñí¢’Ì"_‘Q>âi<É’ƒÌµöUÙM¼#^NÈQøŽÜbîk§…> ÓÓDRýNrõË^µÔ¡*¸æ É] -ù»AEšTAžþxš”܇Z¥5ˆøæ$•¤éy¢[\V]¥®PÊ´Y­¯P½Q_@wÖž;P•Ê½´!ž€Ô#9L«›d°¡Ÿ‰•šè‡n‘Ó4åë¼äLÓUaìc°”¹§Ùï"ç‰WM.sŃ\n›òÎ~•Íâ¥6¾%‹é×1È"G?£ÝL—`…E^0zíäá­ä ;ãq9™q/§_N=ÌEJ±Éa=¹«­³®pþê|ßžøü§qx¿Åñè'Zĉ­²ŽdòÍžúL²|Óg§Û(bdû‹ꪛ†5Ì8£Âk^ÍýöQ3L “«‰iéP‘ã4ÝHi&=A¼Ühq&2_º6+`oE“Ã0$×ʆT(èé XVH>«.Q’ª+¤ƒËQ5DAwŠ¢°-ÉbŠAêA¦êE~ÖKA2–*¨4BŠ´x¼Â¬îzÐú,T¤À¤ ºczÐvÇú³Ýë‹×}9ê„öI½jꜘP'àÙTêÅ|,ΘCg) ç]š}‘ò=šIÎr•Zð¡ mTQëj¶WHzP´Ã #PL¸ÍÚì± ™òÞl¨¥Ï¸šZ*3§XÔ_´¦“^•©Ä¤W%ßÕ•~GÄ›ÙÍ(is.kv~Õœ¹d5hY·žT^5iÐîÇæãØ#ÚžÕ4x ’WfêW³tWó³ðïs|Ç|%fÕ?ýd$ÔušC¡HýÒ¾æ aù’K᪎J^Üæs/sê‘°Ž‰| ò]w[„+íÓ ÕÕø¼Ý¬ysJ/SÀ£÷’͘¡Ù±¿ùìD³Xd«(ßm&Iz«|%«øG^hò~Œòþp„Òþ =ð¾ -endstream -endobj -889 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 888 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -890 0 obj -<< -/Filter /FlateDecode -/Length 3187 ->> -stream -xœí[M·½Ï¯˜³Ñ$«ø>ðÅAŒâCƒ4±l£rùûyÕÓüè™·’V>øàÝÅît¿b“ÅbÕc‘Í gßWÿªWk+YÏ—÷§'ïJòøÙJn6ñßðWÒ9x-.…–k:¿7@Š+-Å’Ï×þÝݮů§¿:ýçøL8G×ZŽ!ýÉD*®ÔR|"¢‘BD)¹RbÊD”ƒC[c"¨‘ŠF}¨¡­&&‚c%¢ -5DKGQƒ±e"¨Z*D<ôÑ{*ƒ"^U"‘…ä2Œž™,—k‹Ê -d¡D&q¹hHÉšË9§Êd -]RóÉtIAÕ3tQ©…É2t‘,žÊ K¬E˜¬@—ë4"«ÐÞU© ºøì“5q©UU*kùZê£,úäRñL‚KðM¡2D)"‹Ð%ûÔ¨ º$ñ‘ɺ(~™ <‘¤ÔJ¢5Zt‹—Àd ºÄX”Ê  Ÿ1@ÌÐÅ—Ì(䌗ÄRœ¶¨Œb§U+cX›ÓR„Ñ@lÉin…ñ€øY ŒÄC—¤™1袈\*ƒ.Ò”qDè‚Œ D KTa\ `[…·0.ЭúøV}ÈŒ „ 5=ããJÍʸ@@¹p¥Æ¸@À¹îd\ ]„{a\ `]I92.ЮhÍŒ ¼+<ãïŠàI*ƒ.p`Æ`G'¡ -ãïJð…q‚wF‘qFÕÁ3ãøŠ‹µzÆ -ÞÕ+ãïÆ‚)€ÊŠC -ãïÆ„.°™¼“Œ ¼5fÆpþñ4ï‚BO  –qæ{È¢0.@e."-a\À»¡aú#1 ¶r¡¶Ì¸ wCÅðQYs¡Àâ$naernŒ x•0.Hà]Ðge\Žw˜Q#ã‚Þ ‚™šÉÀ»!6ϸ w‘7$Æp0.Àü悇ëRYs¾Õʸ wAK‘qfaç+˜„ÊŠƒ#Æ c瑇2.Èà]LïqAïú$¸ ƒw½"í¡2è"52.@^–Ä4’Uç#˜‚ÉÀ»>`„™ ¼ë}iŒ 2xצMƹ+ã(èGƹªk¥dƹyÈòQYv¸OŒ Š@YT]´(ã$Ö®I«Œ J„.#ã‚¡ RÆÈ\ ȾéòºÀ]èú@¡ 2EÆ`2W›*ã‚’2Öc°*“åèj]SY…,Æ¥¨ÃT`-å*‚žqÞYºÄ¸j@”qAiС¸S‘«™9“è‚$›q2]ÈB`\P#tA6ȸ ÆŠUföŒ 0Cc- S3™z[gVÆU³³T‘qÂ+M0%•AÐãŒ-¶ã,~°ØÄ2‡Ê ‹$e\Pk´åfe\P+t‰>2.€oÚz³0.hº ãc\Ð|v–&3.Cæ=ã‚*Ö›Q .m½Y4ñXob‰Gâ¶I¶õfa\к$¤(T]45·à$¬7ÁNL–¡Klʸ ålëÍʸiÖ›Èèé–@µõf¡ÛàÝÔÀLLÞEfšàëMd¶lmïA¼© ?ãÂj+ÎJw <¨7an¥[Ü‹ÙªÐ=òµ5Ý4€šXYÖLw 0­B<Ý6ðà_äcúÀ ·Ý§u‹*à -æÌZ¬“ a¡ÈîÇšc“'ŠÝöÇ~ýùôõL¾çŸÿ{z÷Õ¶SÖÍ7’)h£Fûý Áòym^à+àŠÌôÐt/ rÍ÷à¶k±—ÓcY -væ±×#ŽÕ`Ýð¥9äµ½ô¢Û‚^–ž,ðõ„ÅV¤wpJ³ìhnuÖ;áÙ“ë‚ÎNϦ¦u˜}/§1ÐÖ:¦5A*ÓšòÁç ~sîCe­¨Ãa[>÷²¸z>4ᣭ8²¦î-£¹`ó -ñ¡Ê}¨.>TQúNy–Í­àêC™úÐ@g§gSÓ:̾——Èý]"×Ruû9?^–=Xgôá=È'ƒì`·Åö/Á÷|°àËöSÎϾUá¥Ç«!žý|/Á÷|Ï >dÏK9ŸÈ—À{ ¼?Xà}~Êù¸ÞÿÓë4ÛÕ೩S­Ûë{K_lKóüúýéëï~øëŸÿþÖ¯ßþñ÷¡â/Ü>½xñ™ÞâkOµkÈRÆõ ï ÿöŸç×ß?Ñž½5íYQñª³÷åVU׫LñÖÄÖtž÷Ö|J·{}wk.4 ü8 ôjÞb}ìD³ˆ1Û»Û(µ·ê·¯Â7½“˵®­ÞðnŸÚö¿¶?cÚh7ÒeïÞÊt\¤k½?Óº÷zu¹Îó¹ÑFÞe—¥Ü›gô^ï{Ï4Ý´Ü5܆órÓ&áSÞìx݇ûí®Y<~êO7ÍõalIO=G¬>Ç|ÑíÝnÁt{οµGkv núàÙ­–wsåƒÊš •}t7߬·:LŸð¯Çz²Ø6¹Åx¬gÍ7»niÓï#zHôOéá÷1(ûøè’KÌÝìHNös#uožÛzLí}Œ7}7½­þ·‹—ÿ´Û"Í1°v·ë2íµgÙëÝí×õï±Ìôïþ³ÕYvò¬«Gör~üQ»ê}ßÓˆÌ5*—ö÷vÃ>^ß½Þ·Ô¶³†þœììXn±µe;vß­ûŒ"ßÐ#›·{ë[} ù¥Ï¨ÒN"Þ#<±{×ÀXÞÜʆ3ÖIzF ²Ÿ™Äq#ƶ—I‹™òÍ5úld¸S€äF~» 7×j7ܨÐ}×÷î±µ÷fw·Ëîöõ®þt7\oÔ°õ!õ>< ã‡SÞÞ™…íÜ„ÏÕ…h+ÏYÁ™ö¾úlïéª }ØÂfèp~âÉí8ê‡Qj?¡êíЊ½°¼_]nöò¶FW—;‡o§Éü×Øo&|=ÙiB%°êœ>¸_úQ—†1¯tìr -bYË]IIÎï—sò‘Ô/cê½±çSÌÞò c¿³¸5L@<™Ã#l½÷.ì°È¬Nö»øI8ˆ_Àôú¥¹ Gíú{ƒ?L—'8T_M–áïecY†ócàYYïïD¯µs`½ªn]Ì“E©6ÐÔKŽÑ1N²´ö|å{ÕŠÁòeÔìmú ¬Ý‘t”k½.'Zn¯-‘*£T¶nù©Êtu©Ãð», Z±#æKŒxé—GØæë1Ö¾.~@,9tDâ„·¥Ìcé4¹Â§îz+(K½®~úËD±”ÙM…Ð옽‹´ÿ7ªH5æÙ.‚—²óón6b±9࣑V<ÖQf e–]ÌJ>»Ú RÞHw”; ‹ÉËk?ªÎƒ<Žp^7`£°nŸÁ•+è»hnÂi¸òõO=ÓU8{o,‡ÅÝÓ¨wÂypçu…Ëñ`‡C†¾£ÞÅç;xÙ&6½‡ÍõkodÂÑÙn6¶€S1„'^7¸Gë`';ðÞ/g±÷rúå´MsQRl¶Ù%ÁÎ:®YW8ÿe¾Çß¿OzþKßüºÍãѶˆƒ[ð:“ÙÉøú™°”ïà›ŒºÐþ„CeS÷†1ǸðµÎÇý$ö^2  Cº‚iÚpãpÝd±Lúx¹³âHd~ëØÌ ûv+½shFìXF× -7kwp[§Læ”|^ªÄS:¤—q³VŠÛ¥Á65;¨i¹62Loúë:bm-7Ka·2e:§ÙµêŽm½XŠ –õf­XÃÚh;èC”þâðúÍ㾫œ{:¨} ×3tGe»ÍÇÛ1çÈÙnzðN ºd‰=IÎ ™ZèáfõÑ­ó±½@ZÕŽíÅ  `¾c£ÆÒuÊûcÝ,[+µR9ÅDY-ÖQFLë¨ä‡²VoŸñF¶$#J«;—Ù;?KŽ\²,¯OTgIéØcÛzl»Ï¶ç¥:É33õó±ôPò‹øïKb‡n)³RýwÛ uGÃD­¡H”톾æ Q;$^´.[%Ï~æKC­-a8œŠø컢\…+íÓ‚¥ªþ=RþXó´KÏ3À“çúè €°}Yh{s°mÛbKEûn XÒ[í+ Å?ñB@÷m”Ëa eûý?‹½ÊÒ -endstream -endobj -891 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 890 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -892 0 obj -<< -/Filter /FlateDecode -/Length 4332 ->> -stream -xœí\K$· ¾÷¯ès€•õ~†|q#ñ!Èa¶wÇF0`Cþ~>ª‹«ŠÝÓ=;FžÌN‰TIE~$Õ]åŽ?ïþ«Ñ™Z[Éñxú|ør°¦$‹½ÇªÑÙÃoIGgc1ɵ\Óñ3B1¥%_òñé€ÿ6MÙýéðóŸÿ^ßãŽÞ´–½KÇß>+Sj)6)¬–uAa¥dJñ)+¬ì –ؚƂ©D÷¬1b«IcAŒè}UXb„X\سÄðÅE1\KEa9 9œ·VåAcð -Ï%“¡ô¬ñ¼3¹6ßT^ϯñB0¹D—œÆk&眪Ƌ%5ë4^‚,ÉÅh5d‰¡—!KÈÁª<Èâk ¯@í4…W! ¬«ª<Èb³u¯“ZQå5ðl-uÏó6™TC°Ï9“`›AåÁ£°I¹(<Y²MMåA–¬×x²Düh<àD -¥VÅ[=yw°Ái¼Y¼/QåAl¾†>C[²ð C¸¤a€/ÅÄ棾k¬ -øÚL,%h0à[21·¢á@°<ï4 ²¤˜5$²Dx®Êƒ,¡E ‚‡,è aAÅÇ aAÚFX‹†pmsàm´.kX¸ÓjX€¸¡æ¨aA䔚†˜€€.ܽhX€º!e¯aAì†X³†¸¢³Dàn¸SåA°†@G\ Dànp¶hX»p#¯avÕÀ³†°ãkµDய6jX»¾ ¨¼bàƒAÂÜõ KÐ"7p×'ë5,ˆÀ]}Ö°†b€?VÍ€»€¤§«aâ=x>hX€ÁŒGZ¢aAð§ø4Ðʸڲ† ¸ë*¶Oå5ã -4®ø-´l\ÎMÂÜE  -$à.à³jXŒ7ˆ¨^ÂÜu‘ZãwoVÂÜEÞ4,€9‡@ÃÄ7ã,LWå5c[­$à.`ÉkX€(ll’¨¼b`HNÀ±±ÈC5,ÈÀ]„÷¦aAîÚ‚†¸k#Ò•YBõ ¯n«ø4’Uc=Bãw­Ãk<வ¥iX»65,È…¾jX ²`¯aA®Ñ´R²†¹Yðò©¼lÐN Bd©<ÈKÔ°‰µi¡U Š‡,Á{ Š‡,H4,@F`šCö­–æ¢Ö² SÔ°Hfj‹QÂ’2ê1hUãeoj\«¼ -ž+” B±Ó°µ”©pz ð†Ò% x.jXPd«hX€PdªGf®ñdA’­a2]ðœÓ° zÈ‚lPÂê+ªÌl5,@„F- Uk¼h©Î¬Ô˜ ¥ŠÀMPi)UdLhX€ý¡b;iX€âÅ&Ê•YBŠÔê©Ü¬Ô -Y¼õÀ6©Þ,4 YñiXÐl6”&kXÏZ š«¨7}Ô°~IõfÕ° ‹z%žâ·-dª7‹†-B–„EåA$MMñ[`êM “ÆËÅ·¨aAË™êͪaÒ Ô›ÈèÕ#JõfQ €»©™4p™iÖ° Ô›ÈlµÚÞxSA~¦3+UœU=1°€Þ„تX`/¢UQÏ ,À—j$õÐb¢²¬Y=5@XÓYõØÀ‘Å&œOŸäU†9ÄÌZh‘ n‘Ýšcv ºÏÇ~ûåðÍ‚ïñ—ÿÿÔOÊø‡l#‘“¦±Û¾a·? ”‡Èk³ ?\‘™nÈ0Í}®yKì§x:2²< ƒ#‹}ZÓQÕÕNÓ9äšKo!› žÄJùé€b醜Òè;§“Ä<Çä¹’'A‹žSMíhú=~ÆF‘cLmT -ÂÝŠt¶çl· ÜA[YÚÜj‡à²]¢Ù¡[o5všöZîØdmú'¡F¹\¡tIî+–Xt*r B·&SõÌ}qµ#®Lh’×&$éH~ØXÆtŽÂ¦bBV7!+L¨¢÷–œò´–1$Jʪ ê\ôœjjGÓïéÍqÿ/ŽK™:ý;î/•Ú™kø¬;äE'“z“ºs¾7çûƒ9_¦帿¸Ãù„ÀrÅBkË~s¾7ç{s¾;Ou²ûRÎ ùæxoŽ÷s¼ÛSÎ}¹ÿýû$ëß©ÁßMŒµ@Ò:Ñ<¾ÿ|ø懟þúç¿ÿ„úñýãáßZë*~~èTÞZ¿´ä–¿ #~Ïü€ßäÏíxÂo^þRßüÝ?ï<¸†ßÙy7›(dMˆ¹¸ …â|¨$ÖY’ïÞ¹o§4ýo\¤Ê‹$õ,M*çkâuéЦOãI’äÎãôë|¾¦þ¼’~/ñš#Ѫ–¾‹cœ²Ü—V+í<¾·ÓhŽ‡åžÊZœýXþ!Óv¾´h“ûܮ˶Õå3 ]ðz–í¸èNÊÆzÍûõÚôGÜëÖëÖrZ¬!/¢g)³‡7Å‚c™ÃÐuƒtê>îÇɪéËûqúÚæžA¾krIŽE'q±—•íø³‡(²Ñ—b²>7eìnËMxÐã2ï ÿAØeYú.:ûä–¾ŠLì݃ËÒ¾â?½ßÊ´ý_ÆYdOéªNÛvÝ} 4ÿÇE†¼ø {š²'^Ë‚>¬‡.G:;íõ1Öž÷cµÖ¹¯[ÓxÎÝŽb!xSžG±4½ÇoÐexœD*%žV:÷Íyò¢aF{Ö\ï· óhG»u? -«ȹ[ÊÀcLK]úÑüŸfüpþ¦­FyﻤQàÌ£Øsosß÷š`IËÚ¾X«2üKß¹×ÃÄÐèsЯÇÄý8÷a"Àë’_‰û±{V‘·–»¶Ú³E®±mÄþÇ>œÛŒSëK†…çIq™1õñl?n™Ã§s{g'q½'öq-S|¼ªã¸ÕÃKÖ²Ò‰\_™:ëã¦éáÄãµ…E×,û/f»ßÏÞGûXaês;·¾gWõ”wzºE2žlcj\æfý°´y=rÂÓÄ Ž+)Ïñ9—"c¥éè÷š|Äïc?ØU¦1Iu~Øμ–ö@}8—M‹þíÕX«fg]ž«æÃî…Ÿ¯#ÏÔ%}!œ£ùToZdKB·Nô[ÖÛûÞºJ”’ùÎV®¾&Þ¯²«¯Ó³/_Ó]²ªîD^5d¾ ] ŒíÒõéÏûJU”?‰v:W^!oìk»Ñ_ÚûÜí6xuÍ;|~][}¹^z®ð:kÜcïï±FÞ;ŽmE±[%×í6{ÚØ®-sQ›^²Á­?:ö«~wU;LÞÁ'UàɨDŒø0í›sû~ÏÇëºàú!Þ¨“—éà,ûµµõZ¹ÏUé8ì&]ªçF-sc|½VC®³r{=Ÿøv)/›Õ„ŽÑÏÕu‰O“Ê5Ýå=ïòu»ÉÕ§î†ýɼñŠí©ù&_s -êv¶UiOAØÐÈF~¼¬½Íó­¾/¼Ž2ûŒÓ6Þ–s¯a3Q¯ „wؾ­ý‡lÓاF.˜¦õ<ÙÊ}\çè·Øö32ï°úšMJ•9>ÛçõZ®Ýé·æ.n®ƒüH®ØÃWú] -sÏèhŸ#g¡c¶•“XKbÝ/yœyý+ØÃ-ó?[°8>(ØïïœûãâÇ›XžÊí'Åãž?ÓÉU8c[*Çseµ>Yïk§ÛÛÓ–þƒ°ŠÍ™K8]>Ižè1O:V§Ö│½ö¢c÷Ä9P²wžR¿Õë뜚”œŒ…S“ý8÷šTë.ɱxÓËOMöcß{’ìoD¶W=u¾à×úªŽýV;¤>£eN׳»Î¶kÈTÄz°eæ>[Î(DöÊÙ?¡þóz°ó¤êÚúv'7Wõ·ú•2ï g8› -|¥Ã­måsÕÆÕk¸a]^œºõùAȒΓ+¹þBTøeŸzwœð×JÏ?? –Ý ÊÉü-ç×÷|w¶œ¥ÿ=¬Ïê6}Ø:å' ÛÏ »ß®¥f·Z"l÷bµ2v}–þrÕï=Õÿ -¿gºwUzjÿwÂøýØ| -Ç™òö{ø¡ülèžOó¶§Æ>%TOxÅɈŒ;·}BØÚv­2VpEÉ×+}Xd{2?èzßâî=±pu² ↪K·ÖÕvo¤Îä)zz¸¦+gÝVYw uÇËr}ìD)Ò7CƒÜjt º?¼_Vè/q±ÇD/åÈÍ·&žsYžƒ¸¡ËõG%”§b–Ù÷Q|ÿ^n†¤7ÒÐ|4±zˆKûþL?¡ütöS-r•ß£Ûß±«²OϪ'º—ŸFÔy½ÍÕú|ËIß2áCc|>©ò¬b?Í™x »mürÈýaD×H·¹çé5¨Ý ÄÒŽôdµ!:Þ6×íŽîìïùù2z-¯þ±ô6zôü^ ÑXúéþ!+šÌAª¿¦Ãvrõܘ䧽¦%*äg¤{†LÄåÒŽ±(×ÚÐNèû`›ž!»\Îè_úÄ«¡ûßFÏEËB€ì<±BÄÙíÉ´zkÜB¦WÝT–V¢¤Ì2ÓwàÆ€QöΟ%»`1í‰VL7É>²<ŽªË“8D—ªsbû¹/ªRñtÀ´aK}R©ô‚ Šµëí !TÔÄ=džıO -‰¾0¸#¾³Zåú[û3Yý€h4éSMO/] ”ôVzW\±µŠç]X¡ôŸÿf£» -endstream -endobj -893 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 892 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -894 0 obj -<< -/Filter /FlateDecode -/Length 4324 ->> -stream -xœÍ\K$¹q¾×¯¨³€¥HF€±2ì5,Xð@>>Ì”z$½V>øïû V’ɬŠªÌžiI½½5ÝÁGd0øÅ#™Î??üS8¸RjN|¾ü|úåä]ÿZ‹ÍEcÿŸ,çà9; 59ÿ¬Ê.W‰9_OøçærnþzúÏ_þgÛ'œ£«5Š翼(‹Éå’³ƒUÁò –ˆË9J2X)8Üb­ bHæÈ÷¬ 1¸±Xƒc,«@ âèžU!FÌ-ÄU²Á -r„è½Éƒ ž™¢Á ┞,^ .•«ÉËà…-‘K™ƒ‹W]JIŠÅcÈ"Õ‹'E³·x…©d‹— %ò&²Ä’ÉâeÈ¡jð -du“Y|òÁâUrR ³É«àù’Ë=/zqRˆ¼Å Á l“Lv)eƒ!KòRMdòÑâdaüX<à„P.ÅØ­Qw7y -O KŒ™MdÁâ[dñ9Y€ä—, ˆ9;®‘-ˆ…. -ÄRçL Ä*ŽSÍàÅ`yÈ"œ,$ Y;×äAªlaEÈ‚A–ÈdamÖbanÙ×`aoÙ‡dap!¦·°€€¸T[X@€\˜Rµ°€€¹ì´°€ºØîÙÂê’¤hav‰K²°€€»ÄÁ[XÀÀ]"ô4ylaÐÑQ(daw)ølaw±¢…XU;LÀV\,Å[XÀÀÝX<[XÀÀݘáL^v؃daw£à,Ï Ü⣅ Ü“…0üñf4Ü„ˆ@¬…ð÷àE²°ƒ¹ˆ°ÄÂî† -÷gìi • ¥& ¸ -–ÏäU24nì[hÙ…”ª…Ü…£" ¸ ø,ã“—®Å‚ìA@–Ƀ,œÙÂÖ®R-äY(F r„,,,@Dàj@ôm¦æbæ Y)ZX$s¥2[X%!ƒV-^Š®dÀµÉ+à…laAÎìàŠƒ…È¥\Á¦·°ï4\²°b€Ø‚\! ¶Š…pE®DDæ/@Ù Ò/ J„,ˆ-,(± ËLÞÂxhä’PµÅc¯yf±° pr*ZX€m‚LHiò `¬&Ûba’$›HsLd!a J‰šn J,ÑG `›šof ª‡,ˆø,,¨>9 “-,Œƒç½…5䛑-,À¾Ô|³XXPÉ#ßDŠgìÛJIóÍlaAeÈ"QLdAÐT} LB¾ t²x ²ÄÊÔ”4ß, Ì@¾‰ˆÞ, Í7³Y.îJ2Y<à."Óda.o"²µr{à•ŒøÌfÍ8‹Y1ð€^o5KØ o•ÍšøjŽd &2˒̪Ü*˜Á›eüE<Æw˜p­>Í%ªsÈð™%ëMVl Ft?rŽµ=hv­ýåO§_†ó=ÿéO_Õ*eý'Àø‰“&ÖH7RË ¸rm8F0ªA3aÿ4 !à·ôQ!r]… €Å¥è¦BÂÃÝÖóø#lE†Ä*s@0ÓîŒçy‘),%[Ö7÷y'YW%Ѹ(âg%!膯QÇnéõ`Ÿw×ë<ïª$KÖ7÷ywYi!OBX/ÛyM!÷ïJGúßùþ! ’êÃBî5~G!ïá?à¯Õ÷tžl!C,履O¿þÍoÿý_ÿ[¬Î§¯§?ü`™½—⑯âsÁßYãxüÀ†ñYètå…?þø_çO?ÍsE¯ =ü¡lçÒá=]›ÿæTÕªŽgKÓºeÛÌ1hŸÒÂYØœoO†vßÜå›ÌtÑ©‹WãÆÕ¨qœ 2HÏwŠ–>ëUã2"\Äݪý_~úéŸþù?Vµ«jù >eùû Âd$.j˲”+ûR}½.…òCÐ?,¿ùˤo­¨/¦©…þHhQŽêƆ /NÇœõýæ.}sŸõªïqH†¸!?S¸×@ôaË?]„Ëõ·*qCç…ž–ëGJEÀH -!°ßSæӦߡÄí,‚1°`µž“&_$ -Ï;Ôå=Àÿ]–{•;e‡¾‚øÍZî±teYÊŒßWàz8¸hÝ•[Ü»|Ʊǽ‘%ûE£ß»ÞÁ¯’ÄòÀ˜r+˨ÇÝ5¦§Mߢ"òéXb«öøÍW„Ù{’ìóñÌ 9zKõцë/*…åż¾nÍŒãÙÉÍ︽ö×_vL *p*BL7b2̨2™¹ˆÑ[^lclÏòàsŠ¼aíõù{;ŒU^ͺ0mͶàùs|÷o‡ýÃlÃ,†°³pH™sõ5UcÌýeGàÄ…)š½¥G[3¾EM/ÌYàp‘Y$eDZËznGz|ÓH°_ -z„Á2䨥 ÕËÌ9íBøó¦ïáäÅåC;)P9Ç´ìóñ \Ÿm‹¤TÈŽòzœÓ~d°îîí$Ç"­£_j°zþ+:—Ï{Q±ª&"™÷¥±Š…ÐmðDZ¬ZÞ3øçMßÍàE\IQŸ9ˆ>B)¥=x.Ù±>Ð൲T}óƒóÆ,Êjb}3´´U3þ/{¦²:£í´m¦—í #ºq|2öá¨å~>5Mþ|ÜwúKë¿•§a¸Þ}k—odœÜḯ÷ã·1â4ßW·94À‚è£d)ŸCùº×;ˆË0?ŸMýìõŽú§(°«©wÄ{#èáN€ÆÃõ á&ǾѷømÈA/-=ß—=éc·$’-KÜÕ›>4×ÒYZߟ›“ÓC -Õê}Ho)i¨êêÇóßÁlÑÓí)ùqT;ÖçÄ\TvhÄM õ sôÁ¯[½AœÀž£ §9ÿßÀL0`Ÿ}rx.ɵLŠw°àX—½K€Åô ®éd0ùèfÈCæ7È}ï·Œ¹?O0³3NLjü%˜R,¥ÅñÔZ0ƹØ~‡IOÏû„ÝOâ‚ÏíPÎs[;Öçã#úÏ^Oì›ÆvYÃÃöXìE?Ç3¾íðÇLgZòûÞY‹vÇ‚û^¦8RXü9§ý¾w3Ëχêîz>>G–D¦kO= p%>›;ÝE=F ”¼u?/4Bê1rñMïG¨ÿeòáÁÆÀ4®õxÎÑòëÁ>gãé‘_ŠEä]˯Ûaߧüz?æ[ʯFïï,¿r°æä‘Ä$­¹§¢ç’ž[Ç¡.Ç8*"–*ÁÞ×86ÃÎÆ!_nRUSñëc¤Ïàô%”vó©âuù0Š}yO -àØv‡uQ“­Òãnaô{hõ¼é{•E²«‰õˆu•c§ŽuùxÅ@ÉØà…¥§AóApÚ;Û ÞZù6zË}M~ä·;¨¯}ÄØŽ¬íţϛ~Ͼkw{èVÒ㤜jÈo:‚¥Õw™Îiém–³?ý8Ö­†RÂ*”v-ê{aDí´ÔSUìó÷ƪqâG_É¾ê §fÉhI«ÛÉžt| ÚËÍã•zÿ(eð¾¡jÌSU¸{ø‘òߟ0võø@_¨® 0 d›Ób6zbo˜N?FÖO÷ÉõZÒ|¤ìþdŸVK«¾Du3iÓïÓË}ßjzûìšÞ“” ÌRŸY ÿ|â>/)ÊekÖƒžúÝÄŒž¦9¦çÇæ~ƒÕÁJžYÝ°¨¼•ôräduË!Æfm¥ÉqoqHI«”n&|fq%¦n=@ÚŒXKßYyjpǺ|4{k¯=¶·§ëÝ5÷»åý¬‡ÇD¿;AOÕ×éu„¡¯Ý&;ú¹ó#D;‡›hkvR¿8K¢5àšõ]›GF_®×<&à,^®‡—ÛÆÐׂøz:6,œØ 5øq -WKâªívêöÅÂÚ8½@¤Â½Ò›ÇN×πѴŒSzf™ïóbì?NónÆ—eîI^6иé÷ðãí2þrJí±ÐÞöˆ×ºêc98sÒu©g}`V†N<¶ä0¬nº~VÎDß…Àt+Y†)¿nÈ«œ2¶ªø1Y -“¹Ëw%§¯39úrôwŒ;Ù|'^šcã[²š~铬d­wó“MÄU0€ÂJ^aôµ‘ûnè¤G2ûŸë&³<îåôçSss‘D«l.QÐïú˜£®pþ?´ù Ÿÿ>ñùßúË¥W?ý@‹8°uCž=™~3T9HÖ“â8¶ÍDŒ<ÁþJem+݆qÂk^»ûØ{Ë04 îL”U‡9ÓÕ·¼VÍÈâåF‹#ùÞµYöõ’úÍaÒ×’»T¸˜o‡ôüõàÑê’ÏÓ¸Ò¦«K—ãÔ󠸜&¬«d1Õ çI†êU~ž—‚t®éb -#ô’V¯nvºÓÚ]LMÓ|1Ìaž´nä1„þæíõÝ뾈œúPê€öA}©ãÆ”:ϦR»LÛËás¨Õ„úæ]54Æ¢iïÑrÖ­±†¼¹˜mt¢–µÛÒ@æI¹Ó6“vG1à4ßicÄÜeJK·®–vÇÅÔR1ÅJýó¬i™We(QæUIwmuÜîñF´D#’Ùœózw~m9bÉbÐÒÜ{PymIv?7oçîÞö<ݯ‚¤52õk7¹kùMø÷-{ǬÓ[­úO«Œ„²~µžŠÔ¾aÓ—”€!¬_’”¹L¥’7÷y^;¹¯ôÚÉ<–Ã1‘ÏA¿+Õáõ”¯>ì9cªªÝ­zó–Þ¦£4´ÂÜýS•öey­ÀÖ -Dã2kª¨ßIôýJ¯ìƒY*je }Qš7%”öóÿ’Qd} -endstream -endobj -895 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 894 0 R -/Resources 4 0 R -/Annots [ 896 0 R 897 0 R 898 0 R 899 0 R 900 0 R 901 0 R 902 0 R 903 0 R 904 0 R 905 0 R 906 0 R 907 0 R 908 0 R 909 0 R 910 0 R 911 0 R 912 0 R 913 0 R 914 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -896 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 766.923057 101.433071 748.173057 ] -/BS << -/W 0 ->> -/Dest (cb241-1) ->> -endobj -897 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 747.976036 99.933071 729.226036 ] -/BS << -/W 0 ->> -/Dest (cb241-2) ->> -endobj -898 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.029014 99.933071 710.279014 ] -/BS << -/W 0 ->> -/Dest (cb241-3) ->> -endobj -899 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.081993 99.933071 691.331993 ] -/BS << -/W 0 ->> -/Dest (cb241-4) ->> -endobj -900 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 691.134971 99.933071 672.384971 ] -/BS << -/W 0 ->> -/Dest (cb241-5) ->> -endobj -901 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.187950 99.933071 653.437950 ] -/BS << -/W 0 ->> -/Dest (cb241-6) ->> -endobj -902 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.240928 99.933071 634.490928 ] -/BS << -/W 0 ->> -/Dest (cb241-7) ->> -endobj -903 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.293907 99.933071 615.543907 ] -/BS << -/W 0 ->> -/Dest (cb241-8) ->> -endobj -904 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.346885 99.933071 596.596885 ] -/BS << -/W 0 ->> -/Dest (cb241-9) ->> -endobj -905 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.399864 99.933071 577.649864 ] -/BS << -/W 0 ->> -/Dest (cb241-10) ->> -endobj -906 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.452842 99.933071 558.702842 ] -/BS << -/W 0 ->> -/Dest (cb241-11) ->> -endobj -907 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 520.611778 99.933071 501.861778 ] -/BS << -/W 0 ->> -/Dest (cb241-12) ->> -endobj -908 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 501.664756 99.933071 482.914756 ] -/BS << -/W 0 ->> -/Dest (cb241-13) ->> -endobj -909 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.717735 99.933071 463.967735 ] -/BS << -/W 0 ->> -/Dest (cb241-14) ->> -endobj -910 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.770714 99.933071 445.020714 ] -/BS << -/W 0 ->> -/Dest (cb241-15) ->> -endobj -911 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.823692 99.933071 426.073692 ] -/BS << -/W 0 ->> -/Dest (cb241-16) ->> -endobj -912 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.876671 99.933071 407.126671 ] -/BS << -/W 0 ->> -/Dest (cb241-17) ->> -endobj -913 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.929649 99.933071 388.179649 ] -/BS << -/W 0 ->> -/Dest (cb241-18) ->> -endobj -914 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 345.982628 101.433071 327.232628 ] -/BS << -/W 0 ->> -/Dest (cb242-1) ->> -endobj -915 0 obj -<< -/Title (RKE CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 141 -/First 916 0 R -/Last 1052 0 R -/Parent 1057 0 R ->> -endobj -916 0 obj -<< -/Title (RKE CIS v1.6 Kubernetes Benchmark - Rancher v2.6 with Kubernetes v1.18 to v1.23) -/Dest [ 304 0 R /XYZ 84.259843 784.970079 0 ] -/Count 2 -/First 917 0 R -/Last 918 0 R -/Parent 915 0 R -/Next 919 0 R ->> -endobj -917 0 obj -<< -/Title (Overview) -/Dest [ 304 0 R /XYZ 84.259843 704.822079 0 ] -/Count 0 -/Parent 916 0 R -/Next 918 0 R ->> -endobj -918 0 obj -<< -/Title (Testing controls methodology) -/Dest [ 304 0 R /XYZ 84.259843 166.076079 0 ] -/Count 0 -/Prev 917 0 R -/Parent 916 0 R ->> -endobj -919 0 obj -<< -/Title (Controls) -/Dest [ 311 0 R /XYZ 84.259843 612.381496 0 ] -/Count 0 -/Prev 916 0 R -/Parent 915 0 R -/Next 920 0 R ->> -endobj -920 0 obj -<< -/Title (1.1 Master Node Configuration Files) -/Dest [ 315 0 R /XYZ 41.740157 784.430079 0 ] -/Count 21 -/Prev 919 0 R -/First 921 0 R -/Last 941 0 R -/Parent 915 0 R -/Next 942 0 R ->> -endobj -921 0 obj -<< -/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 920 0 R -/Next 922 0 R ->> -endobj -922 0 obj -<< -/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 -/Prev 921 0 R -/Parent 920 0 R -/Next 923 0 R ->> -endobj -923 0 obj -<< -/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 922 0 R -/Parent 920 0 R -/Next 924 0 R ->> -endobj -924 0 obj -<< -/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 277.251496 0 ] -/Count 0 -/Prev 923 0 R -/Parent 920 0 R -/Next 925 0 R ->> -endobj -925 0 obj -<< -/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 315 0 R /XYZ 84.259843 146.451496 0 ] -/Count 0 -/Prev 924 0 R -/Parent 920 0 R -/Next 926 0 R ->> -endobj -926 0 obj -<< -/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 317 0 R /XYZ 84.259843 739.970079 0 ] -/Count 0 -/Prev 925 0 R -/Parent 920 0 R -/Next 927 0 R ->> -endobj -927 0 obj -<< -/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 317 0 R /XYZ 84.259843 609.170079 0 ] -/Count 0 -/Prev 926 0 R -/Parent 920 0 R -/Next 928 0 R ->> -endobj -928 0 obj -<< -/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 317 0 R /XYZ 84.259843 478.370079 0 ] -/Count 0 -/Prev 927 0 R -/Parent 920 0 R -/Next 929 0 R ->> -endobj -929 0 obj -<< -/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 317 0 R /XYZ 84.259843 347.570079 0 ] -/Count 0 -/Prev 928 0 R -/Parent 920 0 R -/Next 930 0 R ->> -endobj -930 0 obj -<< -/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) -/Dest [ 317 0 R /XYZ 84.259843 170.823057 0 ] -/Count 0 -/Prev 929 0 R -/Parent 920 0 R -/Next 931 0 R ->> -endobj -931 0 obj -<< -/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) -/Dest [ 320 0 R /XYZ 84.259843 694.023057 0 ] -/Count 0 -/Prev 930 0 R -/Parent 920 0 R -/Next 932 0 R ->> -endobj -932 0 obj -<< -/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) -/Dest [ 320 0 R /XYZ 84.259843 365.776036 0 ] -/Count 0 -/Prev 931 0 R -/Parent 920 0 R -/Next 933 0 R ->> -endobj -933 0 obj -<< -/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 702.470079 0 ] -/Count 0 -/Prev 932 0 R -/Parent 920 0 R -/Next 934 0 R ->> -endobj -934 0 obj -<< -/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 586.670079 0 ] -/Count 0 -/Prev 933 0 R -/Parent 920 0 R -/Next 935 0 R ->> -endobj -935 0 obj -<< -/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 470.870079 0 ] -/Count 0 -/Prev 934 0 R -/Parent 920 0 R -/Next 936 0 R ->> -endobj -936 0 obj -<< -/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 340.070079 0 ] -/Count 0 -/Prev 935 0 R -/Parent 920 0 R -/Next 937 0 R ->> -endobj -937 0 obj -<< -/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 209.270079 0 ] -/Count 0 -/Prev 936 0 R -/Parent 920 0 R -/Next 938 0 R ->> -endobj -938 0 obj -<< -/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) -/Dest [ 327 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 937 0 R -/Parent 920 0 R -/Next 939 0 R ->> -endobj -939 0 obj -<< -/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) -/Dest [ 327 0 R /XYZ 84.259843 668.570079 0 ] -/Count 0 -/Prev 938 0 R -/Parent 920 0 R -/Next 940 0 R ->> -endobj -940 0 obj -<< -/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 351 0 R /XYZ 84.259843 184.188585 0 ] -/Count 0 -/Prev 939 0 R -/Parent 920 0 R -/Next 941 0 R ->> -endobj -941 0 obj -<< -/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Automated\)) -/Dest [ 442 0 R /XYZ 84.259843 702.470079 0 ] -/Count 0 -/Prev 940 0 R -/Parent 920 0 R ->> -endobj -942 0 obj -<< -/Title (1.2 API Server) -/Dest [ 510 0 R /XYZ 41.740157 784.430079 0 ] -/Count 35 -/Prev 920 0 R -/First 943 0 R -/Last 977 0 R -/Parent 915 0 R -/Next 978 0 R ->> -endobj -943 0 obj -<< -/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Automated\)) -/Dest [ 510 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 942 0 R -/Next 944 0 R ->> -endobj -944 0 obj -<< -/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) -/Dest [ 513 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 943 0 R -/Parent 942 0 R -/Next 945 0 R ->> -endobj -945 0 obj -<< -/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) -/Dest [ 518 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 944 0 R -/Parent 942 0 R -/Next 946 0 R ->> -endobj -946 0 obj -<< -/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) -/Dest [ 521 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 945 0 R -/Parent 942 0 R -/Next 947 0 R ->> -endobj -947 0 obj -<< -/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) -/Dest [ 526 0 R /XYZ 84.259843 427.220079 0 ] -/Count 0 -/Prev 946 0 R -/Parent 942 0 R -/Next 948 0 R ->> -endobj -948 0 obj -<< -/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) -/Dest [ 531 0 R /XYZ 84.259843 652.220079 0 ] -/Count 0 -/Prev 947 0 R -/Parent 942 0 R -/Next 949 0 R ->> -endobj -949 0 obj -<< -/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 534 0 R /XYZ 84.259843 183.470079 0 ] -/Count 0 -/Prev 948 0 R -/Parent 942 0 R -/Next 950 0 R ->> -endobj -950 0 obj -<< -/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) -/Dest [ 539 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 949 0 R -/Parent 942 0 R -/Next 951 0 R ->> -endobj -951 0 obj -<< -/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) -/Dest [ 544 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 950 0 R -/Parent 942 0 R -/Next 952 0 R ->> -endobj -952 0 obj -<< -/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Automated\)) -/Dest [ 547 0 R /XYZ 84.259843 314.720079 0 ] -/Count 0 -/Prev 951 0 R -/Parent 942 0 R -/Next 953 0 R ->> -endobj -953 0 obj -<< -/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) -/Dest [ 552 0 R /XYZ 84.259843 520.970079 0 ] -/Count 0 -/Prev 952 0 R -/Parent 942 0 R -/Next 954 0 R ->> -endobj -954 0 obj -<< -/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) -/Dest [ 557 0 R /XYZ 84.259843 708.470079 0 ] -/Count 0 -/Prev 953 0 R -/Parent 942 0 R -/Next 955 0 R ->> -endobj -955 0 obj -<< -/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) -/Dest [ 557 0 R /XYZ 84.259843 501.723057 0 ] -/Count 0 -/Prev 954 0 R -/Parent 942 0 R -/Next 956 0 R ->> -endobj -956 0 obj -<< -/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) -/Dest [ 557 0 R /XYZ 84.259843 264.976036 0 ] -/Count 0 -/Prev 955 0 R -/Parent 942 0 R -/Next 957 0 R ->> -endobj -957 0 obj -<< -/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) -/Dest [ 564 0 R /XYZ 84.259843 520.970079 0 ] -/Count 0 -/Prev 956 0 R -/Parent 942 0 R -/Next 958 0 R ->> -endobj -958 0 obj -<< -/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) -/Dest [ 569 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 957 0 R -/Parent 942 0 R -/Next 959 0 R ->> -endobj -959 0 obj -<< -/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) -/Dest [ 572 0 R /XYZ 84.259843 258.470079 0 ] -/Count 0 -/Prev 958 0 R -/Parent 942 0 R -/Next 960 0 R ->> -endobj -960 0 obj -<< -/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) -/Dest [ 577 0 R /XYZ 84.259843 427.220079 0 ] -/Count 0 -/Prev 959 0 R -/Parent 942 0 R -/Next 961 0 R ->> -endobj -961 0 obj -<< -/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) -/Dest [ 582 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 960 0 R -/Parent 942 0 R -/Next 962 0 R ->> -endobj -962 0 obj -<< -/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) -/Dest [ 585 0 R /XYZ 84.259843 314.720079 0 ] -/Count 0 -/Prev 961 0 R -/Parent 942 0 R -/Next 963 0 R ->> -endobj -963 0 obj -<< -/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 590 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 962 0 R -/Parent 942 0 R -/Next 964 0 R ->> -endobj -964 0 obj -<< -/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) -/Dest [ 593 0 R /XYZ 84.259843 183.470079 0 ] -/Count 0 -/Prev 963 0 R -/Parent 942 0 R -/Next 965 0 R ->> -endobj -965 0 obj -<< -/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) -/Dest [ 598 0 R /XYZ 84.259843 445.970079 0 ] -/Count 0 -/Prev 964 0 R -/Parent 942 0 R -/Next 966 0 R ->> -endobj -966 0 obj -<< -/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) -/Dest [ 603 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 965 0 R -/Parent 942 0 R -/Next 967 0 R ->> -endobj -967 0 obj -<< -/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) -/Dest [ 606 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 966 0 R -/Parent 942 0 R -/Next 968 0 R ->> -endobj -968 0 obj -<< -/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) -/Dest [ 611 0 R /XYZ 84.259843 595.970079 0 ] -/Count 0 -/Prev 967 0 R -/Parent 942 0 R -/Next 969 0 R ->> -endobj -969 0 obj -<< -/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) -/Dest [ 614 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 968 0 R -/Parent 942 0 R -/Next 970 0 R ->> -endobj -970 0 obj -<< -/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) -/Dest [ 619 0 R /XYZ 84.259843 408.470079 0 ] -/Count 0 -/Prev 969 0 R -/Parent 942 0 R -/Next 971 0 R ->> -endobj -971 0 obj -<< -/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) -/Dest [ 624 0 R /XYZ 84.259843 689.720079 0 ] -/Count 0 -/Prev 970 0 R -/Parent 942 0 R -/Next 972 0 R ->> -endobj -972 0 obj -<< -/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 627 0 R /XYZ 84.259843 239.720079 0 ] -/Count 0 -/Prev 971 0 R -/Parent 942 0 R -/Next 973 0 R ->> -endobj -973 0 obj -<< -/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 632 0 R /XYZ 84.259843 483.470079 0 ] -/Count 0 -/Prev 972 0 R -/Parent 942 0 R -/Next 974 0 R ->> -endobj -974 0 obj -<< -/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) -/Dest [ 637 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 973 0 R -/Parent 942 0 R -/Next 975 0 R ->> -endobj -975 0 obj -<< -/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) -/Dest [ 640 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 974 0 R -/Parent 942 0 R -/Next 976 0 R ->> -endobj -976 0 obj -<< -/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) -/Dest [ 645 0 R /XYZ 84.259843 577.220079 0 ] -/Count 0 -/Prev 975 0 R -/Parent 942 0 R -/Next 977 0 R ->> -endobj -977 0 obj -<< -/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 662 0 R /XYZ 84.259843 411.552842 0 ] -/Count 0 -/Prev 976 0 R -/Parent 942 0 R ->> -endobj -978 0 obj -<< -/Title (1.3 Controller Manager) -/Dest [ 676 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 942 0 R -/First 979 0 R -/Last 985 0 R -/Parent 915 0 R -/Next 986 0 R ->> -endobj -979 0 obj -<< -/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) -/Dest [ 676 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 978 0 R -/Next 980 0 R ->> -endobj -980 0 obj -<< -/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 679 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 979 0 R -/Parent 978 0 R -/Next 981 0 R ->> -endobj -981 0 obj -<< -/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) -/Dest [ 682 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 980 0 R -/Parent 978 0 R -/Next 982 0 R ->> -endobj -982 0 obj -<< -/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) -/Dest [ 685 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 981 0 R -/Parent 978 0 R -/Next 983 0 R ->> -endobj -983 0 obj -<< -/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 688 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 982 0 R -/Parent 978 0 R -/Next 984 0 R ->> -endobj -984 0 obj -<< -/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 691 0 R /XYZ 84.259843 727.220079 0 ] -/Count 0 -/Prev 983 0 R -/Parent 978 0 R -/Next 985 0 R ->> -endobj -985 0 obj -<< -/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 691 0 R /XYZ 84.259843 524.420079 0 ] -/Count 0 -/Prev 984 0 R -/Parent 978 0 R ->> -endobj -986 0 obj -<< -/Title (1.4 Scheduler) -/Dest [ 696 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 978 0 R -/First 987 0 R -/Last 988 0 R -/Parent 915 0 R -/Next 989 0 R ->> -endobj -987 0 obj -<< -/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 696 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 986 0 R -/Next 988 0 R ->> -endobj -988 0 obj -<< -/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 696 0 R /XYZ 84.259843 257.404475 0 ] -/Count 0 -/Prev 987 0 R -/Parent 986 0 R ->> -endobj -989 0 obj -<< -/Title (2 Etcd Node Configuration Files) -/Dest [ 702 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 986 0 R -/First 990 0 R -/Last 996 0 R -/Parent 915 0 R -/Next 997 0 R ->> -endobj -990 0 obj -<< -/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) -/Dest [ 702 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 989 0 R -/Next 991 0 R ->> -endobj -991 0 obj -<< -/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) -/Dest [ 707 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 990 0 R -/Parent 989 0 R -/Next 992 0 R ->> -endobj -992 0 obj -<< -/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) -/Dest [ 712 0 R /XYZ 84.259843 258.470079 0 ] -/Count 0 -/Prev 991 0 R -/Parent 989 0 R -/Next 993 0 R ->> -endobj -993 0 obj -<< -/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 719 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 992 0 R -/Parent 989 0 R -/Next 994 0 R ->> -endobj -994 0 obj -<< -/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) -/Dest [ 724 0 R /XYZ 84.259843 558.470079 0 ] -/Count 0 -/Prev 993 0 R -/Parent 989 0 R -/Next 995 0 R ->> -endobj -995 0 obj -<< -/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) -/Dest [ 729 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 994 0 R -/Parent 989 0 R -/Next 996 0 R ->> -endobj -996 0 obj -<< -/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Automated\)) -/Dest [ 736 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 995 0 R -/Parent 989 0 R ->> -endobj -997 0 obj -<< -/Title (3.1 Authentication and Authorization) -/Dest [ 743 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 989 0 R -/First 998 0 R -/Last 998 0 R -/Parent 915 0 R -/Next 999 0 R ->> -endobj -998 0 obj -<< -/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) -/Dest [ 743 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 997 0 R ->> -endobj -999 0 obj -<< -/Title (3.2 Logging) -/Dest [ 745 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 997 0 R -/First 1000 0 R -/Last 1001 0 R -/Parent 915 0 R -/Next 1002 0 R ->> -endobj -1000 0 obj -<< -/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) -/Dest [ 745 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 999 0 R -/Next 1001 0 R ->> -endobj -1001 0 obj -<< -/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) -/Dest [ 748 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 1000 0 R -/Parent 999 0 R ->> -endobj -1002 0 obj -<< -/Title (4.1 Worker Node Configuration Files) -/Dest [ 750 0 R /XYZ 41.740157 784.430079 0 ] -/Count 10 -/Prev 999 0 R -/First 1003 0 R -/Last 1012 0 R -/Parent 915 0 R -/Next 1013 0 R ->> -endobj -1003 0 obj -<< -/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 750 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1002 0 R -/Next 1004 0 R ->> -endobj -1004 0 obj -<< -/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) -/Dest [ 750 0 R /XYZ 84.259843 553.851496 0 ] -/Count 0 -/Prev 1003 0 R -/Parent 1002 0 R -/Next 1005 0 R ->> -endobj -1005 0 obj -<< -/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 750 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 1004 0 R -/Parent 1002 0 R -/Next 1006 0 R ->> -endobj -1006 0 obj -<< -/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Automated\)) -/Dest [ 753 0 R /XYZ 84.259843 763.220079 0 ] -/Count 0 -/Prev 1005 0 R -/Parent 1002 0 R -/Next 1007 0 R ->> -endobj -1007 0 obj -<< -/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 753 0 R /XYZ 84.259843 454.079014 0 ] -/Count 0 -/Prev 1006 0 R -/Parent 1002 0 R -/Next 1008 0 R ->> -endobj -1008 0 obj -<< -/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) -/Dest [ 753 0 R /XYZ 84.259843 163.687950 0 ] -/Count 0 -/Prev 1007 0 R -/Parent 1002 0 R -/Next 1009 0 R ->> -endobj -1009 0 obj -<< -/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 757 0 R /XYZ 84.259843 519.629014 0 ] -/Count 0 -/Prev 1008 0 R -/Parent 1002 0 R -/Next 1010 0 R ->> -endobj -1010 0 obj -<< -/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) -/Dest [ 766 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 1009 0 R -/Parent 1002 0 R -/Next 1011 0 R ->> -endobj -1011 0 obj -<< -/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) -/Dest [ 766 0 R /XYZ 84.259843 383.493907 0 ] -/Count 0 -/Prev 1010 0 R -/Parent 1002 0 R -/Next 1012 0 R ->> -endobj -1012 0 obj -<< -/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) -/Dest [ 766 0 R /XYZ 84.259843 195.693907 0 ] -/Count 0 -/Prev 1011 0 R -/Parent 1002 0 R ->> -endobj -1013 0 obj -<< -/Title (4.2 Kubelet) -/Dest [ 776 0 R /XYZ 41.740157 784.430079 0 ] -/Count 13 -/Prev 1002 0 R -/First 1014 0 R -/Last 1026 0 R -/Parent 915 0 R -/Next 1027 0 R ->> -endobj -1014 0 obj -<< -/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) -/Dest [ 776 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1013 0 R -/Next 1015 0 R ->> -endobj -1015 0 obj -<< -/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 776 0 R /XYZ 84.259843 332.207453 0 ] -/Count 0 -/Prev 1014 0 R -/Parent 1013 0 R -/Next 1016 0 R ->> -endobj -1016 0 obj -<< -/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 781 0 R /XYZ 84.259843 675.273057 0 ] -/Count 0 -/Prev 1015 0 R -/Parent 1013 0 R -/Next 1017 0 R ->> -endobj -1017 0 obj -<< -/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) -/Dest [ 781 0 R /XYZ 84.259843 301.829014 0 ] -/Count 0 -/Prev 1016 0 R -/Parent 1013 0 R -/Next 1018 0 R ->> -endobj -1018 0 obj -<< -/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) -/Dest [ 786 0 R /XYZ 84.259843 641.326036 0 ] -/Count 0 -/Prev 1017 0 R -/Parent 1013 0 R -/Next 1019 0 R ->> -endobj -1019 0 obj -<< -/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) -/Dest [ 792 0 R /XYZ 84.259843 445.970079 0 ] -/Count 0 -/Prev 1018 0 R -/Parent 1013 0 R -/Next 1020 0 R ->> -endobj -1020 0 obj -<< -/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) -/Dest [ 796 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 1019 0 R -/Parent 1013 0 R -/Next 1021 0 R ->> -endobj -1021 0 obj -<< -/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) -/Dest [ 796 0 R /XYZ 84.259843 425.926036 0 ] -/Count 0 -/Prev 1020 0 R -/Parent 1013 0 R -/Next 1022 0 R ->> -endobj -1022 0 obj -<< -/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Automated\)) -/Dest [ 796 0 R /XYZ 84.259843 208.126036 0 ] -/Count 0 -/Prev 1021 0 R -/Parent 1013 0 R -/Next 1023 0 R ->> -endobj -1023 0 obj -<< -/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 800 0 R /XYZ 84.259843 542.326036 0 ] -/Count 0 -/Prev 1022 0 R -/Parent 1013 0 R -/Next 1024 0 R ->> -endobj -1024 0 obj -<< -/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Automated\)) -/Dest [ 800 0 R /XYZ 84.259843 138.881993 0 ] -/Count 0 -/Prev 1023 0 R -/Parent 1013 0 R -/Next 1025 0 R ->> -endobj -1025 0 obj -<< -/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 810 0 R /XYZ 84.259843 670.970079 0 ] -/Count 0 -/Prev 1024 0 R -/Parent 1013 0 R -/Next 1026 0 R ->> -endobj -1026 0 obj -<< -/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Automated\)) -/Dest [ 810 0 R /XYZ 84.259843 392.223057 0 ] -/Count 0 -/Prev 1025 0 R -/Parent 1013 0 R ->> -endobj -1027 0 obj -<< -/Title (5.1 RBAC and Service Accounts) -/Dest [ 817 0 R /XYZ 41.740157 784.430079 0 ] -/Count 6 -/Prev 1013 0 R -/First 1028 0 R -/Last 1033 0 R -/Parent 915 0 R -/Next 1034 0 R ->> -endobj -1028 0 obj -<< -/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) -/Dest [ 817 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1027 0 R -/Next 1029 0 R ->> -endobj -1029 0 obj -<< -/Title (5.1.2 Minimize access to secrets \(Manual\)) -/Dest [ 817 0 R /XYZ 84.259843 523.851496 0 ] -/Count 0 -/Prev 1028 0 R -/Parent 1027 0 R -/Next 1030 0 R ->> -endobj -1030 0 obj -<< -/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) -/Dest [ 817 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 1029 0 R -/Parent 1027 0 R -/Next 1031 0 R ->> -endobj -1031 0 obj -<< -/Title (5.1.4 Minimize access to create pods \(Manual\)) -/Dest [ 817 0 R /XYZ 84.259843 307.251496 0 ] -/Count 0 -/Prev 1030 0 R -/Parent 1027 0 R -/Next 1032 0 R ->> -endobj -1032 0 obj -<< -/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) -/Dest [ 817 0 R /XYZ 84.259843 206.451496 0 ] -/Count 0 -/Prev 1031 0 R -/Parent 1027 0 R -/Next 1033 0 R ->> -endobj -1033 0 obj -<< -/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) -/Dest [ 844 0 R /XYZ 84.259843 449.446885 0 ] -/Count 0 -/Prev 1032 0 R -/Parent 1027 0 R ->> -endobj -1034 0 obj -<< -/Title (5.2 Pod Security Policies) -/Dest [ 855 0 R /XYZ 41.740157 784.430079 0 ] -/Count 9 -/Prev 1027 0 R -/First 1035 0 R -/Last 1043 0 R -/Parent 915 0 R -/Next 1044 0 R ->> -endobj -1035 0 obj -<< -/Title (5.2.1 Minimize the admission of privileged containers \(Manual\)) -/Dest [ 855 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1034 0 R -/Next 1036 0 R ->> -endobj -1036 0 obj -<< -/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) -/Dest [ 855 0 R /XYZ 84.259843 589.851496 0 ] -/Count 0 -/Prev 1035 0 R -/Parent 1034 0 R -/Next 1037 0 R ->> -endobj -1037 0 obj -<< -/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) -/Dest [ 855 0 R /XYZ 84.259843 238.710432 0 ] -/Count 0 -/Prev 1036 0 R -/Parent 1034 0 R -/Next 1038 0 R ->> -endobj -1038 0 obj -<< -/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) -/Dest [ 858 0 R /XYZ 84.259843 603.629014 0 ] -/Count 0 -/Prev 1037 0 R -/Parent 1034 0 R -/Next 1039 0 R ->> -endobj -1039 0 obj -<< -/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) -/Dest [ 858 0 R /XYZ 84.259843 252.487950 0 ] -/Count 0 -/Prev 1038 0 R -/Parent 1034 0 R -/Next 1040 0 R ->> -endobj -1040 0 obj -<< -/Title (5.2.6 Minimize the admission of root containers \(Manual\)) -/Dest [ 862 0 R /XYZ 84.259843 584.681993 0 ] -/Count 0 -/Prev 1039 0 R -/Parent 1034 0 R -/Next 1041 0 R ->> -endobj -1041 0 obj -<< -/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) -/Dest [ 862 0 R /XYZ 84.259843 453.881993 0 ] -/Count 0 -/Prev 1040 0 R -/Parent 1034 0 R -/Next 1042 0 R ->> -endobj -1042 0 obj -<< -/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) -/Dest [ 862 0 R /XYZ 84.259843 323.081993 0 ] -/Count 0 -/Prev 1041 0 R -/Parent 1034 0 R -/Next 1043 0 R ->> -endobj -1043 0 obj -<< -/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) -/Dest [ 862 0 R /XYZ 84.259843 207.281993 0 ] -/Count 0 -/Prev 1042 0 R -/Parent 1034 0 R ->> -endobj -1044 0 obj -<< -/Title (5.3 Network Policies and CNI) -/Dest [ 865 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1034 0 R -/First 1045 0 R -/Last 1046 0 R -/Parent 915 0 R -/Next 1047 0 R ->> -endobj -1045 0 obj -<< -/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Manual\)) -/Dest [ 865 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1044 0 R -/Next 1046 0 R ->> -endobj -1046 0 obj -<< -/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) -/Dest [ 865 0 R /XYZ 84.259843 538.851496 0 ] -/Count 0 -/Prev 1045 0 R -/Parent 1044 0 R ->> -endobj -1047 0 obj -<< -/Title (5.4 Secrets Management) -/Dest [ 889 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 1044 0 R -/First 1048 0 R -/Last 1049 0 R -/Parent 915 0 R -/Next 1050 0 R ->> -endobj -1048 0 obj -<< -/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1047 0 R -/Next 1049 0 R ->> -endobj -1049 0 obj -<< -/Title (5.4.2 Consider external secret storage \(Manual\)) -/Dest [ 889 0 R /XYZ 84.259843 568.851496 0 ] -/Count 0 -/Prev 1048 0 R -/Parent 1047 0 R ->> -endobj -1050 0 obj -<< -/Title (5.5 Extensible Admission Control) -/Dest [ 891 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 1047 0 R -/First 1051 0 R -/Last 1051 0 R -/Parent 915 0 R -/Next 1052 0 R ->> -endobj -1051 0 obj -<< -/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) -/Dest [ 891 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 1050 0 R ->> -endobj -1052 0 obj -<< -/Title (5.7 General Policies) -/Dest [ 893 0 R /XYZ 41.740157 784.430079 0 ] -/Count 4 -/Prev 1050 0 R -/First 1053 0 R -/Last 1056 0 R -/Parent 915 0 R ->> -endobj -1053 0 obj -<< -/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) -/Dest [ 893 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 1052 0 R -/Next 1054 0 R ->> -endobj -1054 0 obj -<< -/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) -/Dest [ 893 0 R /XYZ 84.259843 604.851496 0 ] -/Count 0 -/Prev 1053 0 R -/Parent 1052 0 R -/Next 1055 0 R ->> -endobj -1055 0 obj -<< -/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Manual\)) -/Dest [ 893 0 R /XYZ 84.259843 324.051496 0 ] -/Count 0 -/Prev 1054 0 R -/Parent 1052 0 R -/Next 1056 0 R ->> -endobj -1056 0 obj -<< -/Title (5.7.4 The default namespace should not be used \(Automated\)) -/Dest [ 893 0 R /XYZ 84.259843 193.251496 0 ] -/Count 0 -/Prev 1055 0 R -/Parent 1052 0 R ->> -endobj -1057 0 obj -<< -/Count 142 -/First 915 0 R -/Last 915 0 R ->> -endobj -1058 0 obj -<< -/Length1 41480 -/Filter /FlateDecode -/Length 7851 ->> -stream -xœí| xU¶ð¹÷Ô­®^Òéîtg_:{–˜˜ ¥AˆlbpM „ Ba#„ÁIP""b@ ˆ@DQDdgÜž 8èL@œ‡ŽÆ¤òNU'!8ã›™÷ýßÿþÿûêœô­{oÝåœsÏVõ})`D…é¹¹o®™¾{ Àc©7ò¦#sƒ®¦v)µKoÊ»eBÒ'×´RûšsÓ„IÃϽûR*@}$Ý¿|󰉣ÌC3 ð¤ƒÚßÞ2!-cÎwÏ/`MÔ¾}ÆÜ‚R|Y¢õò¾ öö‹zavÔ €ŸÕÓµ¨tÖÜù×.¾àÖut׬‚²R0Âc£¨m›uÏÒ¢ßì¸Ñð­:¢xfAaÌ_ÃGÓܺŸ]Lö'Âʨ½Ú ÅsÞ»[r]à4~ü»÷”Ì(XÔQJûO¡ý’çÍ-¸·4ä<ÿ˜Æo¤ñÞysg&_¸þÀ&âŸ.-)[ØùL¥ýS´û¥ f–1}MÕۮŠɎßÙÔ÷kuÑ]9ß@Œ¼aK¥výmó¬)JvSS~ y¦¹j•'èþS”¾R/zQë :õØD+€äáÁþ5$;«AtdŠMÔŒö_ñPÄ]4Á*#*ç’¿+W4²|à…Ų[u³Í¦¹ìl>°Î;µ»ÒI(êÉ׿ ü,Ò¼ºÛ">¥_]ï1Ô®þW×KÁ!–ÁqQezÛǵ«œéoóŸûÛb¨ÿúר¦ùn¨ü÷8ñƒtÊõķ5æK­0ŸÿÒôu]pˆ‚WõûÛüu:ÑCZ¿ô9Ìï^ÇP»/”`< ¤{{¤¸þB‹`€`€`€`€`€`€`€`€`€`€`€`€`€`€`€`€`€`€`Àÿk VBš°ø¦Hó­Mÿúžö5=7•L¿JPCW/¡¤_@dÃ0n‚Ñ0&@Ál(Åúˆþp Ö3â61Ša,èìì<ûßá¿ñ÷÷pÐ$ 9ƒ~^G#O]Øè»u²÷Í)±ýûý¨éu˜¼×°ÔÛÔÙ™7YŠSEd#&*Rbü§?uóÓþýÆæMö6vŒѵêÈüÔ7a2UµuSÿÈú=mÓF‘H£ó½3Š½:Œü cæàþÐÄ—û:P±Íß'âwø·:ü֎ߨxYÅÿLÄ¿Úñë:¼”ˆ_=8L|¥âÅ:¼P‡­mø—6ü³Š_Æ/†ãyÿ”ŸŸ› >¯Ãs4ðÜ<ûYš8Û†Ÿ¥á§*~¢âÇønü¨?Tñ¾¿ ß;ŒTñ]þî2gÇÝ»ÅîBÜÕà»±Á…ÏÑ϶áNŸQq‡ŠO»p»ŠOm³‹§2p›Ÿ,ÄzR_‡[UÜò„MlQñ >þX˜x¼Ûì…áfn²àF7Ôˆ *Ö`-Mª­ÃG±‹GSð;>܆ëk‹õ*ÖTO5‡±f¹Tý«DQ= «}Ò¯ñ!×­ Ö©¸v>Hl>8 «ÖXE•×X±’:* q5Iju"®râ/U\¹Â)Vª¸Â‰¨¸\Å -}¿X¶LüBÅeËðþB,Ÿèå‰xŸŠKU¼×ŽKl¸Ø‚‹T\؆em¸  ç·a©Š%*ÎSñžXœ£âÝÎáâî 8[Åâe8‹E*ÎT±PÅ*NW±`0æ·á6œ¦â*NUqÊd‹˜Ò†“-ø³à0ñ³ ¼]ÅI´ó¤á8у˜CLÅÛÜxë˜ q«ŠyV¼EÅñ7;Äxovà8ÇÒ±*Žíc‚ptT€íÀQx“Š¹u8²G¨x#ï/nlÃá‡qØXô©8TÅ®w‰Üx}N ¸Þ…9CDŽ¯3‡à`©xÝ@·¸® f;Ä@7fgYE¶³¬xm4f`Æ5V‘¡â5VLO³ŠôL³â€þf1ÀýÍØ/ûöI} ±OªKôIÄT¦$'Š”a˜œˆI‰V‘ˆ‰VLP1^Ÿ@Œ%>c]è-Ę6Œ&¢ 1*#I‚‘*F´aøp £F˜Š¡…B’ -Q1˜&‡¡GE·ŠA*ºh€KE'ñꎎeXˆvlÁ"@E¶£UE‹Í**4LQÑäF¹%º)‘xzQ%¯å¼?2‚Š¬‰®zˆõýÿà›€ÿ¢X4Á ÂW¡g;¨¥}Ÿu>õÔó}° -QÏkì«âý©o\‚S4²N`ƒl dR/À{‚Ãe6öÓƒ˜› 2ÉHã¥ýÒmR“t^: ¥2餔/•±LÜ&n;è7_ç.81ÐÄ>†28„_b&¶H#$;|Œ'±>§]´Øyªa;”-nV¼œßF=ÇÄIØLXB÷O²-ìQwˆ­„3°%> -¶°3Ä× øVâD^Aá9“ýÇh­“43”I Î0 ¨¼/õõ´×t½ŒÂþ⌎— ‚vžÛå&ÙmŠ§]4‰í`¯±Vù¨‡Søsœ°UR¼´SÕ~ `>TÓÚ›µ9r[J¼kX®­Î—Hù¬¾”òMÓií×5ŽhÏýü6¡}·…~Kdñ4„­Â*¢T»'Mc¤4šO+˜–×%˜wS­öÀ>èuPM+éüÊÅ·4óqéS⹚=Ä¿…“8R¡Hº¨}ÛÖ W5÷'!úèXŸø‘ý‡ø&÷ò9„› /ð è$ÜÞ¥RÃO£ð®‡É—¿–¿6Í6Uš¾P”E:î6ßaÞh~ß2Ç@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ÿ/àkVu¢õ5[0(dó -¾œàq.1¾} 8N·¦Åzb yDÇç|åvmìTìU{Vr¡’£½õHkM˜é‰ÿàÔ)U¥qŸHSÅ°€ÏçŽõ¯˜ Þ¬ÄÈ‘1Ìê8=¶1pâäfì»nJëQÿ"—[i×±&O‰cû1PâÓÆ:EVb¦“(QÙu›ùÓ¾½A*Õ4ªíL-PG»— ¶ø’ÃÂ#04Ò)$p -! w<é|4 Þ½^‚z g–ÈÊQŽö±ž‰cƒ'Þ1¶Ñ=ñ¢;_¹nÊÑÓ­¯¼ât ê¢æ²NÉ!.˜ÄÖép† "Ú|“¤ÛÅí¦û¤ûÄâˆÊ0“R˜.EˆÈ…°X^^±0r¬[¾"bEäNØáœÓ‰‰¬l˜umR|œlÊÊÎÎÌX® ~ÚQo«Š[¹.ÑgŽ ‹ŠÄؘˆD:2âìñ¹ËçÚÏ9.jHL§ûÜ'à;ÉOâIé„8!›¶Gï‹æÓØ4'{ÜÁ™áÌ“DÄsÔhâ½àt@lF0ß¾fëÖ5ôcæq{óTà}s>eB½ô™Ú¡^dy,bÜc8äж'~rÛ!¾´)!Iý«úÕϦ©_ýåOêŸÙCl)›ÎžŽÖþwÅ ŠIƒ8éЯ}ÃÀIj)$®)sZÐNˆ´¬ušhQ´ÃMµ 0 ³b’õÿ/1 éÛÑíPsÎn%F¯jÏEñWþú”¸}^cÓ|ÃY 4*0C)¬³‰)\F³ÌÂøíl2ϳÍbÅü^¶˜ß ¤%¦{•J¶†/·mä›°N -¡“g,–e²xŒÅxÞ¢^ä‰jùç|Ð;k:îZsFØ;ÂpO[_V¡>@–uœ´¹•8WÀ ^¸Ñµs­ëVky.ÆiUxPXŒ{d°‹`†H—KšÑN¦CÚ9HW]:^ÇÅAéûãˆæŒÕ.¾§’H§¥i]0•R|,{„xê‰'žR[XßGׯTµré|ÛòûkŸV/ýÐñ?ÞñQåÚu«x‘zCÉ‚ù¥;^Ù[µÍí=±ñÍ÷ÉúÊ:ÏŠdÒ¿0Èö…§ÞÇV³ «/ˆégîºS=¦þQ}O=vç]§Fb[ÛzQ¥Iq-IÑ -|¹Vâµð€R+=gÌlÂHlA§í‘Vú¾˜–æòœ]¿ãØØÎu âßµß Î4¨¹ gºx^Kª™±ÓoÈ9Z@t Ò°ÇgÑOBû|Ѻƒº/ˆ LK2Ið07Æ)Y"OÂd9É”¤$™½ÑÙ,›ç²\^,I‹Ä’ 5òÓFy£)FsPÁÁ!AñHïŒwÆz5÷Àœ~‡ +¿áä{/Y{ï‡o±7´¯ì¨R®­}˜·×üB-fuÓ;ªÄ™wÿøÐ!~KÇÅÊ•+WišSI±iÙI2ü—`ãv+Ž‰VÌÜdá11ÑÃ-ÖèÉÃÀó¤ûÑÐZ§T &’ÓH‰¶Xc"Lfïo -sÇ¥8><ÚÚÞzŽb”.-néNÄñ†³[µìšTº.$œÀTΘԴÔ[RÑïcô¢;½Ø¸¤ä¬à®ˆ–œœ””umBfF°4ªìí»ž~aÉŽû>ûƒú‘zþ—·.x®¥rsùgo±of¿/¶¿>0{ùâ3cÂú¾wà½OÒÓ~72wÍ/æÝÚÿ•]oœKÒt¡œøî/•“Å$B å$1Ö³ž ‘›íNïê˜C‘ÍñMÎu!6ÁгbAÅ=2‰NÿíÓ­Nýèž»ÜNÞâ -4“:hÑy^zTztzLº7=6=nh²/Êí‹ñy}±¾¸¼¨¼è¼˜êwQ—¢ÄPʆò¡ž¡¢Ÿ)MI3÷³”@ +á%ž’ó´ùš€cƒ{d«G*ÊMºÐMREû>ÛɃw›>ãwsÔËê1–Úþ35ñ§×ln¶ó;§9víµ{úôc×1 ůÕŽnØ¿g‹¦iÄØw$ë ˜â‹fSž•Y%l°Ë-d“Y(Öqn-xY´àeÕ‚×ØF»^×Òöœ£í9GºtÃ9G©ãb5ÒÙŸ'ÏSïÑ€¦-°“ƒËÊÔ”˜×8ãf–¦þ¾¹±qÏK²{S^ñŒêö4ü}õøûˆ®C”Cêt]ë C3 É•vg“mƒ…qÆk–›ëÖ|öåV=Ì‘8]äöå{ô´+Þ©Ÿ´‡*™NÝR¤Â¦ûï¯ÝÝÜ<ü…E¯¾Á·wüœoÙºåÈöŽJÙݱefáWÚ¿JBY*kÿ·m‚¾>»|DÚ -\0E‚\ÅÑNáTã²½•ôßaö™óÌùæR3鿶ôöj”ÿC½ìþºøxœÖ³/Jýéøݺ¸¹Wðs?Àz–|—Ä-½“yªè«Ü΋ø,¥Œ¢ö -^%~¥<ÂëÄå)îÒ¢6·RÄNÁdI‹Ù})>c¾­ -WIUâ!ŠÌ›qƒ©ŸL¯›Þ5ý /áߤKR¸µ`œÉe±ñ‡šyâ_:öð9—:Ž5ËîöÙìlÇåŽÝ<¾ã#â÷Šüâ®qÓó”ê pt¥:¥â’ýB#Éîï[»deŠ"ûŠƒ©¾$Ùe 9Êä±UFy±)¢%Ìag ¢ÈyN%0/2T Ï׃v{{«ÿ©1'çÜ圣­º"ø‚ÒòJjê _Nø8¡3ÁLš¡ë‚§·~\Q_QRG¾²âù#Í Uïh^°ä¡ÍÍC—Þ· «î_üÍgšÚ<ù¸¦6|˶Ç^~ª£RÊß3kúýݧ]HQ>~•Ö¶üc­=×­µûó=¿õðë­çŸè-m¬©­ß3-¢}­c|Ar³ šmM®u¡fWà­èòŒ ÕQ—'ç?4¬Êå -S…Ra®°TXËmöŠÀ -G…³ÜUv)Ìyõ“gr†æsü^—=º{Wí#»w?r‰¹Ô‹—¾V¿bNüøüñãç¿xóØ—«oª­êrCƒÈÛ¸Ùu~Éà¢Ð ô +[é$­Xio2·˜,²J®ËA¹—n[ä/O¿­9ÈýyA[ƒ4™$ýH !8&ft¿ÇŸin|hUЀHÜïrž8Ò±ÄQ4CÚ­„âÚ1Ú-Îwå>ºRŸ WRŠwU’{µ§*T‹w‰MWrŸÛ"»IqÇLѨ:}UîCð-º®Î}ºSHÖLrn¤%Òi@n¼ŸµŸmˆyˆeˆuˆÍê/Kà)–kŸ 4wš§OpJtJLª756!yµeµuµmu€K{3Ĺl‘­hôc :0 Ã1#¥(srZêÐÔ»R+R—§Ö¤Ö§^J ¥rþ“,-Yøq’¥É׎ß9µªjú£C>ý·?N}힢7 -V¬›¹Ë·kã'¿)Ú/ Ý“’2q¢ot¬½Ï¦ªÇÄÇÉÊšrëؼÄÀ„Ú[vGkZ>å_ÅÒrŠÎv¡â³àd-J¥ÅJ2¦øìpÙ5-×C†ÿ¡Øo—ö=ï÷ÏZ4 Ý"—IYœl +WW-{é¥3Û*+Åõ×ÕõUã7o}‡çW³4＇ô|²n_n⋼baë,¬ÅÝd#ûr[Ç“¥åz4…äרs=fVâyE3³ Š ~ÅîÉ’ØÍÌžkjºqï¢Wßd¿e‡øŽŽ‚­[lçå?Ôï.šq wjÜ_O6^!åƒ ?ø’»ü8ãB» —2wy8Gx™œ=r&$0ioÜ,=O~ÚK/í ˜öâ ô_!þw^½ž3”ž·"Ú+¯_âwór^ÁWóå|=ßÎm#3šõgŽp —’ ‰¥bªäU² ‹ ÆÁRº’ ¹l4Ž–rÅ(٧ܷ³)8EÊSŠ ˆÍÆÙÒ,Q,ç+‹`!+Çrz*¹O^«XVQb±)ŠCrÙÇkôùÉÓ¨£líY³D)œÓÜÀ5ÂT*¦‹îljáY=x%Ó‚±(¿*Ó%$·Óî©ÐŸbshZnH_¥#£„÷1CŒ¬$D›ã’Æ ¸"¨£ZÙ®‹+$"&þÙ'e•ýôÙë€ Á¦„–°¨X-\gdq¶:Z3èÏÊ]§90{`¨ºÏ¼—ÝÒRHíx™<~%õÍ|Ÿ&ή³G’&»ÿ”'E%kÂìn7k¼[¶:wI0Þœ’ 8‚CÝŠÃ ‘²aŽ‰—Ü‹31] B#½ÏÆ:y¥-iƒÇÛígérÎßóCmW‹ÿG¹°_O{ŸE=<ìê}.=gC)LÕ¾2$™‰•tý»CZA0µüu -Ëíªc¯~©W]@(ßU—ÁÍŠàF(RX - `6Ì‚bX^H¤^È€tÂLªM§^NcBýÀL(€¹ÐzGÃ<?€jÃàB/ÜÖ³V™ÞšI×™4g1•…4Òò/ìšÝ³ëDÚi1í¥}õ`Öè( 9ÿÞŽ#¨v7Í»Ñí Kúj3õ:G^Ze•¥4f:­;›Æyi~ í^ ßûñ:ôUʈ"zŽƒ9Ô«íZ¦áižÎË’ßÀ«fuÏAÿÇ:ÿH'ûNxg§>RÿÖÓû•%Õúõ–ʞ«vÇÖ3ÃA£µ¯Q9(c yFþ.ŒÊÒ|FRN¡Rûº£ÓëGåBY$qFtŽ 2—ΔÁXGåx’&ƒI0XÐÞ im? ÍÉ>"wÜD°ßS°p„ê_¼ý«VÝ5m$›3sÁ<âÃÏ£{\¿güm$rœ -4ß/SõÊØ(‘¤îJçq}ì‡0ˆ®úZ©ãÁžQv—k®,âï¿÷¿ ©]´ÔtµýÔnî5bsïkçs;ŸëÕ{J/·÷¿ýê+ô’Øÿyè¬éœó/û Iwñ{°WOW½óÕÿAIÿÞ™v.ëñ£Ò(Mª=Útª÷ŠÇ; þåiµƒ¬.‘ΠÙ‹fa£È²ÆídSšEq°Óý™HÈi\Ù®f›’n•‚æd‘ŸÎ&4ÑÜQd5£ Í´Æx²Á[ ­´Ömdÿ“hÍ)´¦fýc¨äÿH»‰®º©ë*_5BÖí÷§€"Ñb%¨f'®5pPÍ .½¤û¡`zjõûŽ-°ܺ︯`AÁt¨)X0wÔL_P0jfÌ+£²xæ*—.¸jfÍ,¡ú¬3ç@MqÁ<S> -stream -xœí9yxSU¾çœ›&-PhÚ¦‘²¦ Pºå&鞦Mš=Ý’Ò%é’î;m)Ô²”UÞ*ꌈúͪ<A?Ë(.øé7#3Qtt|3ãèÆró~ç&--¢ó½?ßûæžž{î9çwÎo9¿í¤#„f ˆAzsi‰Ë¸Ú± -¡y÷ÂèB³«¢pEÙýg ŸVâJUÕöÂè74õøú˜ùBa3 ÿ‹¶îáÖ¿]‘æ#$r#;ÒÞâkŽ¼Rs§¡jÛa \Îl‡õ°R´÷ Þþ™âhè"Ä4w¯hòåÿ¶¨ öÛcÇ{|·÷a'ê†ïÅ”ž^_O‹\‘Å"4ç]{¸oÅÊÁÀ HôõÑyDy`¡5°`sý¬Ü †ù/A<öøIÚ~rà¸ÀEî2s’y -º"DPðu‚xîjQ8s’ßiòsŽ9‡Ô §Û`†: a¬*í ¾…Ag;©‚1{°ÅuHÅK‹N¡øn´Ê@…7æ[øF„æ¢(™{& Z -¶”öQ‰<¨­AëÎ -Í*ÁjòP²£j˜­Î>¿uùôØ|Í?1P||éE;Ðãè-(çÐgè -aâ|ŸÂÿ )¤ÜMÞ ïðåR°0ˆÉdZ™;™½Ì1æ DBQ -´— Cð°à„àrX|˜'¬'ìž°ƒa¯Bù ì¯a°€0 -Ê<áRaƒp—ðUáQ’È"ºGtTô;Ñ7á3Âg‡—„÷…ï?!hŠØñXÄóïF|5M0m6”Eÿo‹êGJ>h‘œT`ÄÌÁ±‰äJêðôüCeæ¾ Ìå'³À*Pb -¡P$‘k•l\œT“B4jm††•@Gƒ’ùD‚`\(”Dk5j ³Òj ´žìd¨ åÙýuÚŠöp_˜:©Ð•ÅmÏÎTë>ÉËÍØY™-(+ o)^ª ¿*V8ôeB—KTïgE|#–; -°D-þ",‹åŠ -SÒ5Q_Ò µ<<ýkgäGRºa¦;`¿d¡YʼnѬDH$±ÑR‰ülWG}_W[½'ŒÁI¾ˆîÜÞG¸K°R+k‚+¥m´FM”6.ZKDim]ý}õý] '":qü#{±²#Âǽwd”û¤ŽÒ“‡Ûñ(ù‰¡#IEJ©[¨ˆWÐJa5åx?ä°/ÆrŒ÷s_Õ`1óÔµQAõ):xi€öéhBÑã[%$j‰‰ò8Ïظ8V¥Õjt}wíèëÛqWÞ#5Œf©Ôl4˜¥dÞ«¯yúµ×ž®¶Ù†+kÖØlkjo"ø„?Bd†Ô"FÊåâĽd£ËŸ Ñ #…“Xò)ä+HçD1‰äÚv¡H&‘iž½·)ßd´3U‚-mÃM#¸Š[ðô–Eö -sßšfמ¡Gå1=pD‘Ï@SƒÐMD¾¡¬P•(¹†ÕjÇñ6¶›XsVCÝníüYx•Èm2Y›[¤·yëŠô:‡¨š ·§»5ºšÈ°¨:G–G½¢5×aͶ:pŽN£×kA~ý‘*rMC‘prÌŠY‰,%Ëãúžææ=ÆýEø§(Ù¿Ÿæ¶Pš­÷d‘wi$À2‰vœì›è¥dŠed:·_Z£vµ'kW”wlžYéÖ—”–kJ¢—ãcdë……KŠzò,…Ý5Yúúââ -vÞ ´Q:òGò"8 ØL:!b@“¨‰’©À|g‚ŒãÿZY]…¥]…mk5]Ž¶ÁŒû¦¹9R«ÊM®R'ÙuçuÎÆ~c·Þ{`¯è,{@nfõ•¶âjÊ• ^×ÈÛ4û¤Ú&ÓÈð5îÏ^ÏàÉ]þA²¥ñÞåK’ Z7"äÌÑT‹'N.î…àdT -! -…¤nÏÕv9]:­Îª_åp¬Ô[txV©©¨ÔUhp}Zçq:k¼v|;W[ɲ•ÚìJIL½¡À§Ñø - Ñê2E™§ŠŠôÅÅzƒ™—W€¨Aâ©öj)"å7䦜P!JÌKV«„Hs ¹ëîêOîªmwŸYîv˜\åÅwê6?œÌftÚ»¶<|ä±å½÷»Ìvo•ÅZE-›·dÈk¨ïL=È ¤'=}4kƒJzüß‘p¨Èé<ëtRëy“Mä9€š†Ð"™HÃÆÈ• ƒÿÄÉl¸Þq­¡|dä‘GÈs~ûEÜÀí£;Ò…j2¸âù=$n™x\þ‹Æ%:ØHX|&‘¶ÍÄ]¿jnV28î!½ÉTøàEG©áÑýا²-ÕT¤“±ÔR•®,zQ®F“ëÿXŸ•mø–êDRà*ù y Í£ÖIåH#Æ$×’Á†„œäÝëxBÙ3¯Ça,,´:àSùÄ€o¯Ÿ:èímÉ7×»]ë†üæÏVàŸò²x™ÙÇ'r1¢\Ìâ݇««œ;÷o÷ìÜ62BÆ*íêÚã"cþûwnÚ|¿ÿ<¥vÁ¯ÃmüiŒ„š/ø±L2Êqx.w'"+þdÿo;9aÁžŒü¹Phðmø,÷ö·ßzȘí/6î ˜ rýò*oSÙ£Ì$!µâåAjçõZ­« †UÖÖ­Ó¹?ã¡pï.¯o_mí>ߊ'•øë<ƒa}yù:Úv›iùNðÞzÐÓÛ¢´F %2¨,¼I«‡Ûãñà&àÔŒs¹×É÷;¬ -­@£°‚FO€õPžfº—Ž—&\Ðø uÃøMî3ØiáJîuœuÜk°ÕKØÀä Éãßa øy¶ D£ßpG=6 g™(¸sÍRÇȺ-ÆL”ç’þ O#¦·Õã~ø¯“0ÿ5ø~äŽóÕgr–Éyb°˜%ýî~ ¥×C’üï‘þ÷ÉRЂ¤À÷ä õ,´nˉ“‰PÎÇ—€óbmÜçõîk¤2´Ù©äEžƒTªžmm<%Æ—{=¯n#Æž-à% Ò£*&§æ"‚žQ5# †Öló|¶zí/-¿Ø¶ ïZÉ}LÆj6æm - žÂuä2PC-.L)œtú¼ÉIQ(ÊŽ“JÖí`5¾qR«œÏøwônÝ1s‚Üæ})Oã{FŒ$‡è]ôΤ7V"—GƒÇÍ¿x¨×óYIÖåzšÛ°Íf³Ú·áyÜçdLëͱôFsçq«5Og„ÓÈ Gƒ /£Ǥ•¨ä3ÁIVM…,…lŠþbûÂÌÆû²ÂÌ"WNv‡±q}xs˜-/Ë’”ŸU®¹Ó"J¯ÌJ7°‹Uñ³¢΂¬ª´Æ²Åy9šÄ´ÙQ1‹œ…lM&PJq8âý!åG®ÁWOz^›óßGVبÎØÊ*€‰¡š  Ãã±D|ÈSVêñ˜†l¶¡"ÐasmMM-ã,•CÙÙC•øØ!äv7ìŠ_lL ¹›û¾ƒûÞ÷ÑGA3ñ&|¤“Ì@R͵fD Ã3ö›Ö£-§|»G[÷=įI÷ÿ']=JJüLjÖÆð9× -§k©YP<šÏ=ZŽŠ¹ïáÒô,·û(¦x}ô841¢QUò0vsz\Î=‹O””XHB‰ ï€6 rØŒ¨oÂYõõÇ™CöëAÝ­`‚0arš˜iXœp€N8˜_Û)DG`Yøú>ê¬÷™èvÓ1P‰™É{‰Rsé=rŸq $¨ßWH%IëH˜ðòüæ!ÙßœL&‡¬–Îx¯wN—ٺڈϨ*XÖ­R¹Y¶B…Û7˜t©Íþó­iù–Í®!­ S¤%þiiÙô½ó@ZfëÐ-¤•“†üsÛÒ ® ®àà6þ7‘ljÈwA)„¦š2RÀp¶°KNI0ÐX¼Öd\[Z|{A]JIZ‘O„kpä¼2OFJI“iSEÅÆ"ãÝlWVS{q-#×ù &hž,Íš$ +È–­ô˜Íõ¹é+ñ9N‰ÏÙ•Þ -GªVÉëw™×(•Æpª7Só`Í$bãn ^ÝïÕ•tßY3«®Ð^œöéÉB"ÉT¡ÎØW¶V©òê*V¦éATî ¦ó“¥Œ:™p2±Álø&z|0ôø‘欚r³¥Âã™SŸCR4ˆ…ÚòÊšåÜÛ @——¦ïTèò=ÄäY¡Ü6t­’Â>¡[Ú2Y?~Q«öŸ'p[#‹Üuô+~¥têʨ RÞ£5ËåññP“mf¸/˜´†Õ蜯 g5×€̓–‘A£ù†³Ïï7@jÃ\¾ ;ÿÎ}ÍýõF^paR^pÁ?úÁ(~’¤Œg‹“¥rC<Á; ½a0 ›³kÊŠÌnþ’òduÆK; &É˳œ{g¼%Š’¤]n¶Mœ@J0Ÿû!üâºqù×ØðÀ$ñ+ŠyéS¯}⳸ŸÎ¾^o¶ŽXí‹Ó—kÔît•K•^žúíÞTT´±¢b“©4Å[XèMNö¼É¼⮃J¾•âé¼Ùê -餩kî<ÐWùA”ŸÊ=È,né™â¨u\¿¥gÿ„¯0wÍözã»-–[yÖü”æëàŽý;"¨1Õ ûéÆ9‰‚SãÓ‹K÷„Ø= ™nv +Í`™ܵy}ýÑ£m›×Õ?sôôi…cßz‹û÷ž&Ž#‹`ˆÏ_bøÄb÷|]÷Ç-Gž Šëâp2Ÿ3âv À< -°SòŠûp$·Oã¾Ãýv»ï´Ù²9° ½ÌÌ¡žA - -ñ²ÇÓÉÜã ñûè•ÐM‚É=- z2ö9¥Ã-ø#üÿ«Ýú#®?àäÿë´ÕÐ_°€àÓ¦ßrÕ¡oßÏ„¾”‹N†¾h>ºúCÓðm¡o!š­@}h  Ô†ÚÑ D<JãëB䆑hKy¨>€éE+ùþŒtÂ\¿¢­‚¶ÆøùÅüNƒ°b%ʆ• -{wð«P#äfMÙ£t¬¾WÁ¾Í°vƦâZrS¿p¶|7ò¼(4¡”s §BR5`Nƒ¢2ÿ ü Ø©pÉ7Áÿ»Oà9ú‹ï-ú߀ih.œ6šnÈ_<|`Êü2ÀÇðó±Í-«Uh>¼}°f*,<ÿðH! -endstream -endobj -1060 0 obj -<< -/Length1 47128 -/Filter /FlateDecode -/Length 11769 ->> -stream -xœí} xEÚpU½]=Ý=w23ÉäšÂ$„3 Ç2b¸¹ p“È!"`pñÀƒA@”s1bVAñ\p]ED?A]7"ë.†¤ò¿Õ“@`uw¿çù¿çÿŸÿ™÷¥«»«««Þzïª$ ¡„8,ìÕkÈËÆV>EÈ Ã°6¥wAÏ^¾ _¼Ÿ…÷ã{ºéVxÞÿ…> ÷-·ö8óÖ«aB^jŽÏ/ÜtK»œiÍm3¡[ñ~è¸iÅåÿ‘RGÈ wð~í¸;fór{á» aCJË'Lɦœ'äæñø¼rBñÌrbA$/ À{Û„©sK ]sŸ&dŽßêʼn%ÅãC=aÿ­ñyÞD¬p~Ÿ´ïåûÍ'N›uçxGjö·ß™Z6®øƒmï"d”ÌÒiÅw–û_a˱ýblœ^<­¤µíz¤÷yìŠò²™³êO’8¾ì?X>£¤|~ñƯ ì"Äò4‘¼b£wÿîûô¿qvý‘p*Ÿ|÷ÔòüÙÆ?ûê«Eª¶\õ`[Í$C¾g™&R ÑÎÕW׿®-7{jñ;d –ÙÌ -F\$‚=þ EûPV°½„cM¾oÓ¢gøˆ”²8|Áª¨ -cŠliÒ÷ ÒžãI/QÕ#«FÊ%cñøx<ˆÇ(<žÂ£¢á~“¡9ûkc¨í‰¡úÉ^~š”ª›ñ<‡ìmúœÕDïÕø ÛY~"{ÕÑ:~ªáY>{ƒ,糉Ñاöéf¶9\_ýKã* g^J†ñ=¤RÙgžGñidÌ#™æõRÉö‘J³Ýàèµ6”l“õ¼"úžl?àûoàM!~,“Q -@“Ì¿Y&še‚YúÌÒK=(%N½æ¼o^Ç™¥“:È|î4ïä5P;µ‘G°ÎnÖÙÉ~¢Pµ¢ä¸ù°\ˆuVj ¬“OËÖÉ ºù¦f–b3Kù†ºãñ¶üúxªšóâf©˜­Àœ3k¨Y’Hý¨ÿ µ—ZóZ—ZC€Ÿ/öæ?/€‹½á5ð“€\ð¿^ü]ÀyߧÁ9ßUü;ÕTG”¿}kð¿åÀ·üµ¾yÔÇ¿ðu |Ugñ欀3¾ð_¾ð¹€Ó>«SŸ&òSãáÓD8¹>ŸŸ|æŸÔÀÇaøËûaþ—øèCÿÈžpñ=pÂÇ?°òãAøÀ -Æ®÷±ÿ÷Ãpì1?–GÿäáG3àOïÅñ?yà½88‚¤Âaz÷~HÀ»ïòw_w*ïDêßów -áˆòvÞðæx8¸ÌÅ -x#^p@Àþ×:óý5ðÚsÉüµÎ°ïÕ$¾/^Ýëæ¯&ÁÞWœ|¯^Ùcã¯8a ^ÆÁ^°[ÀK^x1þ(`—€v$À ~¨òÁóØÏó5°OÛkà9lÿ\2Tâ©r<+`[<#`«€§lð6 Ø´ÑÁ7 Øè€e2jC ¬ÇWÖ§Á:<­«§pòO¥À“Ö>ñ -_+à‰5…ü‰Wà‰…Êš¥a¾¦ÖD”ÕV¡v¬ðx[X‰/®L‹Ôà -|uE³Ár¬ZÞ~§ß xù𨖹`i~'`‰€G<,à! -Xü@˜/ð@îpŸ€{s`ÑJø­€{,ôC…w X `¾€y5pW Ì0çŽ-|Ž€;¶ÀìYÉ|v ÌJ†™50cÜ. ¼¬5/k Ók`Z L­)& ˜$`â8Ÿ˜”æ@Éxƒ—oÀøˆ2n¬ÁÇÙ`¬ÅE^^¼Š¨›yaŒ£ -…÷£Œ‘ÌG -w#’a¸€a5p›€¡x©*àVCÒà ¾ÙÏ×ÀÍøàf? ºÉÏÕÀMÝü&? tÃi0 ¿‡ðBÿ~nÞßýú:x?7ôu@ŸèÝËÃ{{¡—zÖ@Á ^à„Ðãú0ïQ×cŸ×‡!ÒÝÉ#ºÿÆÁ»;á7èÖÕλù «ºŒ‡Îò=p€Nñ—›ÄóÂÛÑÃs“ w¿ÒÑ°óŽè¸Pécã<Ð!¢äØ }öÞ^@6öŸ½ÚÙ m<´iÝ™·©ÖÞ0oÝZ‡–ã!K@ /d&¸yfd!œÍÓ‘­š§Aºš;oV!'„"JÐÒÒ 5ÅÏSÃâŒç)~HÙ>ãQ%ÙIþþË'ÔiJ7e‡r²[ÌVJ•{H–ùì}e­2O9ªÌ#Ã$et€<$d í‡yö†P?-`ï‘DÒß®¡]øa~˜œ 'è lYIæ0ƒ¾M íè0ºßú‰üDx—Ëré9ú5R¼Š¼øAÖ¥˜¬Â¾‡tŸ%?™ -öJ–ò¬?AÞ _Ìï O¦23L…6üây²•LFÎ|A?¡z,!¥”]$ÕtÛÂ.ÒtÊãh¹9ÞSŠ”·•ñ)r‡2èèå(Ù‚Ÿ kŠ/ÔR:ÛIœ‡ãT³7Ønœã>r -ç…£³Ql[CNÑítRLÈ}t»Rd«$“5êe9'yCÞgï!?™üx˜<¬¶'?)*9h‘²UrŒ„ùJhÈÒO#+i?Ë"œ Ndfº„¼K ?El¥©©d¥’ O!íŒ-häKÞcù0–¬5q9ÝM–“Ýd¦™4güjÛ† kÀ2ry’œÆkýœY9;¦ÃÛðmSTP¾âíùlþtâ¬ÔjzÈBøVª-GüVCÃÈh‚ß°º¬Ã­[¬—l=mÏÚÎÙçÚW:¸£c‰ã¤³¥³ÔçšâÚéΉ‹‹;ÿŒ‡Ç0†1Œa cÃÆ0†1Œa cÃÆ0†1Œa cÃÆ0†1Œa cÃÆ0†1Œa cø?€ã<û¼Šw¶÷$!„’*ñ(j±“@ÄI6[69,Tшխ¸®ÚÚƒ9qùù퉫¶:›†2XnǸN!•y=q ˆVÿ~ù*šµpa…øáôÕ“'é¿]NeÏ›Åì¢ÙsJÄN6«›v‹áV 8\ÇæT7vŸ—Û‘e†|q^³l^ˆ@³V-ÿýjñÃ9úÖ©SôÍï~ÝOž7üCöZF÷²/Ùi$î%ö,Ù¦P¢`Ø×ì+䕱Yu°Óâ”lý>!,Ÿ.ÂÖî—ÈVF‰WpÐö¤]´ñût¢XE‰ò/gê{°j~ÛÆ¿ÄÈ… -íšd^8’M;Ðtæø¬îï§ø‰Ÿ§ÉßF[ÿ%oÇÏ+I é‘x½Ò •ÞµÎU‰ÄgKP}qžDIŽå:s¡Úu.›º2Ò›©n—¯CNu‘P¸Í¶Oš?òäùó&Ó{Ä~ñ‰øX짚I3h„UÓijgÅ7âì7ßÐD±DL£ËéL:‹.Óäü¾&„+H³AZD¼°]aÛù Ù®k‰jDN­È›êƒÑç\¨>nN›»Ã8wwè<"6Ñ‘t:r©šðfªö¹”+~ž7¢œÆÙ%’‡#Y$UáJõ%¦r®„y"q,sZ+ãÖ*äy–èåÄ¡ù¼4Ù~קý«ìC†½L ~ÿuÃÖ¯vçç»ó/ŽwÙýofq9¾s'ä[\ü»áÍh$ƒ%´ôµL Žž˜ØŒ4Kh–˜Krr{~¼WB¯Dg!)¤’nš——ÛQòÒâÎËëT¼Õ²G/½ÁB}{-™=âû~+î¢6šu÷!š,ÎÒdúE» &-¼qíÓªMõw}ðÎðÁú/•s8Ãd@¤ñVÆë+ì•jpeà…”Êøªôµêª,_¼ßC\~_†ËO ¨§e¹jÏ CWÇ廣¶qæ™Z”°øñœë\~6õù¼%Ô,#Óí“¢–¤¦ç6\4¥ö<þ¤¨{f~}ûÔVozzÓšþî¡» ÷žñùTšNCA8óÀŠÏ¾‡iV^§ÉãJ']Y8ttË,š ¾¶ÑÓ¨…£P: 0´³"A²ƒ„ìaVËvNa‰NmIR5ÅæA“>Þõ`uŽ)’3Ç»V£yG¢|× ‚»ƒ;]*ˆ›ý FÐ-Zyâ„x¬n²²ªn)l¯,þ*ÎSí‡\| -­€áø©¤[¤™bI]‘Tiq­t¯ðTZvØÙód‰}U4#4Ágˆ+Íõ)òî ë\ƒU|%™&Î Ò½’5Äë!Ws™ö1¼ZwGëáÙÔM³ÅÅ'?Ï»ëdñ#6‡¶ëÕëÁÙw,nÕFZiÒ—ÎÏ¡•6'"xRéS+Sl+í+\•ÍÖ¦¬ -Ûô$?„ã“ü æai±g\çšäI¡žûPŠ´™êõ4PCÝ&EHjŽIjÔŒs|ìl BiI ½cÌÖA•û]=ÖŒ=’ …ˆ^Ï”oß PZ±Z ‰g@.ô^òÒ =¨”Ôí²ÌºöüÄÇ—eúºÈŸ8Ó‹¥“v¤w¤E¢-³’¨•i¤ª ZxÚªìD¯nƒæIΖIÞ =)9’œ¡æÙhèÝ$‹LCˆ -y‡6p5ǹ›‡¢v5Ž`óÜŽyñž+fïN5kê”3ÄüÅÑ$³“&=¼xÕè ?Cö}ôÄãF;vĨqlíӧϞ=½lvEÖ¶ŠWßzs_Ŷ¬–¯.ûìË/?[ö*½uxQÑðácŠ¤ì'ãÜ(ûĨì-þJƒ¬¤+”JÔÅJ×ZߪpJØ’Ÿ@š%ÙMÙ¬­=ÈÁFsîÕÃNªšÞŒävl”w³ ÚH;Nô½Q[Wîw¬qV|Mó©…6§ñØ3i?­()E¥(- QO+”wNµ~òwÚLÜ!V‰ß‰ávnÑ¢ßÞ{ïo-BŠÏ"Ù•"”‹£¦ƒm%;•­*§L!ñš«íUºÒ†H'ñ,$—‡R$ˆ-È°ƒ5õÇ‚W"!©*·¤ª*7R5ƒ«\—×,UŠ‡– - -©º¡(6²]S–¨ÌÐ5 W%º -Bv€4õ­ëéù¢:§™:g‰þ35ðrtë vÆP£Ô¨ ´B«ÐgëŒ×"ž6\qZŠ°…µ–zÐÖWéÅ{k}ôa0\ÊoS'Â$¥”OP‹l³È?„PsrŽËè– -!¤”.TçgGtÒÌÕ¬]³AÍZØ 3éîøÆ‹†h’ŒÆ„¸‘£G<ñ_³fÏšý_¬ÏüÅâSñaÝ=¬íDJaù 7Þ,ÖÍ;®¸XÌeþæ¯/ùËq~bïÑi«Ño”¢¾B[ö“.‘$›K'>°cìÚ®íúZX•ßÆFÔVI.ÌêÓqÐõf”æì]í’Ç$3ZFUotj ¦·“ùž´>jòW ÄÃbÝEg/øjò”c3ÿT]ý§™Ç¦ îtÝ@Kh)Ýp]'q¸o¸øÍ×âbA_ÔFä©šoò4´xÉ~} ÝïÓ˜Ï ¼«-ñéÍ”09hä\öŽA~tcÔÝà!(²'!š!ªÈ-Öí¡êŸ/~W÷#]I‡ÐçL*-t§¨Bœ¬ì¨½ýÛÓŸ}CÓ‹g•ˆ‹O?#þQ2«XæJH‡òÒa%Ù²_ÝÇö“%Ú~ƒr¥IÀfŠñàÁFÙe¿è²²—ÛQõ­Mâ^ÅY7ƒM¨[Í6_:‰¡ç”ømÑ|Ç`Ý̲õKä£Ø-æ›ý«œCúW¹†ŒÄĈÈuã (}ÑÅ#|³ÿ½˜ýUH]lèG½ÝÌëî‰Äkœajt@G? ¨šìÓ%ÕŒâèP͆ú¸OuÙºBËèo Ãx¡¥ &H R'ZŠlp§¥ÂRn»O¹_ÝfIÈd9¬‹Öƒõ׆°á|˜6F+b¥|šVÎîDC«ÐâK´gµøBsòh?øϤ‘µ¢¯Õµ¿H«Û.é­;ÍBuÝjϱu»šr™“„ˆUrX¡>  ¢ÒÉYŸit]²+“—"ëÌ÷,RKläO‘gÑ,,2Mž€é†Nó CDCfX¹®£ÜPÛ+F{‚z^5À(GâÕ•¸¨]öLf|,Õ™Ssêæµ´€î5Z±î¬»‰ ° 0ncÃ-ɬÌRf¬`Ë´eú3¬ÊRe$)TÁÕGýàr´¤aèLsá&ÞÚPm¸>È1‘N€m²^ä¸O{H\KD/y'³Öt“ߢÂ¥‰­ÄV±œŸ¨ý5­”‚Ú“¾´·‡ü'ä…NæGR-yò/ÁòT‹–“? q•ZX{Å‚³6¢³Îo˜u~“\N1çj¡¤0ÒÑP‰Õ¯^G{Ó~êP:\d@'ªEÖ=ôEÕágI–ß°–¾8ùˆåV6ÂRÊ&Y¬¦à©””Iöv ÓÄàº/LŠ‰BbRkþU^£Ï4H#—Bêvےß®¿J;{‚K·ø¬5#$ wTu$eùqùùM“*|„¼LL‘zHNLö'%%''¥äyó|=½=}C½C}ƒÒJ¼%¾¢4çeïg>sž„ø #e§çNš4w£¨`py¿tÙM "ï‹Ò;Ý>º˜P:LÜ#~ª;ÌO¼õácûÚÄUÜ#†Ñ™åƒQ#–£goƒž=“<iIŠ'ÑmXÓŠ—¾¡xßHÜîV¶‡×ºWµH3¬d Iö;<³®O«¯>(#RÃJ=þY×ÙË*;2¤<‹æ§æ§åòƒýÒúú‡…©£ÒFFG„&§”¥–¥•&Ë‚ÓC³¬³l³ìóóƒóC+­ÛžH[X\ÚbÝbÛbß–º-m[`[p[¨E¡tÝ ÉÊ"º"jŽ9½qff4)ÌQ”Ãó¾øнÃgoþùÏâ¤øàwâ¿–.¥Öùwß?rñŠÏÒ uÌ£ -ß"vºnÀ ®7$†rŽìýÇßóriÏ7Øk@Z(ûÏ;NŸ#—0ïá“ͼ§CÄ¡FÏuèÚ¯ãšëxÿ*°ÃtÂÜtÂæªøBuN6Ýѯ8yƒ ·¨.éÜ/ TvD{63*•,Šd‚\ ³Tʸ<¦•¦bƒ°4O̯¤_R0C?¾k) Ö8¡yþ²G¢‘Ö„¹XU1Mh"$* < µÞ¤7í}”ž¼ŸzK5w£K¡!ƒ.¢Ð‡é¢ºD.:ÒÊÀhôèFˆ¶\úR:-ÒOME_Ê‘dô¥FžÕ@Úõ<¤Üš‡ë -#O7peÁRÙ°9ÎÂ60ܨÒÅj6+æÑ/†X-Ä.y¨‘|Ù¿Ê* Û•v¤Ñõæü²çý¥yË3÷pwa#ˆØÝpgÞw0²#&Žf£y±±›½`T!&qf ó×unUm>– ŠŸ{5ždM²e²©´à˜RÚÚ9ò0vä(9<[Ͷdk9zGœwG_è¥ôá=õ~V™Ž`#àVåV>Xl¬ÐoµÚÊH-cÓa¢2ÑR¢MÔ§Ó­“le¶90G»S¿Ãz§m±å>íAÛKl¼¨ìæ/hûlý/ËÅL7i¨½7¡3ñ`tºX/ -ÄßÅQ€’zCé&ô¡e—E‰ÕW£æž6=ÙŠH‹«õ ˜F4)ÍÔ/•Y”ÎÜG:[ôFyØ¥(œ¦(, Š÷Ÿi\•Í"l+Bí30!C’aÚrigÈ6n2Ê É&hHÜú `Cè–º·Íè_Í<µëëf³¥Þ‘ªqR~ãf¡ -aíäBúø‘lê åÊp!NîÛ‡~{Xý—Ê›Ê<´ª0y2ÒRW‰?`%N8ª®ss§¬K?ä^e#é h×íÖn°{ºdÈ%lŽ;F¢Kô¯Îýt.¿Á› h—Ù-Ø-Ô=óÆà¡Â`ah:º­»ƒw‡Ê3 >z2ødè¹às¡Wƒ¯†¼9iÙÒ"[ÒÆ¥îK[Xž¶,°1m}`GZUÀ%½ØåulnØÊ•‹@Óou¸j3‡m,¿}äÍ%ÉuXŸ]÷lÿW¯Í>¸ÿw3ߺuæ7³h;j§ô+¸ñÑiYÔݳ¥´ððÆ7w§ÜzSÛ¶Ô’ú½üÛtôï£Uæ¦)äºH²ºÁvÌI6xW9%oJ<æ‡q‘D›nOr™!+çB4•2wPÎeïº)­(M&îMV¤`îO`gzÑ«™9wîÌ™óæÍë·köQjˆŸŽÎÞÕO¬¡¥_o]¿~ë3ëÖ=ÃNŒ-/‰:Ä— -ÇnDrP¦RV¹(+?® “Èz\q±76¸• (¢$K;ñt¹zMqáœëG$kLr…\O\‰r án²ºPrû.¿iåÓO¯òxdÈs·‰÷Å6ÌÚ {Vé&>ÍÉ~þÉ'ŸÏi/N¸úñ"v -È|c”\Õ#q®(¯6c÷~L[å8D7G!vIêaí"y%µEšÂ™ gª]g®ðÊÌlLyJZ:äø )ó¶Èmá~;f?Qãè¬%ïfÌ {Ù°Ÿ«7ŽEûR@ì[Xû®äž<¢zÍ Eþ|2¹!"Þ¿Pýˆvœ¯³Ñ×Ų­JIö2Ík'Ìîì’bÒw°Éæ‰äÜ9¹Kíž*‰ô†|×0-HxTó¸QûŠ}í#·· cÕ1ñ<íO›QvËæMü­‹u(½ûî -Duv{šKhí,^_^º`öt)ÕL\ì.AÆ“›#).NmÚ•®#›êNƒÅ[ˆEçv{O§ÕÝÐmŒ›Vé^ºV×v=x0ºÈ=“S[í:'FM#|¡e¡ÆjÉEo4š¦»ÑTò:À’·t¥9âObÍŽG>T=ëT0°žÔ®‡"J¾ô¼)WÑ‹;”¹(Õ¤$#Å Ä{ÄwÜ¿..ÍA?dß™¾!îr 2lÄîˆxƒ=Ô.YAÒr&*eñã9™ð ¨[µlXÏš[7(å„ÜPt÷¦q{šlTÁù{âµ½7{G?TgÅÞIÇÞ5²jsuÙü;g–ÏŸ¿oì(zCÍ%zý¨q[jÝâñe0Dòr×luóÊ5ë6¯X¹ù[‰þ<ù›@r#‰v…PãdÜ1ï!×&evÒÛm·;]rѵä®ÕH·ôiÙ»Šü ýQõÌucšµ““Ò }ay’|ÌÇ;k¬7ï§ e…ÚŒP%|+gwðùÚl1Xû={œ?¡y¯^¢"Õt-]_wŠ E±FõÔ¾@Ÿ@§¶‘~ ÚDçÐÀ•´—È&&ɾü3!d/âå|!o`„ÉÕósµ´šm¸FÝ…ö&“"YÉÞ8]± jItž K‡Ci;SÐtÓRHM¹{Mh :!wÇËzá5Ÿ+{ -^)?pH¬¢´×ÀÒ2&VEO(ÇÛ‰=ž0kl™8íÜ—uCY{JÒœ)[×Õ}Âúì™òÌ“u+E›Ç•“FÅÙ]«³;YgÏü{õþ}âÑFE*¤Ê6øÐL¤BþT­M$^ÝG6ØÅ­JÔ{8@o—k~ªöb§øîþÞñÐ4V£)7zK,Ù9 Ì™=þlTžâqZ|&^¦½aÞ³6<+JÄ;¢ñzõ ^')©Cùh¤DÆ™.‘Ô+qæcý v¦bŒ‰˜Ñ¦ITv9sm¨ _fEC<ŽoB(‹“Á<ë|vv‡ÜVm­zúúgwîJO§®Ž;çg·³kiÿ°£2Mò5å¹™?…Ù´H’ƒkNØà¦;µ ÄЬ:ÓÑ\qŽ!ž&ý«Ü²ˆ3³‡™5¼’5¬¾ÐU:=éð»“îñòÓNàt9ÝƒØ ä-bE¨ D¨ŸÜ8Å\™L¸Yz»Xú›Q»Å{Ç_رƒ?%^¯'"<°S=yá8=‰‹­ß ÅëÑ‹¨J‘¹žŒ‰µôKXå¢;ãTFâvwoôi®¤¨mDñ™œ+-y¡Ì\ãQûä+ÙZ/Ò‹bÄVŠ´;Õèbx€/VW’•t5¬VVð5êVx‘¾ ͯìG0ô&P z‹9JQm ¨—ÖËÙ÷Á¸™Š³·Ñß^³Ñ1ºÑQîGt”ûu?âô/îGÈ=ÿ[_y ‘Ëry¶ÑÛÜtcL5* “}Ñ@ò÷c2o$ø˜WqÜ¥º°›8Ýcø¬´9kųԖZ+½¹5lkçÈ%¹´#ëÂ;«-´ëlݽYtû¡·ÖÇ6†*Cµ‘úëpÛG)+RÆò"µÈR¤7Š¬³Y¹2“—«å–rm–QnE¨÷jê÷[¶-u<¦=a[æØž-Ê3üÚ3úë6 -D}Q{Ùö=‡”wÕìcøHù„ŸÕþªeýÖ6ÒV¼ù†B}訽¯ÒVxŒ‹¹¯îsQpµ Ô)¬öÒz`µ¢A{ ”Ÿ•Îô2R­Äª§j:‘'»ª¥Z,ª’*U7e%OŠüò-ê8%a…§(ô´a1¯(·P«­QvÎ7Ñ¿Êse…qðøÁË;ùÿ¹?A¢»  ¡Þºê7À}0ŒÒÇÂT}&Ü¥ß a‰¾Tœ,ƒeð¸ºV_§¯‡çõ*øš.q?쇣úQýƒÓúiýsø¾×¿×ÿAÎÃ?Ôz=S±i`ij%E‹7vºÒJkn  •.ZG#Û^Àú+ýµ£Ì~?YÈ–*ªKµ…Æãd[£¬V×h+§Õ*öšòš&õê¨rTÛo|DŽ±ÓÊ_ÔÓÚ1ãkò9û^ùFý^ûÜø™ü¤v–¾šB3¥FßSé¼³ßÐyxÞ*î«ýYÜǺ±t±‹¨;]w€ŽOI»óãŠ*åæ¤y‘œ©Ä‰Vf³ƒCþϵNȉ­ÐÜœa‡Á\œë´O€ìt9V]“ ½¼«QhMäeœé \è?Ñ}Æa*ûkÃ`©™¢Ú|ÅaÉͧ6‹Ý.ë1Óiíjâ´Ž78­D…êÀ9j˜…k>êå^ÕkiΛ«Í-ÒÆ®ƒ<5Ï’ïÈwö$=i?è§ôä=Õ ¬D½ŸÝÏïWÛ;g+qq±Ú¾Ú±•mƒmÊ3Žgœ¤{a·R¥W¯Y_¶¿ìx‡¶v¼ëüeù—z|óx:uò£‡kƒ!¦Tdõ~õ‰£å#oI@»¨ÓØÅKy¯¬ø[çþäú(B”^Èu<IÒÐ H—Æx¹6pMÚQ tïÕ©¢{?’ã¾üsÏ«~—ƒF -†³¡–I¬Ô2—Ýa¹×²Ü¢¡’k.Š¼\µp—5²´vÖ|­»µŸ6Æú;í)íxUC%ÖPµ/¡Zó›ñÊBåÒÐlx¿nXëcë+E5ukêI +î ¨rO “ôŠÄ“dÝîsd%z*RT{¨g }H ¹`Ää¿ë‘#Gj»iO"îÄ”à†‹­³gnòZB;“ÒpU€i0Z­ o¶Ü°È€ÜŽò:„ï.ÿ(ÕÜèÝHK£kJK?¤q楹Q JåfVªž¿%§ øÒmÃÌ‹è¾AãÞÁmÃP™Z¡‡êa®éüd4®üºb'v+­pêöøž^÷¤Fê‘t“Û‘xŸÎâØ)ƒ¯SÈ&±Óe“ôc;×wÑ-ˆû|òþä*L&—'%G’5jþ -4Ý⸲Éñ±Üì÷VÿÎLˆÇÅñxU•ÜëŸÒær¿ãRªŸoØ…1©ö’HÄ͉f€VàêÑÕÓ)_ŵ ôºâ5ÅiÝ +ëÈ&·¾ÓÎLb/ﾘ”\»ïÂæ±·‘’sºR¿øÚÜ{‘kYžõÏ»/H‹AZZ’¶dhÄïð·²g»|­+H.$<ÕÞ¼g³Œ!íšðñ‚Ü ’ŠàM -¤oh{ª9ªB+{KÔ…æ;SCru+µÁT‡§éW«„ü…ˆ«Õ¢jj”«ÐD3”Q’ã×êG#Ÿ¯hˆ¹w!g(¹EnŒ$$ºí­\Ž -’Š³óU¤©öôž¡ð–MgW]+ç—”ÖlCz*yÖ¦KúNWJ°qb¿¬æ¦þ­¢7ÈïLÁü’®K9ý¢º›`!#ä×å Ã4ÛüÞ¼¼¦Ä‡wÑkF4Ú«áHl¸Vš\s’H§7\«$ÞOn e¤œÌ%3È$2L$³Ì¯ÑC®IÉFì€Wc±EôÀ6³ÈLøÕ/ÇJÈ _–­/®Ÿ]¿¹¾ë?7©)z\Sû\ý²úeÿ¢çvMÆø÷ðOmê§üzãú çÍ×ÔúOå‚«[ˆçÄWõÅâÀ¯ô;[¾'cYpUý»ÿ<Êeš/S¥æ×xr5­×RþK >ï"‹Í›nŠ‹â¼8o^¯Èû -ÔÛ%¿ÄE”ßì«FY&Io”ª+RÄ–Ãë\CÓe9׿tyŽ” -iˆúÒ§H%ñ˜¾ô®âÅcɲâÓ¦“ecgO"ËÆOŸ‰åÄ’XÎ1•,›PR†×f”L!Ë&OÇ6KÆbÍ”âéÅdÙÔâ² ,Ñ'ß;­xÖD²lúYS6¡xY6cötl9«tú,'ÊþÅo›²œ:iBñU¾[!QßM‘;òÌqþ’Bš‘e{S|•yÿ<òõ¦øíXˆ˾ø%}ÿ7ì}þY -endstream -endobj -1061 0 obj -<< -/Length1 17264 -/Filter /FlateDecode -/Length 12304 ->> -stream -xœÝ|yxTŶo {êÝs§;Ý¡“Nè$B&’¦4Â<ažÂ<*¢‡C ˆ&P"ǃ˜ƒÂAŒ<!ˆ=ˆ9\q@#z=€ -â­Ú݉À»¾÷¾ïýñ¾ïõNí]µ‡ªµV­Zë·ÖÞ€0BÈ;ÅŒôÌ”=/ ”ÿœêÓ«w~û ý ´;õ:dx¯Ç.FèA´cû 8hæÔ_¡ÝÚùC†§fÌùäƒ4„ðnhœ:oòB|ŠíqS,öj¥ Ïê"DÒ¦/œ1o,™s ®óû÷̘¼h!’aCùû m˜1wÉô™i𼩡Œº™Ó&EW¸6@ÿ|¼ì™pÂৠ ×Q»™ó{2ëÌ,èšxàÜS'wm×φ±N4Ì›üäBñ#ü5\[ËéŸ?yÞ´¨ëÙÀoÏ(8÷Ø‹»ó ã?ï/|tÚÂ.'=„äHÄeE&Ô->òü‰æn7PŒ‚øïÂ/”ðã;? GˆE g¥h*üÏÉóX4ôs–7aѽ¿Þڙɨ µ6AT= q¶ûÎâgøU1S¬‚¦'x¤£é8$zIG!8Þï¿¡Ó{!?ŠEË%;³ã­ò<üå$„/ݹ¢efëœ:á,`¤aP'Pê¡x¡äÂy œ¯2Ú»‚÷ãMPŠ \…sÓ¡¬†rÊ(ëBçÊCçK¡¬‚²"x?ÞU®C‰„âãý‡îç}œ€ÒÚ?oŸ -ÑÊëCºwqèÞÅ¡1ù¹T(›‚ôkÏØxÿ!ÚÏûÄcZyW£·Ñq´ ¶ãZÙ¡fTæA}ªGëðlÔ„VA‹kÝ@_#ºspB±ÃkGõ…£IÓ =€ú¡Ñh<šˆ–ß¹Ãu u@@ã&¢ÉwîÜùò÷í~ yS–DŒ:ÄZö_¿¢}þ‡ -cßíMép_3Ö"ÇîCC÷—ÄÖݹ3´PˆGï£öQŸ²OðÅ_þ£‹—S: Z[‡½{…ºí=©œ^UÞ‚Óp¾w/íuŸèƒ¿~“öÅNû´åéø.O[¦uI9HŠ±cÿæñbÏ(ì@ˆÂ¾ ØŽÔô½ Ù`oÕêmoF[aoÒêÆýß÷{ú°-‡–¦Œb=Ê€½ªõ§ÓîR@¬ËZ]Ò §Ú¢ÁþÑŒ2F[–Ó£·½•A;L]N¹Y&þÂè/G…›7F‹7ËèÍbáÆõñÆhzÃ/\O ÿþ9Uü÷-ús*ý/FbôÇ zÍN¨ Í@b3£ÍuwÎúïß÷¡ß]-¿« W‹è·Œ~óu¤ø £_GÒ¯½2‡~É覗ÿå/ߢÿrÓKô F/2úùgñsF?sÐ ôÓO⧌~²^/~â /§u¡MÐhêBÏ3zîCU<Çè‡*=Ë茞yÚ*ž‰¢ÿ §ï3ú^m,õ‰ŒžfôÔrú.£'}‡Ñ[b£Ç=ÆèÛŒ…þŽÚé­ÿÇa±žÑ¼5^üÇaúbá­Ã>ñ­ñô-¿pØG1z°‚Ö•÷ßd´µ·èÐ×F_/¢û‹èßMtŸîeô5æo¡¯2º‡Ñ¿Ùh £¯ì6‰¯dÐÝ&úò.«ørÝe¥})EüërúR -ý £;}‘Ñên±ºˆîxÁ"îpÓ,ôy•ngt ²Ñ­FZµ¥£XÅè–Ž´Ư¬ Ï+}të¹Ãô¹baó3>qóxºÙ/lbôYF7B{ãaúŒ–ƒ0Ê{Ò Àí;]¯§ep¢¬ˆ–‚ÐJ}ôi+]ÇèZFK]³Ú*®atµ•þ£«}Êš/>5œ®d´øIºâÏËÅŒþy9]î¡bt™‰.eô Fgtñcq±™.®ÃÈAxÌ@;*,²ÑE~áQFat!£ æTÐùó’ÄùÃé¼$:—Ñ9t6£³2èÌ[tÆa:ÑiŒ1:uŠGœÊèd§xèdF'1:‘Ñ côâ_DǽKÇBc¬ŽÑSÐèB;ÅèHFŽt‹gÐŒgt£-§Cb§ƒ„SÄAŒE´Z‡ioí'zåÐó­âƒ6ú`ñûuB~O³˜o¥ùuA«§ß$ö4Óžuø(´üyÑo¢þ:\ ­<ƒNÌ3м:ì÷ =í$t¿E»1Ú5‰va4œ[D;§GˆÐF³Sìb6£Yh§´±Óš ‡LF3àÆ FÓárzM‹ ©PKuÑŽºp±ãašÒ!LL±Ó”:‡í`±ŠÂhNn…ü€OLfô¸ómOºˆíMb4‘Ñ3õ…狾޴™Æ3g6‹qŒzcSDïr›BcPŒìa4šÑ(m£‘0+‘nÁ¨›Q£NèÁY@Ã)bx>uØ-¢#…Ú-4 î ³S -ƒŽÃ~­§…8ÏC/á× Çe0æ´‚À‘ ƒžß×Ñû¨¶Mè%´êœ²U@ÿEt•¢ëh ¹ŠÆ@ýà//8\Sp Ü„nBO5¤;™÷€Þ¶¢­x §EWÎÐe±‰$C¯€„¦ íb“¸…ËŽMâOp¡h©N²ËñÀ—Û.üN'ƒÑ9x~AÇÑGègxµ/Û–Õ‰àqZŸÕлdkfÝ.]fÝš¿Åï|y¿ÃóB»H!ôÆŠû;XŒzSú¼h5<¯bS…M1¨T'Y!‚&Èmô:·Q²i&ús(NÍ(pqð3 ü´Ó°(Ê>Ž˜èóåˆÖL«OHf[ñô\¶oÛ—‹§³­¹xè"¯UÌòeZ¹®˜pözgÞ­¬ë«©†¯œ-Ðk<ÌmzÈßEùDIt¹#¨3Ò'Ib¾Åú²±Ò^! J‚,*ÁªÇg¡í¢-éèQ°‰¡á®¿´Œb«ItfŒŽóÁÈYÙ('»ÕŸdeƒ¼n% /&¯Æ®¬¢‚MÅcß]8ãääÏ°~tQ禚šš¸c¥•C–oÈð½ôŒ«ÿ˜tô±ž<ÁÖ.æ½I¨ÐVéPKu»Œ•RLi쮨Êø -©ÊñJûð0DínO‚ÅCãb캘ö@/|¾Ùª-ñfPM®œÀçþM€ä®?äûâ³~w‚mDSeÓvöý͘þΔ]û÷oÙºµtûÆ5£ëg.ùG¿ X\GcO>÷ÏïÚÊêT±þ©ª]Kç-Z–”t(6ö³7–½ÄýÄE˜C0߃Ԉ(5æ#ª—+EL×ê°AEĔv&K À‘抮ðš-ä„S âSÜÝ"ãˆ,”7‹\bíñÇÞïNž<ÕR"F¾§ï2_bÛqÑ.¹r\ -Œºûã9:¢R¶–Z6Ø+¤­5VÉ5êANVã%Æç¸!´’¯„¤Å€‚0˜U+— rØѽbi!×[’Guø[Ø—¿ýtUeÙº-#¼Vì?{vÿŠ^ï»;N_ùòTõ)<åÉ?ÿùÉ¥Å+¹î¯Ž -4ŽÚ¡®þ¸0 U†ÿÍb,5l°TÆI•QqU¾0‰â˜8ÇàæS|àls«+ý»¡Íp+À ÕtÏfå8‹ÌXŸmÀª#VnÚSYr™Ïô‰T>Óÿþ ?³‹ìû~›IEë4¶¬ƒ©Æ^ì.šƒÕëÿ…uìi¶€•°E1@sЯ -‰ZLé7’h°Sq´€ :pów=èd­!G‰ì,Ëw =hþzà¢Ï¦€ÿç `JeÀð€{`ãXà -ï!8@yo$0‚ï¢z’å+¹­–O€Þyý6Q€àM¤¯I¯Ê˜ $!‘+\††dšÀèˆgaaIà5:ìö%ÁKßfGÙñ7ñÎ]x'Ÿ•B¬V8/–Âðñ°ßç´´…Â!»ƒò~O}÷cz¤®š7xÿ” Gfºøà„ÂÞ 'ñÆ­SÖ ݵ0}ôüÞ½ÞÊí|ôÅ«ÆÌÑ=•ý Q>Šdo [ÅE° -:¡…þô¤ävNj2è";ѽNÝ^ƒ5±ÝÞd§gozrV¢QJ2 )ÙŽ"Œ vo²!¥c,¯°n ­lhÎóS M ÚBoã6Ío,‹¥b¹8¬Ø^ì8^ ­XäañY|Õ´Æ%³H3•Ù9N¸lØ‚©xÎœ•+çÌ).{Æ·jØ‹çν8tM»}o²‹¸?¶eÏÍMË[Ö…mcãñ“¸ÛÙ[Ä»rÛ¶•OmÛƾ]×ëç·Þú¹ {ÞözÀ3Ù›l©ÝQâváq^ƒÿÉnþ d⃙ߣyEmñ÷D>€º Ö>Q¡H>Qt>ª*P°O¥*òðš*xM¹ï§)‚ªHZC'¦ªzQ0 ªÕe*šÍ•ƒwÕ°ÃûeŠñx„ŠÌ¨6b=¨AÐÉ’²¯#Êx4S¯Œ½4žÌl‚éï7ð©³ó[nÌ=+Æ·ôµ[Éx5[Æm÷.àçàGx$–û37ªTu•¶µ¸Rý{ŒUïŽ SˆˆLžp1#*]‡<¶4/_´!„¢ùŠf ¡ðEÈ ÓÖŠÏ{—Ùözñ#?î«xa÷ß?»jåfÖúê×U«6½Ìn²ßX9ÕrqÙúgבé¬ÇÂåízçu/ØÃÏT7òX ,r:¬87êèp¿Žö‡WRãë†ý–J]­ŠË0 t)-‚“ö»£;œæû]?BmûfçéƒvŽe—Ùqœ‡£ÇîÔ¿f䉆†…¯ôËjßWà…x>®jßþLw?@Þ÷Ù?Ù~¾ö×Ć…$–äwH•ºµ¨Ò,!³N¦†tÙcI³wÅF×—‘mµ$xã­aAZ¼V|àÎéSwФ"<÷bo±vv×mܸ}û 1•mfÅ€©Ÿƒq0:#†šµ÷‡KM£µJ¥ðw‹ºt€P¦A›’††¶Éh³¼œ ·Œ Z%GOpdSPÓò¥†¨Ág…гµó‡…zþ&U붓ì6ÈÃÝÆ_¥ ZÆ‘i-Ûy}kZr´xíKa(ÌQ4êæ÷º#P8¨Œºgž<‘ne‡eHY.£Þyh²Øù`Âë1cÖø,¯0ô¡ÆÇÙÖ€ý8zž¡ÕL3¨;ÓvŠ5ÅxñÆ]‘¿}5IB\¢T’¿ h­*¯bº‚Ë´ 5WÙí -TÒ $áÎöñëIûÆÆ–y.t;)º•LN¶är)ž‚^%­Wðšª6;B%xÞê‘QŽÎÀ³ÁNyø‘Ñ&Æ,ØŸ¢ÝÙIœ8ŽsÙIåí55ÂJ¢õ”Ök¥ß«øt -„;²E$”¢ªÄ³¡þpËÑ )á Í’´ EàFc ,†‹N%ALP²Iy˜ŒR -uEd©¸DY¦3²ˆ$"ó›ÅR²œ t¡ýh©<–Ž ¥By”2‡.¥OÊN03 03 eM8OüÐr˜Œ¼ÎÜ[¹„f’--/Ö“æ—Zꀛ›EZöÙå7hj†=4u’,lJ½”µÃûq#9(›B1ßHxn L<ŒIZã’ýf£ñþv¢¢êœØEŠK—€ÛÓ¥½.çÒl¥³Îd–aS)„Ña^d@€kküHˆU @góav³ŠÝ8l+ä×[ÉbbàvëÓî.ÐVØ< L  Ìçd€ Å2± -é²¥©­&#Hoî]Ñ“À©tb>ƒ Nâ’Û“¹³<Š‘Ùòb²TV],à~Ò(<Ï”¸ :Aoa_ŠþõøÄ”ãbÓíLáý[ÉÂû·3Á’-†õ:®5WâÓUši¥£Â\åB†l)ÖåÒˆjµi¸5O06ì®:]W²µª¤¤jkɹ_ZZnþhù…\Åýpû¼hû»q?¶”ã?㵸³b[µÅš CÉ~®´ 0¥6‹ª‰ÆÎVäÑeÚƒ+28‘Zªßå\ @D‰Ë¿+{~ûz6¸… »sû»Óbj˙ͫWoÚõågÿ³e7Ç‹ÙÏ¿V-®ŒE‹ÕYIši²z¬.‹ÁŒ\6`ÞÕj øŒXµ«¥AB®–˜ã¤ø»r(²S¾[¤\ŽPnýÂå°®ôÝJK«t" .$¡ €-aXUßú"ú˽’âïù7P ™0…fû;` ªä£}‚@ó%9¨TC8¼V/ˆÖpDUjEQ&ªº3kº]õÒ¢ƒÆ›‹Îšk e‰»qÚ‚L´Åw¦˜ wjïâµ]Ë#´ ›ü:xþ°ÆO÷Z6õíF\}K/¶|pqã†ÊgÈÛö»ØL¼äÅñ-ëĦ/>Ü|˜Œn¹öÔš•ëB~»?È<ý‡¿»Ñ@LzŸ'ƣ般úbb<ùªÞ#`Çëö—]•Vü:zY¨ôUX«’<ª>&RF ‘¹¦t»œ—–ÄcÓ@óþ²@ Û\ü›êæFð%£ÊH†eFe‚92jËi;ÿs.%1‘ÇšícÒëãN(ß5ï¹Ùe¿fŸ³èý™U5‹7Îýà-l¼4²^Üù~×n«™:3Þ•þáMÿJIù¸_¯uË>ëN­¯~÷¿÷T˜Ç02Šò›¤ Ñë~µ‹Èß‘ié¯6wO±”F– ^àV¬1ÚÒë®åAÚûfjCÖUºª,x­Ç챦°üž¶5 -¾…‹" Ö½¿ æë³x“'±8§ › æØ%#G=é5Nçä×ÌžUó`ï.¤;Ý0ÌïîÚ­[W÷¸¹ôf`æWoçuíÒ¥kœptÂ-0ÐßóüòI€lIkÈ7‰øt QIÓxxç ¦ÝîR7å‡Vˆ;:ÎÇq*Î$3ñijlÀ 6àl˜ ´)ô¥¶ 貿x?ªTUõ*˜Q½Ö„ a—OE&>J È€}ȯ‚ƒT¨^A1ðÐ,øÙž^F©¡W†nmþà^‚ਹ™{ …Û]—Ž+Ñ„#Ĩ<›¬ò$pgu #êúòõ ˆIJ²Î§O0d‘.4Kè"vUºè:é³ #Ð<†ÒQÂHq¬4V¦ŒÒêÇf(3 KèãÂÝãúxPLkfXÿ£ñ”ÆŸ(¯9·§üÄ¥#§€ÍîE㟠õ·’龦l —z ¼ã ó<„žZQĶ>-.ÁDäJôHÏ?#Öçë?à~t’¤Ø^è*¥¢®*ÇWW¬÷aËýº -÷çî@;EAïqm/&è õO’%âz=ÓkVÌŠD(^ˆ“’Ÿ> °Çh¥P?,"îTEh@þF~ - xð§¬'¾ô){–-¾€¯ƒ[}Ÿd¶ä®’U-Ë©“ëFk¦ ÑþŽ÷óª …óªäs7 €†Š–‘ÐMô n²N[{¡Èó©œA²`iú>ÆsñœO™—›ydSàTËòÂø û™>!Ùa…{üf¡Vz“Ô¢7>Óî<%ÐR-éâuÄ[3^|ïþé'V(ÙË ”ßÿŽk°ˆ ûÞqpÁø¨­>ðÉ!mâo\ÆÀȤudZ‹ßùȨ»Dø ø- -Žlõf€Í¢„þô“dÿõ‹rIà#k_I3þÎÄüªÃ"©ï…ÞØ4ÎÞNeó†E¡Œg¼°ŒÇh¾ÿ°¨±—YFµ.¹Ìæ-=]Ö®ÞVå2b—à6©’¡W¬ 9z<`¹ÎMvFðMY*8ÐÀõP¾Ïš -û£ÓbÒbÓ¼iqÕ¨W“jµZ¿3¼ÚYíªvWG˜Æã¶@N‡ÿmi€Ì¬„»2`íH}÷ÿ²tî–×ðÁƒ]_/þÛ{·ÿý ^³iÂѱÓ–žèžK2Y8má¹Cí¶¬ÜU4ñí‡E¯Y’Ý©.1qØ°ŒMœÓ·S˜à4 -¥ù#\-3ëÊUæúÈmnd³õq$)¢ 8ËȾÀÐ`•'-ïÊX`-§«½XIHäSO+Ö®^óôÓkV¯mù²Ã¶é§¿½ÚXTÕ±®Ž¤~t᳦óŸ_ O+„PåGö=;1jøzþ -FÇHÞRý†RãQ *u /£–2]={m$D€–´F½ž0ºñß…½­r|ýŸÆì3ìÃÂC[÷Û4þÕC‡÷LÚÒ379wÆvØ:?Ðáíž]þõÁ™Ë]{p¹,:l@’%(Ù#ÊLö2¥ÊT·Q§QC«Mß—Ë…Oø½rá”6sA|~÷k}:¦®®cUQãÕïNOÛÊÌkW¯.-]½z-=Kü­yýðQ¸+v`+ÎÅô]øü|ÓgZé)¹8€žÞþˆ4±Zª[/…×b©Ìˆßv—…Õ«¢)‰²èÂ%Ô/Êf ÑÖüØ€‹ê -WEËõkZÐ :’£Ur0rPÉ„ÂÀ—G^+<:oÖñ±ì6»€cúè—:aãÚÕ{,dÂéÍw;ç¾ ÂËÅaØ€ýì‹;_Ù·ÏX©D[êR³`ƒR+á2´Í$SI˜Œt¢d4ëí<{ >)ôýMO­fظä|Ú!|ååŠ/$ž:¯d+êXN~åuÉ^õÐŒ©åTz¶|pÝkštX_ÁZ¯}ý‰nƒ'2QGm¥aáº2Ox™™Âjõ˜'{ Ñ$CÉfóö…ÅÚš;Ë•+ Á…jiâ1yîýÚf'¿ã¦î䮩ufeÒ1%+K6”¯]QRwí›»†O©~𹵶Ìkø¹©u$÷ÌÇŸ9óév1ÀQ‘µ;ìܧ,Ÿ0wÁ2Vp—‘c6¢ì"5Ùuð»t&Ê¿0/³Ö¶Aô'¡þFð_v¾µeØ­YC?¹Ú÷ARµ4·f„ȃ³YYZW—¾{Ñß^!µ-ýImå†7ÿÖR"Ù[^š4õ2—Ú~¯Œ§CFÔÑïVj‘¡A݆ŽI¤V õX¢ªl‚ɺÒè|yJƒ·…ó8ÓñÖÇx^`>žÇ.㘺:aR µ¼œæ“yŠb#©Æ1BÒÙ-"¬–)¸–ZLÛè1å¸M¯1 ’ _ù74„TV,¸¦D®€ë‚oÿ´µ -Ùq|ãõ¿²ïÆÀ’²Ó¯Êo—?·}¹ô׫\šÍÀÝ~ͲðwQœAœàœ s‚¿tÊ=‹N €œ€ê‚I†ch[(Ë Ã’Ô õ6€¼›3Z!•û ü mp™c§aQ”pâ]Jé$f+d:YLÁ¸*Š¬‡KtK²KI¢‰b’Ü•v˜+ç(ýi?y´4ZžCg ³¤Yòú¤¸DZ"GÝ—{h®Ç_þ‹õÁì2›²®^²–á³lLKÉ_Éò€÷jà]•b@â å"ªÖNÐZ€*’ôuü+‘À{ÁTðißHÁÓp1“cG|õ¯o°Oñ%\ñ§?o?Œþö ô;¿!…u‡þâOtÙÌ:AFÑ‘’ì0”ÅÒúÈcn‹Œ¬fe4Ø:È<8Ê5(¢w¼åú€}†öYGŒ-<ˆ"îí<:Ð-$\¨Ý®\×^£ò¸Äëï“&¤‰iRšœ¦¤éÒÔ4}^xž3Ï•ç΋ȋ̋ʋÎóÓb!”Ë.µº°}Èþ4êNÁ1؃;òµ[ÏF -#`\î3ýQm~°ÞT…ÓcÑàûhÞð.„ë¶ÍúÚ¸ aƒ{0ÃrWøÍ·§§WáŸJ‚x¡d}Ë)I->Š½Ã¾xpj¾‚ œ¢ul˜#<¡! ¨ ±Ô›«"»Ekx¥ —¿ûæ»)ºÛã{ ¹5,Y½zݺիKHDJÕ´SW¿=  åàA’Ì)_ÜòôðÑ8üs8î2jxùo7™ÎMX2²¢!03²ž"+­4ÕëŽÉª$!lZƒ– οÇ=Íï³ ¶XcQ,Žµ¦¡4œiI³ú‘?hñ[‡¢¡x¨e¨Õ6'ܧ)NaU×¥ýöÔ‚ÜŽ¬êõx6]ÒñOÞk9'Lúì‰qí¸^6¦H@M"Zì÷kùg(ýàôÄxò£=.-á@¥ø¨`/uu•Y…2_½µ*):˜‚)™úÉ’=®wRÐEÞ“‚°°o…>Ò¼+ ÑšT¹/á ÝpH%­ï¶éûCª‡/_6îÍþëÖ78¼vöŒ·F,]sCé½ãÙ §ÇìrtìøÐðýãMÛ—ï:_Ÿ•5utq:1ÅlZñâ^/pº -䮈/À -L÷»L¢Q²âcJ­ªèu”Òb3Ý‹4š¯wkÐ>cãA`Œ{¬ž•LÇ;Ù„ ‹Ï\>Sá†ø;VÞRý§)›v5’Iå¸GŸF -î[õU*>fà+¾?,}mճߡ EkŠ‚‹  &¯›³ð©§Lå‘=»ñn¾ìù¢'KnïÜ=¹è2ŸË"àpž0 Ihš¿=ø öœÁ˜|˜„$ ‘¡Äc¾c"·‹E¡ê-kosµÑÿ ÌÛŸ¨°&ž(R¨""ñÒ–ÆÁ½qÁöèàÉGÐ=·«[s@‹[ý½õà6UÊ3ÓzÈÒM’“''œÁä„3˜œpÞ•œ8öGɉ뜜f%Z“m¹ë2½NÐÇ M"h”à£t‘j„>Æ€p{’ ¶—ÚËñJC.És¥\9Séfè­ôÓèûF*…ºQúцéd.Ìgë¦é'KÅ'•?éÕ§˜U7áÉ·£Æ¨É$YìAzˆÝÔ¾êhu6™%ÎT—‘t‰°BX*þI]¡º@n­¹ ÌsµÇ«Ÿßy¼–ÝÚ÷úþ} À'H~K=]w»šLoÙÊgu Hr5HR^ñ÷ "K€@™ l'˜: ȇK«:u*æ½ -²Õ9A²ùª,`A'¡é§H§4B8åÊÿy*CÖäé´#OdzäÇñY’1Т:Ô.B'uŒ0RU€CÑrØ\×ÄêØÁ&\Ǽ‡ÛãDaRË·-uøm–Gú›ƒŸãœÎï±8µ¡jo£Ódäj£':G\V§ ðžÓlAü`µMF³Ód2æ[ŒȤ+“[MǬ³‘g4mŠ­Ÿ©w°ƒß‰ik+÷ž´î½œj©Q –u¶ioËã¢X›Ûà6&˜Ì­ý¬ýl£*Ï“J2á9C ^æp>×wì35®ãÓã6Ï{h\6ä8ˆûÇ3a¿v”|( иÎÇ_O-ÐúÌ*2QÎ=Ï·>Ýú, þc§;Ÿ 1÷ÿO¡—8¹sG»S»~¡dA¹v ý? Ú‘_1´=!ÁÝF8gÙa ¢ì{ ?ìóaÃ@Ñ$ØógT˜½ -Ž€q–;¡~‚×ùs’v=aò£“§ ´©K‹Òf<:mJ›;yA,ß?6æðÞ§µßÿÞXœ -endstream -endobj -1062 0 obj -<< -/Type /FontDescriptor -/FontName /LXRMZQ+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 557 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 1058 0 R ->> -endobj -1063 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /LXRMZQ+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 40 [ 631 ] 42 [ 774 ] 44 [ 294 ] 46 [ 655 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] -/FontDescriptor 1062 0 R ->> -endobj -1064 0 obj -<< -/Length 772 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -32 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0003> <0020> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0015> <0032> -<0052> <006f> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1065 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /LXRMZQ+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1063 0 R ] -/ToUnicode 1064 0 R ->> -endobj -1066 0 obj -<< -/Type /FontDescriptor -/FontName /ENPKVN+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -132 753 704 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 704 -/StemV 80 -/StemH 80 -/FontFile2 1059 0 R ->> -endobj -1067 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /ENPKVN+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 5 [ 291 ] 7 [ 621 ] 10 [ 158 453 453 485 ] 15 [ 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] 204 [ 218 ] ] -/FontDescriptor 1066 0 R ->> -endobj -1068 0 obj -<< -/Length 1430 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -79 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0003> <0020> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0015> <0032> -<0016> <0033> -<0045> <0062> -<005a> <0077> -<001b> <0038> -<0052> <006f> -<0030> <004d> -<0031> <004e> -<004a> <0067> -<0029> <0046> -<0017> <0034> -<0033> <0050> -<001a> <0037> -<0018> <0035> -<0013> <0030> -<005d> <007a> -<002f> <004c> -<003a> <0057> -<005c> <0079> -<001c> <0039> -<005b> <0078> -<0027> <0044> -<0032> <004f> -<0037> <0054> -<0053> <0070> -<000f> <002c> -<001d> <003a> -<002b> <0048> -<0039> <0056> -<003c> <0059> -<000b> <0028> -<000c> <0029> -<004d> <006a> -<0054> <0071> -<000a> <0027> -<005f> <007c> -<0012> <002f> -<000d> <002a> -<0020> <003d> -<0042> <005f> -<0043> <0060> -<0005> <0022> -<003e> <005b> -<0040> <005d> -<00cc> <2019> -<0007> <0024> -<0038> <0055> -<003d> <005a> -<0034> <0051> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1069 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /ENPKVN+Poppins -/Encoding /Identity-H -/DescendantFonts [ 1067 0 R ] -/ToUnicode 1068 0 R ->> -endobj -1070 0 obj -<< -/Type /FontDescriptor -/FontName /DYCYPS+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ -9 -92 733 729 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 729 -/StemV 80 -/StemH 80 -/FontFile2 1060 0 R ->> -endobj -1071 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /DYCYPS+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] -/FontDescriptor 1070 0 R ->> -endobj -1072 0 obj -<< -/Length 1182 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -61 beginbfchar -<0014> <0031> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<0011> <002e> -<0003> <0020> -<0028> <0045> -<0051> <006e> -<0056> <0073> -<0058> <0075> -<0055> <0072> -<0048> <0065> -<0057> <0074> -<004b> <0068> -<0044> <0061> -<0024> <0041> -<0033> <0050> -<002c> <0049> -<0059> <0076> -<0053> <0070> -<0052> <006f> -<0047> <0064> -<0046> <0063> -<004c> <0069> -<13ae> <00660069> -<004f> <006c> -<0050> <006d> -<0019> <0036> -<000b> <0028> -<000c> <0029> -<0015> <0032> -<005a> <0077> -<001d> <003a> -<004a> <0067> -<001a> <0037> -<001b> <0038> -<001c> <0039> -<0026> <0043> -<0031> <004e> -<004e> <006b> -<0049> <0066> -<0030> <004d> -<0013> <0030> -<005c> <0079> -<0010> <002d> -<002e> <004b> -<0045> <0062> -<005d> <007a> -<0035> <0052> -<0025> <0042> -<002f> <004c> -<0036> <0053> -<005b> <0078> -<0027> <0044> -<0054> <0071> -<0039> <0056> -<0037> <0054> -<0042> <005f> -<003a> <0057> -<0012> <002f> -<003c> <0059> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1073 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /DYCYPS+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1071 0 R ] -/ToUnicode 1072 0 R ->> -endobj -1074 0 obj -<< -/Type /FontDescriptor -/FontName /IJJFHS+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -155 598 728 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 728 -/StemV 80 -/StemH 80 -/FontFile2 1061 0 R ->> -endobj -1075 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /IJJFHS+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 602 602 602 602 602 602 602 602 602 602 602 ] 15 [ 602 602 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 602 602 602 602 602 602 602 602 602 ] 62 [ 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 601 601 601 602 601 601 602 601 601 601 601 602 601 602 602 602 602 602 602 ] ] -/FontDescriptor 1074 0 R ->> -endobj -1076 0 obj -<< -/Length 1570 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -89 beginbfchar -<0031> <004e> -<0052> <006f> -<0057> <0074> -<0024> <0041> -<0053> <0070> -<004f> <006c> -<004c> <0069> -<0046> <0063> -<0044> <0061> -<0045> <0062> -<0048> <0065> -<0058> <0075> -<0050> <006d> -<0047> <0064> -<0056> <0073> -<0055> <0072> -<0003> <0020> -<0010> <002d> -<0051> <006e> -<0020> <003d> -<0008> <0025> -<001f> <003c> -<004b> <0068> -<0012> <002f> -<0049> <0066> -<0021> <003e> -<0038> <0055> -<001d> <003a> -<002a> <0047> -<0059> <0076> -<000a> <0027> -<001a> <0037> -<0013> <0030> -<0054> <0071> -<004e> <006b> -<0042> <005f> -<005a> <0077> -<0011> <002e> -<0006> <0023> -<0004> <0021> -<0037> <0054> -<004a> <0067> -<005c> <0079> -<0007> <0024> -<0014> <0031> -<002c> <0049> -<0033> <0050> -<0027> <0044> -<0035> <0052> -<003e> <005b> -<0005> <0022> -<005e> <007b> -<0060> <007d> -<0040> <005d> -<001e> <003b> -<005b> <0078> -<000b> <0028> -<000c> <0029> -<002f> <004c> -<000d> <002a> -<005f> <007c> -<0015> <0032> -<0009> <0026> -<0019> <0036> -<0017> <0034> -<002b> <0048> -<0036> <0053> -<0028> <0045> -<0030> <004d> -<0032> <004f> -<0029> <0046> -<003f> <005c> -<0022> <003f> -<005d> <007a> -<0016> <0033> -<003b> <0058> -<000f> <002c> -<0025> <0042> -<0026> <0043> -<001c> <0039> -<003a> <0057> -<001b> <0038> -<0018> <0035> -<003c> <0059> -<004d> <006a> -<0039> <0056> -<0034> <0051> -<0023> <0040> -<002e> <004b> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1077 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /IJJFHS+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 1075 0 R ] -/ToUnicode 1076 0 R ->> -endobj -1078 0 obj -<< -/LXRMZQ 1065 0 R -/ENPKVN 1069 0 R -/DYCYPS 1073 0 R -/IJJFHS 1077 0 R ->> -endobj -xref -0 1079 -0000000000 65535 f -0000000015 00000 n -0000001112 00000 n -0000001250 00000 n -0000040655 00000 n -0000040789 00000 n -0000043487 00000 n -0000043686 00000 n -0000047426 00000 n -0000047832 00000 n -0000048037 00000 n -0000048244 00000 n -0000048379 00000 n -0000048515 00000 n -0000048673 00000 n -0000048832 00000 n -0000049065 00000 n -0000049299 00000 n -0000049514 00000 n -0000049730 00000 n -0000049971 00000 n -0000050213 00000 n -0000050436 00000 n -0000050660 00000 n -0000050892 00000 n -0000051125 00000 n -0000051339 00000 n -0000051554 00000 n -0000051781 00000 n -0000052009 00000 n -0000052218 00000 n -0000052428 00000 n -0000052657 00000 n -0000052887 00000 n -0000053098 00000 n -0000053310 00000 n -0000053529 00000 n -0000053748 00000 n -0000057509 00000 n -0000057974 00000 n -0000058175 00000 n -0000058377 00000 n -0000058592 00000 n -0000058808 00000 n -0000059005 00000 n -0000059203 00000 n -0000059422 00000 n -0000059642 00000 n -0000059843 00000 n -0000060045 00000 n -0000060273 00000 n -0000060502 00000 n -0000060712 00000 n -0000060923 00000 n -0000061138 00000 n -0000061354 00000 n -0000061585 00000 n -0000061817 00000 n -0000062020 00000 n -0000062224 00000 n -0000062361 00000 n -0000062499 00000 n -0000062693 00000 n -0000062888 00000 n -0000063078 00000 n -0000063269 00000 n -0000063460 00000 n -0000063652 00000 n -0000063844 00000 n -0000064037 00000 n -0000064276 00000 n -0000064516 00000 n -0000064731 00000 n -0000064947 00000 n -0000065154 00000 n -0000065361 00000 n -0000068935 00000 n -0000069413 00000 n -0000069609 00000 n -0000069806 00000 n -0000070002 00000 n -0000070199 00000 n -0000070398 00000 n -0000070598 00000 n -0000070798 00000 n -0000070999 00000 n -0000071197 00000 n -0000071396 00000 n -0000071630 00000 n -0000071865 00000 n -0000072064 00000 n -0000072264 00000 n -0000072467 00000 n -0000072671 00000 n -0000072873 00000 n -0000073076 00000 n -0000073276 00000 n -0000073477 00000 n -0000073673 00000 n -0000073870 00000 n -0000074059 00000 n -0000074250 00000 n -0000074442 00000 n -0000074635 00000 n -0000074825 00000 n -0000075016 00000 n -0000075202 00000 n -0000075389 00000 n -0000075601 00000 n -0000075814 00000 n -0000076029 00000 n -0000076245 00000 n -0000076458 00000 n -0000076671 00000 n -0000080377 00000 n -0000080880 00000 n -0000081082 00000 n -0000081285 00000 n -0000081487 00000 n -0000081690 00000 n -0000081901 00000 n -0000082113 00000 n -0000082334 00000 n -0000082556 00000 n -0000082785 00000 n -0000083015 00000 n -0000083216 00000 n -0000083418 00000 n -0000083616 00000 n -0000083815 00000 n -0000084028 00000 n -0000084242 00000 n -0000084441 00000 n -0000084641 00000 n -0000084852 00000 n -0000085064 00000 n -0000085210 00000 n -0000085357 00000 n -0000085571 00000 n -0000085786 00000 n -0000085978 00000 n -0000086171 00000 n -0000086382 00000 n -0000086594 00000 n -0000086813 00000 n -0000087033 00000 n -0000087232 00000 n -0000087432 00000 n -0000087640 00000 n -0000087849 00000 n -0000088045 00000 n -0000088241 00000 n -0000092113 00000 n -0000092584 00000 n -0000092721 00000 n -0000092859 00000 n -0000093051 00000 n -0000093244 00000 n -0000093443 00000 n -0000093643 00000 n -0000093800 00000 n -0000093958 00000 n -0000094171 00000 n -0000094385 00000 n -0000094581 00000 n -0000094778 00000 n -0000094970 00000 n -0000095163 00000 n -0000095386 00000 n -0000095610 00000 n -0000095811 00000 n -0000096013 00000 n -0000096210 00000 n -0000096408 00000 n -0000096605 00000 n -0000096803 00000 n -0000096963 00000 n -0000097124 00000 n -0000097321 00000 n -0000097519 00000 n -0000097654 00000 n -0000097790 00000 n -0000097973 00000 n -0000098157 00000 n -0000098349 00000 n -0000098542 00000 n -0000102387 00000 n -0000102874 00000 n -0000103033 00000 n -0000103193 00000 n -0000103414 00000 n -0000103636 00000 n -0000103839 00000 n -0000104043 00000 n -0000104266 00000 n -0000104490 00000 n -0000104694 00000 n -0000104899 00000 n -0000105130 00000 n -0000105362 00000 n -0000105575 00000 n -0000105789 00000 n -0000106018 00000 n -0000106248 00000 n -0000106466 00000 n -0000106685 00000 n -0000106921 00000 n -0000107158 00000 n -0000107376 00000 n -0000107595 00000 n -0000107730 00000 n -0000107866 00000 n -0000108059 00000 n -0000108253 00000 n -0000108464 00000 n -0000108676 00000 n -0000108879 00000 n -0000109083 00000 n -0000109274 00000 n -0000109466 00000 n -0000109680 00000 n -0000109894 00000 n -0000113976 00000 n -0000114463 00000 n -0000114666 00000 n -0000114870 00000 n -0000115075 00000 n -0000115281 00000 n -0000115471 00000 n -0000115662 00000 n -0000115899 00000 n -0000116137 00000 n -0000116368 00000 n -0000116600 00000 n -0000116804 00000 n -0000117009 00000 n -0000117217 00000 n -0000117426 00000 n -0000117634 00000 n -0000117843 00000 n -0000117996 00000 n -0000118150 00000 n -0000118347 00000 n -0000118545 00000 n -0000118706 00000 n -0000118868 00000 n -0000119050 00000 n -0000119233 00000 n -0000119398 00000 n -0000119564 00000 n -0000119761 00000 n -0000119959 00000 n -0000120161 00000 n -0000120364 00000 n -0000120513 00000 n -0000120663 00000 n -0000120845 00000 n -0000121028 00000 n -0000124874 00000 n -0000125345 00000 n -0000125566 00000 n -0000125788 00000 n -0000126002 00000 n -0000126217 00000 n -0000126435 00000 n -0000126654 00000 n -0000126858 00000 n -0000127063 00000 n -0000127239 00000 n -0000127416 00000 n -0000127615 00000 n -0000127815 00000 n -0000128010 00000 n -0000128206 00000 n -0000128404 00000 n -0000128603 00000 n -0000128755 00000 n -0000128908 00000 n -0000129095 00000 n -0000129283 00000 n -0000129477 00000 n -0000129672 00000 n -0000129818 00000 n -0000129965 00000 n -0000130167 00000 n -0000130370 00000 n -0000130537 00000 n -0000130705 00000 n -0000130861 00000 n -0000131018 00000 n -0000131225 00000 n -0000131433 00000 n -0000133745 00000 n -0000134040 00000 n -0000134184 00000 n -0000134329 00000 n -0000134531 00000 n -0000134734 00000 n -0000134948 00000 n -0000135163 00000 n -0000135348 00000 n -0000135534 00000 n -0000135712 00000 n -0000135891 00000 n -0000140751 00000 n -0000141006 00000 n -0000141262 00000 n -0000141529 00000 n -0000141795 00000 n -0000142002 00000 n -0000142208 00000 n -0000145778 00000 n -0000146009 00000 n -0000146207 00000 n -0000146396 00000 n -0000150083 00000 n -0000150286 00000 n -0000154029 00000 n -0000154252 00000 n -0000154386 00000 n -0000158416 00000 n -0000158655 00000 n -0000158789 00000 n -0000158923 00000 n -0000159057 00000 n -0000162674 00000 n -0000162877 00000 n -0000167587 00000 n -0000167978 00000 n -0000168112 00000 n -0000168244 00000 n -0000168376 00000 n -0000168508 00000 n -0000168640 00000 n -0000168772 00000 n -0000168904 00000 n -0000169036 00000 n -0000169168 00000 n -0000169301 00000 n -0000169434 00000 n -0000169567 00000 n -0000169700 00000 n -0000169833 00000 n -0000169966 00000 n -0000170099 00000 n -0000170232 00000 n -0000170365 00000 n -0000170498 00000 n -0000170631 00000 n -0000170763 00000 n -0000170894 00000 n -0000175901 00000 n -0000176300 00000 n -0000176433 00000 n -0000176566 00000 n -0000176699 00000 n -0000176832 00000 n -0000176965 00000 n -0000177098 00000 n -0000177231 00000 n -0000177364 00000 n -0000177497 00000 n -0000177630 00000 n -0000177763 00000 n -0000177896 00000 n -0000178029 00000 n -0000178162 00000 n -0000178295 00000 n -0000178428 00000 n -0000178561 00000 n -0000178694 00000 n -0000178827 00000 n -0000178960 00000 n -0000179093 00000 n -0000179226 00000 n -0000179361 00000 n -0000184173 00000 n -0000184636 00000 n -0000184771 00000 n -0000184904 00000 n -0000185037 00000 n -0000185170 00000 n -0000185303 00000 n -0000185436 00000 n -0000185569 00000 n -0000185702 00000 n -0000185835 00000 n -0000185969 00000 n -0000186103 00000 n -0000186237 00000 n -0000186371 00000 n -0000186505 00000 n -0000186639 00000 n -0000186773 00000 n -0000186907 00000 n -0000187041 00000 n -0000187175 00000 n -0000187309 00000 n -0000187443 00000 n -0000187577 00000 n -0000187711 00000 n -0000187845 00000 n -0000187979 00000 n -0000188113 00000 n -0000188247 00000 n -0000188381 00000 n -0000188515 00000 n -0000188649 00000 n -0000188782 00000 n -0000193785 00000 n -0000194248 00000 n -0000194382 00000 n -0000194516 00000 n -0000194650 00000 n -0000194784 00000 n -0000194918 00000 n -0000195052 00000 n -0000195186 00000 n -0000195320 00000 n -0000195454 00000 n -0000195588 00000 n -0000195722 00000 n -0000195856 00000 n -0000195990 00000 n -0000196124 00000 n -0000196258 00000 n -0000196392 00000 n -0000196526 00000 n -0000196660 00000 n -0000196794 00000 n -0000196928 00000 n -0000197062 00000 n -0000197196 00000 n -0000197330 00000 n -0000197464 00000 n -0000197598 00000 n -0000197732 00000 n -0000197866 00000 n -0000198000 00000 n -0000198134 00000 n -0000198268 00000 n -0000198403 00000 n -0000202995 00000 n -0000203386 00000 n -0000203521 00000 n -0000203654 00000 n -0000203787 00000 n -0000203920 00000 n -0000204053 00000 n -0000204186 00000 n -0000204319 00000 n -0000204452 00000 n -0000204585 00000 n -0000204719 00000 n -0000204853 00000 n -0000204987 00000 n -0000205121 00000 n -0000205255 00000 n -0000205389 00000 n -0000205523 00000 n -0000205657 00000 n -0000205791 00000 n -0000205925 00000 n -0000206059 00000 n -0000206193 00000 n -0000206326 00000 n -0000211317 00000 n -0000211828 00000 n -0000211962 00000 n -0000212096 00000 n -0000212230 00000 n -0000212364 00000 n -0000212498 00000 n -0000212632 00000 n -0000212766 00000 n -0000212900 00000 n -0000213034 00000 n -0000213168 00000 n -0000213302 00000 n -0000213436 00000 n -0000213570 00000 n -0000213704 00000 n -0000213838 00000 n -0000213972 00000 n -0000214106 00000 n -0000214240 00000 n -0000214374 00000 n -0000214508 00000 n -0000214642 00000 n -0000214776 00000 n -0000214910 00000 n -0000215044 00000 n -0000215178 00000 n -0000215312 00000 n -0000215446 00000 n -0000215580 00000 n -0000215714 00000 n -0000215848 00000 n -0000215982 00000 n -0000216116 00000 n -0000216250 00000 n -0000216384 00000 n -0000216518 00000 n -0000216651 00000 n -0000216783 00000 n -0000220032 00000 n -0000220271 00000 n -0000220405 00000 n -0000220539 00000 n -0000220674 00000 n -0000225715 00000 n -0000225938 00000 n -0000226073 00000 n -0000231076 00000 n -0000231299 00000 n -0000231434 00000 n -0000236225 00000 n -0000236428 00000 n -0000241436 00000 n -0000241659 00000 n -0000241794 00000 n -0000246649 00000 n -0000246852 00000 n -0000251775 00000 n -0000251998 00000 n -0000252133 00000 n -0000257000 00000 n -0000257223 00000 n -0000257358 00000 n -0000262131 00000 n -0000262334 00000 n -0000267334 00000 n -0000267557 00000 n -0000267692 00000 n -0000272677 00000 n -0000272880 00000 n -0000277784 00000 n -0000278007 00000 n -0000278142 00000 n -0000283091 00000 n -0000283314 00000 n -0000283449 00000 n -0000288275 00000 n -0000288478 00000 n -0000293483 00000 n -0000293706 00000 n -0000293841 00000 n -0000298855 00000 n -0000299078 00000 n -0000299213 00000 n -0000304128 00000 n -0000304331 00000 n -0000309308 00000 n -0000309531 00000 n -0000309666 00000 n -0000314447 00000 n -0000314650 00000 n -0000318970 00000 n -0000319201 00000 n -0000319336 00000 n -0000319471 00000 n -0000324362 00000 n -0000324585 00000 n -0000324720 00000 n -0000329754 00000 n -0000329977 00000 n -0000330112 00000 n -0000334992 00000 n -0000335195 00000 n -0000340299 00000 n -0000340522 00000 n -0000340657 00000 n -0000345547 00000 n -0000345750 00000 n -0000350768 00000 n -0000350991 00000 n -0000351126 00000 n -0000356049 00000 n -0000356272 00000 n -0000356407 00000 n -0000361218 00000 n -0000361421 00000 n -0000366467 00000 n -0000366690 00000 n -0000366825 00000 n -0000371758 00000 n -0000371981 00000 n -0000372116 00000 n -0000376932 00000 n -0000377135 00000 n -0000382112 00000 n -0000382335 00000 n -0000382470 00000 n -0000387421 00000 n -0000387624 00000 n -0000392507 00000 n -0000392730 00000 n -0000392865 00000 n -0000397809 00000 n -0000398032 00000 n -0000398167 00000 n -0000402979 00000 n -0000403182 00000 n -0000408184 00000 n -0000408407 00000 n -0000408542 00000 n -0000413541 00000 n -0000413764 00000 n -0000413899 00000 n -0000418682 00000 n -0000418885 00000 n -0000423879 00000 n -0000424102 00000 n -0000424237 00000 n -0000429096 00000 n -0000429299 00000 n -0000434327 00000 n -0000434550 00000 n -0000434685 00000 n -0000439559 00000 n -0000439782 00000 n -0000439917 00000 n -0000444664 00000 n -0000444867 00000 n -0000449930 00000 n -0000450153 00000 n -0000450289 00000 n -0000455240 00000 n -0000455443 00000 n -0000460278 00000 n -0000460501 00000 n -0000460637 00000 n -0000465662 00000 n -0000465885 00000 n -0000466021 00000 n -0000470808 00000 n -0000471011 00000 n -0000475993 00000 n -0000476216 00000 n -0000476352 00000 n -0000481349 00000 n -0000481572 00000 n -0000481707 00000 n -0000486477 00000 n -0000486680 00000 n -0000491763 00000 n -0000492098 00000 n -0000492234 00000 n -0000492368 00000 n -0000492502 00000 n -0000492636 00000 n -0000492770 00000 n -0000492904 00000 n -0000493038 00000 n -0000493172 00000 n -0000493306 00000 n -0000493441 00000 n -0000493576 00000 n -0000493711 00000 n -0000493846 00000 n -0000493980 00000 n -0000494113 00000 n -0000498615 00000 n -0000498926 00000 n -0000499061 00000 n -0000499196 00000 n -0000499331 00000 n -0000499466 00000 n -0000499601 00000 n -0000499736 00000 n -0000499871 00000 n -0000500006 00000 n -0000500141 00000 n -0000500276 00000 n -0000500412 00000 n -0000500548 00000 n -0000505561 00000 n -0000505784 00000 n -0000505920 00000 n -0000510767 00000 n -0000510990 00000 n -0000511126 00000 n -0000515989 00000 n -0000516212 00000 n -0000516348 00000 n -0000521170 00000 n -0000521393 00000 n -0000521529 00000 n -0000526387 00000 n -0000526610 00000 n -0000526746 00000 n -0000531422 00000 n -0000531645 00000 n -0000531781 00000 n -0000535383 00000 n -0000535586 00000 n -0000540178 00000 n -0000540409 00000 n -0000540545 00000 n -0000540680 00000 n -0000544182 00000 n -0000544385 00000 n -0000549242 00000 n -0000549465 00000 n -0000549601 00000 n -0000554375 00000 n -0000554578 00000 n -0000559697 00000 n -0000559920 00000 n -0000560056 00000 n -0000564808 00000 n -0000565011 00000 n -0000570145 00000 n -0000570368 00000 n -0000570503 00000 n -0000575236 00000 n -0000575439 00000 n -0000580443 00000 n -0000580646 00000 n -0000585453 00000 n -0000585676 00000 n -0000585812 00000 n -0000590572 00000 n -0000590775 00000 n -0000595831 00000 n -0000596054 00000 n -0000596190 00000 n -0000600966 00000 n -0000601169 00000 n -0000606179 00000 n -0000606402 00000 n -0000606538 00000 n -0000611307 00000 n -0000611510 00000 n -0000616355 00000 n -0000616558 00000 n -0000621376 00000 n -0000621599 00000 n -0000621735 00000 n -0000626488 00000 n -0000626691 00000 n -0000630319 00000 n -0000630522 00000 n -0000633800 00000 n -0000634003 00000 n -0000639049 00000 n -0000639272 00000 n -0000639408 00000 n -0000643952 00000 n -0000644155 00000 n -0000648447 00000 n -0000648670 00000 n -0000648806 00000 n -0000652880 00000 n -0000653111 00000 n -0000653247 00000 n -0000653383 00000 n -0000658341 00000 n -0000658612 00000 n -0000658748 00000 n -0000658884 00000 n -0000659018 00000 n -0000659152 00000 n -0000659286 00000 n -0000659420 00000 n -0000659556 00000 n -0000664331 00000 n -0000664594 00000 n -0000664730 00000 n -0000664864 00000 n -0000664998 00000 n -0000665132 00000 n -0000665266 00000 n -0000665402 00000 n -0000668166 00000 n -0000668369 00000 n -0000672683 00000 n -0000672922 00000 n -0000673058 00000 n -0000673194 00000 n -0000673329 00000 n -0000677356 00000 n -0000677595 00000 n -0000677731 00000 n -0000677867 00000 n -0000678003 00000 n -0000682658 00000 n -0000682905 00000 n -0000683041 00000 n -0000683177 00000 n -0000683313 00000 n -0000683449 00000 n -0000688333 00000 n -0000688564 00000 n -0000688700 00000 n -0000688836 00000 n -0000692983 00000 n -0000693214 00000 n -0000693350 00000 n -0000693486 00000 n -0000697662 00000 n -0000697909 00000 n -0000698045 00000 n -0000698181 00000 n -0000698317 00000 n -0000698453 00000 n -0000703448 00000 n -0000703679 00000 n -0000703815 00000 n -0000703951 00000 n -0000708536 00000 n -0000708767 00000 n -0000708903 00000 n -0000709039 00000 n -0000711984 00000 n -0000712207 00000 n -0000712343 00000 n -0000716421 00000 n -0000716624 00000 n -0000722138 00000 n -0000722537 00000 n -0000722673 00000 n -0000722807 00000 n -0000722941 00000 n -0000723075 00000 n -0000723209 00000 n -0000723343 00000 n -0000723477 00000 n -0000723611 00000 n -0000723745 00000 n -0000723880 00000 n -0000724015 00000 n -0000724150 00000 n -0000724285 00000 n -0000724420 00000 n -0000724555 00000 n -0000724690 00000 n -0000724825 00000 n -0000724960 00000 n -0000725095 00000 n -0000725230 00000 n -0000725365 00000 n -0000725500 00000 n -0000725634 00000 n -0000729339 00000 n -0000729626 00000 n -0000729761 00000 n -0000729896 00000 n -0000730031 00000 n -0000730166 00000 n -0000730301 00000 n -0000730436 00000 n -0000730571 00000 n -0000730706 00000 n -0000730842 00000 n -0000735267 00000 n -0000735490 00000 n -0000735626 00000 n -0000740087 00000 n -0000740318 00000 n -0000740454 00000 n -0000740590 00000 n -0000745056 00000 n -0000745279 00000 n -0000745415 00000 n -0000750381 00000 n -0000750716 00000 n -0000750852 00000 n -0000750986 00000 n -0000751120 00000 n -0000751254 00000 n -0000751388 00000 n -0000751522 00000 n -0000751656 00000 n -0000751790 00000 n -0000751924 00000 n -0000752059 00000 n -0000752194 00000 n -0000752329 00000 n -0000752464 00000 n -0000752598 00000 n -0000752731 00000 n -0000755980 00000 n -0000756235 00000 n -0000756370 00000 n -0000756505 00000 n -0000756640 00000 n -0000756775 00000 n -0000756911 00000 n -0000760328 00000 n -0000760531 00000 n -0000763793 00000 n -0000763996 00000 n -0000768403 00000 n -0000768606 00000 n -0000773005 00000 n -0000773372 00000 n -0000773508 00000 n -0000773642 00000 n -0000773776 00000 n -0000773910 00000 n -0000774044 00000 n -0000774178 00000 n -0000774312 00000 n -0000774446 00000 n -0000774580 00000 n -0000774715 00000 n -0000774850 00000 n -0000774985 00000 n -0000775120 00000 n -0000775255 00000 n -0000775390 00000 n -0000775525 00000 n -0000775660 00000 n -0000775795 00000 n -0000775931 00000 n -0000776127 00000 n -0000776353 00000 n -0000776479 00000 n -0000776625 00000 n -0000776765 00000 n -0000776962 00000 n -0000777196 00000 n -0000777427 00000 n -0000777683 00000 n -0000777922 00000 n -0000778169 00000 n -0000778399 00000 n -0000778641 00000 n -0000778866 00000 n -0000779110 00000 n -0000779338 00000 n -0000779573 00000 n -0000779791 00000 n -0000780022 00000 n -0000780236 00000 n -0000780471 00000 n -0000780689 00000 n -0000780933 00000 n -0000781160 00000 n -0000781392 00000 n -0000781639 00000 n -0000781844 00000 n -0000782020 00000 n -0000782215 00000 n -0000782420 00000 n -0000782626 00000 n -0000782833 00000 n -0000783087 00000 n -0000783317 00000 n -0000783540 00000 n -0000783751 00000 n -0000783962 00000 n -0000784177 00000 n -0000784393 00000 n -0000784607 00000 n -0000784857 00000 n -0000785072 00000 n -0000785291 00000 n -0000785509 00000 n -0000785725 00000 n -0000785937 00000 n -0000786142 00000 n -0000786349 00000 n -0000786554 00000 n -0000786755 00000 n -0000786982 00000 n -0000787212 00000 n -0000787441 00000 n -0000787658 00000 n -0000787875 00000 n -0000788101 00000 n -0000788337 00000 n -0000788581 00000 n -0000788797 00000 n -0000789010 00000 n -0000789238 00000 n -0000789452 00000 n -0000789664 00000 n -0000789847 00000 n -0000790061 00000 n -0000790265 00000 n -0000790490 00000 n -0000790723 00000 n -0000790936 00000 n -0000791158 00000 n -0000791355 00000 n -0000791529 00000 n -0000791719 00000 n -0000791916 00000 n -0000792108 00000 n -0000792319 00000 n -0000792527 00000 n -0000792731 00000 n -0000792966 00000 n -0000793179 00000 n -0000793388 00000 n -0000793583 00000 n -0000793780 00000 n -0000793963 00000 n -0000794138 00000 n -0000794323 00000 n -0000794517 00000 n -0000794718 00000 n -0000794942 00000 n -0000795164 00000 n -0000795405 00000 n -0000795628 00000 n -0000795877 00000 n -0000796109 00000 n -0000796356 00000 n -0000796593 00000 n -0000796847 00000 n -0000797070 00000 n -0000797248 00000 n -0000797444 00000 n -0000797671 00000 n -0000797890 00000 n -0000798099 00000 n -0000798331 00000 n -0000798552 00000 n -0000798775 00000 n -0000798983 00000 n -0000799238 00000 n -0000799486 00000 n -0000799709 00000 n -0000799936 00000 n -0000800148 00000 n -0000800343 00000 n -0000800543 00000 n -0000800722 00000 n -0000800922 00000 n -0000801105 00000 n -0000801320 00000 n -0000801525 00000 n -0000801716 00000 n -0000801901 00000 n -0000802140 00000 n -0000802372 00000 n -0000802608 00000 n -0000802830 00000 n -0000803024 00000 n -0000803241 00000 n -0000803454 00000 n -0000803655 00000 n -0000803849 00000 n -0000804039 00000 n -0000804236 00000 n -0000804424 00000 n -0000804629 00000 n -0000804799 00000 n -0000804997 00000 n -0000805192 00000 n -0000805363 00000 n -0000805568 00000 n -0000805801 00000 n -0000806004 00000 n -0000806185 00000 n -0000806249 00000 n -0000814191 00000 n -0000818994 00000 n -0000830855 00000 n -0000843251 00000 n -0000843485 00000 n -0000843911 00000 n -0000844737 00000 n -0000844890 00000 n -0000845121 00000 n -0000845718 00000 n -0000847203 00000 n -0000847353 00000 n -0000847588 00000 n -0000848127 00000 n -0000849364 00000 n -0000849517 00000 n -0000849761 00000 n -0000850356 00000 n -0000851981 00000 n -0000852138 00000 n -trailer -<< -/Size 1079 -/Root 3 0 R -/Info 2 0 R ->> -startxref -852230 -%%EOF diff --git a/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf b/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf deleted file mode 100644 index 8984cc57c5e..00000000000 --- a/versioned_docs/version-2.6/security/hardening-guides/rke-1.6-hardening-2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf +++ /dev/null @@ -1,8259 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 30 0 R 45 0 R 53 0 R 67 0 R 77 0 R 99 0 R 129 0 R 164 0 R 194 0 R 232 0 R 270 0 R 310 0 R 350 0 R 390 0 R 425 0 R 464 0 R 499 0 R 534 0 R 557 0 R 591 0 R ] -/Count 22 ->> -endobj -2 0 obj -<< -/Title (RKE Hardening Guide with CIS v1.6 Benchmark) -/Creator (pandoc) -/Producer (WeasyPrint 54.3) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 611 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (cb1) [ 45 0 R /XYZ 84.259843 441.572079 0 ] (cb1-1) [ 45 0 R /XYZ 101.433071 439.875057 0 ] (cb1-2) [ 45 0 R /XYZ 99.933071 420.928036 0 ] (cb1-3) [ 45 0 R /XYZ 99.933071 401.981014 0 ] (cb1-4) [ 45 0 R /XYZ 99.933071 383.033993 0 ] (cb1-5) [ 45 0 R /XYZ 99.933071 364.086971 0 ] (cb10) [ 390 0 R /XYZ 84.259843 416.811778 0 ] (cb10-1) [ 390 0 R /XYZ 101.433071 415.114756 0 ] (cb10-10) [ 390 0 R /XYZ 99.933071 244.591563 0 ] (cb10-100) [ 499 0 R /XYZ 99.933071 590.755821 0 ] (cb10-101) [ 499 0 R /XYZ 99.933071 571.808799 0 ] (cb10-102) [ 499 0 R /XYZ 99.933071 552.861778 0 ] (cb10-103) [ 499 0 R /XYZ 99.933071 533.914756 0 ] (cb10-104) [ 499 0 R /XYZ 99.933071 514.967735 0 ] (cb10-105) [ 499 0 R /XYZ 99.933071 496.020714 0 ] (cb10-106) [ 499 0 R /XYZ 99.933071 477.073692 0 ] (cb10-107) [ 499 0 R /XYZ 99.933071 458.126671 0 ] (cb10-108) [ 499 0 R /XYZ 99.933071 439.179649 0 ] (cb10-109) [ 499 0 R /XYZ 99.933071 420.232628 0 ] (cb10-11) [ 390 0 R /XYZ 99.933071 225.644542 0 ] (cb10-110) [ 499 0 R /XYZ 99.933071 401.285606 0 ] (cb10-111) [ 499 0 R /XYZ 99.933071 382.338585 0 ] (cb10-112) [ 499 0 R /XYZ 99.933071 363.391563 0 ] (cb10-113) [ 499 0 R /XYZ 99.933071 344.444542 0 ] (cb10-114) [ 499 0 R /XYZ 99.933071 325.497520 0 ] (cb10-115) [ 499 0 R /XYZ 99.933071 306.550499 0 ] (cb10-116) [ 499 0 R /XYZ 99.933071 287.603477 0 ] (cb10-117) [ 499 0 R /XYZ 99.933071 173.921348 0 ] (cb10-118) [ 499 0 R /XYZ 99.933071 154.974327 0 ] (cb10-119) [ 499 0 R /XYZ 99.933071 136.027305 0 ] (cb10-12) [ 390 0 R /XYZ 99.933071 206.697520 0 ] (cb10-120) [ 499 0 R /XYZ 99.933071 117.080284 0 ] (cb10-121) [ 499 0 R /XYZ 99.933071 98.133262 0 ] (cb10-122) [ 534 0 R /XYZ 99.933071 799.173057 0 ] (cb10-123) [ 534 0 R /XYZ 99.933071 685.490928 0 ] (cb10-124) [ 534 0 R /XYZ 99.933071 666.543907 0 ] (cb10-125) [ 534 0 R /XYZ 99.933071 647.596885 0 ] (cb10-126) [ 534 0 R /XYZ 99.933071 628.649864 0 ] (cb10-127) [ 534 0 R /XYZ 99.933071 609.702842 0 ] (cb10-128) [ 534 0 R /XYZ 99.933071 590.755821 0 ] (cb10-129) [ 534 0 R /XYZ 99.933071 571.808799 0 ] (cb10-13) [ 390 0 R /XYZ 99.933071 187.750499 0 ] (cb10-14) [ 390 0 R /XYZ 99.933071 168.803477 0 ] (cb10-15) [ 390 0 R /XYZ 99.933071 149.856456 0 ] (cb10-16) [ 390 0 R /XYZ 99.933071 130.909434 0 ] (cb10-17) [ 390 0 R /XYZ 99.933071 111.962413 0 ] (cb10-18) [ 390 0 R /XYZ 99.933071 93.015391 0 ] (cb10-19) [ 425 0 R /XYZ 99.933071 799.173057 0 ] (cb10-2) [ 390 0 R /XYZ 99.933071 396.167735 0 ] (cb10-20) [ 425 0 R /XYZ 99.933071 780.226036 0 ] (cb10-21) [ 425 0 R /XYZ 99.933071 761.279014 0 ] (cb10-22) [ 425 0 R /XYZ 99.933071 742.331993 0 ] (cb10-23) [ 425 0 R /XYZ 99.933071 723.384971 0 ] (cb10-24) [ 425 0 R /XYZ 99.933071 704.437950 0 ] (cb10-25) [ 425 0 R /XYZ 99.933071 685.490928 0 ] (cb10-26) [ 425 0 R /XYZ 99.933071 666.543907 0 ] (cb10-27) [ 425 0 R /XYZ 99.933071 647.596885 0 ] (cb10-28) [ 425 0 R /XYZ 99.933071 628.649864 0 ] (cb10-29) [ 425 0 R /XYZ 99.933071 609.702842 0 ] (cb10-3) [ 390 0 R /XYZ 99.933071 377.220714 0 ] (cb10-30) [ 425 0 R /XYZ 99.933071 571.808799 0 ] (cb10-31) [ 425 0 R /XYZ 99.933071 552.861778 0 ] (cb10-32) [ 425 0 R /XYZ 99.933071 533.914756 0 ] (cb10-33) [ 425 0 R /XYZ 99.933071 514.967735 0 ] (cb10-34) [ 425 0 R /XYZ 99.933071 496.020714 0 ] (cb10-35) [ 425 0 R /XYZ 99.933071 477.073692 0 ] (cb10-36) [ 425 0 R /XYZ 99.933071 458.126671 0 ] (cb10-37) [ 425 0 R /XYZ 99.933071 439.179649 0 ] (cb10-38) [ 425 0 R /XYZ 99.933071 420.232628 0 ] (cb10-39) [ 425 0 R /XYZ 99.933071 401.285606 0 ] (cb10-4) [ 390 0 R /XYZ 99.933071 358.273692 0 ] (cb10-40) [ 425 0 R /XYZ 99.933071 382.338585 0 ] (cb10-41) [ 425 0 R /XYZ 99.933071 363.391563 0 ] (cb10-42) [ 425 0 R /XYZ 99.933071 344.444542 0 ] (cb10-43) [ 425 0 R /XYZ 99.933071 325.497520 0 ] (cb10-44) [ 425 0 R /XYZ 99.933071 306.550499 0 ] (cb10-45) [ 425 0 R /XYZ 99.933071 287.603477 0 ] (cb10-46) [ 425 0 R /XYZ 99.933071 268.656456 0 ] (cb10-47) [ 425 0 R /XYZ 99.933071 249.709434 0 ] (cb10-48) [ 425 0 R /XYZ 99.933071 230.762413 0 ] (cb10-49) [ 425 0 R /XYZ 99.933071 211.815391 0 ] (cb10-5) [ 390 0 R /XYZ 99.933071 339.326671 0 ] (cb10-50) [ 425 0 R /XYZ 99.933071 192.868370 0 ] (cb10-51) [ 425 0 R /XYZ 99.933071 173.921348 0 ] (cb10-52) [ 425 0 R /XYZ 99.933071 154.974327 0 ] (cb10-53) [ 425 0 R /XYZ 99.933071 136.027305 0 ] (cb10-54) [ 425 0 R /XYZ 99.933071 117.080284 0 ] (cb10-55) [ 425 0 R /XYZ 99.933071 98.133262 0 ] (cb10-56) [ 464 0 R /XYZ 99.933071 799.173057 0 ] (cb10-57) [ 464 0 R /XYZ 99.933071 780.226036 0 ] (cb10-58) [ 464 0 R /XYZ 99.933071 761.279014 0 ] (cb10-59) [ 464 0 R /XYZ 99.933071 742.331993 0 ] (cb10-6) [ 390 0 R /XYZ 99.933071 320.379649 0 ] (cb10-60) [ 464 0 R /XYZ 99.933071 723.384971 0 ] (cb10-61) [ 464 0 R /XYZ 99.933071 704.437950 0 ] (cb10-62) [ 464 0 R /XYZ 99.933071 685.490928 0 ] (cb10-63) [ 464 0 R /XYZ 99.933071 666.543907 0 ] (cb10-64) [ 464 0 R /XYZ 99.933071 647.596885 0 ] (cb10-65) [ 464 0 R /XYZ 99.933071 628.649864 0 ] (cb10-66) [ 464 0 R /XYZ 99.933071 609.702842 0 ] (cb10-67) [ 464 0 R /XYZ 99.933071 590.755821 0 ] (cb10-68) [ 464 0 R /XYZ 99.933071 571.808799 0 ] (cb10-69) [ 464 0 R /XYZ 99.933071 552.861778 0 ] (cb10-7) [ 390 0 R /XYZ 99.933071 301.432628 0 ] (cb10-70) [ 464 0 R /XYZ 99.933071 533.914756 0 ] (cb10-71) [ 464 0 R /XYZ 99.933071 514.967735 0 ] (cb10-72) [ 464 0 R /XYZ 99.933071 496.020714 0 ] (cb10-73) [ 464 0 R /XYZ 99.933071 477.073692 0 ] (cb10-74) [ 464 0 R /XYZ 99.933071 458.126671 0 ] (cb10-75) [ 464 0 R /XYZ 99.933071 439.179649 0 ] (cb10-76) [ 464 0 R /XYZ 99.933071 420.232628 0 ] (cb10-77) [ 464 0 R /XYZ 99.933071 401.285606 0 ] (cb10-78) [ 464 0 R /XYZ 99.933071 382.338585 0 ] (cb10-79) [ 464 0 R /XYZ 99.933071 363.391563 0 ] (cb10-8) [ 390 0 R /XYZ 99.933071 282.485606 0 ] (cb10-80) [ 464 0 R /XYZ 99.933071 344.444542 0 ] (cb10-81) [ 464 0 R /XYZ 99.933071 325.497520 0 ] (cb10-82) [ 464 0 R /XYZ 99.933071 306.550499 0 ] (cb10-83) [ 464 0 R /XYZ 99.933071 287.603477 0 ] (cb10-84) [ 464 0 R /XYZ 99.933071 268.656456 0 ] (cb10-85) [ 464 0 R /XYZ 99.933071 249.709434 0 ] (cb10-86) [ 464 0 R /XYZ 99.933071 230.762413 0 ] (cb10-87) [ 464 0 R /XYZ 99.933071 117.080284 0 ] (cb10-88) [ 464 0 R /XYZ 99.933071 98.133262 0 ] (cb10-89) [ 499 0 R /XYZ 99.933071 799.173057 0 ] (cb10-9) [ 390 0 R /XYZ 99.933071 263.538585 0 ] (cb10-90) [ 499 0 R /XYZ 99.933071 780.226036 0 ] (cb10-91) [ 499 0 R /XYZ 99.933071 761.279014 0 ] (cb10-92) [ 499 0 R /XYZ 99.933071 742.331993 0 ] (cb10-93) [ 499 0 R /XYZ 99.933071 723.384971 0 ] (cb10-94) [ 499 0 R /XYZ 99.933071 704.437950 0 ] (cb10-95) [ 499 0 R /XYZ 99.933071 685.490928 0 ] (cb10-96) [ 499 0 R /XYZ 99.933071 666.543907 0 ] (cb10-97) [ 499 0 R /XYZ 99.933071 647.596885 0 ] (cb10-98) [ 499 0 R /XYZ 99.933071 628.649864 0 ] (cb10-99) [ 499 0 R /XYZ 99.933071 609.702842 0 ] (cb11) [ 534 0 R /XYZ 84.259843 331.262799 0 ] (cb11-1) [ 534 0 R /XYZ 101.433071 329.565778 0 ] (cb11-10) [ 534 0 R /XYZ 99.933071 159.042585 0 ] (cb11-11) [ 534 0 R /XYZ 99.933071 140.095563 0 ] (cb11-12) [ 534 0 R /XYZ 99.933071 121.148542 0 ] (cb11-13) [ 534 0 R /XYZ 99.933071 102.201520 0 ] (cb11-14) [ 557 0 R /XYZ 99.933071 799.173057 0 ] (cb11-15) [ 557 0 R /XYZ 99.933071 780.226036 0 ] (cb11-16) [ 557 0 R /XYZ 99.933071 761.279014 0 ] (cb11-17) [ 557 0 R /XYZ 99.933071 742.331993 0 ] (cb11-18) [ 557 0 R /XYZ 99.933071 723.384971 0 ] (cb11-19) [ 557 0 R /XYZ 99.933071 704.437950 0 ] (cb11-2) [ 534 0 R /XYZ 99.933071 310.618756 0 ] (cb11-20) [ 557 0 R /XYZ 99.933071 685.490928 0 ] (cb11-21) [ 557 0 R /XYZ 99.933071 666.543907 0 ] (cb11-22) [ 557 0 R /XYZ 99.933071 647.596885 0 ] (cb11-23) [ 557 0 R /XYZ 99.933071 628.649864 0 ] (cb11-24) [ 557 0 R /XYZ 99.933071 609.702842 0 ] (cb11-25) [ 557 0 R /XYZ 99.933071 590.755821 0 ] (cb11-26) [ 557 0 R /XYZ 99.933071 571.808799 0 ] (cb11-3) [ 534 0 R /XYZ 99.933071 291.671735 0 ] (cb11-4) [ 534 0 R /XYZ 99.933071 272.724714 0 ] (cb11-5) [ 534 0 R /XYZ 99.933071 253.777692 0 ] (cb11-6) [ 534 0 R /XYZ 99.933071 234.830671 0 ] (cb11-7) [ 534 0 R /XYZ 99.933071 215.883649 0 ] (cb11-8) [ 534 0 R /XYZ 99.933071 196.936628 0 ] (cb11-9) [ 534 0 R /XYZ 99.933071 177.989606 0 ] (cb12) [ 557 0 R /XYZ 84.259843 446.115778 0 ] (cb12-1) [ 557 0 R /XYZ 101.433071 444.418756 0 ] (cb12-10) [ 557 0 R /XYZ 99.933071 273.895563 0 ] (cb12-11) [ 557 0 R /XYZ 99.933071 254.948542 0 ] (cb12-12) [ 557 0 R /XYZ 99.933071 236.001520 0 ] (cb12-13) [ 557 0 R /XYZ 99.933071 217.054499 0 ] (cb12-14) [ 557 0 R /XYZ 99.933071 198.107477 0 ] (cb12-15) [ 557 0 R /XYZ 99.933071 179.160456 0 ] (cb12-16) [ 557 0 R /XYZ 99.933071 160.213434 0 ] (cb12-17) [ 557 0 R /XYZ 99.933071 141.266413 0 ] (cb12-18) [ 557 0 R /XYZ 99.933071 122.319391 0 ] (cb12-19) [ 557 0 R /XYZ 99.933071 103.372370 0 ] (cb12-2) [ 557 0 R /XYZ 99.933071 425.471735 0 ] (cb12-20) [ 591 0 R /XYZ 99.933071 780.226036 0 ] (cb12-21) [ 591 0 R /XYZ 99.933071 742.331993 0 ] (cb12-22) [ 591 0 R /XYZ 99.933071 723.384971 0 ] (cb12-23) [ 591 0 R /XYZ 99.933071 704.437950 0 ] (cb12-3) [ 557 0 R /XYZ 99.933071 406.524714 0 ] (cb12-4) [ 557 0 R /XYZ 99.933071 387.577692 0 ] (cb12-5) [ 557 0 R /XYZ 99.933071 368.630671 0 ] (cb12-6) [ 557 0 R /XYZ 99.933071 349.683649 0 ] (cb12-7) [ 557 0 R /XYZ 99.933071 330.736628 0 ] (cb12-8) [ 557 0 R /XYZ 99.933071 311.789606 0 ] (cb12-9) [ 557 0 R /XYZ 99.933071 292.842585 0 ] (cb2) [ 53 0 R /XYZ 84.259843 753.620079 0 ] (cb2-1) [ 53 0 R /XYZ 101.433071 751.923057 0 ] (cb2-2) [ 53 0 R /XYZ 99.933071 732.976036 0 ] (cb3) [ 53 0 R /XYZ 84.259843 654.779014 0 ] (cb3-1) [ 53 0 R /XYZ 101.433071 653.081993 0 ] (cb3-2) [ 53 0 R /XYZ 99.933071 634.134971 0 ] (cb3-3) [ 53 0 R /XYZ 99.933071 615.187950 0 ] (cb3-4) [ 53 0 R /XYZ 99.933071 596.240928 0 ] (cb4) [ 53 0 R /XYZ 84.259843 282.344928 0 ] (cb4-1) [ 53 0 R /XYZ 101.433071 280.647907 0 ] (cb5) [ 53 0 R /XYZ 84.259843 217.647907 0 ] (cb5-1) [ 53 0 R /XYZ 101.433071 215.950885 0 ] (cb5-2) [ 53 0 R /XYZ 99.933071 197.003864 0 ] (cb5-3) [ 53 0 R /XYZ 99.933071 178.056842 0 ] (cb5-4) [ 53 0 R /XYZ 99.933071 159.109821 0 ] (cb5-5) [ 53 0 R /XYZ 99.933071 140.162799 0 ] (cb6) [ 67 0 R /XYZ 84.259843 749.870079 0 ] (cb6-1) [ 67 0 R /XYZ 101.433071 748.173057 0 ] (cb6-2) [ 67 0 R /XYZ 99.933071 729.226036 0 ] (cb6-3) [ 67 0 R /XYZ 99.933071 710.279014 0 ] (cb6-4) [ 67 0 R /XYZ 99.933071 672.384971 0 ] (cb6-5) [ 67 0 R /XYZ 99.933071 634.490928 0 ] (cb7) [ 77 0 R /XYZ 84.259843 716.781496 0 ] (cb7-1) [ 77 0 R /XYZ 101.433071 715.084475 0 ] (cb7-10) [ 77 0 R /XYZ 99.933071 544.561281 0 ] (cb7-11) [ 77 0 R /XYZ 99.933071 525.614260 0 ] (cb7-12) [ 77 0 R /XYZ 99.933071 506.667238 0 ] (cb7-13) [ 77 0 R /XYZ 99.933071 487.720217 0 ] (cb7-14) [ 77 0 R /XYZ 99.933071 468.773195 0 ] (cb7-2) [ 77 0 R /XYZ 99.933071 696.137453 0 ] (cb7-3) [ 77 0 R /XYZ 99.933071 677.190432 0 ] (cb7-4) [ 77 0 R /XYZ 99.933071 658.243410 0 ] (cb7-5) [ 77 0 R /XYZ 99.933071 639.296389 0 ] (cb7-6) [ 77 0 R /XYZ 99.933071 620.349367 0 ] (cb7-7) [ 77 0 R /XYZ 99.933071 601.402346 0 ] (cb7-8) [ 77 0 R /XYZ 99.933071 582.455324 0 ] (cb7-9) [ 77 0 R /XYZ 99.933071 563.508303 0 ] (cb8) [ 77 0 R /XYZ 84.259843 372.023195 0 ] (cb8-1) [ 77 0 R /XYZ 101.433071 370.326174 0 ] (cb8-2) [ 77 0 R /XYZ 99.933071 351.379152 0 ] (cb8-3) [ 77 0 R /XYZ 99.933071 332.432131 0 ] (cb8-4) [ 77 0 R /XYZ 99.933071 294.538088 0 ] (cb8-5) [ 77 0 R /XYZ 99.933071 275.591066 0 ] (cb9) [ 99 0 R /XYZ 84.259843 652.281496 0 ] (cb9-1) [ 99 0 R /XYZ 101.433071 650.584475 0 ] (cb9-10) [ 99 0 R /XYZ 99.933071 423.220217 0 ] (cb9-100) [ 194 0 R /XYZ 99.933071 590.755821 0 ] (cb9-101) [ 194 0 R /XYZ 99.933071 571.808799 0 ] (cb9-102) [ 194 0 R /XYZ 99.933071 552.861778 0 ] (cb9-103) [ 194 0 R /XYZ 99.933071 533.914756 0 ] (cb9-104) [ 194 0 R /XYZ 99.933071 514.967735 0 ] (cb9-105) [ 194 0 R /XYZ 99.933071 496.020714 0 ] (cb9-106) [ 194 0 R /XYZ 99.933071 477.073692 0 ] (cb9-107) [ 194 0 R /XYZ 99.933071 458.126671 0 ] (cb9-108) [ 194 0 R /XYZ 99.933071 439.179649 0 ] (cb9-109) [ 194 0 R /XYZ 99.933071 420.232628 0 ] (cb9-11) [ 99 0 R /XYZ 99.933071 404.273195 0 ] (cb9-110) [ 194 0 R /XYZ 99.933071 401.285606 0 ] (cb9-111) [ 194 0 R /XYZ 99.933071 344.444542 0 ] (cb9-112) [ 194 0 R /XYZ 99.933071 325.497520 0 ] (cb9-113) [ 194 0 R /XYZ 99.933071 306.550499 0 ] (cb9-114) [ 194 0 R /XYZ 99.933071 287.603477 0 ] (cb9-115) [ 194 0 R /XYZ 99.933071 268.656456 0 ] (cb9-116) [ 194 0 R /XYZ 99.933071 249.709434 0 ] (cb9-117) [ 194 0 R /XYZ 99.933071 230.762413 0 ] (cb9-118) [ 194 0 R /XYZ 99.933071 211.815391 0 ] (cb9-119) [ 194 0 R /XYZ 99.933071 192.868370 0 ] (cb9-12) [ 99 0 R /XYZ 99.933071 385.326174 0 ] (cb9-120) [ 194 0 R /XYZ 99.933071 173.921348 0 ] (cb9-121) [ 194 0 R /XYZ 99.933071 154.974327 0 ] (cb9-122) [ 194 0 R /XYZ 99.933071 136.027305 0 ] (cb9-123) [ 194 0 R /XYZ 99.933071 117.080284 0 ] (cb9-124) [ 194 0 R /XYZ 99.933071 98.133262 0 ] (cb9-125) [ 232 0 R /XYZ 99.933071 799.173057 0 ] (cb9-126) [ 232 0 R /XYZ 99.933071 780.226036 0 ] (cb9-127) [ 232 0 R /XYZ 99.933071 761.279014 0 ] (cb9-128) [ 232 0 R /XYZ 99.933071 742.331993 0 ] (cb9-129) [ 232 0 R /XYZ 99.933071 704.437950 0 ] (cb9-13) [ 99 0 R /XYZ 99.933071 366.379152 0 ] (cb9-130) [ 232 0 R /XYZ 99.933071 685.490928 0 ] (cb9-131) [ 232 0 R /XYZ 99.933071 666.543907 0 ] (cb9-132) [ 232 0 R /XYZ 99.933071 647.596885 0 ] (cb9-133) [ 232 0 R /XYZ 99.933071 628.649864 0 ] (cb9-134) [ 232 0 R /XYZ 99.933071 609.702842 0 ] (cb9-135) [ 232 0 R /XYZ 99.933071 590.755821 0 ] (cb9-136) [ 232 0 R /XYZ 99.933071 571.808799 0 ] (cb9-137) [ 232 0 R /XYZ 99.933071 552.861778 0 ] (cb9-138) [ 232 0 R /XYZ 99.933071 533.914756 0 ] (cb9-139) [ 232 0 R /XYZ 99.933071 514.967735 0 ] (cb9-14) [ 99 0 R /XYZ 99.933071 347.432131 0 ] (cb9-140) [ 232 0 R /XYZ 99.933071 477.073692 0 ] (cb9-141) [ 232 0 R /XYZ 99.933071 458.126671 0 ] (cb9-142) [ 232 0 R /XYZ 99.933071 439.179649 0 ] (cb9-143) [ 232 0 R /XYZ 99.933071 420.232628 0 ] (cb9-144) [ 232 0 R /XYZ 99.933071 401.285606 0 ] (cb9-145) [ 232 0 R /XYZ 99.933071 382.338585 0 ] (cb9-146) [ 232 0 R /XYZ 99.933071 363.391563 0 ] (cb9-147) [ 232 0 R /XYZ 99.933071 344.444542 0 ] (cb9-148) [ 232 0 R /XYZ 99.933071 325.497520 0 ] (cb9-149) [ 232 0 R /XYZ 99.933071 306.550499 0 ] (cb9-15) [ 99 0 R /XYZ 99.933071 328.485109 0 ] (cb9-150) [ 232 0 R /XYZ 99.933071 287.603477 0 ] (cb9-151) [ 232 0 R /XYZ 99.933071 268.656456 0 ] (cb9-152) [ 232 0 R /XYZ 99.933071 249.709434 0 ] (cb9-153) [ 232 0 R /XYZ 99.933071 230.762413 0 ] (cb9-154) [ 232 0 R /XYZ 99.933071 211.815391 0 ] (cb9-155) [ 232 0 R /XYZ 99.933071 192.868370 0 ] (cb9-156) [ 232 0 R /XYZ 99.933071 173.921348 0 ] (cb9-157) [ 232 0 R /XYZ 99.933071 154.974327 0 ] (cb9-158) [ 232 0 R /XYZ 99.933071 136.027305 0 ] (cb9-159) [ 232 0 R /XYZ 99.933071 117.080284 0 ] (cb9-16) [ 99 0 R /XYZ 99.933071 309.538088 0 ] (cb9-160) [ 232 0 R /XYZ 99.933071 98.133262 0 ] (cb9-161) [ 270 0 R /XYZ 99.933071 799.173057 0 ] (cb9-162) [ 270 0 R /XYZ 99.933071 780.226036 0 ] (cb9-163) [ 270 0 R /XYZ 99.933071 761.279014 0 ] (cb9-164) [ 270 0 R /XYZ 99.933071 742.331993 0 ] (cb9-165) [ 270 0 R /XYZ 99.933071 723.384971 0 ] (cb9-166) [ 270 0 R /XYZ 99.933071 704.437950 0 ] (cb9-167) [ 270 0 R /XYZ 99.933071 685.490928 0 ] (cb9-168) [ 270 0 R /XYZ 99.933071 666.543907 0 ] (cb9-169) [ 270 0 R /XYZ 99.933071 647.596885 0 ] (cb9-17) [ 99 0 R /XYZ 99.933071 290.591066 0 ] (cb9-170) [ 270 0 R /XYZ 99.933071 628.649864 0 ] (cb9-171) [ 270 0 R /XYZ 99.933071 609.702842 0 ] (cb9-172) [ 270 0 R /XYZ 99.933071 590.755821 0 ] (cb9-173) [ 270 0 R /XYZ 99.933071 571.808799 0 ] (cb9-174) [ 270 0 R /XYZ 99.933071 552.861778 0 ] (cb9-175) [ 270 0 R /XYZ 99.933071 533.914756 0 ] (cb9-176) [ 270 0 R /XYZ 99.933071 514.967735 0 ] (cb9-177) [ 270 0 R /XYZ 99.933071 496.020714 0 ] (cb9-178) [ 270 0 R /XYZ 99.933071 477.073692 0 ] (cb9-179) [ 270 0 R /XYZ 99.933071 458.126671 0 ] (cb9-18) [ 99 0 R /XYZ 99.933071 271.644045 0 ] (cb9-180) [ 270 0 R /XYZ 99.933071 439.179649 0 ] (cb9-181) [ 270 0 R /XYZ 99.933071 420.232628 0 ] (cb9-182) [ 270 0 R /XYZ 99.933071 401.285606 0 ] (cb9-183) [ 270 0 R /XYZ 99.933071 382.338585 0 ] (cb9-184) [ 270 0 R /XYZ 99.933071 363.391563 0 ] (cb9-185) [ 270 0 R /XYZ 99.933071 344.444542 0 ] (cb9-186) [ 270 0 R /XYZ 99.933071 325.497520 0 ] (cb9-187) [ 270 0 R /XYZ 99.933071 306.550499 0 ] (cb9-188) [ 270 0 R /XYZ 99.933071 287.603477 0 ] (cb9-189) [ 270 0 R /XYZ 99.933071 268.656456 0 ] (cb9-19) [ 99 0 R /XYZ 99.933071 252.697023 0 ] (cb9-190) [ 270 0 R /XYZ 99.933071 249.709434 0 ] (cb9-191) [ 270 0 R /XYZ 99.933071 230.762413 0 ] (cb9-192) [ 270 0 R /XYZ 99.933071 211.815391 0 ] (cb9-193) [ 270 0 R /XYZ 99.933071 192.868370 0 ] (cb9-194) [ 270 0 R /XYZ 99.933071 173.921348 0 ] (cb9-195) [ 270 0 R /XYZ 99.933071 154.974327 0 ] (cb9-196) [ 270 0 R /XYZ 99.933071 136.027305 0 ] (cb9-197) [ 270 0 R /XYZ 99.933071 117.080284 0 ] (cb9-198) [ 270 0 R /XYZ 99.933071 98.133262 0 ] (cb9-199) [ 310 0 R /XYZ 99.933071 799.173057 0 ] (cb9-2) [ 99 0 R /XYZ 99.933071 612.690432 0 ] (cb9-20) [ 99 0 R /XYZ 99.933071 233.750002 0 ] (cb9-200) [ 310 0 R /XYZ 99.933071 780.226036 0 ] (cb9-201) [ 310 0 R /XYZ 99.933071 761.279014 0 ] (cb9-202) [ 310 0 R /XYZ 99.933071 742.331993 0 ] (cb9-203) [ 310 0 R /XYZ 99.933071 723.384971 0 ] (cb9-204) [ 310 0 R /XYZ 99.933071 704.437950 0 ] (cb9-205) [ 310 0 R /XYZ 99.933071 685.490928 0 ] (cb9-206) [ 310 0 R /XYZ 99.933071 666.543907 0 ] (cb9-207) [ 310 0 R /XYZ 99.933071 647.596885 0 ] (cb9-208) [ 310 0 R /XYZ 99.933071 628.649864 0 ] (cb9-209) [ 310 0 R /XYZ 99.933071 609.702842 0 ] (cb9-21) [ 99 0 R /XYZ 99.933071 214.802980 0 ] (cb9-210) [ 310 0 R /XYZ 99.933071 590.755821 0 ] (cb9-211) [ 310 0 R /XYZ 99.933071 571.808799 0 ] (cb9-212) [ 310 0 R /XYZ 99.933071 552.861778 0 ] (cb9-213) [ 310 0 R /XYZ 99.933071 533.914756 0 ] (cb9-214) [ 310 0 R /XYZ 99.933071 514.967735 0 ] (cb9-215) [ 310 0 R /XYZ 99.933071 496.020714 0 ] (cb9-216) [ 310 0 R /XYZ 99.933071 477.073692 0 ] (cb9-217) [ 310 0 R /XYZ 99.933071 458.126671 0 ] (cb9-218) [ 310 0 R /XYZ 99.933071 439.179649 0 ] (cb9-219) [ 310 0 R /XYZ 99.933071 420.232628 0 ] (cb9-22) [ 99 0 R /XYZ 99.933071 195.855959 0 ] (cb9-220) [ 310 0 R /XYZ 99.933071 401.285606 0 ] (cb9-221) [ 310 0 R /XYZ 99.933071 382.338585 0 ] (cb9-222) [ 310 0 R /XYZ 99.933071 363.391563 0 ] (cb9-223) [ 310 0 R /XYZ 99.933071 344.444542 0 ] (cb9-224) [ 310 0 R /XYZ 99.933071 325.497520 0 ] (cb9-225) [ 310 0 R /XYZ 99.933071 306.550499 0 ] (cb9-226) [ 310 0 R /XYZ 99.933071 287.603477 0 ] (cb9-227) [ 310 0 R /XYZ 99.933071 268.656456 0 ] (cb9-228) [ 310 0 R /XYZ 99.933071 249.709434 0 ] (cb9-229) [ 310 0 R /XYZ 99.933071 230.762413 0 ] (cb9-23) [ 99 0 R /XYZ 99.933071 176.908937 0 ] (cb9-230) [ 310 0 R /XYZ 99.933071 211.815391 0 ] (cb9-231) [ 310 0 R /XYZ 99.933071 192.868370 0 ] (cb9-232) [ 310 0 R /XYZ 99.933071 173.921348 0 ] (cb9-233) [ 310 0 R /XYZ 99.933071 154.974327 0 ] (cb9-234) [ 310 0 R /XYZ 99.933071 136.027305 0 ] (cb9-235) [ 310 0 R /XYZ 99.933071 117.080284 0 ] (cb9-236) [ 310 0 R /XYZ 99.933071 98.133262 0 ] (cb9-237) [ 350 0 R /XYZ 99.933071 799.173057 0 ] (cb9-238) [ 350 0 R /XYZ 99.933071 780.226036 0 ] (cb9-239) [ 350 0 R /XYZ 99.933071 761.279014 0 ] (cb9-24) [ 99 0 R /XYZ 99.933071 157.961916 0 ] (cb9-240) [ 350 0 R /XYZ 99.933071 742.331993 0 ] (cb9-241) [ 350 0 R /XYZ 99.933071 723.384971 0 ] (cb9-242) [ 350 0 R /XYZ 99.933071 704.437950 0 ] (cb9-243) [ 350 0 R /XYZ 99.933071 685.490928 0 ] (cb9-244) [ 350 0 R /XYZ 99.933071 666.543907 0 ] (cb9-245) [ 350 0 R /XYZ 99.933071 647.596885 0 ] (cb9-246) [ 350 0 R /XYZ 99.933071 628.649864 0 ] (cb9-247) [ 350 0 R /XYZ 99.933071 609.702842 0 ] (cb9-248) [ 350 0 R /XYZ 99.933071 590.755821 0 ] (cb9-249) [ 350 0 R /XYZ 99.933071 571.808799 0 ] (cb9-25) [ 99 0 R /XYZ 99.933071 139.014895 0 ] (cb9-250) [ 350 0 R /XYZ 99.933071 552.861778 0 ] (cb9-251) [ 350 0 R /XYZ 99.933071 533.914756 0 ] (cb9-252) [ 350 0 R /XYZ 99.933071 514.967735 0 ] (cb9-253) [ 350 0 R /XYZ 99.933071 496.020714 0 ] (cb9-254) [ 350 0 R /XYZ 99.933071 477.073692 0 ] (cb9-255) [ 350 0 R /XYZ 99.933071 458.126671 0 ] (cb9-256) [ 350 0 R /XYZ 99.933071 439.179649 0 ] (cb9-257) [ 350 0 R /XYZ 99.933071 420.232628 0 ] (cb9-258) [ 350 0 R /XYZ 99.933071 401.285606 0 ] (cb9-259) [ 350 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 99 0 R /XYZ 99.933071 120.067873 0 ] (cb9-260) [ 350 0 R /XYZ 99.933071 363.391563 0 ] (cb9-261) [ 350 0 R /XYZ 99.933071 344.444542 0 ] (cb9-262) [ 350 0 R /XYZ 99.933071 325.497520 0 ] (cb9-263) [ 350 0 R /XYZ 99.933071 306.550499 0 ] (cb9-264) [ 350 0 R /XYZ 99.933071 287.603477 0 ] (cb9-265) [ 350 0 R /XYZ 99.933071 268.656456 0 ] (cb9-266) [ 350 0 R /XYZ 99.933071 249.709434 0 ] (cb9-267) [ 350 0 R /XYZ 99.933071 230.762413 0 ] (cb9-268) [ 350 0 R /XYZ 99.933071 211.815391 0 ] (cb9-269) [ 350 0 R /XYZ 99.933071 192.868370 0 ] (cb9-27) [ 99 0 R /XYZ 99.933071 101.120852 0 ] (cb9-270) [ 350 0 R /XYZ 99.933071 173.921348 0 ] (cb9-271) [ 350 0 R /XYZ 99.933071 154.974327 0 ] (cb9-272) [ 350 0 R /XYZ 99.933071 136.027305 0 ] (cb9-273) [ 350 0 R /XYZ 99.933071 117.080284 0 ] (cb9-274) [ 350 0 R /XYZ 99.933071 98.133262 0 ] (cb9-275) [ 390 0 R /XYZ 99.933071 799.173057 0 ] (cb9-276) [ 390 0 R /XYZ 99.933071 780.226036 0 ] (cb9-277) [ 390 0 R /XYZ 99.933071 761.279014 0 ] (cb9-278) [ 390 0 R /XYZ 99.933071 742.331993 0 ] (cb9-279) [ 390 0 R /XYZ 99.933071 723.384971 0 ] (cb9-28) [ 129 0 R /XYZ 99.933071 799.173057 0 ] (cb9-280) [ 390 0 R /XYZ 99.933071 704.437950 0 ] (cb9-281) [ 390 0 R /XYZ 99.933071 685.490928 0 ] (cb9-282) [ 390 0 R /XYZ 99.933071 666.543907 0 ] (cb9-283) [ 390 0 R /XYZ 99.933071 647.596885 0 ] (cb9-284) [ 390 0 R /XYZ 99.933071 628.649864 0 ] (cb9-285) [ 390 0 R /XYZ 99.933071 609.702842 0 ] (cb9-286) [ 390 0 R /XYZ 99.933071 590.755821 0 ] (cb9-287) [ 390 0 R /XYZ 99.933071 571.808799 0 ] (cb9-288) [ 390 0 R /XYZ 99.933071 552.861778 0 ] (cb9-29) [ 129 0 R /XYZ 99.933071 780.226036 0 ] (cb9-3) [ 99 0 R /XYZ 99.933071 574.796389 0 ] (cb9-30) [ 129 0 R /XYZ 99.933071 761.279014 0 ] (cb9-31) [ 129 0 R /XYZ 99.933071 742.331993 0 ] (cb9-32) [ 129 0 R /XYZ 99.933071 723.384971 0 ] (cb9-33) [ 129 0 R /XYZ 99.933071 704.437950 0 ] (cb9-34) [ 129 0 R /XYZ 99.933071 685.490928 0 ] (cb9-35) [ 129 0 R /XYZ 99.933071 666.543907 0 ] (cb9-36) [ 129 0 R /XYZ 99.933071 647.596885 0 ] (cb9-37) [ 129 0 R /XYZ 99.933071 628.649864 0 ] (cb9-38) [ 129 0 R /XYZ 99.933071 609.702842 0 ] (cb9-39) [ 129 0 R /XYZ 99.933071 590.755821 0 ] (cb9-4) [ 99 0 R /XYZ 99.933071 555.849367 0 ] (cb9-40) [ 129 0 R /XYZ 99.933071 571.808799 0 ] (cb9-41) [ 129 0 R /XYZ 99.933071 552.861778 0 ] (cb9-42) [ 129 0 R /XYZ 99.933071 533.914756 0 ] (cb9-43) [ 129 0 R /XYZ 99.933071 514.967735 0 ] (cb9-44) [ 129 0 R /XYZ 99.933071 496.020714 0 ] (cb9-45) [ 129 0 R /XYZ 99.933071 477.073692 0 ] (cb9-46) [ 129 0 R /XYZ 99.933071 458.126671 0 ] (cb9-47) [ 129 0 R /XYZ 99.933071 439.179649 0 ] (cb9-48) [ 129 0 R /XYZ 99.933071 420.232628 0 ] (cb9-49) [ 129 0 R /XYZ 99.933071 401.285606 0 ] (cb9-5) [ 99 0 R /XYZ 99.933071 536.902346 0 ] (cb9-50) [ 129 0 R /XYZ 99.933071 382.338585 0 ] (cb9-51) [ 129 0 R /XYZ 99.933071 363.391563 0 ] (cb9-52) [ 129 0 R /XYZ 99.933071 344.444542 0 ] (cb9-53) [ 129 0 R /XYZ 99.933071 325.497520 0 ] (cb9-54) [ 129 0 R /XYZ 99.933071 306.550499 0 ] (cb9-55) [ 129 0 R /XYZ 99.933071 287.603477 0 ] (cb9-56) [ 129 0 R /XYZ 99.933071 173.921348 0 ] (cb9-57) [ 129 0 R /XYZ 99.933071 154.974327 0 ] (cb9-58) [ 129 0 R /XYZ 99.933071 136.027305 0 ] (cb9-59) [ 129 0 R /XYZ 99.933071 117.080284 0 ] (cb9-6) [ 99 0 R /XYZ 99.933071 499.008303 0 ] (cb9-60) [ 129 0 R /XYZ 99.933071 98.133262 0 ] (cb9-61) [ 164 0 R /XYZ 99.933071 799.173057 0 ] (cb9-62) [ 164 0 R /XYZ 99.933071 780.226036 0 ] (cb9-63) [ 164 0 R /XYZ 99.933071 761.279014 0 ] (cb9-64) [ 164 0 R /XYZ 99.933071 742.331993 0 ] (cb9-65) [ 164 0 R /XYZ 99.933071 723.384971 0 ] (cb9-66) [ 164 0 R /XYZ 99.933071 704.437950 0 ] (cb9-67) [ 164 0 R /XYZ 99.933071 685.490928 0 ] (cb9-68) [ 164 0 R /XYZ 99.933071 571.808799 0 ] (cb9-69) [ 164 0 R /XYZ 99.933071 552.861778 0 ] (cb9-7) [ 99 0 R /XYZ 99.933071 480.061281 0 ] (cb9-70) [ 164 0 R /XYZ 99.933071 533.914756 0 ] (cb9-71) [ 164 0 R /XYZ 99.933071 514.967735 0 ] (cb9-72) [ 164 0 R /XYZ 99.933071 496.020714 0 ] (cb9-73) [ 164 0 R /XYZ 99.933071 477.073692 0 ] (cb9-74) [ 164 0 R /XYZ 99.933071 458.126671 0 ] (cb9-75) [ 164 0 R /XYZ 99.933071 439.179649 0 ] (cb9-76) [ 164 0 R /XYZ 99.933071 420.232628 0 ] (cb9-77) [ 164 0 R /XYZ 99.933071 401.285606 0 ] (cb9-78) [ 164 0 R /XYZ 99.933071 382.338585 0 ] (cb9-79) [ 164 0 R /XYZ 99.933071 363.391563 0 ] (cb9-8) [ 99 0 R /XYZ 99.933071 461.114260 0 ] (cb9-80) [ 164 0 R /XYZ 99.933071 249.709434 0 ] (cb9-81) [ 164 0 R /XYZ 99.933071 230.762413 0 ] (cb9-82) [ 164 0 R /XYZ 99.933071 211.815391 0 ] (cb9-83) [ 164 0 R /XYZ 99.933071 192.868370 0 ] (cb9-84) [ 164 0 R /XYZ 99.933071 173.921348 0 ] (cb9-85) [ 164 0 R /XYZ 99.933071 154.974327 0 ] (cb9-86) [ 164 0 R /XYZ 99.933071 136.027305 0 ] (cb9-87) [ 164 0 R /XYZ 99.933071 117.080284 0 ] (cb9-88) [ 164 0 R /XYZ 99.933071 98.133262 0 ] (cb9-89) [ 194 0 R /XYZ 99.933071 799.173057 0 ] (cb9-9) [ 99 0 R /XYZ 99.933071 442.167238 0 ] (cb9-90) [ 194 0 R /XYZ 99.933071 780.226036 0 ] (cb9-91) [ 194 0 R /XYZ 99.933071 761.279014 0 ] (cb9-92) [ 194 0 R /XYZ 99.933071 742.331993 0 ] (cb9-93) [ 194 0 R /XYZ 99.933071 723.384971 0 ] (cb9-94) [ 194 0 R /XYZ 99.933071 704.437950 0 ] (cb9-95) [ 194 0 R /XYZ 99.933071 685.490928 0 ] (cb9-96) [ 194 0 R /XYZ 99.933071 666.543907 0 ] (cb9-97) [ 194 0 R /XYZ 99.933071 647.596885 0 ] (cb9-98) [ 194 0 R /XYZ 99.933071 628.649864 0 ] (cb9-99) [ 194 0 R /XYZ 99.933071 609.702842 0 ] (configure-default-service-account) [ 53 0 R /XYZ 84.259843 561.590928 0 ] (configure-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 283.686971 0 ] (configure-kernel-runtime-parameters) [ 45 0 R /XYZ 84.259843 539.222079 0 ] (configure-network-policy) [ 67 0 R /XYZ 84.259843 599.840928 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (create-etcd-user-and-group) [ 45 0 R /XYZ 84.259843 169.788971 0 ] (ensure-that-all-namespaces-have-network-policies-defined) [ 67 0 R /XYZ 84.259843 564.092928 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (known-issues) [ 45 0 R /XYZ 84.259843 799.370079 0 ] (overview) [ 30 0 R /XYZ 84.259843 272.631496 0 ] (reference-hardened-cloud-config-configuration) [ 534 0 R /XYZ 84.259843 537.158799 0 ] (reference-hardened-cloud-config-for-red-hat-enterprise-linux-8-rhel-8-and-ubuntu-20.04-lts) [ 557 0 R /XYZ 84.259843 511.863778 0 ] (reference-hardened-cloud-config-for-suse-linux-enterprise-server-15-sles-15-and-opensuse-leap-15) [ 534 0 R /XYZ 84.259843 397.010799 0 ] (reference-hardened-rke-cluster.yml-configuration) [ 77 0 R /XYZ 84.259843 191.441066 0 ] (reference-hardened-rke-template-configuration) [ 390 0 R /XYZ 84.259843 518.211778 0 ] (set-automountserviceaccounttoken-to-false-for-default-service-accounts) [ 53 0 R /XYZ 84.259843 522.092928 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 632 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2586 ->> -stream -xœµš]c· †ïý+|`J¤¾€"AŠAS À¶APôb3Ø$¼6½èßïËcëÃãw?²iƘ‹Ô9⑨‡¤ìx¼^DüiCk½;?½9½=I¨Yðsô¸kê¿á·æs«!Ç^Z>¿qÖP{Nµœ/'üyÖÜ»_Nß~vú÷ý5ñœBï%Å|þ嵫LCmµJ&ª•D%ªœC­)¢*1à{g*˜‘«%{TU˜a½e¦‚–R#ª3ÔjÔGU‡©Fc*˜{®DvÄ$Bu0DÌ4]Ì¡`Ò Ó¥Jë©S]….ÖÄtª¡T‹92]¥”ܘÎ`Kî™.ÖÍ„é`‹i«LW`‹ªƒ-©Ueº -[f§]ƒ-ð®Fu°EŠD¦ërofTס“VÛ£.I¹© -ÓÅ2|S©; -‹T*Ñ%ØR$wªƒ-Y%1ÂËéÀ‰¬µ5²[“ïnL—aKJÕ¨¶`ñR-R CvPp.1¤Zƒõd ©i°fQ µ¬VeH=+½2¨DèRd P-Ù -#FØbعT[´c&Ø‚Œª°%™2(hkðÆnMzd,PðÖ$Æpa¦0(ˆ«­c¹p¥ÎX `®‚Œ -èb»WÆu5—ÄX À®Z+Œ -îªEa,0pWWRl3€ŽAcSÆw5Je,0pÛ(1`Uü°0ÀWBjM ÜMMŒ±ÀÀÝT¨®ìAe,0p7e<‹ÜànÊ’ ÜM– -c%€?B³pÉ<€-,câ=tI p³–0dp7v„?²§A«[/ŒÜ ËGu=ÄŠ'û³b)± ƒ»TÊXÁ]à³1€ñ51dp7*"5Ó»1ua,Èà.ò†ÌXw câ[ˆ×¥º¤·ÆXÁ]`)1 -i ÕÕGŠŒ€qä¡ŒÜExïŒÜ•¬ÊXPÀ]1¤=T[´%Æä5ÐaÛ’=d5H)˜Ü•ˆf:pW¤vÆ‚îzØd,(Õ©1ÀÀ€,81”f¡×Z JèòQ] hgÆ‚*d ‹ê`‹Uc,@bºöÆXPlÑ” j‚-H „‘}Óò¶À]h}`°™"cHZ7c,¨¹ ì2]I¡Uàšêt±2Ôj¡82 – - ›ž±€ž.1À è¢1Ô[°U ŠBKÈÌ™.Â$ÙŒÈt¡‹‘± %Ø‚l± ¥†*³c"4jIL5Ó™xÙ š•à©"c¶ *M’ê` 0ÁX€õñb;3 øA±‰2‡ê`‹fc,h-y¹Ù Zƒ-Ic|ÓëÍÊXж ãc,èR‚§ÉŒÀ8t"Œ=6Ô›É °/½ÞlŒ]õ&J<²o»¯7+cA7Ø’‘¢PlAÒÔɾ“Po‚NLW`KêÆXÐKñz³1 Í@½‰Œž 4¯7+=.ws™˜ÜEfZ Ð@½‰Ì–ÕöðæŠüŒ+›WœžЛ[é‘€½ˆV•žàë5=4€™¨,[¡§«PF¡Çþ"³&\OŸö#ªw¨ˆ™­úCvl Cv?kŽÕMßÑíz>ö˧Ï_!øžüÏé‡ÏŽ“²ñŠp~µâ…uñs8Q“ó›]nà† &´v¾@®’o÷¹¨ñ‹2òñÃhC™ž±]zêÑæcƒ¡¼»ï4üÔó㛇œ/_žì*}á«…º#\7!µÏç ™êùå›ÓçúûŸ¿ýê/X±—?œþù¯ðá’¯ñÛf©þËtëûûLÿÛS9"z<ª:T¨rüØ[>¨Ïg?{Ãâ˜îxLP<¿ãÊã°üíìu;?/©=º®o[ÿ·ÇB ˆÀþŒžµ\Ϻä# ççb`¡øÍ£L)váí­Ì{¡ôLÏdO§ÏëÏ{¢€•ÛÛ>o®y¼Å>*ëú<.ó„4+–ûîu`"Ä•%>ŠýéÕåUìçÅ-è­U¦)Hªû®ÚÞwÝp]øAqTÙ„ùQ(ÛpKœlؽ¾˜SW–pš¾O]Ü–ôMu[Î÷ ŸNVŸK/Tê§TãVcvŇL7£ú”æÑs.ˆÍu"¢§¾qkÃbNý¶jžë_…m8’Í~}ô#¢§íw»[ž+Ug¯¶.ícæ—)Ëյ͉'²cŽnÒê€m{Dt¼½_±ÖH¼–ߤáÓ y©=ˆ/§\Iï¼X!y¸Þ.Ôí¾SÜdùË’"?½M¶æy¦ä¯¨ÈSêä9Þ h—yµ³Zkß›S|?I»¼Lê›huõݦ+Ö:}vŸ¯Ø„ôwèÎÞsÆî¤Û”mòÚ‡y© {qœ^7ÅŽ°1?“•»P†n‰ótåËxÙ™çVÍ2+qs÷<ï»Äe²ó²‹ë\ñè¥ë´wÞwóù!|:›=»ë·1È'™Ñn ¶ —a€Â/Œ^ñØ­“NþqÜx»6‹¸O§ŸNG˜KšS÷Œu*®=[Šçÿ¢Ï×øýùdçoFêãI&-Òdëxdþ¹]ûH±Ž7„sÛlÂdö—8¶Õ7o˜q<¥×¶.—öÑ3N‚Æ©Ý…yÍá&NÓuSÔmfò{„OÏfq&2¿umVÀ¾6u<†Q/‡Uhìƒf[:]!ù¼Ý-ïºB:´–¶ ÑØoŠæ6`_–Ý™é¹2§Þí·})ÔÇÚ[áM]:[av¿õO±uA -¬{c¿±Å}Ð~g1ú“·×o^÷›Éeì—N´Oée—Îsé—êÑ,÷Ísôì±y× Í{é¶÷t&9kk¬ÔÂî»nÒ¶.»uÈû 6dwƒŽ@1q™ Ù¼c6•ÛecZŽ'nt–êÌ)–ô§}¦ó¾*só¾*塯ßwD¼™-éL€òîÎu=¬ž3—lDVö«§ÔVO²Ç±í~ìmÏÛcØ2¤¬ÌTÖeù¡ç'ñïSö=Ða½Æë8шm–!P*z|ÿIZ)`ˆùGXÕÚvÄñ«¯yÿ™ÇãÉÆ8óØGÂrS•ý›lÜ„ ýÊíVã[nü².ô‘~ݼóÔ‘¿Åã« ø¹ìÌfõRÑ¿¹¤žô6ÿÀµJ¤G<ÑîŽNŽ×ÿéò² -endstream -endobj -6 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 5 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3524 ->> -stream -xœí]Mo¹½Ï¯èóîå÷ä°Ø É"°€³‹ ÈA;°wHìò÷Sìi²^M“’5’ mKî~îbÕ«G²©i^ý}§é[rzM)Çà–óÃéóI­Ñ+ú³µ'ÛË?Òþ5Þ­ÞDïó¢£^ULÑ©åᤕ]­ ÎGÄï%®vÿù›Ó¿ÅEš“O†½^uÒZ™Å‡5d“µ]¾|üŠÖZ«5”?q9|ùõôíõ}ùõ?§Oßl¡‡hÖ¬¼×f1&®1êàÝ.e‘’hâ%ÜÐpk'óÍâ{¸|‘Iì/bœŒQÂô”öæB­¾ƒ6Ççâ!¬–mžØ -{¤Ã½5öѳˆ‡ñ’GD\ãÄPkÍжé&XàŠ­°GÎT?ß²ßH¶à!J‚¿Æ±d¨'ÊQÁƒðx^µit"š}#‰ö¥øü…îHºS¢S¢S¢¯¶Ðu¡?‹2.¥èuEüZ¢ÖEXMÃEŒ ‰Žâr¹³‰Ž¥D“¯Û+R¢ ¶@Ø#%ÞKƒQYŒK‰2ŽbL°•¨GÛ¦›`Ä9zôÈ™êç[öÉ<ÉC ã¢dòj½âÁ xœ†‘£D³êñÀ¨Œ‡q)Ñ [k\ÒìQ ‚=àA#æ QÈT?ß/‘(Gó0îXŠ¢š‰)Ñ)Ñ)уDo½E‰bOdô¡Ñ”è”è”èI´/Åç/tGÒ}­…®#ƒ=‰.¤è´î΢¿–¨SVÓpãB¢€ƒ¸œÊM$p,$ꜯÛ+÷‡-öH‰×‡ÒT”àB¢€ƒ¸À£@=Ú6Ý#ÎÑ£GÎT?ß²ßH¶à!HvÁ.J&­é Ñ+Ì€ƒ<äƒDW=•ñ0.$ -8–4{¨àAxa´èÑ#gªŸï—H”£yHw,EQÍÀÄ”è”è”èA¢7Þ‹ -‰bOdô¡Ñ”è”è”èI´/Åç/tGÒ}µ…n}‰2.¥HÅÞE?H”Úé^i0.%Ê8Š+¤Î&8õ”?xk8à°ÒJ ¸(à(.“:›HàXJ4¸î#Ý>À{ üÆ}è_è¿p)Ñ:CàQ m›n‚7ð`8{äLõó-ûd ¼ä¡ -†qQ2©óH÷fÀà±óH·¹ËCð%U¢¶Ö¸¤Ù£@zÀƒFŽtC¦úù~‰D9š‡tÇRY&¦D§D§D½õ^%*z.¢ˆ¦D§D§DßH¢})>¡;’î”è”è”è«-t“ïK”q)Ŭú³(≦ÀNð¢$~õ †qWJM$p,$Œí>Ò l4Áð÷¹€ŠÒ\Hpx¨EÛ¦›`Ä<ÎåLõó-KÉ<œ¾ýî¯?ýýý÷ |:ýãwJéðû.~8ýá™þZã°3ÊúÅê-ACãñEÆ£-;,¯mÜÇÔâ.Ë34žn2]°Ö,îò{–‡Æó ÆK.ˆ-µøË/ο{¾qÖ`¢Îz —'¡‡ÆÝm½w†DœœÓÛèü©ž¾¬pÐ5î.è;ú?É×’þ¬uÉnÆÿø·?ýüý_ظ JyC_š¾¢R.ñ±ßu½ÖšDtë"²ÅhÞ úýø¼Ÿß=fX -躓®Ú¹£óÝv±©,µûþôåØ}º¼fýÞ¾J6ÊG4×k-}9·ÛsüZKŠ*!6ú•F§žÙïƬZM¦R"ã«ÍFû²(ñ*'å -Õ¥|üjTûXéw|ª3MvN%e®zñíûßÿù§÷LK ‰ºæx´h%‹ÔXš}w×v¯é.)Ü -œ.USZÂûùÝžJ³··¥ÔYWÆüÿsJe/Ž)Ý+d뎻t¥T:½Á®1[oõ^z-¤¶©)@õ»ý<@z5÷cb1.?GmVs9ù»ýšòúGVTÁJ.j_ýù±¾xO A·õ[ð¿õ cÿÔ ÃØvmä ŒæµJÄjâ,¹ìÌUÏ%ö’Ø‚ƒŠ.ÕÁèÓS%ãt\õÓækŸ½’y’JƒáÖî1zäDø¶ôпÚN•Qb/#ǹ{ƒøÄ<üºñüšDÎ2¶¿­^vZ´E¼Ûå÷‹j’ŽÛ/ÉÛ¾ü¨kœèÉ¡Í´ðwÉ“‚h©³71,_>ž~¦{Ú¯hRúLcàJÞbŠ…³z’cò¥Åq¡ói÷®—òw¼¾"“û]…q…àH«çî:åªì†Tž÷ÿïöv{º¶ÔAI–‘pk[°_8Ýæ|Á·6y_6ê²tÜÛ\—Ö/ûPûòñ°Äü|ò‰Š—ˆ”eº1§8­óÆ,º|ʆ/žî°ƒ -ÉÔ|ë-Cz\z~Ø ×Vå;A4"ZMCÝv.Nöö—õîÉ*z ûJƒÅåˆ`ræ¯aºM ™úp„é6Ð|%\ÀýP5[N·»bt¯jËýñUKëWUçûfܶÞøM¹Þ×Ëèv†èkÓ€)Å{qÜéÊ p‰¾l§\`"Á§Õîg¡uŇÚg٠öl/|ÖVè w “–rmkÚanœغŽ©Ó@mk"Ðùx>‘[{ÞwQ£fjvj˜…Nå†úÚ²âO¨ìMÀwªšvDf{X3kÚÁT ɵv¹¶ë@çS·ÝnÍ7¦bk•øÒ\3Ï]áR·©%¾ƒm9ÚQ&îá´Ü`šÊ¡0P¹V êÆÀó©Œ;øþäc§µç±BùZzZ°Ûस^©¦Š¤Y±rO^¾_† -ßÐ2òlÚµ’Š ÏØIÑfƒe’mÔq½ h¹-¤KÇØjó¥“ê´/ƒnkÝ2&PHà1×î•Aª Ö­ê\†°šŸ6V"¨j'Èþ•ò½€¹Ÿ¾I•Š½: ÊÝ7» ‡6vÞ#ã:¸Ïj¾‚çmbs×p)ýT0lT›íØ€Ü1æaô~ƒ«ZÛè¤iUYd½÷|úí´MsÆz“ËÏ6,Õ´Ü8ÕË©Íôõ¯“[Þ×ÔË> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 489.361263 663.111024 496.429134 648.111024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.881526 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 146.805601 573.711024 177.256773 554.961024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.881526 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 536.961024 504.679134 504.261024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 146.805601 529.011024 197.845152 510.261024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.893245 529.011024 496.429134 514.011024 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 492.261024 504.679134 459.561024 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.809749 484.311024 496.429134 469.311024 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 447.561024 504.679134 414.861024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 234.738707 439.611024 313.229430 420.861024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 489.877620 439.611024 496.429134 424.611024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-cluster.yml-configuration) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 402.861024 504.679134 370.161024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -25 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 484.970394 394.911024 496.429134 379.911024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -26 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 358.161024 504.679134 325.461024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 210.896178 350.211024 288.867613 335.211024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.993831 350.211024 496.429134 335.211024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -29 0 obj -<< -/Filter /FlateDecode -/Length 4932 ->> -stream -xœí][‹$»‘~¯_Qφ“G—Ð ÃcÃ,Œ}°Y–}˜)Ÿ¶15†±ü÷÷‹¬”ʌ̪êžðNSÓ•!e(®ŸBÊKÛ³ÁÏwÿe²SÎ%E:_>>ŸÌ”‚Á¿¹Çp07¿Ç'…³5”¦`KÌáü‰ >M©—âùz«CÙýzúãÏNϱg7• ç¿ÿÈM䧔S2Ai*h2Ö+M!L)¹•¦h'¨XŠÖ1B"GÛ¦1¨ä 5A r.+MbxJÖo› -ÄpÉ’Ö1l Ii²rXgŒÚA ‘wJ› S„Ñ£ÖæìsqEmKh³ÉimÞO1‘ Vk+SŒ1d­ K(Æjm²Kd´6ÈB>'­-B½QÛ ‹ËÉkm ²8X§(m² º²ÚYL4Vk+~ -%©mm&§¼ms&L!{o´6k§€Øôj2 -NŠIis%šPÔ6ȼqZ›‡,„­ 8|ÊYÉVÇÙí·Z[€,Î%RÛ œ¯!€‹Å¤¨A2hb\Ò0À¥4Qq¤€Ë~¢LYC—ËD)y \ Å’4ðÆ¢ÍY ¼,¢†ÞBBæªmÅÒ°À;È‚xYy <Ж-xÀ-™b5,ðÀ[26jXà¸ÓhXà¸>GÒ°ÀrJEÃÌõÀN <@éž4,ð@]¢Ó°Àv=å¨aîz²FÃîz3Õ6È‚Ö°è8y›½†ÜõÖ$ ¸‹4rÀ«â0jX€X™\ÎFÃîºlHÃ)@mKrÐkX@À] ‚6sw]0NÃî:rQÃÊü1j5Ü„½€,X 0ߣÍy Àlr(K4,À][0ý)9 ´šl.QÂܵîSÛÊd,®ä-¬<Ù‹†¸‹‰ÊkX€»€Ï¬a0~ÂŒê4,À]ë1SkmÀ]ëŠÑ° wQ7 “E aæ·É„®ÚV&SrÖ° wKNÃÌ“É@µ-M$«aÀx2¨C5,ˆÀ]LïEÂÜ5Á{ "p×ʵ ²øì4,@]ƒ6¤­’Ó(V'ã€Zp×XxXkî“Š†¸ËÓ¦†11Áe à„*ØiX3M%¥¨aA,m(ùÔ¶8á8hX ¥¶AJ¤a -ë©ø’5,H²xç4,H² dаÁT,ªouyY.êú€ *E €dS.D¤±ƒUµ¶è¦œ×j[F›M¤D¦b«aÖRSFÒkX€Ÿ¸\Ò°b Í’†©@¤Š†˜Š¦ìP™km² ÈÖ°•.Ú¬Õ° ;È‚jPÂì2V™ÑhX€kI˜Zk#Ãë̬aA¦8q©¨aÒ+M ¥ÚYÀ?¼Ø`ñƒÅ&–9jdñ4,ÈÙñr3kX3dqÆiX€ØäõfÒ° È‚ŠOÂbâÄe²†€q´£aA±ëMG /y½™5,(Þ`½‰%ž’·ÅG^o& -A–€Emƒ,(šŠ’·À$¬7NZ[„,®†%F^of Pf`½‰Š^ÝȼÞLêvp7 “ÖÜEe5,ÀÖ›¨lµµ½ð†„úLo̼âÌêŽôÌ­ê–öb¶JêžøòIÝ4€˜XYæ¨î`ZE£5ê¶þ¢£ &ÜvŸäUD8$Ì™9±’iA¨îÛš£wó;Ýnûcÿóéû˜|ÏþÇéågóNYý±uOq^X#ïbqþþtBI4qîz+é×S$6ØšÎrÖÞð0)TWû^N‚îP#;9n¯#=¢Ž˜ébD@Bí-äÔ‹ÔGЯ ŠÎ5cïÝF¨^ònt¡Ïu¤7íňÂRº½/§?ÂõŸN½•Àtö.Í{jÖ²DsÀà$öo*Ýÿ3βŸÉþŸÅ4Pvûe -ÄÄû1ÊN,”1ŒYÓ1›w¯sõ¹¥±`wbAÐy£ÅÂ2"ûK‹…¸ qŒy+ºÅ²¤õn#Ô!üN,zÓ^Œ(,¥Ûûòÿ9ùÉI"}öãQK˾ÕGgVõÑY¾Z!‡Qý#è×ÞÑGgv‚Å“°±ÖOõà¯ýüÒðf oõÓ™Ué,_é¯A£Æßà/=^ïè£3;ÀC鯷âa«° úà?úV?Yõ—Îò•þä0jü þÒãõŽ>:³|,¾¾|}?ü=ºàsˆ -¾‹Ö·ãû Ï~~iø9зúèÌ|ÿú9ôùWЯ;þ¼£Îìß‹/‡ïƒ¿öóKÃϾÕOg¦àûÛý5ȡ׃¿ôx½£Îìߥ¿¾¾þp_¯k÷è[ýtf -¾¿Ý_ƒz}1øK×;úèÌð]°x¾oך¿øádãr7\<‹”ÆK`¾]é‡O§ïñ_øïw¿<ãàåô?ÿaŒOÆÐG|.ƾ¸àñ´àðÇ!ã2ño‹Oºõ ü ·~Pb>ŸÏ›ûűO¥ÍüÂ2–¿ñš¿—[Ÿyì·1?ºËç¶>e7,Ç—~AÈ`ÞöÆsîG?ÿßó¿Ý±“5ÒPl©ãl“¼èPåv7þ3ïe¬PÛ!½,ÒÏ™ù–*Ûí·ÇxîG|ª®ñÆ#dÁ;wÝÃ⫹oè6ªýù˜ªÏ>,2,>¯ã 6þ¸âÏW:ð1kl¹ýfº›ùÚÓmìé¹Òb—ê3©ËPõ¯6£gKŒ„ Û¶ÅqÕ+myÍv«¾}ã×x¥‡•Öì(mNKÌ¥1ÖC<´ ­mÃ>ŸÇ ÝþÍ6«¼j}„Ïæ­9ðããúιTóØè>pqÌë\tÕ§‚ÞdüthŸ¸¶¯±\1©âëu¹m>Þde¸¿¹p¼ÞÆùàñÌ?ÀÌTF3𳜧 éb|+Åž5®Õø¾•øH"–ê8³Ý>lc0h¶Éº/gº-VßäÝúD‡¤qæ|®¾”ñp„W/;y¹ø±}_åb‹cc†¹¨ê æeé±>˳²ÝÆÿÚ"®mQý%ã¾ùøhnXÅÉ£8 âºÕ»%€wX#Xž¨Þ×’WÕ_ò9òÝyl9Ï̙۹á‡æ{F›áf?SÅwÓj¤YwêãÍ·óy¾Çõ|n×jÜ—Q^mn“µƒ†× Ÿˆ©¹ï#sËË¡ÍâÚf¿ƒG5ŠýÓV×·l\ɲÏëßðÙõц‹}Û`#ÏÆWwíÈÿ-rRìËe·‘ó‰zbLiãœö•V›ÚeÃû¡8¯cÐîÒfi3Æ6Æáßþy‰‘‡2”µ _¶Õa]ˆ”ø¬óÔl§Z[ -_ÈZ£axêsî¬ó2×zyXóp܃æÊ}üÛž‡×¯mÞü¼Ìœ¿ûõéûÿ\Vу-æ«ÉΖó§Sà‡~J0ÅHú•2+%›pþçé÷,Ë6t4'[%WÈMü|›ÏghµÎ·²[SøøñΒ¯ë:;€•ËÑ[#éOë,ØÃG:»{k½Üç³u>ÑKŸ+‚\«\ºÿk¬µ'C𨽢ö"òSñ9/éo²ßœ“¼óo±×ú8šlòÞeö=&ÀF6NÒ7º|:~ðoÞÛ"3EÀ ß}W&FÓn@zÅ)÷îY*É*çöÅ*7+¬'à0óä‹ã›>Í„<̆6®uø›GÚ!¯›MǼ{ÿî7x×Ó*öóæ€})¤W†‘¼1›xß­eSq“->ø(éÏgS¡Îæ0Úä^Í0G˽mZŽ£È¦ûuË „ˆB.ä]áõòa>“Qé‹Ìá^ÔÁsX÷L~ìótÛ¿Yl.gbó²'tˆIú›lPQÓ‹½ Y#¯¯c¸½=±‡0îm<¬‘¨ŠºÄg*ä$]A"Ù1µ‰Ùšb ùùŠ-=ÎO‹=Ñù]}”õ6;ÓÐÂ5lÈr&ã7§çÉü&õJli#ˆŽìw²Í½o¨ÑÐæqç^S?Ýt`¯=mCPÛZ%1t -²k¡ë¬– ÄËÊŠ­y«oú„};ôU9 Ãï·jRñcÄBæÞæû”|,qÄ]û”ŽVrâDH¦8–.Ù &¤¤™žå'é -Ïc‰QFð¡ïmÔ§YɺÒf-D”À^HÆdå eGúÕéõf¿/"ÇšLmÐÞ¨WImŠ1µžNõóaÛœãÏ|P“·[¨ñò"÷|+rzjôÒ‚†£‚šûiK‡ ¥J­Eƒ ÐL¥5Ž©Ê—ÓªYf³j¥ÔjŠNý‹´t^iF Ò+qÓ—ùÖ¯UK¾@A†sêÚ™Þ³Õ’Y¡Eyv£Rïé+m;6c×Ùö,Ô .H앩駅MÏWáßkrGݲÔz ;6÷וF~0‰ocšÿÉ1Cˆ_"ž(‹-Ž§Ï9ÞóØîlÔ=9’å½HïM²ü·„t®h(÷«úw†ôÓŠQUzÎÊ–N‡¹í–ÕüÇ$ðoÙØi‡‰—Šü·c<½™_yŸÌÎ~sÜì^½ÿ?† <û -endstream -endobj -30 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 29 0 R -/Resources 4 0 R -/Annots [ 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R 38 0 R 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 445.281496 409.271317 430.281496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_v2-6_CIS_v1-6_Hardening_Guide.pdf) ->> ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 418.281496 162.214732 403.281496 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 403.281496 332.953990 388.281496 ] -/BS << -/W 0 ->> -/Dest (configure-kernel-runtime-parameters) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 386.659914 295.486949 371.659914 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 169.605601 388.281496 200.056773 369.531496 ] -/BS << -/W 0 ->> -/Dest (configure-etcd-user-and-group) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 367.909914 319.724254 352.909914 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -37 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 169.605601 369.531496 220.645152 350.781496 ] -/BS << -/W 0 ->> -/Dest (configure-default-service-account) ->> -endobj -38 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 350.781496 255.796275 335.781496 ] -/BS << -/W 0 ->> -/Dest (configure-network-policy) ->> -endobj -39 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 317.031496 400.593883 302.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke-template-configuration) ->> -endobj -40 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 302.031496 397.449596 287.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -41 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 233.696178 302.031496 311.667613 287.031496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-cloud-config-configuration) ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 293.575760 126.231496 442.798661 111.231496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 111.231496 285.368241 96.231496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/1.6-benchmark-2.6/) ->> ->> -endobj -44 0 obj -<< -/Filter /FlateDecode -/Length 5113 ->> -stream -xœÍ\Y«É‘~?¿â<”Ê%r30Í ƒ è±hc?¨[Ý WÛþûþ¢*—¨ª8ÛUãÛ-Ô:¹TdDäKe•;[üyçð¿BΔRs¢óåËéo'kr´øoé±¹Xš¿ÅßÏÎR6ÑÕTâù B6¹FŸÓùå„ÿí.e÷—ÓïuúëvŒ;{Skò.žÿþ7Q0¹äl£ÒTÑd]Pšb49û˜”¦ä –X«Ö6b&OǦ 6¨–¨5 ò¾(MlÊ.›*ØðÙ‘Ö6\Yir|8o­ÚF,QðJ›‹&AèIkóΤR}UÛ2Ú\öZ[&erÑimÕ¤”bÑÚ¼ÄjÖÁKtDVk/JÖÚx )Xµ ¼ø’ƒÖ–Á‹‡tªÒVÀ ¬«¨màÅ&ë´¶L¬…Hm«h³%—c›·ÑÄ‚ÕÚœ3¶Ô6ì(()e¥Íƒ—dcUÛÀK Ökm¼þhmÀ‰r)Ênõ¼»ƒ Nk‹àÅûLjxò5ð ¼Øœ4À2ŒKøœ UOø * -øR å4ð5J5k8¬C›w ^"% ‚/„«¶—PIÂàÁ :hXxñ4,@[‚µhX·d«Ó° oɺ¤aAà‚M«aA→HÂȅ)U 07;5,]l÷¬aAꆘ¼†°¨$ p7³p7ŒTÛÀ X࣠® ¸œÍpÛÈkX­ØaÒ°¶b|)VÃîúbIÃîú  ¶eƒ=4, à®X‚æ¹»>Z¯aw=ù¤a Ŭ w!QÀ VÃø{´ù a&3a‰†¸ë*ÜŸ²§VÆ•š4,ˆÀ]W >µ­—!qeßBÊÆ¥T5,ˆÀ]8ª aAî>‹†Àxê5,ˆÀ]ੵ6à®óÕjX»ˆ¢†0ãhXÿfœ…éªmÕØZŠ†¸ XòÀ [€$j[60$§aÀØXÄ¡$à.Ü{Õ° wm AÂܵ„°Gm/¡x ×  ÛVÙÓVõ@ -­ ¸k4¬µw­ÍUÂÜe·©aAÊLðEÃ0h{ R!SsN¤jцOmK×QÂlAˆ€,µ ¼P& X›jÑ° {ð¼×° {ð‚AÃD¦:Dßjz^`.j~@à‘¢†@2S*‘†9&äcªÖ–¼)p­¶´¹¬aAÎdàŠ†È¥LÁ¦×°o8\Ò°l Í‘†¹‚l àŠLñˆÌµ6^dkX€HmÎiXP~>ýé×Ø?X`þ"ŸŒŸÖ߈Ԭ¿àwj1)þý>üí ȶVU±VX×T”÷×ÈA߈çF’ã\ç$ÌCß·y–’Æa.€5×5¡:̵Œkãy.æ1Š9é3ÿ=ÎY¹àVB±Êœ<Çà/«<lK‹h+iòŽ¯ÍýoÊ&ô×ôÎöÕïûúã”;u{lû·÷[ø²7m‹Z×ärãQ¬íQý/´,äØxŽÔäy4aÓR~KŸÚtœ»­oå¾®ç¦üÊGâœëy]m×ó¨bžs¼N'·ÖèõÎ!ê´w5žå^È÷x\ï÷ßáî(#l[ѤfãWwØ9;äR\ó7~u:ÃE>?æU²9Fã9ý„lL¨žÃuÄ`¶"ýÚ{Kû]W1ŽK³ñ»•æûß~øÍw¦»æÑM³¹žE|~ ×Ëuš.+JóhÛc3F@Ìhëf`×~K±%¸O7[÷—¡¶,ðª§Õ €÷ñÊØ­sÌíµ3ixÐQSmåGY‘f Oy[cpˆ§;»!ß2‰a‹°¢PàÀ‘{Jñî û‚h?U)#6{4..SL ;~èS"§îѧǼñårmÔÄô:µ`¿Xu7 B£ë*#ÏyTq%ÞUY‡z(œìÖ½xÑ;7!±DB¸Ž%7]D<„ -æŒP¶¹dûýêj9 [\îEÛ#™–çfWîsÕÅ -^%ýÿszÿŸÍä¼ÉÁ*³CúåFÄjÍ’þÂç9*,*žÿyúݵ|IFöbš Ûê¶cýõpæfZóù>=èa„ÀóUöÇÐ<RJNd‡(t‰9¼ Av®þv -çó!\º9 ˆûP•±Æ/¾QìÅ.ƒ¯ä™Ÿñ²9y§Ü÷Þ¾ºåÃ7¡R6›Äxjשݧ…Y1[=„î¡ëHknê jiæ!ý‘©/ÿþa¥»ÒúõþKÁ‡œHÈâß,»MjW.8}Kn|”à˜*Iëé5Ý°Q®ÏAqË? y­1ÓÄ摲‹Ô}ЫÀGû¼Ì¥½ùMÊÝÆåÉÇLÕnÊ1äø6ÐK;½}‘ž²ß¤R=ýì÷ú$üã®û~ùþºÍoôÖôy¿üŽ¾o”Z›ø+ä'm1A¦€[,߯m›~Žõ+{±ÏÓýa/ÍüDÄJ™IÊì€Ý#Vk)ìZüÓì³ðaç:çžh÷­Ûpr\Š)r(ãsv¾HÏ´yç-®ÿn­«µ Kô]ÚQŒi–Û#‚1®µ]iç—Ýn–}­k_{õ¼Ï[pµ©8—å¸á…a–¸3LY'Öêdלó²D]Kã!C·ç|}Û »Ýá#_%SÎXe¶ÝÚùPïõüù1o»EÀéàw£ÉÃq^ˆ/­×ú¶YU¹äãèãÐî8Žµ²æ$ ¨ qÎ0ŸX JÑéé1o\uÏ@ÝMôa·>žJôШ‰ÚõÊü@Ž»¨ä‰Ë*x¼»ï•Dy‘‚†ù’¬5! ç£á>®E½b–xFªäé1ÿ•P¿ë*“qéBüòÙî¡®€áº_ï±Ã5‰X!íÚ; ¯‘Ò3ø>¢ŸsÄËðý׶Xº/~ÇøÛ´u}´ËËüG;ºb‰OEøñ:ÊüJ eîÁccÞÚ&¿¹€IW°k2‚*7Å^¦,JÞ˜’6 䎲¸Š›ˆ€Æ;öRµÏ í·¨:tC;(»TÃçíðµWžkNuðkv£lßëôÅnjõÔæ5øÁ“ÝQ<UŽgÉç¡ÅõÝpäWn\:Öã ù^å÷Š2ö¡çJÉQ{Ψ>#“ÇñÇ5oêÅÖÙï#d·áÑÙYF¥Í})}Wó}¹ö,÷(ÖGNá«ËA‘}Øo)‡•qG{9Žç÷& 5ÒîÛ'j:·¼¹S!MŽ¯°?âTž_ÂÔÖqÇþ"¿gS¨†p…mŸõ®,OolIŒ{mÑóM›¢ƒîvådiêyÎZBtœëZIßµgiKl§aüyÎVão¿ŸârøædØÉT\ª”xÞÖyß– ªÐ‰|V®qóìü`„å\3¿Y8-ã¯&aÄ >p{vÈ?oã×>»]Ÿ·•–qs²ÅŠ¸†¡…²ÛÏ­>ŽÞ`½âÃKÿÆËÑhnÄ?ü…ŒÐI÷@üs0%Ú´ûÞˆb­ë7bê­ûÆãF‹QÖ–ùfäJ@à7½ÛÇÃve‹k/ÉDý—m¹¢½¥xõ6÷θÊc…öÙÛ^ìÄÛsàS‰Tb•¯“Žmu·ËmtXÆxAóìv/Cnˆ)ûúÈPÍüôµrÐ Ûðïµ·Çv¸é?Ióþ¤clù¥oºÿÖšâ^ýˆ›¼ü°Ó=ÿIËKønù‹MÅ8Ï_j;ó‘`–g=ó‹ÿÅ$MÜÝb®Œ\lgÚ•]ÍÉòWpø ‹:äEë¿ÚÛD!dRx–ÏSÙ…\|¿˜ä—¿ÂF -¡¬ÌÄöÓŽ¹È Ðì´ËÉÁòê¾gˆÆ¶Ÿ³Þ湟ØWÃãcƯ#ÞñýŠmw½±BÄÈäŽd^½5®‘ùoÅ„v•+1užAœ’ì;'œï’ùAÛ$Æ#ÑŠÛM²§ÎãO‚ Ñ¥I¬KÑ9¡þÞ×g¡Î[ÄË · {ê‹JåKõ©ºt¥vZLÕA½çP =)¤ËI!¾³}j‚2G»Ðšï±2•nH4úÕÞO!]Nj¿6[šÊ£W™Ck—üdešz(Cð -í"ªq™¿Y)öˆ ýç–̯j]ÃóO»ñâåiìÄI~9ŬôŽ+lì¦'‰AÌ;ÈÅN{™TÄ7MTØšÆ7àÿ¯P•‘gùÁ.Óõ äÕ¼Éå$È[!Iz¨Cšøȃ;P1wÎÃf¥¼á)ýtGï!± UˆLÐùÅ1uà±%»auƒÌÖå3°Rmg·›ä8LùeCž|ƱU£7KN˜{óNrØù"ÉyhÜñ×f¿c^aóxYíÉlú¥ßd’½ÞnÞL'c…Iž0ú²ûnèÄ_Ðì?ç&Ó<îåôÓiqs>DÏ)H -Ž?ž&£%wþ'úüÿÿDçýk«÷v …غ!KOÆÇc˃dþôf'Žm#ˆžìO²+³oìÖ0ü¸÷¯i·Ø{O7ÔVIŒS†‚ì‡é._¢’‰7ˆ—G 󵺙{½ }q| „¿óҹ…\.Ël Ó%ŸÅ”¸â®Ó¥£•¼ˆ 9).Å ëälÃ&¤¼É=óORï%.DÁ—a¶Ñt³rêN[V!º òBNÌ5ò9WÝð£0ýêíõÕzo,§¾˜: }P_$u,Œ©ðtjX.Óörøœ°œ7ê›wJhÌÄÞ #È™[c†´¹6*¨ek¢¼)uÚæ¦ÝQ ¸ÍvÚ˜1wžRÖŲ¬¸¨RÊ#¦˜ÔŸ¤¤£ÔÊb”ZI‡¾ËKÂæ'­G=Òœó\=G,YZ’£•fÏÐiÇ{ÓöÞÝÛžÅ2h2’fdjç°xèù*ü{ÍÞQ_ôÕzm*®Ìï[ÁQ“ËÁ‡å“嶤 !þPE¦"JO¹]ó8V6zÍCÞ êà"ÍŽ?>¯³ð‚†z¿ALÕ?L¯«V]ÒsPJ:æŽ%«åëÃø¯vÆeæT‘?68è-üÔlõ -–¨xmÿ âóP` -endstream -endobj -45 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 44 0 R -/Resources 4 0 R -/Annots [ 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 191.048717 658.622079 244.661998 643.622079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/admin-settings/pod-security-policies/) ->> ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 439.875057 101.433071 421.125057 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -48 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.928036 99.933071 402.178036 ] -/BS << -/W 0 ->> -/Dest (cb1-2) ->> -endobj -49 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.981014 99.933071 383.231014 ] -/BS << -/W 0 ->> -/Dest (cb1-3) ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 383.033993 99.933071 364.283993 ] -/BS << -/W 0 ->> -/Dest (cb1-4) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 364.086971 99.933071 345.336971 ] -/BS << -/W 0 ->> -/Dest (cb1-5) ->> -endobj -52 0 obj -<< -/Filter /FlateDecode -/Length 4935 ->> -stream -xœå]K$7r¾×¯¨ó¢HFð:ëÃ.0 2¼‚£Þé]#Zü÷ý3ùĘ̀ª¬™–gO£»*#øˆ ¿ˆ ™9îjñóßÌÎä\Räë˯—ß.Ö¤`ñ¯–Ø\TöøMáê,'\‰9\%“Jð)^?^ðgw9ÿxù·?\þk[Ç]½)%z®ÿø ,&“rJ6(¬–u¤°B0)ùVt·XŠÆ‚!±ç#+A .9h,ˆÁÞg…•!qrtdˆá“c1\ Ia9 9œ·VåAËL^á¹`"”5žw&æâ‹ÊKà¹ä5‘‰‰]p¯˜cÈ!K(Öi¼Y‚c¶²0å¤ñ"d¡HVåAŸi¼Y<´S^†,°®¬ò ‹Öi¼B&”̬ò -x6§|äyLÈDVã9gl“Tf)&…ç!K´¡¨<ÈÈzG…ñ£ñ€RÎÊlõ2»É’Óx²xŸXåA ¾†>B›¢˜AFpIß’áâYŸÉp次€ÏÅpJ¤Á€/Áp,Iò<ï4 YG ÈAÆÌUy… -kX@² €†DÅ3iX@@[†µhX@€[¶ÅiX@À[¶.jX@\ˆi5, .åÈ ¦T4, `.;5, €.¦{Ò°€€º¢×°€»Ä9jX@À]bg5,`à.jª<ÈÖ°èhÈeÒ°€»älÒ°€»˜F^ÃŒªF `+Æçl5,`à®Ï–5,`à®Op*/ÌAÒ°€»>à4Ï ÜõÁz ¸ëÙG `(øcÕh¸  z8Y°À߃çIÃ4f< p׸?eN­ŒË%jX€».cøT^1.Aãʼ…–‹±hX€»pT¤aAî>³†Àxê5,À]GðÔ¸ë|±à.↠aÌÁ8À¿gaº*¯[rÖ° wK^Ãxac3Då%CrŒEªaAî½ "p×" "p×2•Y({ ×€‡i«Ìi«Æz …ÆîZ‡ÖxÀ]kSÑ° wÅmjX“|Ö°DÁ^˜ٔ”¢†±Xðò©¼hp4,H„ÈRy…kX€ÀÚ*YÂä! y¯aAò!ƒ†ˆLqˆ¾Õô²À\Ôü€! "E €d&f RˆÈÇ U½É p­ò2x.iX¸b§ar)“1é5,À —4,€à9Ö° È‚©¢a\‘É‘¹ÆsA¶†ˆtÁsNÂì! ¢A ²ÏÈ2£Õ°¹$T­ñØJž™5,È„Š`š ÓRª<Șаã#ÉvаÉ’M¤9*²P` rö’nf r†,Þz `›’o& Š…,ˆø4,(6 “5,Œƒg­†Åe䛞5,À¼”|3kXPÈ"ßDŠ§ÌÛBQòͤaAaÈ¢¨<È‚ ©(ó˜„|è¤ñ"dñ…5,(1J¾™5,@˜|½º$%ßLêrp7 “Æî"2àù&"[-··ÞŸéÌ,gVW , 7À·ªKØ o•Ô5 ð•I]4€˜È,sTW àVÁtV]6°À_Äc|À„eõi^¢Š0‡Ÿ™“ÜdÁ´`D÷=çÅèF±e}ì»|ûÎ÷ú·ÿ¾¼þ¡®”µã'Ž5±Fü‹/oà•©íq]MB‰#BÀO©#B¤2„t€ÅuÑM„„+†»-×þÅmE†Ä"³C0SïŒ7ý"Up+Šª¬O×y#Y‡Ž¼ä©Ù–Rf!¯CÔ†ïNUìÙJo®Ù¹ã¡%UÚç+½¹nü¬&¡‹IMHhàÇ%hÒT{²Î›kvîw(I“õé:o®× tb2Àe6?x5¸NIUìÙJo®Ù¹ãÉü4iŸ¯ôÒaøû/ˆ7–½Žx­ÓènåÇ_/ß~ÿ/?ýû»?¢Í_/?ÿ“µ˜d6ü‚OÆ'"G$‹–_:òµz¤LX¿{üƵ>q—µœ—úø^Özei³¶œÓBÏk¹<ÚYxßýÇõÇ?Ï÷ ËNêL»{±¥úÒì±"Ýè‚>T³í‚ÞcE7½*¿¿Ý£ä…äØe½GŽk¯yÕǪ‹¦Ÿ°ò+-Lº?èh!¸ƒÓx# eØŸ·]ò6yi²)ËPÂ?ÿ(¶Œ¸IB;qbañl²ë ˆ¯¶n‘ ë²Æ'™þjñP,rLܲ¡â%&G e r¬Ã4­×E;ýÒ!6]¥Ý(éÛŸþò¯?ýéû1)´ ²˜»âñ›º–úÄÛÎ7˜P–¼²ß5½ŸoÎÍ -—…Î5–ð$k‚Q–‡Úˆ¨¦ÓÙˆ‘lTþtÿ¥sëuQI¿tº¼².[ë2Ã*Ìøï¾quŽ¯Ÿmª¤åº~.àV§™w*¶Ä²ët™’K;În?§^¯{¹n ëu\?wå¸ÉÛäŒ{yƒŽŒK&¨šb³—<æþ Ÿ«ó¥}È‘q8ÄQô>Èq§Äðô ;Ì<[d-t×éÝA_ûíFg—ß.‡Ûjmçñåš0…Hšá¡L²j:©~õeª“wFÈoo·î)|wÿŽà9`'™e:Ölëís¦Ô©)ªO-9ÏkA²TŠ¯²ltj«óõL­œ ê†5´»íÅ>·î p+÷Ëhƒ_·Ÿ½îÞ›i†‰×Ú Ãpš©ö2Ítý¶Ÿ~ý~ª÷ÀgÏÉ1 ›ÐCuÚ”W/”Ö@9MAZjX® wä?à7«!¦‡;Š1æ]§Õ¶@Ñ-ÑY5õ÷K-u¦×C›ä­‰TÏcÛ¬26­¬²å>¶Y`ÔÁ‹mÛ¼}ËY ®g tYxMný6r)M?÷bðzöÂcÂÞÐAxÞ{Àeï异"C^ëGUŽÄ yØõ-9¦ ¾Zÿ_õ€ÐËÆÈ"û âû£xð\•/ _=ô²}Î0Þ‘ÁÞ¯–=n;®PykD9R±×({G7î©*_z†¸š‚èÕ«ƒÐðûDØW‚ÁӮџOÅÆ·ÛÍÁ°e@‘Òî­#9j†éž—ÓÉ&KîÁȬóÕ JèvuZw‡îÉ¡ŒÙ Lám';~""?¶Ó†îÎŒõmÆkŸ‰Ã“#päµúwƒ#ݤHvl%ô­‰÷9“:Wçë1)†!''eG“Út2'Ÿ`V‡¶ž2«Cí'ÍêØû³ÚÄ£e»XÕ/§è´ÆbÅ›kÑ©SŠ·ÆÇsôæ”zŠxD’»Ö#âe‰#†xýR¼ðµä¼ïÝïþôÓ»iY'm}5—–©îòÄ×ÉE<¥*©ãðφGªªzö1Åâ=¯×³jÙs•ÁwžÄ—Ӳ촧b8(ŽPò© Û(a½tAö³© î¶·ã€ð…¦5Û°cyº.ͧIÝ”å­ÙZß - kŸM®]™ê#èžæ>ÿ{FÿËToÍêk–ßäÕ¶‚í[tµÞë(×ï7ÜÕ!ïu(²4­óþuÅ^úíò4™óì‹ÖûòC/u¥%¯ò½L¾,¾îfÕ±‰k›Í_º­ÎÊW{Ú–¨”uw·åBÜënèc–¿ÙV×áYž±eÁp’Ïf e²m»µåù6Öúj6þ2hµüë®­»ã{Wù`wŸ;‡Öy£nÍÎã§{šVÿzÙ @OãÂS_³'Œ•°µÕ«\ÓÜi{c­Î^†Å.îé/Úƒþ49?C§í(íìòwÇÂgÆQY] ÓüSVôfüGµçfËû•ÕI¯mõµé£ÚÂì[V ÜØË _³ŸOŸ¥»C¼¦Ûæ}™ïêìà/ºnÊVÎùøH;–Ò£´ûšôxw¾ÜÀõekÏNñÂ#ÜF¾vó½áÂÆœíGj:†Ïã‘'»pvã‹ë87úûôÍ«ó1ò\’Wä{µÍ«æÞG‰ÕvάÖGÙ%€&²&ÇΉiU=¬þ£û${\EÙG²£¡ËÕæñ"ã½ñKv_¿÷=Ý[ý†½owqÆxÌu«]¾<´£b£IÙÉÓ¨G™ž3Šòô-µ7Ák71á];Ýï‚Õ±½;þ0s:•W[¹±®›äñi[ÏØ‘ÍÆ#•H¶uOÖùÒ‹p}_$ar#–¥õ˜L5írúæôƒÝþ%µ¼§â?á$Á’þ¯u>ìöhú–ìM%$‡!‹·J8µ°G9’g¬£RûÄ•h ]yüâX¬ZÙ±R5kìüfs¶²/È1“¾Ùîqê·³APÆïíÎmœyZ8û²…Ô9Íè)m«?帅ÂýiÎ:}‘{–§„ä ¿‘u) µ>TuyØÓgKŽí=žÑcúX»Ÿ®¼¹ý9fªºõ¹ryüÞ…|Í#Oå='ë|=f"¯ñ € ùÿ_Þ[Þ³UÂɼ'´¼çXûTÞÃ-ï9Ö?÷ü°>œÂUš,¦pe~ö¸ÛèÃ"L²…»Ç'ø®n÷´Ü6"F“òú?9#Š»/Iž˜WS°Ýêo+–a¬zÔ”j—nù5µÚ¯ÖjçoåÔ†ì¾P[M­!Ûç»õœªS_m•ÛN²|øn¯þß.±¾±ÁÕ·öXD,ÎËký®‘Xi*WyKD¶Äý!ZWä®7jÖ—!þÖKÉ_¬¼2I^—Q‡c¾XËÿVê׋ d\²$·¼ËÌVröíb?^ä]v¬™ÇÁ˜d!®_mo‹]ÏÜíå"Ï•}I¤vý:ãPÏôdùjÔ­š¼c€m+Dõ)û¥c…ˆšÑÉr÷Ö¸•,ïD¬µ^Å.JˆMfGƒ<— ŽŠÉK b8íÔÝ {nò8yLW]Ä.ú¬:7 + /êO_.è–öÔ*UÞBÖšjÚõ¶Óhªtjh%û€p'…ôrQˆßØÖ4c0;5?ν4Câ^®´r -é墖kLúH¥^*ª¥i~ˆ2LrW¼B{™Na%yÁé4G,µ¯[²<ÙÇZ`×!Sw_.ûLä—”Òa`… Íôf"Mívr¶Ã^Ù̪*LÍF“7aÈß*B§ -òÔ/Ž»IIl5®F'27;y«¤™;ê°¦Çi”Ô%Kbt £íl•òº½t×؆:©l¢§ÒÄêà±%»nu,ÖôÓ±r&Ú&ºäÐMùã†<ä }ªÛ;‹n2÷ÐÛäرóãLN}ÄåævÃÄÉæñ¥:6Þ“Åôsëd%7læÓ;›ˆC0€Â ýXÉm¶vt’“Uíë˜dšÇ}¹üýRÝœ§à%œääM{s´ä®ÿƒ2Æï^øú®½ÚeñãÞv´ð[7äÙ“É{YóI²<(Óˆ}ÚLDÏì²Ë£lhÖÐý¸¬²¥MªÛì­¤ëê:w&†¡Ã‰ì»ézG“fÂâËN‹=ùܱ{¹¤vs²`(/jRáb¾\æÁ£á’¯S“¸’¢Ã¥ƒË~ªˆ‹¹Q\N–!ÙFL1ȹ“®z‘Ÿç¡õ¶ùb -#ä’‡››n´zS„À4_Ì ³›;-y¡?yz}ö¸¯"Ç6„Ú¡½S?ÎÔ~cB퀧S©^Æíe÷9Thl“wh¨·EÓÜ£䌩1B Þ\Ì6:Qó¨¶s§Üh›N›£èpšm´Þbj2ŵZSK½ã¬j)õ˜bPÿ>k:Ì£Ò•æQ‰‡²Ònóx=Z¢…ٜӸ;;JöX2+´8×îT%©ÑŽ}ó¶ïæm¯Ómð$ŽÈÔŽjáPò“ðïSæŽúæ­Tû©+.—¡É+D\"Oõýö6Ç ayEiâ<-q<]çþšÇqe£­yÌ=a8 Ùää*ÐEøFy̘šjÿ‹^­Xõ–žS€²¤3`îøž£úªjü[vúe’TQÞLOôfy¡n²ú{\Þ,ÔŸÿa#À° -endstream -endobj -53 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 52 0 R -/Resources 4 0 R -/Annots [ 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 751.923057 101.433071 733.173057 ] -/BS << -/W 0 ->> -/Dest (cb2-1) ->> -endobj -55 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 732.976036 99.933071 714.226036 ] -/BS << -/W 0 ->> -/Dest (cb2-2) ->> -endobj -56 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 653.081993 101.433071 634.331993 ] -/BS << -/W 0 ->> -/Dest (cb3-1) ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.134971 99.933071 615.384971 ] -/BS << -/W 0 ->> -/Dest (cb3-2) ->> -endobj -58 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.187950 99.933071 596.437950 ] -/BS << -/W 0 ->> -/Dest (cb3-3) ->> -endobj -59 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.240928 99.933071 577.490928 ] -/BS << -/W 0 ->> -/Dest (cb3-4) ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 280.647907 101.433071 261.897907 ] -/BS << -/W 0 ->> -/Dest (cb4-1) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 215.950885 101.433071 197.200885 ] -/BS << -/W 0 ->> -/Dest (cb5-1) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 197.003864 99.933071 178.253864 ] -/BS << -/W 0 ->> -/Dest (cb5-2) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 178.056842 99.933071 159.306842 ] -/BS << -/W 0 ->> -/Dest (cb5-3) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 159.109821 99.933071 140.359821 ] -/BS << -/W 0 ->> -/Dest (cb5-4) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 140.162799 99.933071 121.412799 ] -/BS << -/W 0 ->> -/Dest (cb5-5) ->> -endobj -66 0 obj -<< -/Filter /FlateDecode -/Length 4904 ->> -stream -xœÍ\[¯$·q~Ÿ_1ÏDñR¼† ‚pÇ Ià‡³ã=6‚£rò÷ó»IVw×ôÌ9+[ÒB»ÓUMv±._«/îjñ燿 -9SJ͉®·.?^¬ÉÑâ¿vÆæ ±ÿs¼:KÙDWS‰×˜²É5úœ®oüµ;”§¿]þýW—ÿÙŽqWojMÞÅë_¿0‹‚É%gV˺ °b49û˜VrK¬UcAŒ˜ÉÓ‘•!Õ5Ä ï‹Â*#PváȪÃgG b¸³Ârr8o­Êƒ –(x…ç¢IPzÒxÞ™Tª¯*/ƒç²×x!˜”ÉE§ñªI)Å¢ñ²ÄjÆ‹%:"«ñ …’5^‚,!«ò ‹/9h¼ Y<´S^,ð®¢ò ‹MÖi¼L¬…HåUðlÉåÈó6šXB°Ï9á›Aå!¢`¤”ž‡,Éƪò K Ök¼Y4p"†\Š­ž£;Øà4^„,ÞgRyÆ×À'ÈbsÒ d—4 ð9ªž4ð%*T4ð¥Ê9h0àk4”jÖp Xžw Y"% ‚ƒ,„ÈUy%TÒ° xÈ‚4,²x - -Á[4,€[²ÕiX€·d]Ò° p!¦Õ° qCI¤aA䕪†˜€€.Â=kX€º!&¯aAì*IÃ‚Ü ä¬†Ü #UdkXt4Á• awƒ³YÃî"Œ¼†°ª& à+Æ—b5, à®/–4, à®ÏH*/Ä`а€€»>b Zæîúh½†Üõ䓆pü±j5Ü„D½€,X ïÁóAÃLf<Ê "p×U¤?%¦VÆ•š4,ˆÀ]W`>•WËи·Ð²q)U "p‰*hX»€Ï¢a0Þ £z "p×djÜu¾Z "puCÔ°î` - ߌ³p]•W­¥hX»€%¯a²°±H¢ò²#9 ÆÆ¢Õ° w‘Þ«† ¸kc$à®%”=*²„â5,@]ÂV‰i«Æz …ÆîZ k<வ¹jX€»œ65,H™ ¾hX ª`¯aA*djÎIÂT-x(ùT^28Žd Bd©<ÈB™4,@amj¨EÂì!Kð^Âì! J P˜êP}«ÛÈwQ÷YP)jX$3¥iXcÂ~ ZÕxÉ›’×*¯€ç²†9“A*v`/e -‚^üárIÈž# r…, ŠLñ¨Ì5žƒ,(²5,@¥ žsYP jXP|Á.3Y ¡±—„ª5YÞg -%Ã¥¢†ì4”*²&4,€}x³5,Àæ›MlsTd ‘4,(Åóv³hXP -dñÖkXßäýfÖ° ZÈ‚ŠOÂj“á2YÃÀ8xÖjXP]Á~Ó“†ˆKÞo j°Øob‹§Äm ‰÷›YÂJ%¢DQyESU☄ý&ÐIã%Èâ+iXPSâýfÑ°eö›¨èÕ–@áýfVÛÀÝXL¸‹Ê4iX€ì7QÙj{{ àõ™Î,¼ã,jÇÀz#r«Ú2°À^d«¬ö ,À—÷HjÓbbgY’Ú5@ZÓYµm`¿¨Çè€ K÷I¶¨Ü!#g–Ì‹¬ Bu?öó´pç´¥?ö×?_¾}Aò½þù/¯¿j²þÇÁù¥¶±ö¾ÂÞÀ+Óæƒ[0 -‡Â‘Ê"B b1rbò¸µíÆb"#áÖëøá¶BCf–Ú¡œik£Í…±Yp°VHº´ïôSH{TýwŸ.À˜¥¿™®B‰H‚y¼½~úáòíwÿúýüî1ç§×ËýŽ£µTð?áw^~£>kÇí߸òp.}^híw{ÿaÛί ^Å\i™£ÑV:µóóÇë§ß^þé”L,vJõÊ-’E—ŽÆ„<~EêmkÌý¿{ȇ´¿*;Q”6Ð2¶ÿžSâE¼¥ƒ%b¿êbqPʬâníòýþáûùnÚ¥éªëƒ#ôÝjŸ~J»9×í4ô:|eë"˜»/ì3ìá)Ù„>Nsò%š’–Q7&M\ÛdÊ9 û·ž]A³è{Gü¼MÎwit nà±–( -‰pmùmñâä9¯©éÝC~^= qk=Ó“ýý|žô· Ïm°Øâq+Ö>†ÓûéìlNwñðóÄÏv\–%6 ì$p7ösââ.m¾´^㶪b]¢sÒ¸YÖ“Qá¾â?ÙèØ! ‹i .ýèÝcþ>ŽDýª‹©Æ¡ qÈ‹æÌ“XÝäüo¾qqý—Uè–ß^3Óú»yázž]iÿê -ÁöàXŠ}¤çÓS¿B½Û« ŠÎ°eEfä ;vEå¡<7æ'©`~ -W˜‚c[Ž±³ -¾u1_\Íã5÷§ŽÜ榶ÍØL½`Aw‚ûãS1ÖåÈÛÃøî|ÍÙìêT¿žŽôíîîõ<¶æÜšNéž¼;Çb 0½x»Wo›“±íó-ú -Ïq¹zM‹ôe]mÙ…`?îÚÈëñëC‰¬Ön3—3-¼g¡ZFð÷páéHë>ȉ„þ$æö[úµÆú?ó˜OÜöI1æªi€óÉ—–3¦?ä{€»s'–»ƒØ$˜ÒêŠøñ䘟;ƒLy!š§àmÒa£›×N3(Ðþ©%–å÷ËÎUòt!¿%½àž»ñœ´&0ûªB„r±0ùv9Íä·‡£GÈG»/F§lj¢\µÑO@LÈÜ­*lÆãø®½º‹z¾˜BµÏ§¸'Çür\”FÇj½^䄧ñÜÁQR°û„í¤#4æÇ8¨À¤U¹Þ@Ü=Ê)ÅWÜ£-ãXï1ìxtÞ#kÙ†ÝýG¸ö¹ªÏ"Ö­Œèþ|~E hBŠ®M?yÁêf¤ô0SXoàÍѺëŒU…§VÄ7ý(–Ô=²„†o²Ö{úxXo¤„aˆlÞØ=<Ý…‘ˆ 4U[ø±$nƒÛäã#ynÌ/F…Ÿº×nš¥ÀS²™pS`} —ݼpi-s®ü‘=o»Ðx¢@ôÄ;/ËN”ÿa®„:]u!YmtÔ7â>W¾ÇuPh·ÏZuzî[O ùå¸V¥¶O¨z†Ú¤qYôÈ­ô¦=S·=¤ªôBànã[ïvµ÷×ëãE¸šh_·v]y_öûEÎëyaÒ['û¶vqV÷ñ­îâÏC)>jó”¹EÝÝÇ÷ÖÖÆêè!õž’è¥éGŽXç‘-´"úO}®zoõké°êíŠÛ¿mÞçWN~¿rZ;_Ý>q•¤7Hõ»”ßçägK×yB B'æzYWW‰ëú¿Ðro*vÍÆÞ…“«í Æ]Άy|·3(,ÓZé_Y)N9¢°ÀÆZi‘#v«æ9¦óµ;8Ý*wôW÷úëw{F3Më7Ë×íZåF³«Þâ<óŒ»=ïÓï8?¯¼îÍ_ûvù»ÿ¬±ÞlÑeŠrÜ™~¢Óôó¬Üý–É£¨º›Èé‹wõq¾qz_çc…OÏ[3â‘æT?á Ÿ4å¶ñÜd“>MbMÒ‡ìŒãƒŽËÎ9.n+íe½Þº¹žv~RÖYæøv íWúÝùr×ë¸EF§:‹{ÅGþ¡ îWú ™W„®Šw>%ã{èëe磯sÞ38ÑóVN©c™Åú5c<`ÿÆ¿ßëKŠßt,í7í†ÏI¿‰bMNøÄóÙºÇeÓW×ÝmÆ“¼Û£ë%ٺω_•ÕïÄÅ•Æ掘>™6¾¹u\œêÉïõ´Ñs~[æšö1¿yB¢ûPÝ®ç)]½ê]—¥Ñ{Ͳ®µÏÝ}í<–ìxŠc`å¾FQõyªCRuØ}&O=t’¶÷Ÿ·2FQ }Ü–ìâIâÇÞ7ÇÚøÐÁ÷ow|ó ÿŸö8ÕcÚëñ¡ÝW_“¾BOaêvM{?>`X™¾µÁõ{¾“u½i»—gt8p¢ÉyªÃrðÅî{UØ]bÓ×úÆëÖ'x¿ÉXë×ø²ŸíSõÐSyAØkøÝùÛmÊÝ÷ -“NsF>䌑3“Àé_]·´ÒÅÓ\ÒfÍæ^V¹nšÌëµfÜä ü"E%ç‚"¯µäâû¢³lEÿíŸ/ßþÃÚÔs9g|¬ü¼ý -΄Ø^Àô7~1¸òm´ëÿ]þðăwrš¨ú%"7{§ªèé«1;óÞIœì÷#³Æ]åê5à®ìø#}WÎßæ=Ù뽚ÀŸ}|éêtŸ!ý¸Šë ì;Õß1çmrÒ©ßÉy¢ð;GÅ„øåEA·ßÉièÔïÎkÈ\⾆ìvÝå¶Øå°o9Á’}_eÔZú!ý<ÙW¢{^w9èÝ5æ™î`-eO|×ÿ´~¾NqcƒµŽÖ¿Úä·Ž«Ñö®Û=ãa=DdrÎÎ;e=ŸL«3䣦íÝÊ/'ç~Ðk+tR¤ÏœêÞk²ÞóEÚå5Y+ ÝËú³ã”Ü3žõX”ìC5þ9Ÿ©»è´Qè ¯'ëZÛ1o·×ÙÔëÏÔÖZ/ ç•Ý~ëÐýîq%j‡ÑÿðvÓkÕô´Ñ«Àî;ºJ]å)»ì'lzœëµn½W™„Nvcn¯k ÷ªû›Ú/{ðÔþÙYÕ郇þfÏñ¢×¦ù·´ëã}O9ä™G±ð“î)º>Å}}ÕëƒÃ^jßwuþöÓ\Ïݾ¶¨w‚óó[±ò]@þXFàwòèÑ“àÏù¹§ñ(¸Í¦xWK¹sëÐÞMáÎên¸§·gÁoÂ5æöàÎ3áÁe¸fÄÙ{ùî¾ñtI|L·ü¶C¾ÄÝÅúú› öVô®$?ºÖi º¹VEFö¶}LjßÃ'˜²Iw º™æTog¥þý²ì NÚ+‘Çôÿ(½{{° á=d¼ç¶^”ÐZ6òÿ~}‰.G,4Ôj*!Žå«{#öžò Ô&’_Ýî±í­±1%=«=éc¨f~áT35ß•eµø®¢ŽÚѺ„Uý½nÒ­ç]Wk¡«–ß·¥%<ÝZ‘ø}¥¼¾Š3dùrPÿ—Ô^xví£6ã<뚀_¬Ïzå§m‹ 人]S»ÞÙ¾%öã8‹ÿÉòGømófy°ž¿3öŠ•Lê Ú>d¹ø~0Éoþ)døþI2ןvÌEn{§Ý.žW÷g~iù9â#pÉ>ÇÇ>ŒŸ™';Þ˜k/©.Vˆ™Ü‘Ì«·Æ­dþœ¶ÇëQ¢ÄÔeæçlÆ„$ÏÎÉ.XAŒG¢—›dO]ÇŸ_ªK“8D—ªsÂüý\Ÿ…9ψ· .öÔ7•ÊñéSuíz;hAU5ö3‡AhØI!Ý. -ñÛ§&sð…Õ|ØÖ[‰ÆyµŸ§nõ¼u¶8,•ÇYe­]óS”éê¡ Å+´›xÐ)sº1bCÿ¹%'¶@·µ-Âoüx»D‘8Éo—˜•³ãÄ -ŽõH bÞA.vúˤæÒU…Ðì4~‘œÿ^ "*#OûÁos¹><šáØä­’$= Ô!MŽòžÏ ;ÎÛP…Ê=×.ƒÔ-Ù ¯d†°®Ÿ•’h»¸Ü$ÇáÊoò”3ŽPv\,9áîqÌ;Éi`ç›$çaqÇ_öòŽy…Ïwâ­%6Ú“ÙõK¿È${;²Ý¼˜ NÁ -“u¦t~úÞ‹8“âP\°NÉ6b²CÊ‹ Õ³ü$MøZâ@”|&fš•SwZ[…8%prbrò¢u#"ô‡Ãë«í¾Šœz0u@û ¾IêXSàéÔÐÓöpäœp僼SCc® b/Œ"g†Æ,-hs }TP˶žåE©Ó6í‰bÀh¶ÓÆŒ¹Ë”Öa]-mÅEÕR5ŤþEj:J« %Fi•t8—çíoTKa@Qºsž«³óÌQK…–äèA¥yfè´ãµi{ížm¯b4I³2µsX<œù!üûHì¨ !í¬þ§u4\™ßB¢æ¬}hŸ‡¶%%`ñþ2Ñâx÷˜óžÇ±³Ñ{òJ0‡¡lvü¡o]„70êc†˜ª\V­º¤÷)@iéL˜;¶ïÚ—^ñßÚ؇™·ŠüaçÀEoáïQfëô.hÝ´NÚŸÿ~çɲ -endstream -endobj -67 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 66 0 R -/Resources 4 0 R -/Annots [ 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R 75 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 748.173057 101.433071 729.423057 ] -/BS << -/W 0 ->> -/Dest (cb6-1) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.226036 99.933071 710.476036 ] -/BS << -/W 0 ->> -/Dest (cb6-2) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.279014 99.933071 691.529014 ] -/BS << -/W 0 ->> -/Dest (cb6-3) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.384971 99.933071 653.634971 ] -/BS << -/W 0 ->> -/Dest (cb6-4) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.490928 99.933071 615.740928 ] -/BS << -/W 0 ->> -/Dest (cb6-5) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 287.395585 321.344928 323.513505 306.344928 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://github.com/projectcalico/canal) ->> ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 291.344928 111.294999 276.344928 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.suse.com/c/rancher_blog/comparing-kubernetes-cni-providers-flannel-calico-canal-and-weave/) ->> ->> -endobj -75 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 308.171464 172.723346 401.561844 157.723346 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/concepts/services-networking/network-policies/) ->> ->> -endobj -76 0 obj -<< -/Filter /FlateDecode -/Length 5549 ->> -stream -xœí]K9r¾×¯¨óÃá#øx`ÃØd`¼Â,Ö‚­iFËÀ¬þûþ‚™|eFUVI½Û}°©3ƒI22#H&Ûœ5þ~gð_"£RÊ1ÐùòåôÛI«è5þ”'¦›Rü3þE6š¢ò&‡äÏ_˜à¢ŠÙÛÎÏ'ü·¹>ýéw§ÿžë˜³U9küùoŸ¸ˆœŠ)Fí…¢Œ"mœP佊Ñú £ðŠ9KE`ÃG²´/Š`ƒròRØ k“P”À†£hܾ(ƒ  IE`Ãd…"£Á‡±Z‹e`D9+”¯„¤2kTHÙf±,¢ÌD+•9§B$ãT–UÁ'©ŒÀ‹ÏÚHe¼xC¤¥2ðB.E©,€œËÀ‹MÑIe¼XH' e ¼Àº’X^tÐF*ËNùœˆÄ²Œ2bÚ—Yí•OÎi©Ìåa›N,ƒGAI! -e¼í³X^¼ÓV*sà…ðW*NxS¼Õ²w;íŒTæÁ‹µ‘Ä2ðåK`xÑ1HRŒKØeKØä%J -Ø”Åè$°Ù+ -9J8à´A™58 ^< œ/ÏËÀ‹Ë$a³àHXàx±ä$,p@[‚µHXà·¤³‘°ÀoI› aà‚M-aâºHÂÈ…)e 0×;%,p]¸{”°ÀuVÂØu”‚„¸ëÈh ¸ëjŠeà,aÐQ9“œ„ÜuFG ¸ 7²@« -v$,€­(›’–°€€»6i’°€€»6bË¢‚: ¸k=^A¹»Ök+aw-Ù a E´ w!^À VÂŒ÷(³NÂ4¦, `Ui ¤Ê€»Ú@ÃRpWë˜%,À]6%,‘ 6IX¢`+aAH¤rŒA‚5Êò‰eAáÞKX5%–Š$ak•]ND ^œµD ^2HX€ˆ@eƒè[LÀ ÌE̼ R”°H¦R&’° ú€| R•Ê‚U)®Å²„2%,ˆ‘†b#ar)•àôà‡K€ ”’° fðW‘°C‘J‘¹TfÀ ‚l é¢Ì ’/ˆ%,H6!Ë ZÂŒÐÈ%!j©Œ4ç™I‚DAq¨(aÜ™&R,/€  N¶½„H~l"ÍËÀ‹ó$aAJ–ÓÍ$aAJàÅj+al“óÍ(aAÖàŸ„YÅa²„€q”i-aA6 ù¦% à—œo& ²ÓÈ7‘â ~›]à|3JX ¼x„(bxAД¿&!ß:Ie¼ØLä8ßL Ì@¾‰ˆ^œHœoFqº¸ë3I*î"2 àù&"[)·×^ŸÉ…‰3Î$Îh@¯ÇØ*Nh`/F«(Îh€/çHâ¤ØDf™‚8k€a…F‹Óø‹xŒv˜°Ì>STæ1f¦È/™á„è¾åý1wå±e~ìo9}ÿ„Á÷ü—ÿ9}þ]™)« @ÝQàÄÚ³‹Ø u9!"RìºÎ äçS ׆ÌLÖgg¸"›ßB¼œ²¡›l²Ï3áÅBº3<0­ÔÎÛ@½Œ¯2ПA'Ä›[:bÅötïq¢†±íFï¯ó<’û«ýu!‰r¾œþÿ65Ó - ®RtJð|°ÌK±Ta¥ÆÜ•n0̬“˜¬t¤ýøÏû‹É`?Oeˆ³h½!cünÏB’´%Î`®À@‡(C3€µ;V’`:@§/€ nC7HCÚӭlj:€“  ‘û«ýu!‰r¾ü¿ÿ½®ÿ‰ø‡4ÐØ@W=Ò±#"-ª.ùU•ŽüC0’s»0Ìêâ·è¹]zšúóÈ„qå‚Ìä㕾ŠÉ ÊLÒ W)%Dc£t5òo¢Ezo¥ⶋi츋IäöñJ/Á- 3ý§÷'³ËBz…Çd 6,B,8ñ¬öû/§ïú·_þüîŸQ÷ýçÓ‡}ƒ úˆ­=ç%îÇÿ<¿ÿÃé_ÞóË!:sˆŸ]D’Ás;9€Ëé°×œdeuY‘ëòx´Ê‘4\ùsÞ_4¯ÐÊrj¸([N€`:#µÛ È×Î9µ[$Æ•ëY\¿üÇùýOƒ¸kQ‚¨À®Â?4€Óô en¹§Ï‹8 âô—&Φ²YS<»Žp; )íF-áúW\§åžÙ)4µY¯¹ìãJÉ»•µ4?Kqß6ÓË«Å…}Ù²xÑ ¦…a汈"­¯n×~õÊËÚW)¯}æ.ÂÒ¯[®‹ãò~´¾_áÏö÷«ïÎí3Z-ÏM¯pyˆsœþ"ñÖIĨA«}´Ê7€øæJµ×EøíÖ8ßØMÈWüc`–ìÕè¿3ÛŸ²¨2ƃŒÎÈÑ•I¼Ö~$«û꼶°¿¼‚™œÏVvîâ«'¸Ì–µ­XdX®+\é¦ -ój繦áùÈ´é¼(ç×j—Y40"ÔRw.~¸ëϧõ§íoAŸ†·¨õžŠÿ,×k¹ùØ߸• onj›<…B²ïY[¦9ƒ1<‹]²GÎwg·cP<ž’yÙ $qÇC£1Àc¢wvÓÁ]Fcx -Îè”P»û -£qn.£Ïýíh5ŒwWðÅ"ßÂà–4Oä‚ˆàˆŽ¬á®*oÇFŽ€€0ŠÆ°Œƒ³¸¹®;ý´U1k®ænGÙ© òÂ:1Fó~ Qe=à¶î«óv”À›b`*O$%Tû/?üykp:!gœý0‚. Š=h/y–¤õFhïØ«3Á•yQ¨]ߪ™Òjf”.ÓìµÕÔjdPLñóæ;£ÂÕgesCPï"ã t„KžÝ¿mmwUy3Æ檦¢¾âñÝ ’ðüÏÜòmD€*C|™'s"oW4:HûÎ:oG܎ǃLÚ½ oÏ~XÕÕƸÕK\Tøyãeaö¨>v8…²qùÓž‹ãàÐ’jhCª}‡ ,oW$¢ä% Ÿ úŠ©QV&[^WCò‘+«S·-í®*oÇÐ 2õ_ÒЦF?Qø’=¯Æ†ŸŠDj@‰œÍBWñ"¢¾÷¼ðí­BRo|8Râ]UÞŽSâ¥Zðò’JœmöQ}ÞœG¼8º¯OÿÀ°«ÓSsF*€14ÞsßWåÍ(™ †0fzIOý0Bý7xiØ÷í_óR²ÀxÞIiïöÒûª¼º2!Ì–_PS£{é¾þc^º¯ËK‘\)Þ&Íûb¬J¢æe¶ÛZ¾¯ÎÛQs Þ—žb~I5OîB·kÓëªG½£ó{ü¸mûþ¯úqäÏ‚îœùc½;Òð]UÞŽ‚oAñ>¾¨O~…ïêW>ìC¡×Vžw…²Ò‡ñø®ø¾*oFž÷®¦d£~AuÎ>®Î}ý¦Ît§ÛÚÿf¹´¯9{Ÿø‹¼¸ -gðÊEëÊÔ°¢V~úµ,,k«eµ*¬+Y~ûÝ°j—W”WçBféôeÕl@Çû"4ΞœrËâ³Í¼ÆoËRÌ~öñ:ÿ£¼¶4ë‚müΪ¹¶|S:=‹t]0|lÍv­×2»QÅÚ&«Ô˜ªæL,øõ‹§Ý{lM¬.f^±Ïä†ÊÅ$}7›²œº‰j×ßc³´ïÙ̦y.«ð'M&„²-VZÛ´Îëš/OV~'©íMgõÔ²^mûú´þ´¬¡·õò7k^ã”ÏŒlßUÚGàC5‰Á>Î&´Gª[&‰ Eé”’ok“T÷Ô½ -u/B]ÏO3rúúŒ_§Ó×½…—aÝ‘‰cg‚`â0ɺûÂè;ë¼ö°ÜVûC >¯š±fqS_ž%¿_Ü•Ñ°¸ý±©m®?]‹‚Ñà]üýÀÑFÛ~ƒxç^ê™ñ  ƒP!ZÀ}u^bÏÖËFhüŲç¯ìeÈNFqÖÜôãéï¾¾¸\¶]!¡ž§Ý±œ6äaWøÝþ=SâÉ0X½oi“Ç„G“ò–cb¶’ëBz[ŠóÃÛ - }iíjH#T9Á!Ý’ÂÓ~åy·{äÍ å[¸°´§Uä§ìZ 3½òPûjïÿ‘ëH<ðU9^–$à—©—iKÛ€±4À?‚`äÙ¼¨®UÙúu„wÖyí¤ókyÄËü‘¼U½º«ÉA€ú×2°,×OúÁÍ ]×ÌÛ¤uÓGPåRú˜4T>¿NQùå°vs™}móé¨vˆ*ŠYª}ĸÈ‚%Vã¾>+ˆ²‰âR'kNî•·†·pÜYçí˜(ñ¹†Ïèx¹¹‡¹Ñ¿+qûþOyÄôÈñ·Õ$N˜=\çµ'ÌLãwVÍÞVµäŠ «#{ñ<+Q2ð§=½ÌP\&48š©à½×’>2:Z³ÿ6Oú4LrÕ9Ø6Kpk¦‚?£ï–Ìä©F…ºÏÕ -æ3¶3òÄÌç= íÍd,ûÊ·mZþ&›ÐNÚœLØFر)¸s²¾šãír¯óº&lùô•ßI/ù=Îótxëb&³í[œHÛ Qu‹úM¬V3hƒT§µùÞ<‹£ÝŽœ‚BÜëRÛÿáêbD|nSØŽµ¶NËùîüõu›öä6í'Æî6„7©ÝÔ.‹²ìéoÑnïWsèßlÞâûw?¿ûý/ïÆÙØM”²é7Q÷r„âõÐŽ¨ök§U´ýÚð*AYÚ¢VU>·x5Ô¹ZÙf>pj@·³½j£Œ(ÂÇ8—¹uÄnEMHN¨œÂ! ÈÃu^EljüN”§ÿ?ëésº*Æ:ÀÝ7¸ñ™w&diÛçÑç|ãçlíó8-¦}´¡ý¼¬lOÏÓ; Ÿ×ùj õ]öŸ[iöÈ]ƒGï-zx P2õ÷߇®¡ÇŠ…çÜåÑ_EŒÛÈõ¢ÛrBái‹Üvy‡*çÒžú/ïtS>q+ÖU °ªkz=-:°•ç§Îk}Oýq£ûËb£’MÜ~Ïÿ|ø`á, üS]®ª1¼î²­mKX›Å[þý_OßÿÓê¸S_N…àåÃ{= ÂYÃß”ôg>8gþèOdx¨îwåûç©™ñUŽýð†4»œ‚Æ›viÝË,ÙúﲕY×Qá+öAºmhËj´b„Õ-¯’°âk}³ñ·ê».I[“ò¶G‡¡€ð ’OÑ@M¹)>¨ÌûNÅtìá*¯;«»“-Ü9sÃY(ª¯Î_nxSv‡ Kö×yå%û‘_ssÐ~|pæO×Áñ×¥›ÆET¨ˆ7ŽŽíÃøaGåU¯׫GÔtû2xÍ°½gàšÊqÛ¾Ÿ÷Ô•?‹0QÂ:þ=t±Z,߬!ŠÝÂ캓¥ñòi'~àh95Д“cuHÊX>Zþ€,ÏrúALÚ!][ÅmŠ€ÌùJÍr ÿoí)þ$ÍÇöò‘EãÍúü|9ñŽ¡‚@9O[2¯ÏoÉÏ'>O2QG’2×KÝÚ"Ó€©Ò.'x‹ÊÛ'Wz½ì‰ºëɇ¯oÃõ}­ÆçÜ‘nSu夷¥cˆšÁìÉüöZ™•ÌgÒ'åÖ»ÐX)#b%öi|¶7Ø+’ÓÑï‰z讓ù³„ú¬m—¹éÄÆú(:3¨¿>kã Î[ÄË Ýº-õY¤òIص©*] Þ•æ¦r£úúdS5= ¤ËI ~§kÓe¶òAk|žèBLÕ¨=—ësérŸ[[óMS±=•zÕ\%ßYé¦îR¼@» S+‘Ã÷ÁG0œÙª‡‘XU×: vcwÄËÉSóÄN~>ù(<í;Vh_Mo$º¡ÝFNºÛK§ò1'Ë\³Òø4Fþ -ߨŒ<åÂP3)žmíw½öÍFž…4ÒCC’$ÀßñšmÇØlv”—IZxžA·=Ý$6Q‘ täº5xÌdÓ¬®‘ª|VŽD]™àcáÙ7S~žÈOß\ÕëÖY0ƒ¹ûÖn'‡†Ï#96>·ñÛÚl¾/e`£-™M?ÕN:™?«æÓ:ˆ1€B'w}.äê­ øW~ÔËîdÒˆ{9ýõT†9ë¼å0?ðáTnŠ– ’p}þþý׉Îïêñ¢Ë8nuC Û°u"#ÿnt'™WH%6·ˆ–Øïd“ú³¾ZCÇùÄ™¸¡quݽ>i‚šV:}—á@¶Ít­qƒdü âe#ÅÈ|«nú€½ÜºúrèÆñÁ´•+>Wrà·©—¹>$Ÿ‡&qÇö!¥d‡Š¸ÅíÐaîœMl²AŽ4Ñ3ÿ4ªÂq_ÃÍFð­ëeÔ‡Ù±éJ+o1<‚Ø7cüšÑÛÊ?Ó_í^߬÷•åP=€© Úõy¤¶cj<™êÊm˜oÛ˜ãÊQDÕy»„Z[nð=ׂœî=´ éf´Ñšzµõ?vJ•6uZŠ éJk-ÆÊSX«U±”7N¢”b‹):õ¯£¤ý¨•&D?j%ìžåvëˆ×¢%× ?šsìo§û“-–L-Œµ•ú“®Òö}ÓÜwmÏÃkPg$ôÈT÷j~÷äWáß×øŽ8Á,=Uÿ– “úܨy+µuåw¬é0„ø×dDJÃÇÃunÏyìg6êœÇØÔ¡È9 ÿ¶<™…gäã‚¡©ú›ôäjY‹¯ô˜„)sûå×Î -;í6rªÈ¿ÍqЛø—ºDmäo±ž¦©“ò÷ÿå·l -endstream -endobj -77 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 76 0 R -/Resources 4 0 R -/Annots [ 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 715.084475 101.433071 696.334475 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 696.137453 99.933071 677.387453 ] -/BS << -/W 0 ->> -/Dest (cb7-2) ->> -endobj -80 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 677.190432 99.933071 658.440432 ] -/BS << -/W 0 ->> -/Dest (cb7-3) ->> -endobj -81 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 658.243410 99.933071 639.493410 ] -/BS << -/W 0 ->> -/Dest (cb7-4) ->> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 639.296389 99.933071 620.546389 ] -/BS << -/W 0 ->> -/Dest (cb7-5) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 620.349367 99.933071 601.599367 ] -/BS << -/W 0 ->> -/Dest (cb7-6) ->> -endobj -84 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 601.402346 99.933071 582.652346 ] -/BS << -/W 0 ->> -/Dest (cb7-7) ->> -endobj -85 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 582.455324 99.933071 563.705324 ] -/BS << -/W 0 ->> -/Dest (cb7-8) ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 563.508303 99.933071 544.758303 ] -/BS << -/W 0 ->> -/Dest (cb7-9) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 544.561281 99.933071 525.811281 ] -/BS << -/W 0 ->> -/Dest (cb7-10) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 525.614260 99.933071 506.864260 ] -/BS << -/W 0 ->> -/Dest (cb7-11) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 506.667238 99.933071 487.917238 ] -/BS << -/W 0 ->> -/Dest (cb7-12) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 487.720217 99.933071 468.970217 ] -/BS << -/W 0 ->> -/Dest (cb7-13) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 468.773195 99.933071 450.023195 ] -/BS << -/W 0 ->> -/Dest (cb7-14) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 370.326174 101.433071 351.576174 ] -/BS << -/W 0 ->> -/Dest (cb8-1) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 351.379152 99.933071 332.629152 ] -/BS << -/W 0 ->> -/Dest (cb8-2) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 332.432131 99.933071 313.682131 ] -/BS << -/W 0 ->> -/Dest (cb8-3) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 294.538088 99.933071 275.788088 ] -/BS << -/W 0 ->> -/Dest (cb8-4) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 275.591066 99.933071 256.841066 ] -/BS << -/W 0 ->> -/Dest (cb8-5) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 298.350419 124.541066 391.740800 109.541066 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/installation/) ->> ->> -endobj -98 0 obj -<< -/Filter /FlateDecode -/Length 5345 ->> -stream -xœí]]¯ä¸q}ï_ÑÏ–ËâÈ"A°ñbd‡;íÁã<øïç%~H*µÔ3÷"ýàìL«È"Kä©Ã")Qæªñ烿•RŽ®·/—¯­¢×ø¯äX\”äŸñôW£)*orHþú….ª˜½áúzÁ_«Ë1ûë忹üÏRÇ\­Ê9Xã¯ýÄIäTL1j/$e$iã„$ïUŒÖ!)…[ÌYJ‚>’¥mR„”“—’`Y›„¤3Eã¶IfØhHJ‚&û($ ;ŒÕZLƒ!šÈY!ÍxÐèAJ³F…”mÓ"ÒL´Ršs*D2ÞHiY…|’Ò¶ø¬”æa‹7DZJƒ-äR”ÒlqÁi1 ¶Ø”a‹Eëd!-Á +‰i°Em¤´ì”ωHLËHÓ)¦mšÕ^ù䜖ҌQØtb< -¢faKÐ>‹i°Å;m¥4[¤4ð„w1%Á[-{·ÓÎHi¶XILƒ-è|‰l€-:‰àAŠyI⣢lI"›œ¢DIb›²¢D6{E!G‰œ6H³F"§a‹§ 13°…à¹blq™$.p¶ ƒÄÎÁKNâ¶% Eâº%Ä|KÚ‰ fj‰ ×¥@8P. ”%.pà\ÀtáîQâÖu>X‰ h×Q -8ð®#£%. ð®sÐÓ` ,qØQ9“œÄÞuFG‰ ¼ 7² Wp$.V”MIK\@à]›4I\@à]1ˆiQÁÄÞµ· Üà]뵕¸€À»–l¸@Qà-Fà]Pˆ—ÃØ‚•¸ã=Ò¬“¸…)‹°DâÞ5ßàÓ`+eRxð®Iè>1-+Ñâ‚ߢ•• !K\àÁ»¨œÄ¼ úL€ãFT+qZJļ‹¸ÁK\8(ƒ@âŒoÊh@WLËJç”$.ðà]Ð’•¸£°Ò L"¦E ‰ @ÆJ#•¸ €w1¼g‰ xW{ç$.à]M{Ä4Øâ’•¸q ÒංO#XUÚ‚)¤4ð®6èa) ¼«uÌð.›„È›$.€ -Q°•¸ $R9Æ qAÈiùÄ´ pí%.ˆÊÓ` E’¸µÊ.'‰ ¢…-ÎZ‰ ¢…-$.@D ²Aô-N` à"ζ R”¸L¦R&’¸ ú€ùZUJ V¥ºÓÒL”¸ FRŠÄ˜K©§—¸¯8\’¸f ÍÄ1øŠÄŠT²ˆÌ¥4[dK\€HiÆH\,lA4(qA² ³Ì %.À¹$šZJ#ÍóÌ$qA¢ 8T”¸n‚™&˜RLƒ-  ‰ Ð?<Ùö`òƒÉ&¦9blqž$.HÉòt3I\l±ÚJ\lò|3J\5lAÄ'qAÖAq˜,qhiZK\MÂ|Ó’ÄðKžo&‰ ²Ó˜obŠ'ømvç›Qâ‚L°Å#DÓ` ‚¦,ø-8 óM°“”`‹Í$qAç›I℘o"¢—Ï7£¸\ÞõÌ$¥w™‰ pù&"[in¯A¼>">“Ï8“¸b A½c«¸d Á½­¢¸f A¾‰OŠä '5ÝßLAˆW4ƪÙI¿Iéȳ1>c&rm? ›:y2êÃįŒ´¨ÏcšŒ_.ÈF>®ôMF®xgÛÎ?ýrA46í…ëÐvI,b+ º¿|¹üøÓ¿ýú¿ÿ'”ùËçˇ1À -J“áù_3Ënóïžcâ·®ËïÛ|Íùý$«º>Ϻ¾ëp––Ž²Í\ŽS -sY«|hÖéßÛ²~ût=×]òÛz/¿ý¯ë/¿Ûi‹<¶E¹ýЋ¦Ùt¾åzk»&Üúo‡|öþOsZ˜õj^?ÝÖÂô¡©µÛ˜ÌëŸä¬ª¶&œ[É÷»ýç_x³¯¨ÿû¿\~üÇc1“T„W¤È«–„)_ȃø•7 sN¿ÿvùà ˆ¥Ü…˜1ÍHü -œWhE¸qCñfY !ÞEʲ«®çv.Pú4µimë?3ÿ®3\xâB Ë¿‡~û<÷Mô¸®Ï³nìPuÇÏÐiÞåvë! Aé¯f`W“•Õe׶QÎÃ*G„ãÊ×íFŽý«¡ÁIÙòtƒ™Xh_+Ÿ:·]òÒ§ÜÇ¿þç~ýןz—¶Ÿ)…Û×Ì´R\¼öÚp„/xN Âû—Öû2çß6âã:OÑŠ£ÙIßkÅŠxó§ ©úe úJ!z šZW¿y+ -P³ÃhÖ6¬½µxL˜ê«¬ÇuL¬·dFï»M%ožPóæaPÑ’7.¼ -ÓÐŒi¿{÷À«Ty - ë<´Ûž+Z×9…š{¼á/Žž4g~ -1dïŽ0}Jåy Mnì›(G•‹µz¦è—-Õ³ÛœžOãhãJ¼[ o·þ¨=ÏéŒî7m ÜÚE7"~42ÛòH E~)„WžP{Nçiøøkc¡¿³„°j´“[§¼Q(¾Ïg´"ï9š&D!ÞâÇYîwÄ9çéˆXž5‚-Çïø¾Áo L½Ývö3}WÐ{Ö¾0ÜÏ:Íïس¾§ƒE‡uÒ…?ÉóEâ¯LÌ1žŸ/žÔyˆfŒÈ.R’¹âï±àXð¤;Ôµ¡–ÏÝw‰Íýœ J~ÈÞHü:‡½Æ¡¶îˆjÏ©< Œ½-kéüÖ”8äiÂi|·2~.Öèº.*û00Ⱦ6oƒk²^ÒîÑʾ~&¥3¿‚ è;Ì~IËÆ{JüWˆç»þ”Êót½ç‡ãlŠyg+wÕÕ¾G3´N;†ÕVŬySiYñƒM'~¿0èடŽwÞí1œSyžNˆö¬÷Qö¿:„œA:Z58Œ[ºX!ŽK -.þ|Þ7åîv\‚Ó‡}*Ïúiã˜zîœÎÓtFø¦D}ÜuveH¸ýè]Uò¡Ž|zµDwà{Æðë¶Îf¡¼C -¶V+Ã/%AûÄÝX[^ˆ¡’~yf@Q0VigÈOÏ,ú)M9Oê<ˆlà·4sðï ¢E% >CÓú$‰íkeVr‚Ü=©ìÑŠA¨ë`|zf‚ö€E«œ‹‰ÖÍY†±O‹ïÌE^J+¯ñs#ÑaÒq°s:Ï0ñß1}W–ZTr -`uj:.LÅóÑÄ™MÝÇ€³Ñ>¸d˜d¬–ôï•!>pŧÑNê<à8ÞÁyy¯ú·¨äà6 sG ¡PÞ­A¨íb#n´Ï@løFÿ.ÄRTÉdïø1Hƒ;˜ž€»±s:O1~-™Ÿìó;{õo±e%e(y8˾ý`šÊ+m3˜­ ÇÀËè6³•´O´•bеIl;ƒiä˜=Yë¦cv2EŽ€wRçy€WÎ1|†Î;oQÉwï;ÙJ›8i£}ˆÆ+ŽÞÉú÷pD™_&O¶œ¿DñˆçtžˆžÄø°ó$ÂÛqQÉwñáÁ·GX[+Ž9p`Ðö™ÁwþFÿ.ôxÔÖ1”§XÎBïœÎó@/"X°`nù©¢7‚Þ¢’½øN|X•†Í -»ÚSû|žûnly€í¸Ñ¿ ÀÄk-|rºL+”æòÑÎÛI§`Ò4ääÞ“û–•|—L+§IëãÇË©ÃjضŽc`¹XèHGAû °ú¤Fп³—P.Ë©!gŸ²>©ó<À²üz‚õvgK÷m€µ¨d¬Ô7T¶e©/ oµO-ê¶EaAÿ\F_y>Zèìc·çTžFž_.ð˜Õ¼'Œ•­vîËÓJ§7G·åChàFû „nõïA( -|tÎ#\tNçy@y˜ˆÙ¼+-*)¾[=âññlJ{ˆ…6Ú²ÐVÿ„?OËG;”ó—£Füs'ÔyeÍÞj>ôöý ´¬¤@hx4öÌörç mYpÐVû1jç×ù«úŒy}^¨ÝÕVÙxe’‹|–ÛYXÔyXY~iaüØÈÁjQIÞ^¾ R›r‚ÔFûAHmkR„)ÊöüåIçŸø…ã÷„Ô¢’ñ §qé`|.sñ~Û‰€¼ÏͶuîÏ̶Úg`×7œ¶úíÉJZ-‚ÔxQ†°5FÔt~·ò¤Îó@/ò žB~W6[Tò¡®Fí½V½~R}ý¨ëy mê}dßr«ýؾ¥ '"ËåˆbàÆ•“\tvѽ¯uRçiÀÆG=(“ùpîwDÛª–q‰añª};Ä:Ó •=Bu‚úc\'°DÙÏó ‘_êse—1ù<;Ú u˜åIÅÎíu_ûÉ";çq•£¼"RÀâ&säÃr¥FÖÇ•ÙÃîr=ÔÃÔýÝN€³ó±VS¥ûÁ=sPU)yÃtš…“ŽÜÊs?ÔU Òƒ-Ÿ6ÍÿõÊaͦدWcù‹>WLÌùÍ¿˜¯|@tÒŽLmnSÈ\w4Ëw¾¶\ü7Dš¿–À'e—î/æüÓik_.&ò=²÷LŸ1ÑEÌ›0kñë…?cC‚˜¨Es$fáüS·²È´£mªìŽ‹*¯sòéóÏvO9¬DÏNQï†õ}UsÓIc¶^1v§Š!4ƒÙŠ_Ëé@f󧀒róUh¦øPm†°HcÞ^`W<ó®Dú­PÕu±¥já£ã[Ó….l¦Mg†î¯ymºóžðvAµn-}¥ü’ZTm]«›Ì Få&õ5gëjý$ˆnAøƒ®E:³¥½ÆǸOÂTD-_®ùÑí"æ›Kó­§bË•ºj®-ßMéPw©5¼ +m4K#ÛlðíêÏ¥8pÔ¾ÖiÀÝoŒ9´¿^|rûΞòVè†r›8鎗.©6\³Êølþ{¢ -ߤÌ<凡)>Ⱦ_õJØ7›xÙH£<4Ö!©8Ê7)ÊŽ±avl/>êl›ŸI·ån-¶M6ÈcêVthä±›†º&f -«íÓ¸rêjºÛľAùu!îvúæª^·Ê‚àî[¹]w¾ŽâØzÜðW š½­ÜóUx+­Å ýT+éb^í¨ði• ÂnH¡‹;¾qõÖÆNü8WýÙLqo—¿\Ê0g·…gø#;c´d®Cžßáÿÿ¾Ðõ÷õT÷i·º±…mܺ#’-ó'Úª°¹Í ´4Ð~›ÔóúŠ†6Ž[;ð5uu݉½æ4AMK…¾·á ¶ ºÖ¸¡eüámÕŠ-ùÞ¾éötéêÍñ,‚¿P­ÂÅx;¸L=Íõ!ù:‰+ÎÚ‡t¤’q1ŠË¡ÂÜ-[˜É€+iMÏöÓؼ…2^ a_ºžF}˜‹®²rC„Àn¼ &3VšöF³{}w¿Ï&‡ê,mÔÞ¤¯£´ÝKáÉRW.Ãò²9®LR«óöje¹Á÷\ rºkôЂ#Fiêjs?VJU¶¨´. ÓUÖJŒÕ¦0«Õf)wœÄVŠ-¦èÒ¿Œ-íÇ^ièÇ^ ›¼\nñZ´äZäG8Ç~wºçl±ddaÔnRê9]•më¦eÝu´½·AÝÐ#SÝÕü&ç7ñß·øŽxf·”«þ)+&õï ` &ÃgU–OÛê8„øëd‘Ò°Äñ°Îý5íÊF]ókBw(rNGÃ)–MxEB>NŠª0–Õ²oé±–t:ÍmOXwí°Û²°Ó.ùfË¥uô&þ–^Ô;'®\,”?ÿsp’o -endstream -endobj -99 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 98 0 R -/Resources 4 0 R -/Annots [ 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 289.074296 784.370079 316.109452 769.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rke/latest/en/config-options/nodes/) ->> ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 650.584475 101.433071 631.834475 ] -/BS << -/W 0 ->> -/Dest (cb9-1) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 612.690432 99.933071 593.940432 ] -/BS << -/W 0 ->> -/Dest (cb9-2) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 574.796389 99.933071 556.046389 ] -/BS << -/W 0 ->> -/Dest (cb9-3) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 555.849367 99.933071 537.099367 ] -/BS << -/W 0 ->> -/Dest (cb9-4) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 536.902346 99.933071 518.152346 ] -/BS << -/W 0 ->> -/Dest (cb9-5) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 499.008303 99.933071 480.258303 ] -/BS << -/W 0 ->> -/Dest (cb9-6) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 480.061281 99.933071 461.311281 ] -/BS << -/W 0 ->> -/Dest (cb9-7) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 461.114260 99.933071 442.364260 ] -/BS << -/W 0 ->> -/Dest (cb9-8) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 442.167238 99.933071 423.417238 ] -/BS << -/W 0 ->> -/Dest (cb9-9) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 423.220217 99.933071 404.470217 ] -/BS << -/W 0 ->> -/Dest (cb9-10) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 404.273195 99.933071 385.523195 ] -/BS << -/W 0 ->> -/Dest (cb9-11) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 385.326174 99.933071 366.576174 ] -/BS << -/W 0 ->> -/Dest (cb9-12) ->> -endobj -113 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 366.379152 99.933071 347.629152 ] -/BS << -/W 0 ->> -/Dest (cb9-13) ->> -endobj -114 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 347.432131 99.933071 328.682131 ] -/BS << -/W 0 ->> -/Dest (cb9-14) ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 328.485109 99.933071 309.735109 ] -/BS << -/W 0 ->> -/Dest (cb9-15) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 309.538088 99.933071 290.788088 ] -/BS << -/W 0 ->> -/Dest (cb9-16) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 290.591066 99.933071 271.841066 ] -/BS << -/W 0 ->> -/Dest (cb9-17) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 271.644045 99.933071 252.894045 ] -/BS << -/W 0 ->> -/Dest (cb9-18) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 252.697023 99.933071 233.947023 ] -/BS << -/W 0 ->> -/Dest (cb9-19) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 233.750002 99.933071 215.000002 ] -/BS << -/W 0 ->> -/Dest (cb9-20) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 214.802980 99.933071 196.052980 ] -/BS << -/W 0 ->> -/Dest (cb9-21) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 195.855959 99.933071 177.105959 ] -/BS << -/W 0 ->> -/Dest (cb9-22) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 176.908937 99.933071 158.158937 ] -/BS << -/W 0 ->> -/Dest (cb9-23) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 157.961916 99.933071 139.211916 ] -/BS << -/W 0 ->> -/Dest (cb9-24) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 139.014895 99.933071 120.264895 ] -/BS << -/W 0 ->> -/Dest (cb9-25) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 120.067873 99.933071 101.317873 ] -/BS << -/W 0 ->> -/Dest (cb9-26) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 101.120852 99.933071 82.370852 ] -/BS << -/W 0 ->> -/Dest (cb9-27) ->> -endobj -128 0 obj -<< -/Filter /FlateDecode -/Length 5053 ->> -stream -xœÍ]ˮ丑ÝçWäÚ@Ó|_À  Ïb xc -mØ/ªsªl·hÏ¿ïJ‘¢’‘)*ëfµªPu¯ 1Dž>D™³Æßï þKdTJ9:_~>ýrÒ*z?SŽÕÅ$þ#þE6š¢ò&‡äÏ?s‚‹*foc8¿ðßÍe›ýíô§ßœþo­cÎVå¬ñç~f9SŒÚ ¢ ‘6Ny¯b´>¢`1gI3|$K½( ÊÉK"˜AÖ&A”`†£h\/Ê0ÃFC’f˜ì£ 2v«µ(ƒ!šÈYAf¼ -¨ô ɬQ!e›EY„ÌD+ÉœS!’ñF’eBðI’lñYIæa‹7DZ’Ár)J²[\pZ”Á›¢“d¶XÔNd ¶]I”Á´‘dÙ)Ÿ‘(ËéS/³Ú+ŸœÓ’ÌåM'ÊУÐH! -2 [‚öY”Áï´•d¶þJ2ð„w1%¡·ZîÝN;#ÉÒ0XUy0ÕÖønPç8³aêù•œ¶.dr%ŸβïïL—!YoÃ6ð–Y¯=P¼oдI¬ÎÔòúM$âùÇщ…Aã×yá$½x«B¾ -x_éd(u6m±R§=DãGïdý‡ &ïn"Ø,ÙiÅ- ŽéˆA!¹WqUÈWq·ó]"¬ÞŠ=“Z½ö¾Y­^ÿ!ôRäµ^G²1)“xWèôÆt=ÞÇ•LFøüBè­ ùXøªó<Ãhž"½‘µS«eÖ±N½–)×ØßoÒ»,Ó³ÂêcÓ-.òŠZâŠîŸc›7§ýYÆ› hðf&«yPÐ0Ý‚î¦R°¼ÀmCV”ÉÙï ÎqÀkp$‹˜ã•à]ò x+OÚµÓ^åqͺoýÀ Qå@1'á¶ÛÀ¾Ónü^ÿphÓN»nð¿2:N›-wLç8Àõ¼È‰@9¿¸«B&à:„¶t]ÈjÙôÒ¸uM¨éSÞ ¨ b0RuA 6ouz“ƒxçI¯=T–ŒIGI¿ êLízt1Ìw‰×Íw@wLç8Ðü2@D$ÿJè® -™&„¨qþ%n¥ŠÂ’Ò2e &¤5—±A”³ÄK”€¥`ã6T wÚ#Pm Þ×P^j¥ÖTØ„lJ y(Áåk Ñô4oô²c:‡,iÞ?¨ù½—×Av]ˆ&TFô äbßÛáU«Wáîšá"l9x¯íïŸðÞz1§sǸFWbuŽ*‹ÃÙäý~Pío‹@‹zsSèj¢Ü4½¿L}¹`Ü+/Óä}Y{¦É{í}Óä½þ>WÌ´KÓ+c`ÞiKòcŽé‚¡Cö¨o ÁU¡¥hñfL^ùG¿ç6©eR§·hÏlf¯½o6³×ß¿S -7Rü®§£éýÔ¨£v[NxPç8`åM½>Yz‚/Çðª7ú–ÿŠÃl†?5Z*ØMð5,Ù•x×)ò4¦6ÄÛv†â˜ÎaÙk8q‹ßžØDõ4#­ }­SìËÚã{í}N±×ßç=îšAZ–Æâ Îq È/&ŒªŸØ‚õ<W…®œâC'w3ÅB‚úawØÛ²ÇöÚûÜa¯¿ßz$lH–×~øµ°ëëHa:¦s˜zN νr»éº:R8CÏ0+P w ·k<ùnn¦¯ûçØ3}ÝkîõŸ€4¼7À`üø*ö Îq ÍgÃèÌGl¼Ò«BVÎ> +ÓÒ*Š°úÒN\×n±´¼ÙÙu/„*zkÍŽmªƒ:‡BÐüvôt’ηsÂëB_öeí‰{í}q`¯¿/ & ?o ŽuŽAǯ¹‚¢o ÁU¡¿nØÛ²'ìµ÷Žþ~§‰û(‹î¦Íø#ƒ:Ç©çwÞ¢1[¿†ß"[ßt×kdwàºâ—ÛÕÞ&õ~|;Xoé=·oœ×?üÚ ÎqÀØÍCû•›±Ö…|ý;hýýö¼ƒÖkï{Mа·$d‚²ÓÉ (ÜÍå­‰ÖAÀ(j~gÎzýÊͤëB^ûZ_Ö=Ž@H¤tðõO< ¢±~£yuŽÓ¼|æ@BÑO,f?׬ ]í6(¥‰YV±Ì­ƒù$Âöm`ïíÙÛôÚ¥V\ãÞª…‚µöó}WÚ¹ÃY×…ÖEÞŒWqmoåM¸ŠÃ»ôÞ¡@$«œMŽ÷õuŽÓe<‡1å'¶,=ßeV…¶c´ÛÍ9·±WݳüÓ%Ÿ¿Yo]-gíØÊ´lFêmݳë®×^jªƒ[àíñ|äÙó)b)ÙÍíFƒ:Ç[â}ÚšÒ•àæ` ý2ó:¬M×¾o9ý§ëõm:çµ³#u`P{™ïóÓœ—®ùË= ® C¦È?]ïåô|0—UòñŽ6ð‘þ2nså¸]w6Ÿ¦æ]ŒnÆt‡4ÊèøÈl ߪ¹vÁ©)ÏÞ–í–iSWܦm¸ÌÏR˜m–³½m•á‘ЪÆ -iƒ:LJãwÕx#Âãù7C«Ë&´J³áÚÌåÝá)hÝñ™ÉÙ„ì1¨sxxv~)DyÛÌó=îÍ öÎ%>ÒÐð:0ñ~‰ÞނǘÎqà‘ø-ƒj¹ï\~õæù'w§iQ÷#/Oã/Z ê¦i³æwšH‡o¹‘e]èÇvx+¼uÞ>V7×µs?·;Bw—Ð۲縄^{ßq B阮17|{ïšdg“• q:{txPç8vüfSˆá•[\Ö…|Û³Šú²÷œUÔkÌ|/K'½þ£wÙ3á6gÚqVÑ ÎqçÙyÃÜWž¾¶.äÕgõ¥íÙgÐkïÛgÐë?„z(ÛÀçžU4¨sˆ%~K‰¿ñJˆ­ -ùuÎ*êmØå|;íη¯g¡€xïœ?«hPç0À›ŽÞ6‘½rwÝM)Ç8­H0jÏj ¾o+‹pƒüã|ê9é|bà #Èö¬õ -ÁÍ,ˆ›ìÏ?››3¸Ya~.ø§øs‡ünñ– þBé‡ÿþñÏø]3£à¯Ë[þøKÍÅÿ#Ió'¢xCÀÔíÅœÿ—©¡~>° ?#÷²ë·Ûô”ÌÛyo“ßNüí>’†ÙÁdNœÕõ^¼%ê&í.Œ*ßæt^éù×\oî|ùÕúò4¬ï‹o¿/WŒÝkÁB"4ƒé“ùé5å×d>:6)7_…jŠÅf$.7¤6ïrÃEq3™wv,‰¾OÔMqK2€\òÚúk®mŽÄjz[u¦iþ’×Ʀ9%^N(Öݦ¾‰©üÕµr«R»V×4וkª/9kƒPm'!ér¿ÓåÖ ªSâGmÄ)sYMLÿ ñkð -endstream -endobj -129 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 128 0 R -/Resources 4 0 R -/Annots [ 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R 151 0 R 152 0 R 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-42) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-43) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-44) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-45) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-46) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-47) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-48) ->> -endobj -151 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-49) ->> -endobj -152 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-50) ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-51) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-52) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-53) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-54) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-55) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-56) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-57) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-58) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-59) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-60) ->> -endobj -163 0 obj -<< -/Filter /FlateDecode -/Length 4897 ->> -stream -xœí]]¯Ü¸‘}ï_Ñφ!YÅ/`0ƒÍCd`Yìû`ßµ,î˜äaÿþžR‹ժÝ;cØÓªb‰%òð°H•$w¶øóÃ?™É¹¤Èç—ŸO¿œ¬IÁâ¿©Äê`RÿS8;ËÉWbçŸE@ɤ|Šç×þ¹:ì‹¿žþýw§¿¯mÜÙ›R¢wáüO¢b2)§dƒ¢*PYGŠ*“’QQEgp‰¥h*¸{ÞªÜà’ƒ¦‚ì}VTn'G[U>9ÖTpÕ•³ðÃykU±Ìä &¢Ñ£¦óÎÄ\|Qu :—¼¦#21± NÓc YÓ1| Å:MàKpÌVÓÁ¦œ4]„/ɪ:øâs"M—à‹GëE—á ЕU|±Ñ:MWÈ„’™U]Îæ”·:oƒ ™Èj:çL6IÕaD¡“bRt¾DŠªƒ/¬×t_4x"PÊY­^F7Yrš.Àï«:ø‚Î×ÀGøbSÔ(#È/iàS2\à´™¼ëƒõ0x׳(ücÕh¼ - z8_@°`¾‡Î“Æ8™ñK4.à]W0ý)cle\.Qã‚ÞuݧêŠq -®Œ[´²q1 xi\À» Ï¬q8Þ`Fõð®#ÌÔš¼ë|±ð.↠qà` 0¿g]UWŒ-9k\À» %¯qfac3˜DÕ% 9 @ÆÆ"Õ¸ ‚w1½ "x×" "x×2ÂU_({ ×@‡a«Œi«Æz0…¦ïZ‡Ötà]kSѸ ‚weÚÔ¸ &ø¬q4ˆ‚½Æ1³))E b±Ð!äSuÑà8h\,”¥êà 'Ö¸µ)T²ÆÉÃò^ã‚äá B ˜â}«Ëø¸¨ë†/ˆ5.“™\˜5.H!b=†VÕtÑ›œ@ת.Cç’Æ)±ÁTì4.ÀZÊd z @ðFÂ% àtŽ5.H¾`¨h\€©ÈdÈ\Ó9ø‚ [ãDºÐ9§qAöðÑ ÆÙg¬2£Õ¸34Ö’hjMÇVÖ™Yã‚ÌÑH¨¨q† Vš`JU_@ d±4.Àâ‹M,sT|¡Àäìe¹™5.Ⱦxë5.6e½™4.(¾ âÓ¸ Øh$LÖ¸4µ—±Þô¬qÆ¥¬7³Æ…,Ö›Xâ)ã¶P”õfÒ¸ 0| QT|AÐT”q NÂzì¤é"|ñ…5.(1Êz3k\€0ëMDôê–@–õfR· À»¡€™4x‘iÔ¸Xo"²ÕÖöÄâ3]™eÅ™Õ ê ˜[Õ- îÅl•Ô= ò•5’ºi7±²ÌQÝ5À´ -¥³ê¶ÿ"ã '\vŸú-ª8$Ì™9ÉE FtßÖK1ºQì²?ö¿ž~ÿ“ïù¯ÿ<}þÝ´SVÿ8€Ÿ8ÊÂ:ÈñÝ º2ÓéíÌ$äÉC8øq"•ÅIZœ7ÝÄILŘn˹ýpk—á±øìÌLWÆ}½X)8tEÝ×Ý6_ËWªõbøaù€àíŒ|Úý`œ6c=m`v®î4ùž¢"‰"JQñˆz-¯ -ÿøî„a4WÙ¡m‡ß˜ÍëíùÝϧßÿôŸÿöÓDµï>ŸÞ/áÝß¹[ÿÿ¯ó»?Ý©1„u)€VuÈiÇËiø¿Ýü«mΗßá#þ¦ùw€œ¯ô³M(?Üw‘‚bÔÌ['Ü?4žÆ%–É[ãð\Ø!´QÌé.Æ^êÿû5’r0Œ°.ƒj%pý𙼠|ÏÀVÒ.„=s«:ä´gœ}ž±S±4Ë+ÞÆÂŒ¹¸`•&A1QÊÌ[Gp×@»1ÁÝÛ­¹ìtw W›¶”÷³Aè¤IïoÐæ0ÈÃÊ ‹Oð‡{"ôÖ•¼ï0Öc+”SWºæöbUø”.¿+o6~ý0—¿”$ÔÍSH¾¹Ž‡Ð½lœº ùÆz  ‹x=è[û{àE„.ÑA™¢5C^Ð#ðŽÙ¼Xé{†›¼ù¬8S$›e°:é -¬õÿ;p¦5 +@ >â6?í,À@©¹ÂkÓ¹aŽTà¹ì¸¡ãÒÃγ9Nç&¹ERðÏd¦U%ïkfçkŒ!äF"gt\QÎ÷xrÃòÍÉ_V¬Gf·@[û{ ‘eiXl–[ËÖ°l]ºG ³9 ˆ¼ì§ Ú’ž¢u%ïûÑ+lçùøÃÌ.º8€ùÁû>*uÝâAevìLw³‰hÚ-½Û½ƒ6Çé^§À°¼#vv·¬(ÐwÁ]Uú¾>jt2OÎ^M5ù¸ŽTj¹Íä®üudó.è6ã -øÝ*¾>ŽX¦”%–-Ö­õÒR¸É˜ÄŒ@%ÈÆ}ÎÓ&ô}¸ÙnrGWndnýgü?^F¹Ïø‹ß^ä/Ç×r)ëgV °™Ïóq.Ë—òõœÇN Sõ.ç";Ÿ#ÎuÕr°u¬íçqÿ(ìñëûÄi½ç’Û‡1›ãÀ+ƒb̤Âá[u×.8uõùëºiYoÑü›üìÃË|-•Ùf½ø{ß×ðÈIö×åÞÉ8<ÆlÉ]Ê®PÒÙâí#n†V—‡ÐªÝ†c7O(_Þ-˜sLŽ^n›ÃcÐæ8ðð˜ü²Çü§O&oq_q²yľÆäBè_秌 –ÛfY²ÝÁcÌæ8ðrƒ -¡Q¹=¹üêÝó%“Ü®d(Ë=AD[Þ8›¦ˆû];fsœ®M’èœ8ê#ÿ9«–u¥„‚rÏ)]­\x‘q¿½ÞXÄ.»ð[_ï’,÷Ž¶Ö#û¨VèœÏ^«½ÀuîŠooó çlb°Q¶c$Ù/æ¡G³9 €ÙJ¦”• ÿçíª¬+ÚU¹è€ÊóÌœƒR÷c€.7¸¶ÖC7©Ú=®­ý½»£ìÈ`±O’ÆÂIìqÓ=÷{€´9à<&oò9„gnUÉàvß}ç8¥vǨÔöbË6àÖzbÀ7öw!F’]­dÁ‡+ bã#ˆÙbAD èÞgBlUÉ%~ìÜA^&ß­{&ß­õ¾ÉWi/Þ^Ä9ÚOOyN>>Þ˜Íq€'iˆ!£sž ¼U%_¼/œd;(m|z¼7Ýic=D º)²Sìï2 ŒÄ|~GÜ Ía€,‚_ÏLYWòk¥¾m½Ø“û¶µÞ—ü¶µ¿½€s Öó9GSˆ¦äé»È39ðäá­ŒUü×LãXŸtŠæ>]Ý]«Lv+u#í¹ó¿­ïÖÙÀh>³ß‘¼1hsœ. "DOå’U%_ž¼±=ßžä­õ¾ä ÅþNò†¦éi¿ûϨŒÙgÈ]*t!ÿèšÍõ¹Kš+›0¾íò²·×÷x.YÙ[ëÖ•^Ù䧠µî>س¼e"E»#ÍoÐæ8°ò8OBäû-a¿ªôØi~[_÷¤ùm­o§ùÅ( ÀÖ—i~ƒ6Ç[–@ -Ö¿¥ù=ÊĈ(BÏ–‰:ƒ6‡C²òTŒö·4¿½i~M!æi~ƒ6LJoûr]É·Í’ÚÖ½'Kjk½/Kjk÷À‰s‘cÏ’´9àHW.Ïܪ’ggImkÛ“%µµÞ—%µµ¿ 1–w«i•!W•´Ü¯Ú9EaÂxGwÕÉ|uíUbƒ¯ hÇ„…jQü}<‡b¦¯ÙdÅzdI²@SQíïä–ù¸Kñ‘ç÷‡øDüè–ò Íq@šå (yÛþ3Aºªä«p©[—ŸÞkwë]z£¯ #Ïò¶L@Rñø1L—ÛÐ[ë˜.7¢û{0-²ÐDa|Ù3hs˜N¯Bv‰Ñ>Ï| Úº–UVÜÌŠ-¬\‹IÙ./YìÙux/Pq`ÏKAó¡½Ä`É÷K+%ÿBdåÃ=’¼0uG0—ÿeꨟO\#×(cíòE-;‰e•{-~=ÉÕX#øóƒbÎ?m;—¤z]É^Àˆ ®KR0vþYÚÉ)ÔŸ>Ô«ûPÍ„>äá„z$ؽT¬aÝV,WoØ^ÄòUºlh>ŠÍ•«Ï.'ä¾ìrÂÅð¡X’áaØ -mWÝ"–×±Ö²¾ý,­Ï!l®÷Mçºî¯e}êºóžðå„jéZúªJå[XõTµu½m2êœ*MjÉÖ!ÜúI½œáw¶žk×ô]¯ÉE.Â\Ä­\©åÑËI-7Ÿ-´žJ­T^LKmùÅ•ê”[Ã+²©fi’ÏlvcÄRý¹GéÚ×6w¸ñáËIÿ؈_O!)¥ÃÂ6TèõBêÎÛÄÙ.xY¤ò–êË/ Í*“ï1È¿ªM*Ì3ýpÜ %ÓËÑR‰ŒÍ&^7R/uXk¹óæ6Rœ;¥†Ù¾½\¶Jy!ÝVºµØJÚ5Y'O¥º'$ÕÈc-v uM,VÛ§qe/´Õ T·ˆCƒòëJ¼øÚP ¶U]÷ÐλˆcãÎ×^œZ;ù@Nó··Ã|¾L_‹ú¹V²ˆ½m³ÝRY'\),â…F_'q­$z¯?—A¦Í¸/§¿¦iÎSð³Grò½·>ZrçÿE™?áïÿœøüçú‘Ë<îmc ߸u%îg2ù:hË×B«° ›Nè¹£ýEìòR6T4´yÜûŽ¯y1· ±×’®1¨kÚ^–6ìľA×;êZ&ܾ\µb d¾´o– ûrHõâP ɧiªW8è/‡yÑÑ2%Ÿ»SâHŠ.S:´ì;Cô'ÅaWaY<[¹)€ì+iM/þsßrKª?èÂ9¤EÇË4ÛŸºÊ¦«èŠ ¦þ ?±ÜõYÎUVþ(N¿yx}q¿Ï.Ç:DÚ¨½I_{i»0‘6ÂÓ¥4Æõa›shzym¼K µsQ7ö¨9ËÐXB ^ôí¤y1› „¾R®²U¥u¢ht™­²vÆT}Š³Ym–銳ÚJ©Å‹ôo}K‡¾WZ#†¾W⦬œ·Îx-Z¢…Îi¹:»”l±dVd±·nR^JR•mëæuÝu¶=w—Á‹#q‰Líb6%ßÄo;›«Ý­Tý3íh¸¼|’ 5»Dr?EÂ#8„åC™‰s·Å±ÛæþžÇvg£îyô5¡; Ù䀷.¼BQ+ºS½Î_3ÓÍäi[å’ö5€²¥³ÐœÝìèLLÆóÆN;L²T”ï£ËVVÎòY×dºÅ3mµÐjûdúóãÉó… -endstream -endobj -164 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 163 0 R -/Resources 4 0 R -/Annots [ 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R 185 0 R 186 0 R 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -165 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-61) ->> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-62) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-63) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-64) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-65) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-66) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-67) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-68) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-69) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-70) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-71) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-72) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-73) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-74) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-75) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-76) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-77) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-78) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-79) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-80) ->> -endobj -185 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-81) ->> -endobj -186 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-82) ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-83) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-84) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-85) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-86) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-87) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-88) ->> -endobj -193 0 obj -<< -/Filter /FlateDecode -/Length 5033 ->> -stream -xœÍ]ßä8n~¯¿¢žX$R¿€Å>,’‡pl䡧³s‡ 7À^òïç£Ë’e›UVõôžAw—)Q¢Eê#)Ë*wµøÿƒÃ¯ÌÎä\Räëëo—ß/Ö¤`ñoª±º˜Šÿ‚Ÿ®Îr2Á•˜Ãõ7!P2©Ÿâõí‚_›Ë¾úÛåßÿpùŸ5»zSJô.\ÿñ«1™”S²A)*(²Ž”¢LJ>D¥(:ƒ[,E+‚!±ç}Q‚\rЊ {Ÿ•¢ 1ˆ“£}Q>9ÖŠ †+!)EÎBç­UË ˆe&¯”¹`"=jeÞ™˜‹/jYB™K^+#21± N++&ƲVÆ%ë´²Y‚c¶ZdaÊI+‹…"Yµ ²øœH+KÅctŠR–! ¬+«eÅFë´²B&”̬–”Ùœò¾ÌÛ`B&²Z™s&À6I-ÃŒ‚’bRÊÃ)‘¾ñ$ È:”y§YÈ8jH@²0f®ZY¨°†ä! *hX@Y<“†´eX‹†¸e[œ†¼e뢆À…˜VÃâRŽ¬araJEÃæ°SÃèbº' ¨K!z °Kœ£†Ü%vVÃîS-ƒ,0` €Ž†\& ¸KÎ& ¸‹iä5,€V ì0jX[1>g«aw}¶¬aw}‚ PË’Á$ ¸ënAóÜÀ]¬×°€»ž}Ô°†b€?V€»€ ‡«aü=Ê3'¹É‚iÁˆî[αT£;ÕnëcÿøÛå/p¾×¿ýïå릕²úßÁø‰£$ÖA¦ˆ/P7àÊLÍ1íÌDäIBø"•EHXœÝDH¸b¸ÛrmÜZdH,2;3Óqß/2UQÔe}šç£d¥Ú/¦ÒoÈt- ÄÈȱ§ÌNÔ'Y>BRt$±@D-*^°Q¯åUåŸ?]0æîo+´í²“Þœ1¸Þ^?ývùã/ý·_þågtûéëåóÞýôƒ»÷÷?¯Ÿþô ÄÖ¥lXõ!Íò ~ò­©ànÛuÀg4ÒšÎÈÆCÜ× ðüÚµór«ËZÝÚ&êsé>׺Û~ß"#µ؆í0Ê-ºÿúé€8†@n`Ï<0¼ŒPá@ýŽ½ÞÂtËy{;ÿüim¹9F˜ óÎò–œ?0ö1–wû÷°qdîfôÛøM#ÖŽd3}Õædӿ΃^Ïh!«ÅR·¡Ø%ø¢´w^`BRâ¬pÜMg? -¿ÜJ¸cDˆyÅßJ ?ÌÐS,GF4Æs#Â|öÐŒ@†÷Ѫ“Ï=$|YcõdT~vCáf`“Ë;P12‰­ú¨ôul`òÜ‹™sP¸G 9QʼÎÉýjm´w ,"ÎË‘ŠŒV€‘Òë#ã9%yð„ÅO[u2d`Õ7õqS­7`pÉìú>6¸Î`vÜ#—¡Vã'ß3¸,Éa±"6'Ùàì!¢ñœÆ༬¨ Û’¾£Á­;2¸M°Ê‘‘pœž -Ũôvlb "î¹GLl1ð=ÿ#_ŸiWWUHu”9òœÇÄ|œæ_ùž˜¶îdr%/ -fùw¦yZŒ ‘Ž ¯@m.¯qŒ€<äwPmVGà3õòd(1ËÊ&ò„ÂÉÇCÃã9áÉfy$“¿§á­:ù&ÃûF'Û™ÒN¦CCì iÇ=bˆ.‰ÞÙ)ü0NÞÝ% YöÓÎ!NG†8ÆsCL -BŒ™¾§!®:ù&C|Úù.Ö^Šc ìtÇ=â|;Ãßñ?4½œä)†<¡ŠEdY»lyC,§1<Ù–]Að¬Þn)µÃl8mé)ÌËUÆXØØ"[6?Z{‚Ù˜ýôxt9qçÝG#9ìúyfsÏýÜ"¦r—ÂbB"GYž¹»„1–ó˜R’mä ‘ÚGšÒªÑimçNŽ×¼l$q6§´uh.Nž/!t ÷ÈtŽkß{ãßKÎ&e©|tArç4æÂVv}Yy[áãÌeÝh‰T¤á‡¹Õյ븉bZô2¾¢½—ì™åÉ=÷s˓ʸ<À*†ç*¸– :£)ü ÏyÌ@îÈç>ÒüV~)‚ª¦Ç÷l3§]Ý—±çµúwr=“;í¹ŸË”Qq?­cɯÝ_Ý$Iö™G+ûÉ“-wd’c<ç1É_Ô®šäd -›|Š¿(Iu¿µDÛN²»†W°×>ʽà匼ÝF<½‘—l‚%©kŒç<ê’mŒ!cŽ|$‚¬ýüãÇ£ÂïûŸ[ø»çA’×ûp‘4þ¹ YLjús4…hÚÉúØž†XNcNÁÂz|ØF2lNëF{sšLh<ëêá}›Çaôï¹GÌfY@Øó?Zˆ h£Dž^suƒ<ç1y+#YüÈMeëFWk¾Û]e_:wRƒìã%½.ß÷õL¿ç~.Wîôéè$0Têcö0‰ ¢õt„Nc,ç1² ÔH¤£“0´ðv›%½eVÞŒâi¬Øµ¾ÞÁ dÌòµ»½Uë­s‡K}ƒ<çQ¡œí`‹¼"?ô¬(.Ÿ)ÏKwZ,’;‡bÿ냨áþ#‚v×òô}©rtáî.6J붨þËçÖu8Vg~ßv‹±vFTä`ïáåX^*Éò.ø‘ñœÆˆ¢•÷"§34ž5"î -¦n°ç•ùíæ¯ÛC†.ßÙ•«†TTqÇvím‰~ k›÷b‹°^÷m4yjÿ_×2·{ò÷Œ,ºhÔÊÆ tËÅ!Õ ÏyŒL„$f§#•9yç.mSœÐü.…ã[½jÓõlˆsïDs›áöÓ”õº6,÷ei¿ÑJgei¿)2w<¥£…=¿{™ï«tíûu;§º5Ò ½ñoÊwô/ ‚÷OûTã× “åÔ…­»mòHä‚ Ažóf×M’súv‹!×Ñ#ȸ4g÷H*Ÿ+*Ö>«rï±1ÊSë1X^NNÁÔˆ‡È2Æsfq·àÛ¸5 ÝAÝLÜEó›YÙBÕ÷E¹¡ÒÎEu«ÇŽõ06"ÍÐFñÓAJD4½¨ÿX…c<§Qa²>ر-OÕók{ßz5Õ0pûœHBÄÝs þÁÎËWUîÚz*ŒDtel £\ä@¯XèpŒå<*”÷j3ºxô7rÚ,PŸ§ðýEéÄÞÏ$;åˆo§c%ìÏy†6 #‰x¯ µë†´ö }¤×Ú<]½–è»6t…FÙ3'§NÉKÏ9PpG)ÇXΣÎ,»Ý¬Û74Sº` Zwg…œx(ɉ £ÛdyN3Œy:9‰äXËwÍ -ê°~~É{·GàE±ònÖ´$€»¬¯ßw ¿1u.rÌW*EN× ‡ÏÑyΣ’m”½K9«uªšºÇ¥“âÂ^AMÁ›%Ëâk›} ¸É´š¢7ÐØ?‚mFóèqlÇ{(ß=¸üqNt£b9‹°¸HW²l|LÓñÔûÃAdðùÛ ã%ÊA@N€òÁxB>\?ä9ò³ìâv”Þ‡(áIñi3>vÙcŸÍõòºVön­åŽÇÎã‚'c,§Q`±²‹šm|ÇÛðÊßm¶GèЕ}€‹+ÆÅ$‡z‰e8Ž¼î Ïy†˜dsqLñ§Vl¼®ËZÛuÌn>µùWö©sK¹­R“~÷Ño›Kw½aa /ˆ’Æ_ä9²ƒ8Ä}ß|UÈp9¼¼øÈOœ³0Èsž¡Î²VN“ý.Ðe_î? X#…zdd_Èî¾@ôÄÙ*ƒ<§QÉt¬KœùGŒê¤›ýK.“$F¨ñC§‹¿Ìçé!LµS¶VQVŠ_SÀa•ƒñžH=mîê6§»É¸Æy@#<…‘/Ò |õ,O?äìIÆŸÿõ—ÿøó?-Ã(É—<ô—WlÏ×GJñrûûºº{3Ñ©žl\̳ÙÎõ„Ú³_;=÷µsXå_o«²Sy±Ü¹Ûc³©NèúŠ7ÞzPÒü¾ávø¿ÄéìS7mã}”,Ç#ë‘s‡¯rÞj¶Ä®·›È]ïpN_+ò{«%¿A²rø¸,µOêè/æú¿OŠúí";æäÅ’oß -`'²¬¶lÉoùVVÈpS~,Äù£mmÉã¹ íHLÙÖ¤`ìü±´Æ)Ô>Ô»þPÙäÈÙU¯Ävo+DpF·'ËÝ[ä$7²@R64_Å& -pª4âÒ ÷u—ÆC²l\ˆaO´]w YÀªu}ûXšÎAl¢÷Cç:õ׺>uê|D|½ [ÚRßTªœç_›ª£ëm£Q'TiÔPk6…pÓ“Bz½(ÄlmZ¢«VÞiMNE¾s5$nõJ­§^/j½¹µÐ4•Z­¼°–:ò‹(‹©Sn¯Ð¦1š©I¾*¨›#–êÇ59Šª®‘-vãwÄ׋ltÛ‘ß.!)µÃ‚6TÓë‰ÔµÛÈÙ.ö²PS®C…©Yir¦¬ü¾AEhTAžéƒãfR²ˆ´\-ÈÜläõ õôØP‡µƒ’ÜŽŠ¶Sj6Û—ËV©/ Ûj·[Q»!ëè©Tñ¤x¬É®Y]# „ÕñiXÙmÝ-äÐLùmE^ä mªÛ:‹®3÷ÐÚ]ȱaç[ONMãNùnò¶v;›¯Ä×ɱñ–,¦Ÿk' Y¶rVóiuÄE0€ÂB^`ôm"×ÙÚÐI^P«—I¦yÜ×Ëß/“›ó¼Äª‘œ|gE-¹ëÿ¡ÎŸðóß¾þ¹’|óãÞ6´ð [WäÞ“É7åA²|ãQ%¶iÓ=w°¿]^ê†j Í{ßá5/ìvöZÓ5u­´'†e ;²o¦ëu#_7£Ø™oÕÍâ°o—ToN^T‘㵫T¸èo—y)£Å%_»&q%U—ŽRö#.úFqÙuXÉVbŠAö´¡ù¹WI_ÝEFÈ%-e¼¸Ù¾éJ›î¢«‚˜ú‹¾av}§e%"ô»§×7ë}9Ö ÔíúÖSÛ µžN¥é2®/›Ï¡é=¨:y—jmQ7÷¨9ËÔXB ^]ô6ÚQóÂ6W}§\i«N«£hpš­´Öbª2Å™­ËtÇY¥ÔbŠ…ú÷~¤C¯•6ˆ¡×JÜÕ•v«Çkѵ(ô朖»³KÍKf…{îFå¥&UÚ¾o^÷]½íµ» ^‰Kdj¶°«ù.ü{ÏܹñlV´Zõÿ´¢áòòµpÔìyš¾)Òæ!,_ö“8wKOó<^óدlÔ5¾'¨Ã0‘MN¾óSá 帠kª~¨Î&»þ•[zn”%æìnEgúÒ7ü›vÚe’TQ¾ã‘$èÍòÕTÉ:u‰Ç­÷6ÿ?ܦ°¯ -endstream -endobj -194 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 193 0 R -/Resources 4 0 R -/Annots [ 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-89) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-90) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-91) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-92) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-93) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-94) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-95) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-96) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-97) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-98) ->> -endobj -205 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-99) ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-100) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-101) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-102) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-103) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-104) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-105) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-106) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-107) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-108) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-109) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-110) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-111) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-112) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-113) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-114) ->> -endobj -221 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-115) ->> -endobj -222 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-116) ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-117) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-118) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-119) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-120) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-121) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-122) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-123) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-124) ->> -endobj -231 0 obj -<< -/Filter /FlateDecode -/Length 4460 ->> -stream -xœå]M$· ½÷¯èsËI}Frˆ0²p9¬Ç^Á8€Cþ~«K*U5»»f<›T’Ìv)©X¢øHJ*M8{ü|ð_‘àJ©9ÉùéÇÓO'ïrôø7•X]Lì¯ð›ã9xÉ.†šJ<ÿ¨Î.×H9ŸOøos9>ýñW§¿¯ë„3¹Z…xþù;e »\röÑ`U°|`ƒ£Ë™b2X)8†^µx‰\É€k“WÀ Ù‚œÅÁ K¹£·°ï4\²°b€Ä‚\! LŸ"W‘¹Å A¶…ˆtÁ Á‚BÑ …… -²Ìä-,€‡F.‰®¶xâ5Ï,INCE `&È4”&²&,,€~4ÙŽ ùA²‰4ÇäAŽbaA)¤éf±° ÈBž,,ÀØÔ|3[XP=dAÄgaAõÉi˜la`<ï-,¨¡ ß$±°v©ùf±° ²G¾‰Ï°ÛÊIóÍlaAÈ¢˜<È‚ ©v LB¾ t²x ²P jJšo f ßDDoN Í7³9]ÜÈdñ€»ˆL“…¸@¾‰ÈÖÊí=€7fÄg6³hÆYÌèð­æ”öÂ[esÎÀ|5G2' &2Ë’ÌY¸U0ƒ7§ <ðñ˜\aÂeöiœ¢J>³d}È -³D÷=çXŠñb—ù±Ÿ¿?}úÎ÷üý?N~5Í”µŸ€ÁÏ’4±Žj"T¡nÀ•›š(:¸‰(“„ð5uTˆ\!`qžtS!áŠánë¹ k‘!±ÊÌLO&ã}‘)¨Š“-ë‹ë¼•¬Üî óCú€àí4‚…k& bAŽ=M`¢¾°Ê[HŠi,PŠ+)v õzYþüÝ f4ßþ2CÛ/¹áÍKþüîÇÓ§_ÿù_ÿîsÜö݇Ó_~­áÝgŸ„|¿¡¿÷ˆsññKš|‹ß2O—ϘçëFÏ­þg=¿ûâôÛwëÞF~.ÍðÈ:Mè‘ÑDÿ@Aûª¼JAC/È6€!PùxzI›>oºˆ ->ÐLŠ¯=ø@ç %?PÄÎ:‡Ñ¢u$,ˆRÂGSEîÍDâûù3¬¯U¸I=sy$³žçvè鎚¿(vVÐô«L!ó}5í«s5!"aòoc1>-ßµ››µôÏf!~±–V¾£Ù7³Êòšß­‹ç2F[“šQW>¬ëäâ4«»µ—‡: Çºn§ÉÜŸ­²²]vjç:÷a9Ó¹èþávÿ¬ä°j‚ï/ žY±c*Уº¯ÎqjÖÅèˆÌº…åíà‰Ãàé δ§;q3HÜ_)ì–ÒãPW†AççÁ6í7¬ÚGÚ¨ë{lånƒêêÙ7}ÂÍU4!¨H½¡qv¨–¨}u3 H³hÜÙ÷GsPô“;ÎFKÐØåL©"è’ œÍÎ:Çér䙞ƒ.xÌ°ùßÌêT²Ë§ ÿ¦Šu:‹è<ÊÞigã¨X׳t¸|<«zMpK% >#e€ÙTH¡ûôH%ûêG%ÀS*ü*•h÷{cAl¯Û#qÔñݬÒo‡¶ë`=Ö÷˜Ú´•V²Î»Msª19A¿¤úHiûêFiº§¡¤Û¯³£{JÓ¸§?é-Hw%Ñ´€±W!;ëG! .,~{+rQÊo¢¤ž.«…Ðy¦úH!ûêG!Q'gáë«2›`ÌX¹IETåØž„;.:OÄ_ŸT*= -™wÖ9N—gÝ|—%½ÎîMð8}&‹j¦˜ÊʇvähÝÞ6ñ]Õ¶Þ+^·•KæóÞ2òu9nå¦Ã4oÿÜ–áÍDÅÓ{¶¾ƒ£¹nçx\ŠKÑ')ˆh¼+:¸bľ:‡°âuµÞë.Ó·°£ò·?‚¶F©:Ïpkr€aOØ †0Ô»5PnD¸‚\¼âZ0½8&MÀ¨yg㨙ຘJŒ¯s˜§k|èªúæ6üëþ¿ÜÆYjt‘‚èRóýnÞWç8Ýá®j„¼=üçʇ4}}›t|‚¿fU›é;Ù9ï|uŸ;.%n,R¶SÉÁr[Û©¸Ñ ½_ÊMhÀ—_šÛRÙÇ„êö|0´Óýú¬Ó¦Œ0;‡òh¢agã Fݘ ‰mómÀRªåçû¢ÃƧO‹å&Üô±RôÍ T÷O/ì¬sEDgAøö6 }/ò±ü( -í(qÃOFݸ˜dÚdX«îo¤ôHU;ëGUºº ëxÝbߘεUÓ -d­Ø{.Oï7±ïØn‹_oø[äŽ(!!ºöÕ9Žº¢RóÀ²~AôzÓÂRtúâOxÁ¢ÒÎ:ÇQ™¾“諾ÚõV*½’™áݲª¯Žfݺ#aÚøy¿»÷Õ9Lw'¯;ߧ·$ß$"½¡Ò°(4©%‘èv§Â°ÐÛ?oDzw£ÎrDo&)$“L‘ÅÞ­`;ëgp蔋„·±ÅGKSÛýRƒØ6ŠØÁQF -öê;ëG Q·fÀ÷DZÑ-dú2¿Ù¨@7¾—ù·Ag¹¡–¤[`òiÿœÉÎ:ÇQKQ¨GíW.0ÕµºËÝòP éMAénö½1ÜÎ:‡éæìu? !IúŸˆáàkO1M}º3†ÛYç8*Óô·~»Iã×ÆpYHR¸ÐþngãtwTàÌ¥¾Ñ¢ÒÿM —“niÐ÷Ø÷Çp;ëgpÝáõ(£ÆpÓ[˜‘³¾¶7†ÛYç0j(ÓÛܬGíü·Äp½B’TΤïÐÎï‘ÞÙe_㨅u'šq¯ÞÑ׎¸CìºÀ\Ûsò47àŒn¬KÇÍBÍÍ}˜þ-ö¾ÑÓKjH¬GXIJ¹>z·f_•ã¨=*ˆ4ö-w6[}Ú]—ôÅÛ ƒž§3(Âec÷ݾÛWç8WtßYà¼Ïfd^ˆÓqÍ7^™<Æf©~Ç«PC–…ˆ{lö†¬ö´}ßnÖ´¬û¶6ÛnËoüz/Ȧ^hõëmW ·Š'Ð÷ª÷î[ÞYç0âzÝý&>í[iÝ»ŠóµêÇ-â{^áu£¦bj¨. ™BÇT=N-ÕÈô²¯ÊqÔºC.å´o dµò4®8 ßGú­¼« -„¡Z%îcgãtmTà†¸¯\ Ákèöð y—‰ uᵄtÞonžl»+ãf®e+Y'¬”ÄŸñ-"êÓC îëxW•ã¨¸è>.=-jŸõÜ™\z4SqïjŒÌqÿŽãuÓÓ‘!K‘}+ -ÛìrŒ%^¸öýÕ|–†›?ó4ñ‰ˆk¶¡7yh·“‹_ÆËBÍ¥uL³Ñô<'ýÿ±Sy¦/AúÒ3Ù–«å&j›¼î¤‘ž:êˆÕAòRvè®s³c…âò -º½tï±u貞kOAªƒÇšú¨ëd…°Ö?+G¢oBàv 9ö¡ü¼"/rÆnªÑ÷›¥0 ÷ØÛ]È©cçóHÎ]ãAØëòöv‡1߈O“c“-Y‡~i7YÈä»·[n6Á - yÑç‰Ü¬µ£“®0·¯‹‘Y÷éôÃirsÄ‘4Mô¼Ø1Z -ç¢ÌøýÛIÎ_¶Ê.~œ|G êغ"žLO/;ÉzÚx#v³ˆ$ì/äP–²±†îlj¼–¥º_€½• ACçŽÄ¸ôá@¦>t)ðÐ3ññiÓ‹=ù¥ºYöå’ÛÃá6¬GÛ5©p1>.ËÂãÅ%Ÿ‡&q¥E—®ÐPc£¸nXÉVbê€oÒ»^å—Q¬÷.†0B/yáÉâfǦmzŠ¡B`/Ɔ%Œ7­+y ¡_m^¿Xï³È©Y€R;´wêóHí¦Ôx6•§Ë´¾ì>‡§ãšñ.=ÔÛâÁö¸9‹i,¡…¬.Æ1:PËRm.Ç›J£­nÚE‡ Ð|£õs“)ÍÕZ·LO\Ì^Ê=¦X¨?Œ=G­ôNŒ£VÒUYm·y¼-q€â8œóòt~)ÙcÉbÐÒX»Se)Év}oYß»yÛóð²’–ÈÔ/ÕâUÉWáßklçRg3{`•j?ÓŒF(Ë‘žpÔ2O¥Å—”€!¢mg)ÃÇ‹ëÜŸó¸žÙhsã 'Ì>ý{;¶Ï`ÔÇŒ¡©ö·xìjºÛx¤—u€1¥³Àœ¿šÑ™þàþÍ;ý2kª¨_Eß --E…Ï>˜S<ÓTK\MŸL?ÿ.5 -endstream -endobj -232 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 231 0 R -/Resources 4 0 R -/Annots [ 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-125) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-126) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-127) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-128) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-129) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-130) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-131) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-132) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-133) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-134) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-135) ->> -endobj -244 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-136) ->> -endobj -245 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-137) ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-138) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-139) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-140) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-141) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-142) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-143) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-144) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-145) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-146) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-147) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-148) ->> -endobj -257 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-149) ->> -endobj -258 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-150) ->> -endobj -259 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-151) ->> -endobj -260 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-152) ->> -endobj -261 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-153) ->> -endobj -262 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-154) ->> -endobj -263 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-155) ->> -endobj -264 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-156) ->> -endobj -265 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-157) ->> -endobj -266 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-158) ->> -endobj -267 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-159) ->> -endobj -268 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-160) ->> -endobj -269 0 obj -<< -/Filter /FlateDecode -/Length 4166 ->> -stream -xœí]ßo$· ~ß¿bŸ D‘DJ¢€"AûÐ)ô¢-úpç»KPø -\úпgWÍ.í•7N0hkÃö)ÍpHñ©_Gï/~ 'RKæãçÃçƒw%y|-%6 û;ü”t ž‹K¡fIÇOJ âJM±äãã¿..Çâ‡?ÿæðÏmpŒ®ÖC:þôAYL®H)>¬ -–d°Rr¥Ä” V¯X«Å‚©päkV\%Y,ˆÁ1ŠÁˆA\]³*Ĉ%°Å‚¡¦b°‚‡!zoò ˆg¦hðBrJÏ/—¥Æjò -x¡D‹Gärá‚Å«.çœÄâ1dIÕ‹— K -ÌÞâA&)/CÊäMd‰RÈâÈ¡jð² u‰Éƒ,>û`ñ*¹T…ÙäUð¼¹æEŸ\"oñBp m“L< -FÊÅàEÈ’}ª&²$òÑâda|[<àD¢"bxkTï&OÁâ%Èca“Y`| b†,¾d àANqÉ€XŠãÙ(äXX,ˆR—B ÄšçZ, À‹Áò%q¶€dax®Éƒ,TÙŠ,, ‚,‘ÉÂÚ2Z‹…¸e_ƒ…¼e²…À…˜ÞÂâ’d¶°€¹hJÕÂæ°ÓÂèÂÝ‹…Ô¥”£…Ø%–law‰ƒ·°€»D¨iò °…@GGAÈÂîRðÅÂ°ªC;Ì ­¸(â-,`ànÏ0p7t&¯8ø YXÀÀݘð -VÏ ÜÉG ¸9f ÐPðÇ›Ñp’ìp²`-,@^$ p3–XX€»¡¢û3|hå‚ÔlaAîùL^u¡@ã†ßBË.ä\-,HÀ]tTdaAî>ÅÂ`¼C-,HÀÝ@è©-p7Äê-,HÀ]Ä ÉÂ4XX€þͦkòªóUÄ‚Ü,E Ð ;/@“WR°°`ì<âP 2pÝ{µ° w}"²° w=#ì1y…$ZX€¸<¸­áÓV@ -‹Üõ¶xÀ]ïKµ° wµÛ´° %D±°:DÁÑ‚,ìj)Ù‚\=xùL^v¸NBd™<ÈÂ…-,@`í*U±° DÈB1ZXP"dAÈ`a"W¢o3=€,h.f~À‘¢…@2'•Ù‚’2ò1hÕâå褮Mž€Š…¥°CW,,@.åNoaÞi¸daÄ/°…¥B¸Š…芜DDæ/@Ù Ò/ $BDƒHd™Ù[X€¹$TmñØkž)g§¡¢…pdš@J“YÀ>šl' ü ÙDšcò %¶°@$jº)ˆ@–装h›šo ª‡,ˆø,,¨>; “-,Œƒç½…5òÍÈÀ/5ß *yä›Hñ ¿­”5ß,T†, !ŠÉƒ,šªá·À$ä›@'‹—!K¬laAÍYóM±°aòMDôæ€h¾YÌáànª@&‹ÜEdš-,ÀòMD¶VnＩ >³™¢§˜#ЛзšCØ‹Þª˜cà«9’9h1‘YJ6G Э‚¼9l࿈Çø -N£OãUFs(è3¥èKV¸#ºï9ÇZŒž(vûé‡Ã—oÑùø×áão–‘²öÐø‰³&ÖI]$V˜på–Û1 ÜBäEBxO¢ÔUÈX<º©èŠÑÝÖcÿ¶"Cb•9 ˜YÞŒÇç"S0e[Ö×y-Y©=î‡ôÁÛ2 -å0'X^c/˜ƒ¨/¬ò’âA d”¢;áˆz=o -ýæ7:?þ4BÛ/¹Ñ›3”ýñͧ×ßÿõOßÿák<öÍÇÃß~«áÝW_„gþ¿½f9ýMïðS.háü7Ÿéø Þßo¾9üþÍV¿ÈÈÁ^2 U0Þ6×&™«r—I~ K ¿DÈ…Ðä.K¤4hú¬á®]Êä­Uè¬y•G‡Á.ïÞeÚΈÐÄ×Z—IDÑ1癬³‹ NGª‚Æ^Å9L•÷°šçÒy¸lïÙ&®õûç8ÜÃ6âÅÒzº/‘~¸e¼¹:û1ò¢Èý¯ëO7ý)u”LÕ/£îD´duÏ«~®Î~T_t¸=U_ÇohU}óƒt¡öî7£iÿz0îõqíˆxè”6¦´(fV$tHµ\%Z"üçm8Ue7&Œš™á±Èèîòž:¨QM‘æ¼C'©˜£<"]‰ À¹¥Ø¹*ûQ,2§N•¾Šoˆá¶juì°0#ùФºš­?¯Ú©*ûQ­Î@èL©¶©ró×V]FöDΑ–íàoúûdý(¯ŸRÎBSÊ[ÂE:á%]8ûs~xÑŦõ~ ƒÃ’¶û¶xèÝ6æYžñþ\¶<óÜvÏçëw…ëz¡Õ×Q&~¬¤è¨‰Žˆ-^ ñÍf1Wg7ÍBg¤% ›ó©¦ÞE•M­åÚô1¯Ýï%„]åI'çnûÌÉ~Þ†öÖ6!€ØIŽ:`]u¢[ºaÁ¹*û1`†KŒOp“6Eò TÞÒŸêȉ˜·Ìò@CÈÃ9ð­ c²Î~T›tP ½c½/Fz"óÞ@$ ~A'Þ~ÒHÊäHtDs: ž«²]¤U8OzÏ30EƒÙ¸>“ˆËÉg8EužÃ2Õñ¼fçêìFµÔ¯ëæîñž1‰o/Z®l=f÷‡Ù8«¸Ö ‰Ë<¾±OÖÙO#ˆ€|Š’Ò}à×7lC‘®ÆÉžd¾¯›¬³C%àvMPÎÿh_‡.ÀéÊaâéHq®Ê~L¬ÄI"ÏùbºqëÀúÞ•»µ{ªßcÑõçcï÷&ëìFÍÉ¢#>ÍM*\Í°ý×÷{I^e^I‘w¬ ·àt²Î~.àÃ÷MNL÷{O6Ûÿã5cFºxŒ@ƒ ºcç–êçêìGõI©™è¾I½©ž¬ÁÞÃÅõe¨áϽÜåR: ²>·Óžš— -Ûç==‘¡ tu CHó€;Yg?×ÝU¾ê&•ÿ®ÙªnÍ‹1øî\Ý4‚ìueñ² mO€›Cvˆ]ªÏH¼UÓ-ÕOÖÙêI—F1‡;§À}Êÿ®–* ~×A—¯ïËO¦ ˆI\,HôÂô¬Û\•ý˜7é2«ÂÜÄÑü¬[Î:cî#Õ=sº«6ÜZò5Yg?Ê…QÔžœ^yY·pá-Hx{L¤'`ïí/3›–k–ÅeÀìp×dݘ»xò‹H_u6î0)Ñ–g-†YàÔ4zRçsÊÐæìhÈ\•ý˜JW! =7<ýZóf,GQHâ1ꆒè—M8Ïkv®Î~T›¤‹Ô¹I•{¾ì ëuàÝ„/Æ ³}¼(·õdYÛ¨Y'ýuŸ®.—Déf’5We?&]&àõ ƒÒõXá“ž¡{ÄÝ£¢ j -Ú»ÜÒâ\ݨQ–½¦¤ÜåÆBIʃŠ/¦$¯†g‡~b2|ð>{Û,m†9‹n“éâ¶[ óçêìÇ,¤k¹4L»/y¼ˆžÌI­_XO2¨!‚Ýâ$º/éy-OUÙ’“"žärßTàÕÂÈçÚlÖmyA·cÎF/sUö£LÑEJÊ-V~fk…ªgÝË<ÝZ§ªìFÁÕëZ%öù¾ü—´Öª ¹,›þgw£MÖÙ:I—å’±ª¿ Á6;f7mT†ÐH3YÁ"çA··L0Wg?&HŠp÷uZtœíôl…ë[5fÝ;ULÖÙÂE×êè (¯£p¹KÑ•]M ÑÍôøä\•Ý¨yÙ^ - ¿lþÇ üî¼}“?Ò²‡!Á¸ÿ»kìf‘ºÞÞö)Þ`ÕD>« KÁ¨+‹XGfõÔ}ñ¯ÿøý_¾ýÝúâºÈ)~850ŒïÎù±6 ¢H=¸…¯§Æµ”ÓF&g€=—Szz{.[NƒéKÙ|BÍB–2Ë ⧞ˤáYù<æY>|u©þχ¼œš–““|^úâ*zÐSŒ/õ¨'uˆ'MÝaQP8>Qs9òs/u>£Òë±U:¼¸˜c¼8—ÿ¼êÓ!À)ôµíΓó YG%/É=O 2ºŒ8IVâù£ï÷Ò™ƒ Ú\·¸zY’’óçµßœRûS{­ŸZ5=çA§ûÛ•¶ÝÓƒ "jæpMÖ·÷.œÉz&£8:_å.JÊMf×òXv½áZñ&Yg+Wbº&úáq+Yw·²±¬Ýæ vÑGÕ…Áü­l,ƒ9Ÿ#>ðXº¤>šT= ®Ýªi7úN£A¨Ú©©•ìán'ƒôp0ˆ_øvkt:°šž§s"JkHÜËÕVÎ =Ìr绥n©ÒKÉZµ6ͯ¢¬M¤+Þ -::S‹2;øˆ§öqKÎjfk$k»‰Wćƒ®A¹"?R1J§+|jMo$ÒpßN¿¶—•ª tNŸàš¦§‘èïT¤NUäY>îMJOZ¯Ö‡¨ovòVI#=wÔaKËZvPW(¥·ÙQ_A¼Q^A·—îÛP• ôR›x -R<¶äÐ[]'+„5ýt¬‰¾ Ç­äÔ›òㆼʙº«&ß–ÃÐÜS¿ïJÎ;Gréz´nä1„¾Û½~¶ÝÏ"çæJíÐÞ©#µ¿˜R;àÙTZ.óö²÷9´ì„oλj¨ß‹ߣ䬮±†¼¹Ûè@•µÚ¹@ʶyhë(:\€æ­ß±4™ò¹ZSËòÆbj©ô˜b¥þ8j:VéJL£UòUY½oëñz´D=Jcs.ëÛùµd%Å å±v§òZ’íúÙ¼}vëmÃkð*H^#S¿VKW%ï¿{|çTçbôÀ*Õ¾— ëtè¨9Š´ü/9CX‰-,ÃÇ‹ë˜C<ËPKÞ Ÿ,ßÿ§ö$C -endstream -endobj -270 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 269 0 R -/Resources 4 0 R -/Annots [ 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R 293 0 R 294 0 R 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R 305 0 R 306 0 R 307 0 R 308 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -271 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-161) ->> -endobj -272 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-162) ->> -endobj -273 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-163) ->> -endobj -274 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-164) ->> -endobj -275 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-165) ->> -endobj -276 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-166) ->> -endobj -277 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-167) ->> -endobj -278 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-168) ->> -endobj -279 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-169) ->> -endobj -280 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-170) ->> -endobj -281 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-171) ->> -endobj -282 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-172) ->> -endobj -283 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-173) ->> -endobj -284 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-174) ->> -endobj -285 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-175) ->> -endobj -286 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-176) ->> -endobj -287 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-177) ->> -endobj -288 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-178) ->> -endobj -289 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-179) ->> -endobj -290 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-180) ->> -endobj -291 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-181) ->> -endobj -292 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-182) ->> -endobj -293 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-183) ->> -endobj -294 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-184) ->> -endobj -295 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-185) ->> -endobj -296 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-186) ->> -endobj -297 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-187) ->> -endobj -298 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-188) ->> -endobj -299 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-189) ->> -endobj -300 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-190) ->> -endobj -301 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-191) ->> -endobj -302 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-192) ->> -endobj -303 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-193) ->> -endobj -304 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-194) ->> -endobj -305 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-195) ->> -endobj -306 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-196) ->> -endobj -307 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-197) ->> -endobj -308 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-198) ->> -endobj -309 0 obj -<< -/Filter /FlateDecode -/Length 4937 ->> -stream -xœÍ]M丑½ç¯¨³¡I?ÁÞÃðÆ6f±n졧IÁ(ÜbÎRÌðÑY7&E˜áròRÌpÖ&!)Á rÑИ”a†ÆII0Ãd…$£a‡±Z‹i0D;GVH3^4zÒ¬Q!e›Å´ˆ4­”F¤BtÆ)-«‚ORšƒ->k#¥yØâsZJƒ-ŽR”Òl¡@ZLƒ-6E’Ò"l±h,¤%Øt%1 ¶è ”–IùœœÓ2ÒtŠiL³Ú+Ÿˆ´”fŒòÀ&‰iQ褅4 [‚öYLƒ-ž´•Ò¶8ü•ÒÀžbJÂhµ<ºI“‘Ò1-+Ñâ¸E++B–¸Àƒw1Q‘ļ úL€ãfT+qïÂL-¥wÍZâÞ…ßà%.” qæ7e4 +¦e¥sJxð.hÉJ\€YXé&Ó¢ŒÄ c¥á‡J\À»˜Þ³Ä¼«=‘ļ«Ü1 ¶P²À¯A†­0¦á¬*mÁRxWô°”ÞÕ:f‰ x—§M‰ BdMÀ@/ØJ\’S9Æ qAÈipùÄ´ pí%.ˆÊÓ`‹‹Nâ8Ö*SND [ÈZ‰ ¢…-p$.€G ²÷-†°pã[à)J\&S);'qAôñZUJ V¥ºÓÒL”¸ F§0‰ K©„A/q^±»$qÌ@šqÄ [0T$.ÀT¤’…g.¥Ø'[âxºH3Fâ‚da ¼A‰ ’Mˆ2ƒ–¸34bI4µ”æ4Ç™Iâ‚ä‚bWQâ Dš`J1 ¶€&$.@ÿp°í%.@ðƒ`aŽ˜[È;‰ R²n&‰ R‚-V[‰ €MŽ7£ÄYÃx|d»É€Æ‘¦µÄÙ$Ä›ÖI\€qÉñf’¸ “F¼‰O·™Ç›Qâ‚ì`‹‡‹"¦Á8MY·à$Ä›`')-À›Ä9Ž7“Äp3o£—Ç›Q\.ïú f’ÒÀ»ðLƒÄ¸@¼ ÏVŠí5ˆ×Gøgrbâˆ3‰+Ôë1·ŠKÜ‹Ù*ŠkäË1’¸h3Y¦ ®`ZE¢Ñâ²ÿÂs'ÜWŸú%ª8DÌ™)òMf ï¾Æ-}!Û}}ì¹ýö&ß—¿üóöù7e¥lùk~rkÏCÄft7èJ•â:Ú¨"tÅBø6"æf¤->ÝØHLŘnóKýŬM†Ål³3SîÌõõ"R0è* -²­‡uβ•–z1ü>Ày+«P³GÏ'ÄØe³3õ Ê–¢"örQ¶Ìðzµ[eþþà ÃèQý}…¶^vvc6wh\«_>ü|ûíúïþó{Tûáóíã·ìÞ}÷éþg}x»Ú½²ç‡ÿÓ]î=~Â#Ò¼}ÈÍýóçV†gâvßýߡßßþãúw;¸\¸ƒ0ÛzÔž4üœÊ»þ×hoD‘p¬à€Ìµ÷O]›>ÚÒűM)lú"ßuÜÒ'4D?Möø¿öUZ÷™çzÄ^Â@„[¢sΘÅ0Á×¥'½4§r™^‚‡Ž Ma¦º‰×kóÇ6T\÷{/7–á8šã´; G&”ý–Ó¹NÓ"^±Ž¬žCS›®I»fïGCmöGšËÎ"ûüå~m -à“âçÞÿv¿3æt®Ó‘ÆÁvžþ78¯ô¡ŸPɯIS\vly*mnò®@Ò¢‚¡·CEb3#”ƒrh÷ðt„Îé\–£2T äJ XÛfÓv3w-òÏëÎ\ØÒð_4÷®2ˆÙ†¡¿mÄúem~ÊçœK^Ð.Ðx¢‹(&·m&Ö§ŸpZ¦v~ü– ÏüåiiÔQ“yœIëÑ,äÇÀpPø×5Hü†® ­/ÀÑÀ}êÒÃónr¡VóZFí`5¿EÐß8E¥`Ë#™dËN÷,Š™Ô¹°,fád1Ÿ ¬U¡ûi¬`–)Î -Îð§MÈúy¾r¤k™Ï€”Lqgôö¶ç`˜ÊR³ÒýÍÀ0&f+êïÁ’2¶<õµü ðñ0l†s:סçEvø‚ùL® -ýØ·5vò,ÍF¶…YŸy Ö_ÌE½WaÅ%4ˆ?…ô}·•ñ&wûÒÄ>Ÿ+ÏôF퉶vì0P²ä%ý=Hƒ’)ñó`Ž”6â3ŸoRç:Ž¼I5ºp*³® -teÖ~yaÚ“ë{Γ͵§üÀ²7 éï*%¼PœÕœÎe@Å#.EÍ;¦ÏÕºÐ_Ͳ¼àºk7ŒµÒ¨} J‚þ”°qÍüg=¿Ië@ cÈ&ïÏ„ÒªÐwóÓÙÓdçùñüFícžŸ ¿C⽪ABbÍÛa4"‹g0œÓ¹ =¦õìá9 ÃU¡_ C·÷è&Œp\‚•éÀ„ßO0è‚dËŸ{qÆ+~.⌠=Ñndo@M’þ<á’‘›Ÿp'u®OÞúåFÿ™ð\ÚÇÇVþ,n¬ëд;hœvGý=@1Ñjãx qšïæt.(¯á&Xü6±=bPëBߨÿ®­>Âu£ö1®ôw éQFFµ¼å”´r¼‡ëÙ3ÈIë@“_Iˆ³'¶—ÌCsUh¿È\×ò¶žÝv­o ·iöë~Î}įsâ" -Ú3Ü×–ºý=€9t¦ Éêù““:טgi :•ûV…žºÊ7•Á†ç@ë€2hÏ­=ô÷€¼âWoŸ÷Ú&u®4>@g~¹úD ­ --@ËkÆ*“çÂnF`µi¯m¬ëˆ×6jóÚý=@e>žÂZ£çŸ¿Nê\PAóÛuå$†óµ.ô]€Z¼¶°Éó:Ï>£GžÈŽÚÇžÈ -ú;P &€|\Ù¦> µIë@øuç̙ܵ.tõD¶wâ»ÇVÕû²O<¶y  6Ú }h£þп‘â„ù×Xæt®4ϯDLègmUèQ ç±æƒ5ñÁFíc>˜ ¿¯ÀÛšµÍa~¡cRç:ðJ<ÅCûÌ-KëBß ¯í–ëe¡£ÛÚTË8¦‚ƒn™c´ùÈ2Ǩ}l™CÐßf6¨Ø–7ͧyoNç2ÀŒšßú±^ŸÉ{ëBß ÌØnšùƺ0ߨ}Œùý€ÁÕS:øÀˆ¤RˆË>À&u®0~ 7¡ê3Ò¯ = °m`±°Ù÷ K+Ö›~c´iâYj};jϯ=‹ô÷€ç`¶M”0Û¤Îu€çÙEˆ)Ÿ¹åh]èxý;…}Dú5!CÇlC݇˜mÐ>Èl£þÀo)çÅæŸLê\`‰÷Ok>”ñD€­ -ØñP¡­o5y.0j{. èïÁŠÏ÷ñù|‘œùÈ%ž½×?©sX¥rNñ!®çÁj]èaXýú!B·-h´õyˆÐŒQ{&Dh!† ¿È\€ ÆgÔñàgܤÎuIìãpÔt& W…Nòäg mEl´ç9 6ßoÔžòÞª÷'èïÎñi¤ÙÀí›ÝœÎu@çÙ@tsæV£u¡ïÝW„ à[nÐ>¸Qp—ØLykf6\˜Ô¹à¿«f(žÊr«BË~O–rwÕëÓÂ…±î#á¨},\ô÷díÊ™•³á¤Îe–5¿…æt8sCѺÐY€}M¸0Öx$\µ… ‚þ¬²ÉÊ„ÈÇÜòÉôDTN>Ý…Õ¤Îu`Eü&XˆáÌmDëB ¬Hà£í¡,¹¹üe!J¾í›ùßÎll.ûhíó€¡=µg(™l(hI’eØœÝ G“:פç©æžÊt«B?~»Í§õ®ÞúNÖ¡íácG6ÚÇ6 ú{@âO‰døœÑÙ·²&u®¤Äo‘ñÙîgiUè! -œç;îZä_8)l⨚Î-m;ò>Ö¨}ì},A€™=O|–ñìëIË°©k"èáÌýG›RËôªõ°û¶À°„5ó®ýôñ-–Ì9òäJP?öèJ*`»?>Î-F´Êïéó".âÊþ´ä -¶§Yž`«Ø)žêûb6§è2†Âã¾à™Î9ò—PŠkùŒo†Ì÷ÿõÃÿþáw 2„[³?á'q;áÿ>:÷vädòXHéNH%Sz â‘å~9†e?>òü¼ÞI,yÊI¹øAy&?òø®®p×­o4ûBhÛæÿåÊó¦|gD‡âŠgÞN柚á2'>Ÿžà”=šÛ”2/_Ð,Ÿoû¥æâ!Òü‘ÞBQº£¿xäÿ¥tÔÏ7>§‹ï‘Ç×ýëKºˆyrÛŠßnüõ-'ˆá^ÙI1 ¿êZouÛÈ^ÁzQåmNòJ?~͵pò˯Ö/wÃú~QãSÑùå†åŠ±{¯XB3˜QÌwOå!æ$“¢ÇU¨¦ø°Ø a+Ðõy[Mñ©˜#ô&ô£PwÕ51Ÿž»äµõ×\ûÂjzßt¦ëþ%¯]wî _o¨–¶Ò7QÊßMZŠZZá"£Î¨\¥~ÉY;ÄÕ~D¯7Aø^Šæ¨ ¦w½Æ_Ÿ¸ Ó$Wóå%Ÿ z½‰ù¥ùÚS±æJM5/-ßLiP§T^•6zH#’±#š–_×âÀ=°ôµNnì |½ñ«!ƒøíæ£Û7®Ð~^/¤®Ü*Nºá¥IcZš -Cs‘ñÙýüï*|•2ó”_Œ«âïo´«V Í*^7R/•uœÔ¼Ü R”cÅlß^&i!?“nÍ][l%횬“Ǽ˜Ç$UÉc-6uU̶´OåÊ^¨#P]û -å·•¸ÙéëPõºVLw_ËmâP¹ó­ÇÚã†?¦Rí­åv˜_„¯ebs[1C?-•41ŸT¸À§VÖ ›a …&n4úVÄËh­ìÄOË—_Û “fÜ×Û_oeš³ä-ûå ¬÷–ÌË¿ç÷øùÛͽüaùÅ}·º²…­Üº÷3I2MŠùË’‹°›Nh]GûMlRËë4ÔyÜÚŽ¯]S×Ø—œ¦2¨©©½Ð·6ìĶB×êZÆï_7­X™¯í›6aß/i¹9^ÙåϘ,Vᢿ\¦–FmJ~éŠÄgmS:RíqÑŠË®ÂÜ,[™É€ì+©MÏö»¾+ˆëê.:7‚/©¥¹6ÍöE/²r]¸ÀÔ_ôó6ƒVV^Ù#ýîáõÕýþ09,#€¥•Ú«ô­—Öci%> -endobj -311 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-199) ->> -endobj -312 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-200) ->> -endobj -313 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-201) ->> -endobj -314 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-202) ->> -endobj -315 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-203) ->> -endobj -316 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-204) ->> -endobj -317 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-205) ->> -endobj -318 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-206) ->> -endobj -319 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-207) ->> -endobj -320 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-208) ->> -endobj -321 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-209) ->> -endobj -322 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-210) ->> -endobj -323 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-211) ->> -endobj -324 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-212) ->> -endobj -325 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-213) ->> -endobj -326 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-214) ->> -endobj -327 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-215) ->> -endobj -328 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-216) ->> -endobj -329 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-217) ->> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-218) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-219) ->> -endobj -332 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-220) ->> -endobj -333 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-221) ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-222) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-223) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-224) ->> -endobj -337 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-225) ->> -endobj -338 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-226) ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-227) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-228) ->> -endobj -341 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-229) ->> -endobj -342 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-230) ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-231) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-232) ->> -endobj -345 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-233) ->> -endobj -346 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-234) ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-235) ->> -endobj -348 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-236) ->> -endobj -349 0 obj -<< -/Filter /FlateDecode -/Length 4965 ->> -stream -xœÍ]Ë®ä¶Ý÷WôÚ€i’Å'`xa$‹p#É ‹ñõŒà:€E~?§Ô"E‰Õjêº ÈÏ´HY"OU‘”d®>7ø+9£RÊ1¸ëË/—_/ZE¯ñßTbu1e‡ÿ£¿í¢ò&‡ä¯¿pE³·1\_/øksÙ½üý³ËÖ2æjUÎÁýí#g9R1Ũ½•‘¥ YÞ«­BV0 -·˜³”5|tÖõYj¸œ¼”5œµIÈJPƒ\4Ôge¨a£qRÔ0ÙG!Ëhèa¬ÖbÑΑòŒW¤'çļŒ C¯JyÁªA×b^Bž‰ÄèL±‘¸±”J˜ô€à»K@ ä'qAÌÐSEâ˜"•,†%DÓl}:ávàS8‰@™ Î+X³ò~·F&Tvpc^RÕˆþ¼~æ1‘7ùÀ0"s8«pêD @U`ý0ƒäãfð_ÖÀãv*`~x0¶–xq­Í0-LK !ôÂÀ@ç"ÂA÷Kâ;ÀŸÂ»Ô9chüc ~Dsƒ2§B-D›˜èæ6–,¼ ˯UÈ2½ôBxoÃz¼$¿8¾lt9˜…ÿÏû.>‚ȘÌy ÃeY}>؆|h ²µ1sŸ6é¡Ò öJµ1¨4CÝI@!QLnÛ1ï[;Ýû§M¿¤Rw¢‡.ÊzÚ(Œ:j2@4&sEÞaòY[D2ÅÏÉ^yÙ81ã,³R¨…N7<‰c¦ ‡õŠ_™h -W÷GgHä4ƒcy™ÍæøD'w]éÄZðVÓã:ÙÛ]  íë|8ß ;•™×§é‘ùÎ^eÖ9dI~Ç4ð~r2ìl`dIiÐ~´p3(sàX˜22|®á‰ÀYUú¾ Shgæª}0œèa—@ÚYhç±ñ°Z^O‚ô˜ì´n ÔKwùQë ï€‰76¢s,ï§ÃC0ÉœL¼AÊ; -I6/7¢vkRãSlâæêªnÃ?»ªyãƆ7™2^áƃ3› }áu"¢DIAzX„n4t¡ù·y%6LŽŽ‰à¢Œ*=|ðrc2ç\„ö!$’!7C¦x&Î QÏv‰$n®Ûåšç@OÏDë| Í ŒqXÆp˜˜­$=5Í{ÏÆ&+ÉïÄy}Ú Ô˜ÌiÅ”’ɈäX‰W6o\Ù†ÃVœöa.Ö+õ¬€6 œµ¢GÓKN/O0~îŽñƒ•T)XÞ5 ™·/ï9ìâfLä<°±0ÕÉÂZß5}•g>¬á± -¿‡]áuƒ{ÑQRÆÞŽ#Œ§ƒ2çé~Ï»?p”òÝØu¥íì¯TŸç¼5VÙ7´oeÀ‰­Nh/=âÄ.K¹‚üŽ @ŠoðGDƒ2çRäSË~à3¡´ªô‹ˆúvŽDD½ô±ˆH¸ËˆˆRRÁëAçèxç'=Ó˜ÌiÀÄ;Z)j>:ÿ<0­+}ß‚EZ›)ÉfÁ¿ÄõzëØQ.[Öc{ÍÃoYí¥Gà—Ì…kI~~d„x‹ø´Èè®á Ìyà‡¹iÈ&ïŸ ¿U¥ï[³÷ÃƹuÍ&Ÿ=Ÿ>[ÌSßÖ‘­Æ^úØ^c/¿ (â#ËAóѲa@ÉœPÆ<{ æ3µªô}Ã_+#Xx¬=1ñi1œ•¿^¬kûÀ:éƒëåw¼/ØUÅvÑsƒ2çŸáó !î3¶ªtˆ±¶[žù0sumV'}Xü^xîxUArØ”9 °¼†é¶ø%“x°Ö•ŽkÒ†½ê¶©>¶´ø]½Gü®^ú˜ßÕËïÍ£Ž?!ÀeÑtèlƒ2ç?½”ùÊ.Þ¶U¥ÏÛTV7.ÿ l6Qz}l¢ôÒÇ6Qzù]P:À†dõôôqvцG+Ûƒ2ç¥çÔ@ôT\Uú¾5qè½UriE\*ûa̯k8©Óë1#.kë½ô#.«ëB¯˜õÔªžë§{»wüd!?{müø²í Ìy ɯ…ЙŸ®"$W•N<Ùòcl๠'êÈ᯾­Ç0[|Ä^zf‹—(´Nwá”ùí$Ö­?×øNc2§SÐüpåô"ŽçÁi]éœîE©£°Z€Ñ·y$xè¥BëwaLPˆ¦=]@>°ý$“9¬ˆŸ|qàögÂjUik"¶çêc#íq™_‰žÛCyí€wº9„ÛK;„+Èï,‚À³T0×å ÊœpžŸN‰ÐUÞLkÂo7’»ÝÈ(`®qÿÇ9i¥ÔÞ†s|vV[tÇ°©”9Ï%6¾sÔm;D›Èª}Ôëy›ÊÍŒ^©·;XÙ `³üÐúèÙè1‘Ó UÔü´†õZžMo|pU銾ÇgWs.º¯ïȹè^úعhA~‡‚á(|àQ߃2ç ?¢›Ð´¼q[•ù\h¾ÜVcÞöÕW¬›?WôÒÇâ -A~¦Ü&Jv|õxPæ©ùmˆ÷ž‘ªV}{Ì¢û±ñè}§öœn<ƒíºí@°Ù ãJé£Ke½ô±¥2¡õ»ÁæôO‘_â1êûÊœBizñ›REùÆËØúûÂñ± Nícxa"‹AY+µçN&ô¬1Á…4>Dƒ2ç"b -eïú‰åºÒ»lñ¶sÃÍ Á¾#'{éc'ù½÷:8~¹e6 ™ÑØdLä›ò{ ü>*閭ÌÈy “øÁCñ©ì³ªtµ×½'âÑÐ7Àéj=œNú pzù=à`l3Ì+¿lØpÉœ:YóSN‡gKXWú~k˜æý’»¯£6\};G W/}Ìp ò;`Ê&+,ð`ŽîŠ ÊœLÄÏuLÕg‚iUéa0}ùÖºy¿P§Á‘½^úØ^ˆ ¿3‡:lÎîÀA™óÀ̳u†ºOå¬U¥»0»÷š¤qæéÚ:ò|W/}ìù.A~Püˆl¿"rt)oPæ<€Jü ¿–û™€ZUú&@½™»öé´8²ØK[ä÷ –™r=¼m`T²§GH9 Ц·žš÷E>7°:qY–k^´ðÖfaùø۳Ña³róÝüÖU„VüîF>È(¨}×k†‡Etû¤£øNÒ«Ù¼”»7Ì÷ÄöXñç–(]§³¡‘ßP̽ùõ_¿ÿÇ·Zz“ÐKö#þOŒ[üûCóÜQäùÆ=Xzòv¤p*ÇG SÙq½•ãt_Ú·¹;• øiæ2ü‚f´aPŸÉsß´æÅ7Ýèò±ëþ_/azC¶™¾’ Ãäif>YáqòWùíÚäLén3u¹Þ‘œ>>õk-Å#Ió'*xÛvŽöb.ÿë4P¿\8 -ã{d@ß¾£§d~ÙÝ6ùõÂßrB2< ;˜Ì‰óO]ëâS›´ðATy[’¼ÒóÏ\+'_~Z_î†å}ãw:óÞrÅؽ5,$B2˜>™ï³mNæ7Ò%EóU¨ªÀŸÏ5q©Ðµe— -Á‡É¼—º$ú>Q7Í-Éü†ÄRÖÖŸ¹Ž9«êm×™føKY›áÜK|¹ YÚ¦¾Š©üÕ—RUé]°ZI£F©\S})YÄÕq’^.BâçºTÍrÍoFßKLH®–Ë¥œôrË͵ù:R±–J‹h.=¿¨²@Ríx!mê£95òåš9¢©ü\'2Ö}ÜØ.ñ姻ä׋Bi¿p…özm"5õÖ䤼,©1•®ÂÔ,iüæqþûF¾¦2óL?Œ«â¯,WK#<7kòº“ÚôPYÇI=À¯5]*ꎱb¶í/“´PžI·–®=¶Jmº¬I¹¨Ç$UÉcl*êj2SXéŸÊ•m¢.J ¹%ÙW(¿®’=}ª^×Æ‚iàîk½Kr¨ÜùÚ&Ç:â†?Qõ­õ6˜/‰/“asÛd†~*,ɼ”XàSkÅ@ -KòB£¯Sr™­•øa‘òs™d’Å}¹ü|™Ìœ%oÙe døËF­·d®ÿC™oðÿ¿/îúmy•þÍŽ[]ÙÂVn]%·–Œ¿ƒ—“ù»x%±N›&Ѻ†ö—d“–²¾ ¡Úqk¾v‹¸^ˆ½”4•AMÍmýÒ‡M²­Ðµ†šžñ;‰/›^¬ŽÌï›Å`ß.©Üðü†¢.ÚÛÁeZòh1ÉצJ\qÑŤ#×ÙFm¥¸lÌ‹f+5m#µëY×q[ÍEãFð%-yn1³mÕ%mº‹¦\`j/ÚŠiÍ+}¥ß<½~÷¸Ï*‡28µR{M}mSëqj%<9•¦Ë°¾¬6‡¦õ¡2y—ªuQ3÷¨:9ËÔX\ ·ºh1Ú¤¦El.àÛF]I[5Z E¥ ¤é’VkŒE§0‹•n™î8‰½«O±¤þÜö´oG¥v¢oG%te¹Þbñª·DÕò-œãrwz)Y}É$¤…Vº¦º¥$•´¾m·n»XÛksnQ$,ž©^Ä|WòMü÷–¹s“Ù¬H¥ÊŸiEäåã30ÔÎD²4}OX§À!Ž? ]j–8Ëì¯yô+eÍ£m á‘Ž†¿ -«ðŠŒü8£©ª|5ZãǺ„[:ÖÂ’ÎBsº[Ñ™> Šÿæ…z9Tä/;½‰?`µ—x¦¥–´Z>™þü©(Þ5 -endstream -endobj -350 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 349 0 R -/Resources 4 0 R -/Annots [ 351 0 R 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R 357 0 R 358 0 R 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -351 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-237) ->> -endobj -352 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-238) ->> -endobj -353 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-239) ->> -endobj -354 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-240) ->> -endobj -355 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-241) ->> -endobj -356 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-242) ->> -endobj -357 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-243) ->> -endobj -358 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-244) ->> -endobj -359 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-245) ->> -endobj -360 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-246) ->> -endobj -361 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-247) ->> -endobj -362 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-248) ->> -endobj -363 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-249) ->> -endobj -364 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-250) ->> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-251) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-252) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-253) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-254) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-255) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-256) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-257) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-258) ->> -endobj -373 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-259) ->> -endobj -374 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-260) ->> -endobj -375 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-261) ->> -endobj -376 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-262) ->> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-263) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-264) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-265) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-266) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-267) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-268) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-269) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-270) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-271) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-272) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-273) ->> -endobj -388 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-274) ->> -endobj -389 0 obj -<< -/Filter /FlateDecode -/Length 5119 ->> -stream -xœÍ]]¯ä¶‘}ï_ÑÏ,ó£HE€» d3ðb×ÈÃLg&Ap'€³ùû{J-~Hªn±¯ÛpûúÞiYd‰<<¬")µ=ü|cñ‡ÉNÌ9E:_¾ž~<™)ƒÿæ«‹9ùøMál ¥)Ø9œ¿ŠÀ§)åàR<¿ðgsÙg;ý÷¯NÿXëس›rŽÎ†ó??Kù)qJ&(IIÆz%)„)%¢’í„[ÌYK‚!‘£}R‚”9hI0ƒœc%‰a†§dý>)à —,iI0Ãæ”$k`‡uƨi0Äy§¤Ù0E4zÔÒœ"g—Õ´„4›œ–æýÙ`µ´<Åki[B6VK °%X"£¥Áòœ´´[|ôFMƒ-Ž“×Òlqh¬¤1lºXMƒ-&«¥e?…ÌDjZFšáÄû4gÂØ{£¥Y;`Ó«iQ褘”4[¢ YMƒ-Á§¥yØBøÑÒÀÁ'fe´:ÝÞx«¥Øâ\"5 ¶ ó5p¶˜5 -Àš„—4p)M”i$àØOÄÄ 8Î¥ä5p9LsÒxÀ‹4g5"ð¶Šx [#WMƒ->“ÆÞÁdиÀ{ØâÈk\àÁ¶´h\àA·d²Õ¸ÀƒoÉبqáÂL£qãzŽ¤qåJYãÎõàN D§qízâ¨qïz²FãïzM5 ¶À€'oÙk\@à]oMÒ¸€À»FNãôêF €•É1 ¼ëØÆÞu S€š–&ŒA¯qw]À-h37x×ã4. ð®#5.P&ðQ½ð.($èîlÁj\€ùiÎk\€Â&·Dã‚ÞµÓŸ2¦ÁV“å5.à]Ëè>5-O6¡Å•q‹VžlŒYã‚ÞÅDå5.à]Ð'k\ŽŸ0£: x×zÌÔZx׺l4.à]ø AãÀa²p4.Àü6Yèªiy2™Yã‚Þ-9 0 O†Á$jZš$«qÈx2ðC5.ˆà]LïYã‚Þ5Á{ "x×Ü5 ¶xvÀ¯A†­2¦á¬NÆ)´4ð®±èa- ¼kLÊDð®L›Ä$ÇÀÀ ^°Ó¸ 2M9¥¨qAÌipùÔ´8á:h\ ”¥¦ÁJ¤që)ûÌ$[¼s$[à2h\`ÊÞ·ÀÀE¶ÀSÔ¸L6q&Ò¸ …ˆx ­ª¥E7q]«iŒ4›4.H‰&LÅVãÄRcÐk\‚ŸÄ]Ò¸f Í’Æ)à  0Mìà™ki¶ÀÉÖ¸ž.Ò¬Õ¸€l7¨q;F”Ƙ¡K¢©µ42g²ÆLqWQã Dš`J5 ¶€&4.@ÿH°4.@ðƒ`aŽš[| ˜„›¬q3lqÆi\lJ¼™4.ȶÀãÓ¸ ›8‰›¬qhiÆh\-#Þt¤qƥě¬qAöñ&B^ô†1VeJ1>Løu×âæEºà7]¯‰yøõýJˆÕŠóÍûJì_•gµí•nÐyY€ÄERÔeun1þ?>¬‘Áa"¸èè+¡âÐäÀ4¦ò.0ýʘl‚ÃúD ­Êœ1T°#X*¸¹tr»ü{ÒZYõ.ï«@Q…àNyE „û[ülë(ùÁÍ6¬geÅ¡˜ã ê¼ Žs"ìFOÚ'i]è=RälYˆÜ‚¢^öes½¤$V2˜láŲcðÁyö>1mk}Œñ .Mÿ.ü]È웯›;™’‹ñ~c:¯?€ÆÌ3yl]èÜÌ܈¬B:RS`XanäýÙå¡îßÙu >žc€µ»_F×Û”Ú*ePnÜ—Rî’ðGŸÍ¼k2â-sÉ1×d’MA¸Kî™\úCUËÒø—Æt3ìæÖ6=îëyÄEÛk?æ£)wù8ÄXBõlX–o%hg‰´ï#lHåeædu Õæ¤lŒ›Sޒ瀙0Þd“bSiŒmˆ§ÆVœ¤ñ1>¨ó:]àâLÊù™c|]è“»²óŸ÷õ<â@ïµó ÷ú”[•ñ½òåt˜ÉžU"’5×QçzPçu`&{ß²YÄÏ„ÙªÐzhÙnÚð]'|êàV¼·ÉoÆ`Ø\齸Ò{íÇ\iEÿÎz€‹sÅ6Ùsbá"ÓÖ†T^j s`ˆ‘½ -µâô>±Û ‡OHÿ×…uµ<øÞ)Ú#€—-'k8[Eÿq¯Âq’Œy—Š’œû´²lxc:/9%ÆS¯Î6«èc‹kî…âÏŠÚ¸_yÏÁ8Ÿ8:Ù4vrvÌ’‰G‹xƒ:¯Óe;ÌiOœ Ö…Î]o–îû´t/+F^àpéÆ“\‡«1RÎGÅ—ùüàú²Ÿ‡“lfï-?äû‰MÒ´Ú̓åæÃÒ¬éß™R¼çɺù¼ŠÝ”ÃÝöˆQu^žAv±ànågÂsUèÏ Ïº`¸]®îX­.HÇկ˯6ûF^¢-šOìïñÈp0&ñg}P´Z˜$@ð6ìºíÈpé<ËþóøfÉ Îë9É¡úDñ©<»*tåe…Ö@Ãaú¾Ìc§Z€“MFoïµGœêYîõ÷´<óüì,ÚJfࣜA—“ŒUNFžíxœÖ…ŽnšÜ„\Iï®ç˜;^{ÞÛv ˶ò¼×™˜œõµŽÝ½–¹Ëk‘è^éUÌò¦«¦^v5@Ý‚Ž×ê»ÿüþþðï­Wý¼P#Ë×Ãr][;^¯ ZÙ}ZfÉ“6ùø*“|R¦ûŒ_.ˆÁÿ%¿)³Qñ½»òã~V£²Áÿ±ëåÐén7n¯í—‰«¦à8ÁŽD¡´ølÕ§fA¸Ùë–hw¸è Ü];º`ºc ‹^ìÊé졸ä·Û–ÐZášo.Ç.÷Á­ŽÒ;’-v§ÀY›všÇ`\l»,6çÎNZþU²®ÿ:v¯÷<ÛNK{}Yìs×{ñùz¯Tú!´òB×vÖ¾¯_J»W›‹Þ’ö`»¹m»i}>—»é¯Ñû¬¶Ú®=KÿæÖ¶=NkþÒKùó=ÅVGÅ‘]0Öµ+äÚ/K?ͶÔ1{¿Î»íG;Ü¥¥Þ¸ô‰i˜*ØYã¿ó¯¬ø_¿=}û›e"\Օ䀽ÿzr>"ÀŽ9†^þ&OôfÙÙ>ÿëô'™n õ®fÖv+«bú[Ù±îÜoK›–¾¸®Z,¿—ý¸.ãäh Ýâ„-nÞÃauL—:/ f¬èžxe\ËQ\¸ÙûpQŽ©üÒŽS¨æÊNw‚î8Å ““6rþ|tKjPç—nšv˜n8*`üFÓ4¿Rfÿ¯ÞØ^¢Îèõö^C·íüQoþ(> Üótæ1Xi¼NÓ˶R`G¡áÊ$gÒ8C“³4Ÿºß0c:¯Ó4² âðI?¶‹Hº­À­o¾ÚyòfÕhGÀâå¡0þr}¹Q¦r˜b•w;J*“wökÑV9@{°VÉÁ'Ø4àØJK¿2! ßk—±|wk9lî|{'˵5›u±n·~î÷ õa SG’‡×\ºY^çq4 Æt^gÈVûèõcj´ÙÓ¯çwvká ün5ð&¨Ÿ¡þÀéƵ™nÉîµ Øl†| ¬6ÔÂ:ÿx»Ü`ØŒÙÃEvr—fbÁáCc:/­$[V½¿Á°ÊZøÈš÷#þÁ¬Gûòf˜öP,6|<Ú”ÁíÙl}4›ÛÛÒiB{í¡-º%´×ßa•ä¼¼À(Ø0Îqƒ:¯DÙœ2Y^ÚòKqžŠ·Nj?å÷{²ƒÅêV÷ë>á^{”Ñr¤”5ýw‚’ò$ïIÓ}ò±3óƒÙ÷A9¦ó: Œó›Zä-QÏåj7¯÷˜îmdú–°“ÁéÙÜÔüÉãIÈ©hÀ¯cäþj?”a'ObYÊ&ŽŸËÔyØɆ”'²7¸ðË.ýyí -Ÿ8‡ DiÙßA¾t^Ñ~Óç8\é¹iuã÷Žç¤œåqÛhäȯ™H^ùqä› ê¼ Øb -ÏÉZýPÝûöùÖ…>ÌbûvmCw_×#G…÷ÚÞë?Æ4,K‘qèÎÑGÆT^`^¦chß8²÷øÝîÜåºð±S›íÔå^{æò-h*¨ú² rc‰‘åá$t[v£KŒC¯ÓÑR点Á$7–Þ‰bˆbûèÂ÷ Îë4 cR`T}ã0E·ðÝ6Ì6óî§ç.xÏïŸqìyC/ÓäÙ -K&Î7ŽCÝ@cvaÊYÞ+xvòÖ¦åÍE÷fLçuš†Pž5òjÖ›g pöÔ>¯½¾:¥÷Ë+7’íÒ®êù}ÜDÀG5ô)\7Ë=¿0˃Á'ygÐèS˃:¯’Š•ws=ó8áºÐz–¤b»üÑŸñúKçú‡&_­Ý™@n Ì‘³`í4×ÞÎãèµåÚkD¯-vVj/»|òøˆpÇýÔy@f#/hƒúS_ÒZ©Æ¥fê·z–ùÖ;D†÷(ö6Ýâ!‹¤)¥lçGç#""#;jO*½LÇ[ce~å˜nì]÷=ÿ Z$±©eõÌá“žê"ßWv´Rœ_,³Æ^½î™~–ÀoÙÖªv<\^¦59Ê/³<•þn0‡Yà±;U_‡u¶›×O­Må9ž–×3ÏËI^‹pùhjYdëæ"»€¹Ò”·9}˜Ìò±r–#X×ðÇcÓEMF¹øxåJ°{­XB3Ú½XîÞLvË×*ðä—«XM­æ*lRŸ·ØŲ¤Ø„a/4]uM,+F%¯«sís«é}ÓÙ®ûK^—ºî¼'¼œP­ßJßT©¼Ì½UZ×™*óQ¹JCÉY;„j?)¢ËI~cJфάé]¯É+q¯B.@¢š/—|ŠèrRó-¥…ÚS©æ⦚KË7SÔ=׆Wd—îI€$ßÓãËǵ8J”¾6ÜáÆí„—S :›øí’’;4®0¡@¯ú®Ü*fÓðÒ¤²Å|ý„¡YdòBQù{¥ŠP¥Â<óKRòRàvÕ*‘±YÅëFêå±²i- n´ÝIQvJ³}{ažVò éÖܵÅVÒ®É:yÊÅ•+{¡)F º&Êo+q³3Ô¡L­,Úî¡–Ûırç[/NµÇ­¼á¹Ú[Ëí0_„—yb£­X Ï¥’&–‡Ì -|je°RhâF£o³¸ŒÖÊNî—mi3îåô·Ó<Í9œ¸ÖÑ[ù‚Þ[²ç!Ïïñû÷ÿPÞ{Ç©lá*·®ÄýL&_oÃbùº›"¬Ã¦:êh¿‰-·¼¡ ¡ÎãÎu|MMÝ4b/9meP[S{ahm؉]…®³¾k™pGxÙ´bud~jß´ ûzéËÍIh ïV.Vᢿ\rKómJ>wEâJ²¶)©ä:E\ô…ⲫ07ËVf - ûJjÓ‹ýÔw…ìÅô!—¾¥Q›fû¢‹l¾‹. \`ß_ô“í+Í+{£ß=¼~r¿/&Ç2DZ©½Jßzi½1‘VÂÓ¥~¾ŒëË:çø9ò,ƒ·µP-ËwcÏW'§ æZÐê¢Çh'妶d}¥Td«JËDQé2SdµÄTlŠ‹Zi–ùŽYm¥T}Š&ý[ßÒ¡ï•Úˆ¡ï•¸Ë+å–¯zK¾:@¡‡sjwgZÎêK²"‹½v•RËé‹l_7­ë.³í¹» j†Ä晚¦v9ßÅï;ê£UZ®ò3¯hXnï”ÇD-¯ô‘u\qw8FpÉ7½$ân‰ãaûkû•²æÑׄî˜È{“¬|á£nÂòqBWTù2H]M•[z¬”%FsûáæoüÂËÂN½L*ÊüÉÓ\Ìò½DÉXu‰g^jÉ«å“ùçÿ—•Bû -endstream -endobj -390 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 389 0 R -/Resources 4 0 R -/Annots [ 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R 397 0 R 398 0 R 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R 422 0 R 423 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-275) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-276) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-277) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-278) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-279) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-280) ->> -endobj -397 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-281) ->> -endobj -398 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-282) ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-283) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-284) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-285) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-286) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-287) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-288) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 443.811778 177.650223 428.811778 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/installation) ->> ->> -endobj -406 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 415.114756 101.433071 396.364756 ] -/BS << -/W 0 ->> -/Dest (cb10-1) ->> -endobj -407 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 396.167735 99.933071 377.417735 ] -/BS << -/W 0 ->> -/Dest (cb10-2) ->> -endobj -408 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 377.220714 99.933071 358.470714 ] -/BS << -/W 0 ->> -/Dest (cb10-3) ->> -endobj -409 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 358.273692 99.933071 339.523692 ] -/BS << -/W 0 ->> -/Dest (cb10-4) ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 339.326671 99.933071 320.576671 ] -/BS << -/W 0 ->> -/Dest (cb10-5) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 320.379649 99.933071 301.629649 ] -/BS << -/W 0 ->> -/Dest (cb10-6) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 301.432628 99.933071 282.682628 ] -/BS << -/W 0 ->> -/Dest (cb10-7) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 282.485606 99.933071 263.735606 ] -/BS << -/W 0 ->> -/Dest (cb10-8) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 263.538585 99.933071 244.788585 ] -/BS << -/W 0 ->> -/Dest (cb10-9) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 244.591563 99.933071 225.841563 ] -/BS << -/W 0 ->> -/Dest (cb10-10) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 225.644542 99.933071 206.894542 ] -/BS << -/W 0 ->> -/Dest (cb10-11) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 206.697520 99.933071 187.947520 ] -/BS << -/W 0 ->> -/Dest (cb10-12) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 187.750499 99.933071 169.000499 ] -/BS << -/W 0 ->> -/Dest (cb10-13) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 168.803477 99.933071 150.053477 ] -/BS << -/W 0 ->> -/Dest (cb10-14) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 149.856456 99.933071 131.106456 ] -/BS << -/W 0 ->> -/Dest (cb10-15) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 130.909434 99.933071 112.159434 ] -/BS << -/W 0 ->> -/Dest (cb10-16) ->> -endobj -422 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 111.962413 99.933071 93.212413 ] -/BS << -/W 0 ->> -/Dest (cb10-17) ->> -endobj -423 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 93.015391 99.933071 74.265391 ] -/BS << -/W 0 ->> -/Dest (cb10-18) ->> -endobj -424 0 obj -<< -/Filter /FlateDecode -/Length 4795 ->> -stream -xœÍ]ßä8n~¯¿¢žX$R¿€Ã>,’‡pl4ò0Û7s‡ 7À^òï磫$Ë6ÝVÕô<ž.“¢D‹Ô'Š–UîjñóƒÃ™É¹¤È××_/¿]¬IÁâßTbq1±ÿŒß®Îr2Á•˜ÃõW!P2©Ÿâõí‚ÿV—}ñ·Ë¿ÿîò?Kwõ¦”è]¸þý‹°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑÜb) j„Äž·¬5¸ä ± {ŸV†ÄÉÑ–U †OŽ5Ôp%$…å,ôpÞZ•E,3y…炉èô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx ]B±Nãè³ÕxÐ…)'¡ E²*ºøœHã%èâÑ;EáeèïÊ*ºØhÆ+dBÉÌ*¯€gsÊ[ž·Á„Ld5žs&À7IåaDÁH1)<]¢ EåA—@Ök<‚.Œœ”rVF«—ÑM–œÆ ÐÅûÄ*ºÀøø]lŠ`Á% |J†‹g |&Ù³†>Ã)‘¾ñ$ È:ð¼Ó€€,t 5$ ]#WåA*¬ayè‚AϤamÞ¢anÙ§aoÙº¨ap¡¦Õ°€€¸”#kX@€\¸RÑ°€€¹ìÔ°€ºîIÃêRˆ^Ãìç¨aw‰Õ°€»DTyЬaÐÑˤawÉÙ¤aw1Œ¼†°ªF à+Æçl5,`à®Ï–5,`à®O˜T^2ƒ¤aw}À-h37p×ë5,`à®g5,€£àU£à. $èátÀjX€ùc•­†˜¡±–DWk<¶²ÎÌdŽFBE 0L°ÒRª<è˜Ð°ö‘Åvа‹,6±ÌQyÐ…kX³—åfÖ° gèâ­×°¾)ëͤaA±ÐŸ†ÅF#a²†€qð¬Õ° ¸Œõ¦g 0.e½™5,(d±ÞÄO·…¢¬7“†…¡K@ˆ¢ò  ‚¦¢Œ[`Ö›@'¡‹/¬aA‰QÖ›YÄXo"¢WSYÖ›IMwC2i<à."Ó¨a.°ÞDd«­í-€7$Äg:3ËŠ3« è ˜[Õ”öb¶JjÎÀ|e¤&  &V–9ªYL«`:«¦ ,ðño0á–}êSTî0gæ$7Y0,Ñ}[sÌÅh§Ø-?ö÷¿^~ÿ“ïõ¯ÿ{ùú»)SVœŸ8ÊÂ:Èñæ\™©:†¡™ˆ,óQºRmÃËoˆ´L#<`d,±§üe§éc¡'Ú‘H ¢/ȉဘ×ò¢ðOŸ.D÷æoùÙvÙ©¹œÑµÞ^?ýzùýÏÿùo?ÿËOhöÓ×ËË$¸ûñWÿþ×õÓß©Q–ĦZÔ)ÕpºUÜýo<®N&"„«Åm«sùqþçOK`ÍÎ×Ð’ŽLÑ‹;°Ú˜ÈSfûÖ -A‚—ck=h=Ä{Ö¥_´ñÒ[ÍßþVkr¾ÿýºâÇû_¾óÞo‘ò´üqÛôž¥‹l)èëDˆF¦ÃSÊœÆÖX#`™„ÞwûAãË(°ìeB]4:ÝWXÁ"û»EÓÒ B˜=!ÄáñpÐ¥Ìëí;/Ñ—HФîXÒ³˜pC$Mþ³üî8â@™ƒÊ-eNDÓ’ì}Ç“9ãÉ=“·O ÌóŽ·htvüìpk(j×Õ!Ó²®Ž kNvX•’¢Ù¡{J¦‹KŸ½"=Ð/äV ˆÖÞí—õ=7¨Ý8mD<•#û€ÓŽÉœÇi“<à Åú¤Ó.}éŒ2!fuXžPsÞÐ#©Vx^rš^Ç. D$„’ŠôˆËÂ!y´Z¯|±6ÚDͲ`+6ËC–$”tzß9ÇdNãœ^²h¶¤Œ²—•¾tSbš®Ã2úÃmšŸh+¤lÁÜ—¥ü$“ŽÝbF­¾ÇN9»ôVzÄ)g§Vz«¬ÂÔ?¬æÕ]å!zv¤^½,ôlšr–ïºë ÌyÜÕÇ)º*X:Jkd9aÛj¢ï#ʇ]Rpµ,iͨ¯]îDÛê~ìºÓF(–ÄíVzÄuÑs!e›4ù~ÆhaÀ¾ËÊ3£Äœâ5›Xˆ$ ý¾ÃŽHœÇ]å¹³<¨Éº»F}âñqZ¸ä®œ²qIJ=è˜1™ótMÂDbÌ´Ó5Ýhî>ûØE2aµÆ«£µF):_—‘Ôb¤½W®ò?ßGh­ÿ—¹LOŸcoÍÙ×KwÝ«åŽ8«è*„U;ëzjý]d7ývhµ‰Øî×®¡ÌÆùr’|»¯ëóÜô£cxfÔA²û5ZÊ£+Ú!‰ó"fK@§<´¢Ìy·…øš£™nò(Í?&ržŽ‘-L!{ÞñЧ2SËJ_öÎý‡HÎÉ "ä‹ÒÆ.ÐÈ£IëØß?¶9´â˜ÌiÌ,€ÑãÓ¶‡÷1,é·¡´y Ë¯Ÿ¦µðÖwa>¿“|¬îrœïž-nu|äÙâVú±g‹J=•²QzIè6Þ ÊœÇeå…‹Œø÷{n½Y6òM.ûÀʳÔB%~éºlõöŽ]:3½Æšé—ŽI|)Mþ±\y`¸ÙÛéõS[({äÊc2çqå ÔHô]ÑwÑÈË=QÐŒQÿÞ7© ÕámcÛ¶Ž7A¤Ø@“Ù@$ï -3sZë»iyJ^uòs’—ÒÝaÎmPæ<î%ï²Û"¯G÷Z4òž{õ(÷Œ›uŽ²ióØÍ:7ÙH¸Ù¼KNi}ßÍŠµà½³ã‹ÕA™Ó¸Y´ò¦ØtªÀ÷s³e#/¥ƒŽ\ƒä{\$¥•cÇšÑo+ýl -*:¬¯$HCLòîÃûÛÞÇdÎã6$ûôñ÷® —•¾t˃q„µ{lÔ¬Ÿ".ëƒö4Ì‹‡­ÎlÇÙJ7§“·²øþìSj «kà´³óL‘fí‰zW¿,ïv’¿Ë8Þq^–·ÏS” lòR®CTx´1gPæ<Îäu…]?Òy•Ng•§‰¯z¾t¹Ðxó6­î%Db”Í~Ö£½œ,gˆ‡†“9a³L¾ÞyTþ1“Ù¢‘ï6™mZyh2ÛH7\±[¤lW+Ú†/ëÇîa¤;.W€ÎOo*èX^r?Jh ÊœÆå’•D¡vKžv¹e#/Õdý&é¯3¾ô/¤Wg§Û¶óˆÓm¥GBóya ´¾3I!L36†Ë>¸’8SÉ››Mï=àÛéÆ2Çg’]Â%9>Ív̘Ìyº&È””ryüQ´ï¶w48|]ÍÅë­'¼k»Û:V‰Âõ.(f}Œ®·Çìm[ñ„¨—öLeS›œ`4<"F$Îcö,›à¬÷Јó0%y4š”9M×äé\’C¿u7À&0ø¬Dª÷%ÙîÛÃè)ç"GÉzøéÄ;NG¯Éœ§ËIòI_}Øþ~ݶ£XOþG€E7ËYnÅEÌ4(s·ÓnÁDò)ÍðÄxj‰ÕáMR;ã/ÊQ)NŽÈ^ç ʜǼYöÏ:J7þvͽz+¿Íô¬ÙVÁEu‰Ý]:=^,ËyVƒSûÄiŒY¬ìO…Çí<Þ™Ú‹+Æaf†j^¶ñg9ù ceÎÓ5$ûDcŠ;Øw=ºïyý^I{RÞ?Ñ® ðõù¯+Ù>Y®Œ…Å6‰Ãí…ÑE¾£ã`Hâ<ÆÂPöÁq G*å¼¥ÑwPæ<]“e¨œqyŠeJ$§˜¬ÔÉs›ƒ.“9M—O‡i¹Ä™wžðü#bÜG±§ZëÏ÷s¾þÙ+•b -#¶éOk&:,r`‘© ÕS°®nuî”ô|¼wy¶9àŸòuz»:É™xÒÑ?ýëÏÿñ§š;šàþ ~³t þþÒe%’t€tFíÄš}@9Ù®”k r+'ôP;<ÝMeã-;Bñ^¦=|Âo¹— ][ñ¾QÀvº|ùqÝý¿]ât&£›ÎåµqšçK–cTÌQòRn–ó ‹‰{w»©ƒÜuGrúºƒßZ)ù$+‡"KÊx2Gq/ÿÛd¨_/£PîQ|ývZ¹È²è\“ß.rZ=+dL+~,ÄûGÛê’Çe+Ú+°"™².IÁØûÇÒ*§P?úPïFäC“Se3U½ß½5¬!Ý–,wo»“åÄÿlè~›*!VAœ+ä¾ì\á,xH–ÜÿL [¢íš›ÉrQ-ëÛÇÒlbS½ï:×™¿–õ©3ç{Ä× š¥5õM¥Ê9㵪ڻÞ6uJ•F µd37;)¤×‹BüÁÖª ¹Æï¬&§µÞˆ¹:·r¥–SH¯µÜ½¶Ð,•Z©<‹–Úó³*³«Sn¯Ð¦>ºS“|…I7F,ÕKr T[cá1ûß_/²%mC~»„¤”3VØP]¯'RWo#g;ûËL•µÉí†f¥ÉY—òÿ *B£ -òL7—’ój竹›¼ì¤žê°Ö²Îm¨¨;¥æ³}¹l•òº­t뱵벎žJUO@ªÇ’ìš×5²@Xퟆ•=ÑV%ÐÜLÍ•ßäYÏІj°­±è:w­Þ™v¾õäÔ,îäðá¦o«·óùJ|&6^“Åõsmd&{Ûf»¹±Ž8+P˜É3Œ¾Mä:Z:ɪÔó ÓfÜ×Ëß.Ó4ç)x‰f#99K¿–ÜõÿPæøýï _ÿTo½ÍãÞ6´ð [ä~&“o^Ƀdù&–Jlæ#zî`&»<— ÕÚ<î}‡×<‹ÛØkI×Ô5nO svdß\×;êz&¼C|]õb d¾Õ6ó„}»¤zsò¬YŽý­Zᢿ\æ™Gó”|íªÄ•§tpÙw‚¸è+Åe×`™5[¨)Ù7Òº^ôçÞ$mu]!—4óxžfûª+mº‹®B`ê/úŠÙõ–…>ŠÒO¯o¶û]åXG€P´7ê[Om7&Ôx:•¦Ë¸¼lsM[êà{¨ÕEÝØ£äÌCc-xqÑûhGͳؽ@èåJ[4Z'Š ÙJk5¦ªS¼‹Õn™î8«½”ZL1SÿÖ÷tè­Ò:1ôV‰›²RoñZ´D- -½;§ùîì\²Å’Y¡Å^ºQy.I•¶m›—m×ÙöÚÝÏŠÄ92µ³XØ”| -ÿž;7™Uö@+U¦Œ†Ëóq瘨Ù%ò4}ƒÍ1CX¾„$qîR˼ŸóØf6jΣo æ0Ld““ï"ÔUx£3ºªê÷êb²÷^¹¥Ç:@IéÌ0g7é˨ðïžØi—I–ŠòÝs$Ao–¯ÌIÖ©)ž)Õòy‘>™~þ0_Î -endstream -endobj -425 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 424 0 R -/Resources 4 0 R -/Annots [ 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R 461 0 R 462 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-19) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-20) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-21) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-22) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-23) ->> -endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-24) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-25) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-26) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-27) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-28) ->> -endobj -436 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-29) ->> -endobj -437 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-30) ->> -endobj -438 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-31) ->> -endobj -439 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-32) ->> -endobj -440 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-33) ->> -endobj -441 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-34) ->> -endobj -442 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-35) ->> -endobj -443 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-36) ->> -endobj -444 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-37) ->> -endobj -445 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-38) ->> -endobj -446 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-39) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-40) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-41) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-42) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-43) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-44) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-45) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb10-46) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb10-47) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb10-48) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb10-49) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb10-50) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-51) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-52) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-53) ->> -endobj -461 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-54) ->> -endobj -462 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-55) ->> -endobj -463 0 obj -<< -/Filter /FlateDecode -/Length 4641 ->> -stream -xœí]Ï中¾×_Qç«H"õ Xä°x9$@l4r˜®Ì$xè °É!ÿ~>º,Yv±Úêžšy>¼iLW™”,Z¤>’’¬vg‹Ÿï~ev&ç’"Ÿ/?~>Y“‚Å¿©ÄêbbÿÿS8;ËÉWb矄@ɤ|Šç—~m.ûâ/§?ýâôÏuwö¦”è]8ÿë“°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ+¬ 1ˆ“£[V>9ÖXÕ–³ÃykU±Ìäž &¢Ó£ÆóÎÄ\|Qy <—¼Æ#21± Nãc Yã1d Å: KpÌVãA¦œ4^„,ɪ<Èâs"— ‹Gï…—! ¬+«<Èb£u¯ %3«¼žÍ)ßò¼ &d"«ñœ3¶I*# -JŠIáyÈm(*²²^ãdaüh<àD ”³2Z½Œn²ä4^€,Þ'VyÊ×ÀGÈbSÔ #È.iàS2\• ®ƒ†É‚Y*²pb X›B%kX ŠFÂd ãàY«aAqù¦g 0.%ß̲È7‘â)ã¶P”|3iXP²„(*² h*ʸ&!ß:i¼Y|a JŒ’of f ßDD¯N dÉ7“:]Ü Ȥñ€»ˆL£†¸@¾‰ÈVËí-€7$Äg:3KÆ™Õ è ð­ê”öÂ[%uÎÀ|%GR' &2ËÕY¸U0U§ ,ðñß`Âuö©Ÿ¢Š0‡Ÿ™“Ÿž¾GQñuô«ïÜ÷ãŸ\æÏÏó'Ú îú½~rÞ”ñ·¼æÏó§Ÿ?ѳü©«GWZãÃ1ðÿÓæ~(ãþö«¿ž?üöôëkí!ßg„zèB›côe,; -«ò.… =#{E@‡Àçqz¾tºF{×ýíþÖ•Ý蔟Ág]æzl)å UˆÂž*†jFˆþ‘ÁÜÝUÜéÄ ‚E¦v¤d›Ž«sœ®A.㙼°Òî;¢¨6ú+-ÌÖ(èÐÐ&ÞZn¸|9zõ#¢•UÐçµÑ²m¿G»Æ‹·2M÷ÚÈ1=óL UÖ|º!Ù÷9R±Ããn¤ÆqŒ+É"¼ƒÛ¸ËR$oŒÅ˜J~¯cÆê¦k¼äahùÛ{½Ã{¼÷=o,KUHÏ“Dñ‰ RN¤;;]>Xç8]ŽLÅ’“%ÓG9äÝa¿uʯÁ‰®™LÌH`<Þ,èö3Vç8Š‘u ™øË‹”vpûÿ:úõÙ!!<|Ëx«sµ&@rˆ1ÓÃÔú­bŸ“ÌÎÈÌÛ cªqÕȪwv…Ò½§w Àfçe²îvzHÞé—±*ÇéèÌè©wLoSÝ¿)ëH6;ÚÜôé=®ûõ¶ÄsF_”¶îAQ6ÎO«BÃʪre™‚ƒ,ûÊ|£rcFˆ™ùM#“rm§Ð¼¯ÂÆYîTîU•w_õÖ›TlA•ÛÚOÒ›Îmë­þñD2”efU¦j òG ô=ë«sóI²] ü¼ß|V<õcŸ:_uéè5ÝûÊõÓ¢"`Fiç..d8°`#*yY@œÑ^WíXè–­¬ÄZÙAøfÕ¾QÕ2i‰°1¸M£Oïœù”ƒò|Z—oõÓR¯¡Ò¥K_ö -0o¦]¯Yy†]„’Ýb%r*Zí–H!†ÏJO¨&ÊÈð ®ea“l5v»sƒuŽc¢»Ž|á+¢Ïº‘§á‰¬WÇ'ÛI²rï}g¶àÕmí÷çв¿Î¥ha¿Ã9ô`ã˜K€s-ã×õMŸ¾ß佩SÄ&÷Pj‹Du~8¬è5'7Ýg‹l—}ÄBÇ8Œöh•gØG¬é -–= ·µzЃ!e›´ú«tµ´>mÕM8âGÒ¡Ç1_Ù*²ç;hw'!å,oO8Fô*/D$›SîuÌXÃtM°p\ßî-^íÇ)a3-2À:kµåÅ:u¢wyMz‘§ u${?)…½•úÁ:ÇérÙ웑¯"ªlB–½ø{*«s¡F¢÷[ý#GÅä‡*mµuOmýÑÏ~æõŠ|^OWLa‰Ÿ“–pMXFÆvš6/fÞ>àkêÎÐ’s‘c>{y××Ûéýè×_«su“tŒ„Á_®î·©¿Û:´â©|6KTÛ™­–Ë>o» ¤rW~Tí›O·¤v+ëþ‚޲ᶶ½>e–³lŠ‹trT@Î~wÝx°ÎqÌ/ˆ+Ì1é oòžÿŒÏxõ>ã?¾{¡?_¯·t)ëg”  ƒ¿Ì÷yžËòµ|½çÊÉTþÇë½ÈÎ÷ˆs[µ\–é 0?Ëûyƒ\wÐ(Ê«åNv6›ÃXã˜C–íºÝ¢šÃ·Rכ̩kÏoÛ®ižÔ¿“Ÿe¸ÌÏR‘­¦VyOÖ;æýËršÈ¸yŒÕ9Œy+€ÙF}aôý#n6­Î\vM«ªíyÉ–Žï2-Ý<Š+ÆÅ$ ›Ç`ã˜Éߘ¢¾hûþ÷@góLìÎ¥0:Ô—Âa| g°ÎqÌ#ˆ3„¸:zC=_âäî¨VŽ2->2Bîà³i:uéuÕŽÕ9Žj³ì®•³å¾aÒºnt2¡Ðe› Ðý›¶)ºOl·S¿ImžŽ‘ öoeÙßíZ N—Š×jl3´rdŸó2'yÛz5Ìë‚m2ùŽ6%¤Mç”A´H¬÷ìw¨ÊaÌw:È%Î|guù!3l›VV³,Õ cg˜Ãé»rãnJåóYFHñ`4ÓŽä#ý JMƒ»Ev46ɨžôsv›“uD3q~¦ˆÈÁÈ!æ²ÛšemVÎýEüðûÿü»ÿéB˜´ÿtÅjã ¿ëLT’þ”_à:;5•“Yª<ÏLÏå„êÖöt˜ÊÆÙ?ĹL™‡“›)º¶âµn]$œ_ÚÛvÿϧ8;禳Gmœ"é’å¨H#®(•³œu—-±«Ýí¦rç;5§#Ýn¥ä7HV~•E¾IýÅ\þçIQ?äÍ3yF±Òë‰Ìv"# [òËINäf…Œ Ä’…8µí^²y`C»J’)Û’Œ¿–vs -õ«õi¤~¨ÕdàÉæÇz%¶{mX!¢ft·dyz /|%Ë©æÙÐ|›(!V™A\nÈ}Ùå†KÅ]²ìªXˆá–h»æ²œzSËúöµ4ƒØDï»Îuê¯e}êÔùñrB³´¥¾¨T9K¹Þªö®·FP¥QC-ÙÂMO -érRˆßÙzkÄήñ;­É‰”Wb®†Ä­\©åÒ外›ïš¦R+•—ª¥öü"Êbê”[Ç+´©fj’?ÓÐKõëšEU×È »ñ7ÄËIväÞ_N!)¥Ã‚6TÓë‰ÔÝ·‘³]ìe¡Êán×oš•&çùÉï+T„F䙾8n&%Û—«¥›¼î¤žê°Ö²¨än¨¸wJÍfûþBª ”Ðm¥[­¨]—uôTªxR <Öd׬®‘Âjÿ4¬ì‰¶ -ærh¦ü²"/r†6TƒmE×™{h÷]ȱaçKONMãNXmò¶ûv6_‰—ɱñ–,¦Ÿk# Y¨j>­±Ž¸PXÈ Œ¾Lä:Z:ÉÖèúudšÇ½œþqšÜœ§à%Úää¼ð>Zrçÿ ÌoñÿO|þ]= òêǽmhᶮȽ'“¿.‘Éò×&*± ›Žè¹ƒý…ìòR6Tkh~Üû¯y©n`¯%]CP׸=1,}Ø‘}3]ï¨ë™ð -ñ²éÅÈ|©n‡}½¤úph†ähÓ*.úÇÁe^x´¸äswK\IÑÅ¥ƒË¾«ˆ‹þ¦¸ì,‹d+1Å ûFZ׋üÜ«‚¤­î¢ #ä’/n¶¿u¥MOÑALýEcv}£e%"ô»‡×ë}9Ö ÔíúÒSÛƒ µžN¥é2®/›Ï¡é¨:x—j÷¢nìQ r–¡±„¼ºèm´£æ¥Ú\ ôr¥­­Ž¢Áh¶ÒÚS•)ÎÕj·LOœÕ^J-¦X¨ÿè{:ôZiz­Ä›²rßêñZ´D- -½9§åéìR²Å’Y¡Å¾v£òR’*í¶m^·]½í¹{ ^‰Kdj—já¦ä»ðï=cçZg3{ •ª?ÓŒ†ËË‘ÎpÔìÉlš„;9F`ËZHœ»)Ž7×y}Îãvf£Îyô-A†‰lrò÷Öt^À(ûŒîVõo±éÕä=å‘ÞÖÊ”ÎsöfFgúƒ;ø7Oì´Ë$©¢ü}-’ 7ËŸIÖ©S<ÓTËójúdúù/je( -endstream -endobj -464 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 463 0 R -/Resources 4 0 R -/Annots [ 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R 485 0 R 486 0 R 487 0 R 488 0 R 489 0 R 490 0 R 491 0 R 492 0 R 493 0 R 494 0 R 495 0 R 496 0 R 497 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -465 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-56) ->> -endobj -466 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-57) ->> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-58) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-59) ->> -endobj -469 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-60) ->> -endobj -470 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-61) ->> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-62) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-63) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-64) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-65) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-66) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-67) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-68) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-69) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-70) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-71) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-72) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-73) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-74) ->> -endobj -484 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-75) ->> -endobj -485 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-76) ->> -endobj -486 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-77) ->> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-78) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-79) ->> -endobj -489 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-80) ->> -endobj -490 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-81) ->> -endobj -491 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-82) ->> -endobj -492 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-83) ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb10-84) ->> -endobj -494 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb10-85) ->> -endobj -495 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb10-86) ->> -endobj -496 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-87) ->> -endobj -497 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-88) ->> -endobj -498 0 obj -<< -/Filter /FlateDecode -/Length 5126 ->> -stream -xœå]K䶾÷¯è³Ó|_€áƒ‘bÀŒ,$‹f;»6‚ÙvùûùJ-R”T=¢zç! »ØQ‘%–È_UQ”dο6ø/‘Q)åè|ù|úí¤Uô†³ƒ¡ø'ü‹þl4EåMÉŸ?³ÀE³·1œOøoqØV<ýõ«Ó¿ç:ælUÎÁþý#‘S1Ũ½P”Q¤Š¼W1Z„¢`.1g©føH–ÖEfPN^*‚dmŠÌp[e˜a£!©f˜ì£Pd4ì0Vk± †h"g…2ãU@§©ÌR¶Y,‹(3ÑJeΩÉx#•eBðI*#Øâ³6R™‡-Þi© ¶KQ* °Å§Å2ØbStRY„-½“…²[€®$–Á´‘ʲS>'"±,£L§˜ÖeV{å“sZ*3Fy`Ó‰e˜Q¤…2 [‚öY,ƒ-Þi+•9ØBø+•'¼‹) ³ÕòìvÚ©ÌÃk#‰e°ƒ/1€ °EÇ Qfb^’8Àƨ([’HÀ&§(Q’XÀ¦¬(F'Ñ€Í^QÈQ⧠ʬ‘ˆÀiØâ)HLà l!Ì\± ¶¸L8 [PAâç`‹%'qÛÐ"qÝ’ÎFâ¾%m‚Ä„ 3µÄŒëR ‰ (PÊ8p®wJ\à@º˜îQâÖu>X‰ h×Q -8ð®#£%. ð®sÐË` ,qØQ9“œÄÞuFG‰ ¼‹id%.À¨*à0H\¬(›’–¸€À»6i’¸€À»6ˆeQa:‰ ¼k=.AòÜà]뵕¸€À»–l¸@Qà-Fà]Pˆ—ÃØ‚•¸þeÖI\€“)‹°DâÞ5îO˜Ó`+eRxð®I>±,+Ñã¼E/+B–¸Àƒw᨜ļ úL€ã<ª•¸Àƒwƒ§–ÊÀ»Æf-qï"nðÊ ¸þM èŠeY霒ļ Z²À +À$bYT’‘¸d¬4âP‰ xî=K\À»Ú;'qAïjBØ#–Á—¬ÄˆkP†i+Ìi«J[0…TÞÕ#,•wµŽYâ‚Þe·)qAˆ,°Iâ¨[‰ B"•c „¬Q†O, -Ç^₨!ð ,± ¶P$‰ X«ìr’¸ ZØ⬕¸ ZØ‚AâD*Dßbz[1? Ø‚HQâ0™J™Hâ‚èò1ôªT¬Jt-–%”™(qAŒ¤àŠÄÈ¥T¤—¸¯8\’¸f ÌÄ1ÃL‰ àŠT²ˆÌ¥2[dK\€HeÆH\,lA4(qA² YfÐÀC#—DWKe¤9ÏL$ -ŠCE‰ 0Mi‚)Å2Øš¸ãÃɶ—¸É’M¤9blqž$.HÉrº™$.H ¶Xm%.69ߌd [ñI\uP&K\G™Öd“oZ’¸ó’óÍ$qAvù&R3E¾ÈŒiAˆîkÎ1Us7ª]×Ç~ÿåôÍœïù—ÿœ>}5¬”•¿àw8±ö# AnÑ;uƒFdIH1îæ á87âýÈ/‹eÐ*FyðòˆÑ‚Mæ¬ _µuæ-€CNÁ–MÀ:t§« ZÐîè 7ÜУ!Y·Ž:ÆËd‰&yÅaÈ‚{]h§ÎqŠÌÛ’³ú-ùrnÄûXK€.{Y8Òn[·»Ížiˆs}p‚vÏUON[h=ßb@4™‚ËÐG6mtVžbŸÎq€ùöˆÇ¾%gF @,‘5ÑYšXqBÝ€4,@J×rï¶Ø®áÊ•5»¸r¥½“+WúõúÏPû綛OœÎfö°hŸÎaÀky Íæø†àÑÆc+p.Ýø®sÝΞ˜s­½/èZ!h\óS„"oH†CVУW€V²[PìÔ99,FWågàÑîdxÞèÀ…ÿG>pàNÛ#pCØfƒÐÖ6üð®´Ë_#AŽse'lù¾U$âuWŠ¼ËðBÉÓàéÓ9xøþ7ß0J¯ žY£³tùÃ<§ÄÇ]éGË>«¶n­”Ø0(™ƒV‰‡Æl wŸÎq†;ÂÍú’{K·53¢þÕÊÈ2¦Zr§ê|™ëkb¢µ­Û¢|“Ž’vODæ³6H&©õ´p{O»¿ù ßý²!#Ê$C›îÓ9 ¤y÷Y2³ý !=7b€ô‡…ô Dýæ›,pÞµ`Ó ¨µÛpQå@1KÚ=pŽ|2ñ0 ­/á,ÂÞnÐ÷&:DZEà,b‡WtÄóF_zfŠÉÖíîI(ÖÚ5¢{x:¢s.)c¯»xzï†têHžoš"ͯ ¤Y£í2J{„o†Õåƒvq¹#Òu[{ÒµvÓ7à[éß·Hâ`’K|_}xf@ƒ½Þ‚bŸÎq ùaHáU9mÖèû&òî±v@ ù?%r6 çÚ†šÕÊðfÀ$h÷@͛؀©õtå·ê2ËBH¼ ³”à}uÀéúaÖ§s˜‘æ=šŸey=˜Íxàርϳbkí}Zß 12Neó-ÞYl1nÝ«èÔ9ÄÐeÆÙäý~ˆm@*$\~ôÎ. µØM²JìäXé²ÇKá --ÝZáç*L š“ÑÞ ²Sç8ƒëáV³Gèûšü1kôý2~xh¢¦Ë"¦°c$µ\4ioÝ—Ey©½IÕ½ø±¶qÏâÇZ{ßâ‡ÐCwEZ🊟žtÔï;uŽaÞ&ë“¥;øé~Ï-öí®¦’%ÆšeàÆà{×Û¼¯[¼É[|×^²¹?ÓëÔ9Ì { 'jñÛ[n5šñ²[ßÖmíY6XkﻹÖß·ûÍã¬9ÐðMÎü a’:Ç$?â—§>Ãæ¢nš7:ƒ`~bõÊN·˜–+]-OUWzéZ¨hvs¬íºÅVž0 6$«ûÙªSç8Ðð, ν)[ÍŒxa¶Zµµ‹­VÚ;Ùj¥¿“­æWÊÞøþÀ¿Sç8ä7˜èÌ/‚xE¶š5: Œk¢¡–Â~eIµ¹ ÔFW%Q¨ ‚]ÀøÒœãÒŠ×P~msG"PùµvO"0Ývzl”3¿ÄÇZà ‰oâ7úlA¹Oç0PšŸAÞWózPž7:Û<¹„¬p[©ÍgW,ÜèÕü×=½àÙ³áE1Þôå¼p…·\x0A!wÈ:ô»ðNã€ÌñãbDæ-7=ÎxY¾nk _kïsáký}¼‡¼BQ7¼ÒÂ\wÚ> É>ã@ÒóÃjјgØÐÔÏ{³F%Þ«;4—;ÛDnæÃÀ! oetüÊl ¯5\»àÔ´g—m»)#uÅÚцËx-Ë|0mÙzã=6Uc…ÔNãÀÃq ÌÙŽûgÜ­.›Ð*ÃöaÜú÷í 0Â]кâw&gv°G§ÎqàáÙù¥åM>÷ϸgt6/±çp.)ð+ ¿Ê’ø~‰_½½>ãÀ#ñOÝrÛ¹¼ùð|‰“»1´èûŒLÌSÿ«R:u3´Yó3H¤Ãkn«™7:{á]ólbY¹®™ 5«ÙíÚÐò5)ëBÓ›wÖ¶l߈™×Ú=7 5¿ÍÛXdºB똼bm|{ë˜dg“• qx=¶&d×|ûgÀ:Ç°ã'—B wlþé^Õž7Òµ^Z¯é~xbÝÞ­ÅÊLз9“ï_›îÔ9Î{v—0÷U9jÖèË®M¯Ûº9ÜüáléþµéNã wâ'xøKo¸°67âíצ×öìY›^kÿÿ®Mƒ÷TöÙ0zˆ?EÃkÚŸžB}:‡™BÃ+´MÄDËý4 +ê†D r7^ËR'ÑÇÄ|'.`Xu–çnžñY>á4Û9Ö½‡K¸ÀÍYIü€&&öz”:£Gâg4žyñ›sá§ñÝéHõyßïüGÚ¾±½N€Í*x,ß,~6‹7y3®Ãx¥áâ&òS~La‘¿3À0þþÏ?ÿíÇ?4ëþJLœr†7$…Å G¾pFIÉ*®T<ÔcFrë±Ü?”û×û"CÝ0&a¬“ÇÝŒ«£\Ç7m…«nyFn°åãwËîÿí†ï\˜á[G: i@æaˆ¹¹?ó™¿­‘´ùÝm†2çšÃ'$«µøˆ4hŠ·! ÃÑŒõêóÉ€ãø™I®_€Óƒ˜·.Å'þ b„–¶SÌÂñW]ÏśIJ ˜8ª¼¬é¼Ò㯹žÜùò«õåjXß5þ2?ÞPŽ»×†!4ƒY‹ùê1G1E1)7…jŠÅf§R[w:ᤸ)6N7B¿ꦹI̯+.umý5×1‡°šÞvi†¿Ôµ±Χ„—šuKé£(åo·•S•Þ×™kŒÊUêKÍ: TÇI]N‚ðk]NÍQ-oF¿€s¦$ªõr©'ˆ.'±Þx6_G*ÖZiRÍ¥ç'S&¨»T;^ }4J#¶™#Ú•_çâÀ#PÆZ§7v%¼œø!•øñä£PÛO\¡}^+tÍy«8é /“”·Ì_ÃÔ,2þ~ÿ¥ -_¥Ì<Ã/†*¤ø@ÓÑÔÏÍ*žwR+•uHêN¨ÍJŠsÇX1Ûö—IZ¨Ï¤[k×›I›.kä1ó˜¤*yÌŦ¢®Š™ÂJÿT®l…ºæ&±¯P~œ‰';}ª^×Æ‚iàîëy'q¨ÜùØŠcqÃtªöÖó6˜/ÂËàØh)fè§ÒÈ$æèµÀ§6Ö'Ã@ -“x¢ÑÇA\fke'~IJü:M2Éã^N¿ž7‡Ór®œáï¶Ñ’9ÿu~À¿èücù ÎÕ[]ÙÂVn‰[OÆ_³MbþºmÖiÓ-5´?‰Mšêú‚†êÇ­møš&u={©i*ƒšZÚ -ýÔ‡ØVèZãšžñO/‹^¬Ì—ŽÍä°¯‡®\¿Dƒ?¥T¬ÂA{98LS™›\ò¹9%Ž¸êäÒQJ¶QÄA{R6 æɲ™™ ȶ‘Úõl?µCá¸­æ  #øÐMe4¹ÙöÔE6\ES!°kÚ“iÍ3{£ïž^_<î£É¡Ì–Vj¯ÒÇVZ/Œ¥•ðd©Ãü°ú7¼£¥LÞ©‡ê¹\3÷\ r¦©1…4;h1ÚHÓ¤6Vðm£Td³F‹£¨t™.²zÆXl -£Zé–ናØK±Æ“ô׶§};*µ};*aU—Ï[<^–\ €| ç8]žjÖX2 ²ÐjW)M5]‘­Û¦yÛÅÛž›Ë É0E¦zRó«šwñß=s窳X=j•¿ÃŠ†IÓ'äà¨ÉDÇ·è8ÜI!€Cˆ?ì)5K»už^óX¯l”5¶% ‡"çt4ÀÛ Q· šS=Ž_ß“Õø©Sá’öu€°¤3Ñœ^­è øÆŸqa§FN}>êSâÏGmÄ%ža©å2[>þþÆky -endstream -endobj -499 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 498 0 R -/Resources 4 0 R -/Annots [ 500 0 R 501 0 R 502 0 R 503 0 R 504 0 R 505 0 R 506 0 R 507 0 R 508 0 R 509 0 R 510 0 R 511 0 R 512 0 R 513 0 R 514 0 R 515 0 R 516 0 R 517 0 R 518 0 R 519 0 R 520 0 R 521 0 R 522 0 R 523 0 R 524 0 R 525 0 R 526 0 R 527 0 R 528 0 R 529 0 R 530 0 R 531 0 R 532 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -500 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-89) ->> -endobj -501 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb10-90) ->> -endobj -502 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb10-91) ->> -endobj -503 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb10-92) ->> -endobj -504 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb10-93) ->> -endobj -505 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb10-94) ->> -endobj -506 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-95) ->> -endobj -507 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-96) ->> -endobj -508 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-97) ->> -endobj -509 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-98) ->> -endobj -510 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-99) ->> -endobj -511 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-100) ->> -endobj -512 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-101) ->> -endobj -513 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb10-102) ->> -endobj -514 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb10-103) ->> -endobj -515 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb10-104) ->> -endobj -516 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb10-105) ->> -endobj -517 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb10-106) ->> -endobj -518 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb10-107) ->> -endobj -519 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb10-108) ->> -endobj -520 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb10-109) ->> -endobj -521 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb10-110) ->> -endobj -522 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb10-111) ->> -endobj -523 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb10-112) ->> -endobj -524 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb10-113) ->> -endobj -525 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb10-114) ->> -endobj -526 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb10-115) ->> -endobj -527 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb10-116) ->> -endobj -528 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb10-117) ->> -endobj -529 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb10-118) ->> -endobj -530 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb10-119) ->> -endobj -531 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb10-120) ->> -endobj -532 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb10-121) ->> -endobj -533 0 obj -<< -/Filter /FlateDecode -/Length 5072 ->> -stream -xœÍ]K$9n¾ç¯Èó£Õƒ’(À˜ÃÀ>x5°pc oÇêÜ©]=f}ðß÷GeèĮ̀êšìêªÊõ Dê#))TîlñõÃ&g˜KNt¾ü|úådMŽÿjŽÕC%ÿ ß9ž¥l¢+‰ãùgIÙä}Nç¯'üØ<ÎÙ¿žþãw§ÿY—qgoJIÞÅóß“9gRɺ b49û˜Rr],E#˜ÉÓž”ÁŽ l÷¬lÊ.ìIløìH# WbVH΂ç­Ui`įÐ\4 ƒž4šw&qñE¥eÐ\ö-“2¹è4Z1)¥ÈÀK,Öi´^¢#² ¼Pà¬Ñx )X•^<ç Ñ2xñ¢Ð¼@»X¥›¬Óh%˜X˜H¥Ð,gÞÓ¼&rV£9g"t3¨4Ì()e…æÁK²±¨4ðƒõ-€—FNÄ™•ÙêevœF‹àÅûL* ¼@øø^lN`Á% |ΆŠ' <CL¬¡€çb(ç Á€/ÑP*YÃ`hÞi@,x‰”4$¼f®J/¡†Áƒdа ðâ)hX€¶mÑ° nɧaAÞ’uIÂÀ›VÃ‚Ä œHÂȅ* 07;5,]L÷¬aAꆘ¼†°ˆ“†¸ÈY ¸Jª4ðÖ°èh‚ã awƒ³YÃîby U=L@WŒg¶p׳% ¸ë3L€JËs0hX@À]ÑÍrw}´^ÃîzòIÃ(ŠþXÕîB¢î€¬†°÷ ù a*3n‰†¸ë -ÌŸ2§VÆqIDà®cˆO¥ã2F\™·eãR*Dà. Uа wŸ¬a0ÞÀ¢z "p×XjÜu¾X "p~CÔ°ê` `ߌ³P]•VŒ-ÌDà.`ÉkX+l,ITZ6P$§aÀØXø¡$à.Ì{Ñ° wm AÂܵ·G¥—À^Ãø5 aÚ*sΪ±H¡Ñ€»ÖA ¸km.$஘M R–Ï€A/ØkX˜LÉ9iXŠ .ŸJKÏQÂl‘Y* ¼P& àX› -kX=x ÞkX=xË a<S¼o5</P5> ðOQà ™áB¤aAŽ ñFU£%o8®Uƒæ²†9“)v –2ŒI¯aÞˆ»¤aØÍ‘†¹€L `Š {xæÍ8ÙÀÓÍ9 ؃xƒ°gD™ÉjX XC­ÑÈJœÉ0%#®¢†˜&ˆ4”* ¼&4,€|$ØŽ øA°‰0G¥—IÃf/á&kXÀ ^¼õ@7%ÞÌ ^àñiXPl2â&kXÍZ ŠcÄ›ž4,À¼”x“5,(Á"ÞDˆ§ÌÛ’Ä›YÂBà%ÂEQiàNSQæ-0 ñ&ÐI£%ðâ iXPR’x“5,€›x½º$Àofu¹¸ I£wá™& ð€xž­Û[oÌðÏt"KÄÉêŠôFØVuÉÀ{a­²ºf`¾#©‹`‘%'uÕfDgÕe ü…?F;L¸®>ÍKT êa39K' ¦Á»ï1ÇÈnd»®ýý¯§ß¿Àøžÿú¿§×ßÕ•²öå ü’ÖQ¦ˆ/7àÊÔêÁ™Epa™+‡`ð=e„‰\“°¸,º “0Å0·åÜ?¸5ËàXxvpfjÏhn‘‚ƒ¨BÒy}s™âuŒQ;à1úÕ ÁCþÁF«{´Ð‡ìÜð4L·o/ôQ܆ް•Ð Mœ½XLo«—ÁT±«¯o,òœ¢!ñ³r…âÅ.lQXZeþáÓ µ4]ýîßð”ƒëíùÓϧßÿøçÿñ_@³Ÿ^OŸÿI\çï¿sïýý_çO¸ÍL1€Æ–TÖĸ°D£Å²ìð ¼dÙ¦z¤ÇÊ’gÙ.‘¥ã}N¨ -”À¥¬•>0ÂDÉxe!y_¾õ¢öšª~ò€V„¿®•*”}JTÿX™çQý '!¦Äá±ê?Pm8ÿ)X±¯*ý¿4™4–üÒŸË5_m'ÍÕgð·îÿ~ü¦1çÝø]FßzÒµO×pƒ<õ¹õgá¿/šÄ1Õˆ6zý®ŸýR~îo5cìêsü6tCîì1ïy«y}E;c­¦{µ=» :/|ðZNm<;/‹<%Ý-¼Ê²ùõ ÇÂÏM$Z£Ð­±94n<ä"KïaYª÷ á^§>HÞ/wÇÇïæó4Æ­Ýú]†^·ö{ž©ÏuoàËÂ×ëØN°2?^‡ìâ¤7û¶¯O·²ñóÕÛóú°¯‰ÿ8vÛ$Ÿ½ÜKÚéZÓ…/é-ó³Ï1VÆc;?ÜЪ——I?—¹Qug¯& zehÑóm}Ž/˜ÖÆu…]“^·9~o¾4|íÜ·½MùiÁ°8Æ£cnës‡×zÓñd/Çã|ÎÐECQ–…Z+·ý{Àg˜GèòN`ŠÕî¹x-¼Ù¥$§ð‰YiICé· È¡Q¦m«…'5Àá;Ø2ç¹ [5Ï¿waN¯Wª'y‘2×w½„¥ìÌÄxàòáÕûu¥Ÿç¥„í²Ã´MÔgÜ´ì°]f8¼¼€Q3¦Ê'…››O^ÞÍÎEnuH%>:›~¬Èóˆ;'y“Þ“>?fQsÝHÛ$ŸWÏçÍœ‡Ä½¬uË{¡¬Ô}S˜ŒÀÝü¸+ó4âd+Æ€ éG{?FœëF>7Û÷ ¼¼Jgà·/ßøØ.XvÛ{c]zw’¿¾èëû´GE|°ÌóˆXÞ'v.ýxn_ãm^¨²ºrE6[‡f_·kfîÍ>Y^»f/QC1–\}[ó¾hŽ•yÑD/×0 *REsd– Ò.!Ë‹žëÊ.cO6w_>¶Àáèñ‹éœÓ¾¶‡Kò®±EnJx__¦—–”òrÓoT7¯Q£Ño¹”´u-—©à6Û'­·”ïGšíºß7Sn;Åò¦ƒ½…vrS - ÙÉEVÉ ¶#ŒÕƒ)u¬ÌóL)¹qIÞŠÖ¿Ï]Wúyú—Žº—³²ïj|RiRõ]éÖÇ•¿ä7ªô—;t]y˜EúÞÉ4÷õF/ztå`™§QžbÅ´Ë];¨<ëJ;®Î'1m[ÚàÍv;ê ¹•³~nRÚ~¬Z#îÙ—>‚Âr qÔÊ¿LhXÆ ý~RÿÆ:Gqr÷!DŽûiË<òy9ÜàÉ@®;F`·îá¶3û¶èä<S@ð²fæó‚GÄ?|½}ñÆkPEœ5Yÿ\Žï{DÃ^†8XæyÄñž‘;päVù-‹À‚Íèb/k,Ù©…ðe^±ë¥±ùTOó{dŸÓÑ ‘%2>±/é¸98XæyD–Å|ɽ;#²¾?ESóÉš­;7§Mâ¬b¹ùrzá"×_Ök’Žž>Xæi#õ~"û¾É´_Ø{p[çþžô®e#•?-—®äˆ~„úVÇ2_õÒEñ0˃‘o§ˆö×fœÝæš -á±÷ˆ*å¶åÀp •,Ý:X$[‘þÑFàf‹Ö/Ûõu°¦£rTâŠH¶hvêxm¶,ƒê–WÅ%Ïvcò‹Ç$®ç·ÃÿË)Õ ²\½$Ñ&®‡^Yî´3rj!—³\Ê%{…® ·«äÎ7JÖ»§é¹ä'’¬ÜP)S¨Šc~XòÿRõóI\écÝ/¬WÇÚš,¸Mþz’«ƒII&çÃ$KâòÑöºÈõ“U-íL€ÉÞæ ÑØåã8“&[b×>¶ÞHùØŠÉ•NdûA±z©Ñµa%%“Û'Kï­qK²D lÂò”:+15ž‘8*¤9ï¨p|˜,û/#1îíÔÜH–ÛZ^ß?–.s$vÖç¡s“ø[^¸PþPâå„fÃ6õ«š*—¾¶ªÚèzÛÓÂÄT驱åì¡.'%érR¿³­j‚0;}’šïû÷܉z¾Òò)I—“šo©-vIåž‹GÑÒF~°2qä>ðJÚe:¢˜å>ùiŽÀHù&‡99‰š¬-Ozãw‰—â1Ú%=ŬäŽ+llª7'†©ÞžÌvèËH…ó³ ¦fK“‹Çäç*bOä©u•’ËÇÓhDæfO^Òœž:ê6ŽòÈ; —˹ëì<^Ž­’_@·çî#¶J†lJÏ¥±' ÕÁcìºÖõd°6>+çDÛ˜@s#9vUþºJ|Æ>U£í%7©{ìõŽäÔ±ó뜜»ÄÜÙùíõN:ß/Õ°Ñ6YTŸ[##YV°šúôƦÄÁ@a$ýZ“Ûlíè$¯_¶c’i÷rúÛ©š9¢¯5'ÏÞ’;ÿòüßÿ}¢óÛMzW;îmG ß±u•<[2¹Ÿ&˵ø-±O›)ÑÓû#ÙñÈ›6t;îý„×4ŠÛì-§ëê:uNŒc §dßU×»0L¼“xÙŒbwd¾U6Ã`_C뜕CÓç®Pò0wˆq–JÚå•z›ÅëÞRèPœÕ9ÞÙ‘³û’¬¤¥¹tO¥‘3´´}Û´n»YÛóÔ Œ¤á™ÚQ,îr¾ ÿÞ3w®e6«Z®öUW4»ga¨ÉåàCýsB–S†ÜŸ‰§%Ž7—¹¿æ±_ÙhksK‡¡lvò‡¡t¾‚P¦ªÚÒ‹«vém ,é ˜³»ú—AðoYØéYBEùC@rÖ“Yþ~A¶N]âY®/›—Oê×ÿû`ª´ -endstream -endobj -534 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 533 0 R -/Resources 4 0 R -/Annots [ 535 0 R 536 0 R 537 0 R 538 0 R 539 0 R 540 0 R 541 0 R 542 0 R 543 0 R 544 0 R 545 0 R 546 0 R 547 0 R 548 0 R 549 0 R 550 0 R 551 0 R 552 0 R 553 0 R 554 0 R 555 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -535 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb10-122) ->> -endobj -536 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb10-123) ->> -endobj -537 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb10-124) ->> -endobj -538 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb10-125) ->> -endobj -539 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb10-126) ->> -endobj -540 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb10-127) ->> -endobj -541 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb10-128) ->> -endobj -542 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb10-129) ->> -endobj -543 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 329.565778 101.433071 310.815778 ] -/BS << -/W 0 ->> -/Dest (cb11-1) ->> -endobj -544 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 310.618756 99.933071 291.868756 ] -/BS << -/W 0 ->> -/Dest (cb11-2) ->> -endobj -545 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 291.671735 99.933071 272.921735 ] -/BS << -/W 0 ->> -/Dest (cb11-3) ->> -endobj -546 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 272.724714 99.933071 253.974714 ] -/BS << -/W 0 ->> -/Dest (cb11-4) ->> -endobj -547 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 253.777692 99.933071 235.027692 ] -/BS << -/W 0 ->> -/Dest (cb11-5) ->> -endobj -548 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 234.830671 99.933071 216.080671 ] -/BS << -/W 0 ->> -/Dest (cb11-6) ->> -endobj -549 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 215.883649 99.933071 197.133649 ] -/BS << -/W 0 ->> -/Dest (cb11-7) ->> -endobj -550 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 196.936628 99.933071 178.186628 ] -/BS << -/W 0 ->> -/Dest (cb11-8) ->> -endobj -551 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 177.989606 99.933071 159.239606 ] -/BS << -/W 0 ->> -/Dest (cb11-9) ->> -endobj -552 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 159.042585 99.933071 140.292585 ] -/BS << -/W 0 ->> -/Dest (cb11-10) ->> -endobj -553 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 140.095563 99.933071 121.345563 ] -/BS << -/W 0 ->> -/Dest (cb11-11) ->> -endobj -554 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 121.148542 99.933071 102.398542 ] -/BS << -/W 0 ->> -/Dest (cb11-12) ->> -endobj -555 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 102.201520 99.933071 83.451520 ] -/BS << -/W 0 ->> -/Dest (cb11-13) ->> -endobj -556 0 obj -<< -/Filter /FlateDecode -/Length 4911 ->> -stream -xœí]K$Çq¾÷¯è³¦23"_Áa,@/hX f› ÆP¥ƒÿ¾¿¨®|TUtWõp(¶ ïb·»"ò•ùEä³ÝÙâïWÿev&ç’"Ÿ/?ž~:Y“‚ÅŸ)ÅâabÿÿR8;ËÉWbç…@ɤ|Šç·þ[=ŽÉßNÿù›Ó_—yÜÙ›R¢wáü·„ÅdRNÉ…UÀ²ŽV&%¢ÂŠÎàKÑX#$ö¼e%ˆÁ%1Øû¬°2Ä NŽ¶¬1|r¬± †+!),g!‡óÖª<b™É+<LD£G特ø¢òx.yGdbbœÆ+&ƲÆcÈŠu/@–à˜­Æƒ,L9i¼Y(’UyÅçD/AÖ) -/CXWVyÅFë4^!JfVy<›SÞò¼ &d"«ñœ3¶I*= -JŠIáyÈm(*²²^ãdaüÕxÀ‰@)g¥·zéÝdÉi¼Y¼O¬ò ”¯!€Å¦¨Az\Ò0À§d¸xÖ@Àg2œ9k(às1œi0àK0KÒp€¬Ï; ÈB–ÀQCr…ÑsUd¡Â‡,H adñLЖa-à–mqð–­‹bZ ˆK9²†È…) ˜KÀN  ‹îž4,  .…è5, À.qŽp—ØY ¸K„œ*²À€5,:r™4,`à.9›4,`à.º‘×°Z5°Ã¨alÅøœ­† ÜõÙ²† Üõ .@å%ƒ>H0p×¼‚æ¹»>X¯aw=û¨a Ŭ w!A VÃø{ð• žƒ†É‚Y*²pb X›B%kXc”­†ðÐK¢©5[gf 2G#¡¢†è&i)UdLhXýÈ`;hX€Á›æ¨<ÈB5,ÈÙËp3kX3dñÖkXÛ”ñfÒ° XÈ‚ˆOÂb£‘0YÃÀ8xÖjXP\ÆxÓ³†è—2Þ̲obˆ§ôÛBQÆ›IÂÂ% DQyASQú-0 ãM “Æ‹ÅÖ° Ä(ãͬa Œ7Ñ«SYÆ›I.î†dÒxÀ]D¦QÃ<`¼‰ÈVÛ[oHˆÏtf–gVg , 7À·ªSØ o•Ô9 ð•1’:i11²ÌQ5€[ÓYuÚÀñ®³OãU„9$øÌœä% º#ºocŽžŒn$»Îýíϧ߾Àùžÿü÷Óëo¦™²ú×Áø‰£ ¬ƒt_ nÀ•™Šãi  …' !à{òˆ©t!`qžt!áŠán˹}qK‘!±ÈìÌLoÆc½)8¨Š¢.ëÃy>HÖ¡dΪȀsl¤´*ž¨½afúø–*îͤJûx¦’–jÅ€6 ÍŸ?!*…dÙ€+~uõÁ,!)*’8+"/~ `ƒ…åEâo?Qsõ×Ùïö8ÈH‰Ñ¸Þž?ýxúíwüïþí[Tûéõôùk ¿ùÊÝùäæÏ|ý PNpK¿^?ÝLÇHÄŠ-Ýÿâü݃îçtN¡ù^F˜ó€ 0þæOçO¿;ý맥Vr0ŒðMCpGÄ};Š<–å]Šü%ô‡?‚`‹ÿ0ýmò\æϸÒsPô–ÚÙ¾à3¬ÊJ«:F]#£Ëø7¿Ã¡OÕ:(]m’ ¬Àˆ!!dÙ1ƒyžÆ>0ŽÃPJuªÔÎØ:`U®Ð^#…UeHžÔÓ-”55ôMÁð®è¢5âJ0‘Å}ÿÍNnYþ`æ”Ü–ökGèI”2¯›åó`r“ÙæõmL‡äiAs’µ;èß1cyžÇt0j÷LÞêØRûdýä/³™6¿ æ‘W}úËžš=;™aÉ+Ž‰Ÿæ ;%÷#!YgÂCRòsºÇëêýoKDH“#+aBÜž:–åyL%ÉâU(Öë¦2ô©æ^ªùØMî«Å‰_†}ÉjQÙh›†Ï2Ô*6˲’ñÚ.ÀËó4Mïe~Õ–¤G±{{Ÿº'ÞþÔôcÏn|TGÐ"Š±g„ÁpO[½|Ë–24ú¥›KC›´­§}æ2 åT¡]ü+þåë÷Jw|.ÆtTyñV—…ëì$›ÖNew…Ûsó<¡É¸†œl Ð ÍÙý>ÌÎJ2e´,l UÃ÷CHs´¡ç£ÆÑòU#| #4¬Z Mõ òŒetlÛ¬”$ÆcÚÜ@Òæ½aæÁ<Ïc4²â*Kù#ŒfQØÂhª‚.7 ¢*ÄÊL÷ dRêo­üIö5ʽ®Œ‹ï@œâQ—€²ò0Ͼß7€cyžÇÜiˆ1ÓGÀ¢°_ÌÖ‘ -.jåjÞƒ*n…Z‹ÁwYMˆÜ *}N2.k²…$;æ@{Æs,ÏÓì5ÊÊÿôXöKæŠ&Å®b’Š EÜÒ€*}mx· ì×3Dxq“£—U -Ñ°Ÿ¦½ïâÁ<Ïcˆn7{xÞ0ÄEaG qÏèšÑ@ó+¥¦eY•ÿhm0-Ëqs~·’©^8¬‚ý5¢ÖúÜzœ¸ž.7 ’²q~Ú½áeÁ-m÷ñ`žç1È k:ËGä¢°Ñ e -p1;N#ºõˆknÓTâEI—çùÜq„%ŸëÜ #¾[QÄØ=ËJæ¢í¹ÈRí}#8–çyŒ ÉöìÄñCPiQØ•V“ð‹ÑÍ#F°îÉvv©«xkí*mØ1Aw]Ùh\ãü÷ZÆ[²…ÛïÙîgü¡¤~Î&+‹¦$Ûâ-´7çu0ÏÓ>[Ùfå<ƒjø*w”±˜ñ^»±µk^R5°°uÁÍ5S n=åà—õ´ç—!_5Œ¶Oíê­‘i­Ú®ýqØÀ2¸Ä €®ƒµoÿý»ÿúý¿ôv¥©#Šë½~†ù98i»ëw Ïà¿ô¸—Ó&_ŸÑ6“„7E’}ý18H²išƒ—š^åÍ¥U¯%:{¥O47K(Ýåe§&ŽQvÒqÎJMò.RÒTj¸>·6H«wM;5Í\Ö5ù¹…Bê-;M~…Y«cë¾VM_ß_ÖO…îæOûå*¥H&åJúÆ¿ÌoÅs;ÍoAòFa.o–#Ìõ]{’dógêrP’R}ò=L_Éf.'ûw)¦=|0ϯ D¡ÉËÉÀîr7'ߨ¬:lói .wãݯ—f½iòñ2l¼-ò2ź×äÇòüÚMÞåM²Ç“Ð3î¯JËû%ÖÖ&žšþð*ãR {ËQr, ÉþMY ¶†egºÛSϱ<Ï£ž’LÁОoôˆqÊNl¬‰d³ì¬[úyè5Íý ³ë%ªÅ¦“›±ìÞ²rß¹°•æ–ÂG‹a„/ç"'0cÙ¢;–åiÔ½|Í…õí%w÷í¨?fà -äW•|þúþ¸4Ľ·í0Ø–}S™Äh:?Œ8 -®ó<:ÎÀ¹HïØNv\‹JŽŽTeÛ¿³à·Íÿøäç ËùÜÀÙÛT|,Ïó¨XÎø'Äž76„½ ƒûËÖoN>s EÖÓwGz_óKaîö¾Ì&Ã~œœìD²³»›hæyÕ)Ç-ô­Íç, ;¸ùið¹ÛümãîÑ\Þmi»¹\ac‹œj|ß»x‹¸¬Ø‹–~ÿŸž!ŸÞUïRè‚Æfëè=Œ/9î-?Ìó4]*yqÀr´ùÃÑe¡ŸÇ¦Y©àhx9û¶ôý=ÝÔ·¹ÛÔèýØîû;|Ýx0&D©VÕO·opÚ3žcyžÇx®q¾»±µî}Ƴ(´áê8_më¤Ï -o.Û>~ÄÝrœ./ˆQ©{ß´ú¸g›û -÷=ÛJþ— KŸ mµ7æ9’œ=”I1w ê¼G¼œP-­©o*U®…®EÕÖElVi4U5Ô”M!Üô¤.'…ø•­E3”ÙøƒÖ|Ûœ«!qKWj:…t9©éæÒBÓTj©rÏZjËwQº©Sn ¯Ð¦6š©I~qbè#–ê×%Y7]Û<Øß/' ­xC~;…¤¤+l¨¦7i(·‘³íöÒ©)צB׬4¹šPþ¿BEhTAžé‹ãfRr½hê•Hßläe#ôØP‡µ¡–ÛPQvJÍfÇörÙ*ét[êÖb êÐd=•*ž€T%Ù5«kd°Ú> +G¢­B ºNÍ”ßä.gh]5ØVYtƒ¹‡Vn'džo#95;¹+¶ÉÛÊl¾/“cã5YL?×J:YÖÍ«ù´Êb  ÐÉFß&rí­ ä÷/ê×ÞÉ4{9ýå4¹9OÁKDÉÉÕçc´äÎÿƒ4¿Ã¿ÿ>ñù÷õ®Í«÷¶¡…oغ žL~(#$ËgTbë6ÑóûìrOª54?îý€×ܳÛì5¥kêw$†Þ†Ù7ÓõŽ†– wˆ—U+¶@æçê¦;ìë#Õ—“™¹¥µJ…‡ñuð˜;ºK>EâI’v—.û!#ÆBñ8TXºd 1Å ÇJZÓ‹ü<ª‚¤®áa#ä‘:»›‹®´é-†$i| f7VZò(B¿»{ýl½Ï"ÇÚ„Ú ½QßFj{1¡6ÀÓ©4=Æåcó94M4ÕÎÛ[¨•ECߣäô®ÑC ^<Œ6:PsÏ6'c¥\i‹J«£hpš­´Vbª2Å9[m–é³ÚJ©Åú—±¥Ã¨•ÖˆaÔJܤ•r«Çkѵ(ŒæœúÛÙž²Å’Y¡Å1w£rOI•¶­›—uWo{^ƒ» ±G¦¶g ›”ï¿÷ôkžÕì–ªþf4\î·SÃQ³KäiúÁ1›c†°üfDâ> -endobj -558 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb11-14) ->> -endobj -559 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb11-15) ->> -endobj -560 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb11-16) ->> -endobj -561 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb11-17) ->> -endobj -562 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb11-18) ->> -endobj -563 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb11-19) ->> -endobj -564 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb11-20) ->> -endobj -565 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb11-21) ->> -endobj -566 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb11-22) ->> -endobj -567 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb11-23) ->> -endobj -568 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb11-24) ->> -endobj -569 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb11-25) ->> -endobj -570 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb11-26) ->> -endobj -571 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 444.418756 101.433071 425.668756 ] -/BS << -/W 0 ->> -/Dest (cb12-1) ->> -endobj -572 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.471735 99.933071 406.721735 ] -/BS << -/W 0 ->> -/Dest (cb12-2) ->> -endobj -573 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.524714 99.933071 387.774714 ] -/BS << -/W 0 ->> -/Dest (cb12-3) ->> -endobj -574 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.577692 99.933071 368.827692 ] -/BS << -/W 0 ->> -/Dest (cb12-4) ->> -endobj -575 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 368.630671 99.933071 349.880671 ] -/BS << -/W 0 ->> -/Dest (cb12-5) ->> -endobj -576 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 349.683649 99.933071 330.933649 ] -/BS << -/W 0 ->> -/Dest (cb12-6) ->> -endobj -577 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 330.736628 99.933071 311.986628 ] -/BS << -/W 0 ->> -/Dest (cb12-7) ->> -endobj -578 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 311.789606 99.933071 293.039606 ] -/BS << -/W 0 ->> -/Dest (cb12-8) ->> -endobj -579 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 292.842585 99.933071 274.092585 ] -/BS << -/W 0 ->> -/Dest (cb12-9) ->> -endobj -580 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 273.895563 99.933071 255.145563 ] -/BS << -/W 0 ->> -/Dest (cb12-10) ->> -endobj -581 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 254.948542 99.933071 236.198542 ] -/BS << -/W 0 ->> -/Dest (cb12-11) ->> -endobj -582 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 236.001520 99.933071 217.251520 ] -/BS << -/W 0 ->> -/Dest (cb12-12) ->> -endobj -583 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 217.054499 99.933071 198.304499 ] -/BS << -/W 0 ->> -/Dest (cb12-13) ->> -endobj -584 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.107477 99.933071 179.357477 ] -/BS << -/W 0 ->> -/Dest (cb12-14) ->> -endobj -585 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.160456 99.933071 160.410456 ] -/BS << -/W 0 ->> -/Dest (cb12-15) ->> -endobj -586 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.213434 99.933071 141.463434 ] -/BS << -/W 0 ->> -/Dest (cb12-16) ->> -endobj -587 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 141.266413 99.933071 122.516413 ] -/BS << -/W 0 ->> -/Dest (cb12-17) ->> -endobj -588 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 122.319391 99.933071 103.569391 ] -/BS << -/W 0 ->> -/Dest (cb12-18) ->> -endobj -589 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.372370 99.933071 84.622370 ] -/BS << -/W 0 ->> -/Dest (cb12-19) ->> -endobj -590 0 obj -<< -/Filter /FlateDecode -/Length 3169 ->> -stream -xœÍ›KÇ Çïó)æÀe²ÈzFrˆ0"8H‚äd#XsÈ×ÏŸ=]îå®ve«é&ëÁ®býŠ¬éå+áç+ÆU9ÔÚJÖëÝûˇ …’ÿ¶‡›Mý=~Kº2i ‰[®éúÞRBi)–|½¿à¿ÓíZüþò×ß]þs¬Ã×ZË‘Óõ—·¦R ¥–BÉQ5¨ˆÅQ¥J‰);ªÌØš§‚©hÔ‡ª3´Õä©`†ÆXU…¢…塪ÁŒXX=Ìà–Š£b‚‰\ !U‰ŽŽSÈôìé"‡\[l®®@Ç%z:‘‹rbO×BÎ9UO§°%5bO—`KbUòt°E¥O—a‹d!W[b-âé -l‰æè*lwUW[({º&!µªêêtTK}¨‹”Bª"äé˜C‚oŠ«ÃŠÂ$åâè"lÉ”š«ƒ-I(z:-ŠON$)µ:«5Úêöt ¶ÄXÔÕÁL¾G€˜a •ì!+(—<ÄR‚¶¨b• U«GX[ÐRÄÃ@l)hnÅã€CÙlIš=ÃÅÊuu°Ešz,[PÀcl‰* ´Ux‹Çn•{,ðV‰³Çpa&y,WjVä•šÇsìôX €.–{ñX  ®¤=°+Z³ÇwE™<(¸+‚š®¶À=€ŽA¸ŠÇw…©x,PpË(z,À¬øaöX_ ±VòX àn¬¤ Ü[€«+kP<(¸ÁÛ¹Áݘ(z,Pp7jÌ à(ü!7w䇰€õX€ýº( ÐXˆK<$p—¶?gMƒVkË ¸ËÓçêZà‚wÖ-F9pÎÍcAw±Q‰Ç‚îŸÕc°£F ÜeÁNíéÀ]Ž<$pqCòXwŒÀcö·À×uu-P«ÕcAw¥è±»p  -’¸ºàHì±0„8ÔcAw±½7Ü¥$â± ƒ»¤{\l‘= ®ËÖYÓVEÂӻĘaOî•æ± ƒ»¶mz,Èűz,€QpôX«†VJöXA‡ÏÕå€ûä±  Èru°E‹z,@`š´ê± DØ"1z,(¶ dðX€ˆ 4Fôí¦°îâæ -[)z,ÉBmª JÊÈÇ0ªž.ÇP píê*t\<”¢[1{,@.*½Ç>X¸ä±f@Çê± 4Ø‚¥â±[Q¨‘¹§cØ‚ Ûc"]è˜=Ô[ z,¨±"ËÌä±;4rI µ§S²<³z,¨šƒ…Š °Li‚”®¶ 0?–l'H~l"Íqu°E’z,¨5ZºY=Ô -["EðMË7‹Ç‚F°ŸÇ‚F9X˜ì±‡ŽÈcAãŠ|3ªÇ¬KË7«Ç‚&„|)ž³n›dË7‹Ç‚¦°%!Dqu°ASsÖ-˜„|tòt¶Ä¦ ZΖoV3o"¢wªå›Å=.wS™<¸‹È4{,À òMD¶^nOo*ˆÏ|eµŒ³º'ô&ì­î‘½Ø­Š{f@€¯åHî¡ÌDfY³{j€mJ&÷Ø€À_Äcú€ ·Ó§õˆ*à -öÌZì!–…"º9Ç,&»ýòÓåë7Ø|¯?ý÷òîwÛIYÿa8¿h¶Ä:Ù‰ Ó \…­9xE1`V[¨f! ü”:fDiÓH÷C73[1¶Ûv|4›ÍŒ`f{2]ûE¦À˜*ɾ­/®ó¹l•Þ/–ÒoÈäm½‘»"ÇÞ0S_XåsXŠŽ,È(%-;± õ’ -óú‚e´w;¡·‹ÝØ̓éúúýåëþþ—þô º}ýîòßéüÞv’W_±Ýÿˆëº_§Û'ó~ŸoŸ)îŸè‰û5n¬ït*kíiezù­Ï½lêívÐŽ¾Û¯÷O¦ý¾mý¼Ý?G_¯þy}ýí寳ˆ¼_òa(“…cØóŒ$ONüóª|ÒÄÿó, w¾·qÜFæñ¶C"ƒ´½éЖU'9¹Â2µ}ªF™甎O™ÓÍÿšîpp£zœúq¯³î˜æÞ¿z™>Ã¥{]žß®åø,^ÈÒò<}œÓ»ýÚux0&µ—+vƶŚO:üóª|1d «SÅ®ÇÏ!ó‰ÀýlÛivB™ƒFÄêú±z^/gˆBF•HŸ -ÇÆV*ŒUrwòÖóê9‘¢¯£ÃÅÓj)Ƕ1^ØçXùåØïõùdS_µçMñ1Jõþ%L—·GWlFxT³4ºFK9#miúÓù¼:_ŽCû¾&5ŠŸÃ!¶©77ÌŽÁï“$;ÂËÑÎ9œ`’”«'twç<•{̉·ö|'¨–ç4™ˆ:lìµY²ô´<¯ÎãÑÐm+ŸÁ Ž¨tŠÖý÷ENàÄ -ö;Úãã$÷v(}Ä‚®6±oÎwÒ çÒEw¶ñ1ÛÒãÏ9H÷+þY Èu|û»²W±ZÄ!vXõ¤ã?³Î—ãøჰ½Má:þç Ê“‘œ øÌž·áó"Zƒ×Ñ^šŽÓŽOÛÞŠßîß,õºc|¿‹”„¡$#M±À×Øá -ò‘Éx&Ó ®|JÒm’ó>»ùŠ&í}(øÂPmÅŽmR¿ùóûîsRßâ·ÚàâóÇ=S1:›{ø>·ÙÊÙVû깕3y‰{ÏP6ã2É{™¶ghÛ^&-}å=K£Å–·¯ÎÃÿá’·#l޾Ƥ\BîVí[§ 6žv$bÇߢ܇›·âë#5··Ã>ŒRû cdß!Û÷··É–›½ü‡m¢Þ_¸i°g´eu{¹ƒ6qýfŠï/ör:bÕŸ)6á~I£-l>ñ$»–Jhç’’í—m4.©_ÆÔŸÆê§^Í]•z!ÙŽo;BÔÌüPlOOw±½ Uƒìwy˜‚¦ álPײ³ÁYñ£bZ„é¡–î¦Ø2º^6ŽË6æÂaú:t¼L/Ë2O ï.èVÎÒ{Wj¯eô¦úèF2YŒjCšzÉ1!:æÉÝ]áWÔ›VLæÐ/³f_nÝ„µ;’Žr­—sDw·ÜÞZ3UF©:«¶>òÓ”éêRÇÀ;²mŒvi±7>—5BÒ/âl3Ðçšêâ7ñðî’t¬Ä)¾¿¤â”N“”ºë­BYÚâJÓ_¦´Ô>TXš]f_ Øÿ7T¤!5òl¬Ã¥ìë½y7;±µ9ÄÇAZåyPG½`-³ì2\\ÊðÙu¼—8å º£ô±ƒt²E^Z7Ï 5àqóðº!6„õñ¬\…Ô@wSœ†+ßÄÓÎ4–j¢ÑYæÅÝÓhwŠó`çý*.cÆÙ¾«öŽvŸï»mcÓ³Ø\¿öN¦8ÒØífg‹p(LñÄèý&î«uÐÉÞ?í—s‘y;îÝåç˶ÍEIÑç,l¯­Ñ_ÿ‡2ßâ÷ß½~׿ëºíã‘-â`ëA¼îdö¢j}¦Ø^\í±laÔûSÌu–MÝÆ>ãÂkÕi‚½—äAPÚU˜æ.â8\7²,#“žÞFq2¿vnæ†}»•þpvÆdß’v«p³>nëÔÉÜ’¯K“¸³¢sK‡VãR7k£¸]:lÓ²ƒ™æk'cèÍ~]§B¬¯åf #ìV¦Nç6»6ÝeÛS,EËz³6¬¼vÚö8FòòúÕ󾛜û -0é@ûÞ¯Òñ`&Àó¥²ÝæãíØsäj7}ñÎmɲöd9siÌÐB7«.Ò:«íÒÚ©vÙ¡Ó¾Q \@F]6Z,ݦ¼Wëò=quG©Œ˜bJ^G:­³21­³’”µvûŽ7¢%PZݹ̧£YrÄ’Õ‘åµöê,)]ö°o=öÝwÛëò: É32¥Y-=(ùIüû”µs«s:=ðJõŸíDƒë|;µr‘(ÛüPÍ Q{g³h]Ž8^\çé3‡'ýÌcí ÓT„ -ÛŸnù&ÜCÑ>®XšêÖåWkä>ÒËàÑ×l*ìDg{wÿöƒq[,U´?Õ z«½a\ˆÝ#žíÌ.ŽO¶ŸÿÒ³ -endstream -endobj -591 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 590 0 R -/Resources 4 0 R -/Annots [ 592 0 R 593 0 R 594 0 R 595 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -592 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb12-20) ->> -endobj -593 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb12-21) ->> -endobj -594 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb12-22) ->> -endobj -595 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb12-23) ->> -endobj -596 0 obj -<< -/Title (RKE Hardening Guide with CIS v1.6 Benchmark) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 14 -/First 597 0 R -/Last 608 0 R -/Parent 611 0 R ->> -endobj -597 0 obj -<< -/Title (Overview) -/Dest [ 30 0 R /XYZ 84.259843 272.631496 0 ] -/Count 1 -/First 598 0 R -/Last 598 0 R -/Parent 596 0 R -/Next 599 0 R ->> -endobj -598 0 obj -<< -/Title (Known Issues) -/Dest [ 45 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Parent 597 0 R ->> -endobj -599 0 obj -<< -/Title (Configure Kernel Runtime Parameters) -/Dest [ 45 0 R /XYZ 84.259843 539.222079 0 ] -/Count 0 -/Prev 597 0 R -/Parent 596 0 R -/Next 600 0 R ->> -endobj -600 0 obj -<< -/Title (Configure etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 283.686971 0 ] -/Count 1 -/Prev 599 0 R -/First 601 0 R -/Last 601 0 R -/Parent 596 0 R -/Next 602 0 R ->> -endobj -601 0 obj -<< -/Title (Create etcd user and group) -/Dest [ 45 0 R /XYZ 84.259843 169.788971 0 ] -/Count 0 -/Parent 600 0 R ->> -endobj -602 0 obj -<< -/Title (Configure default Service Account) -/Dest [ 53 0 R /XYZ 84.259843 561.590928 0 ] -/Count 1 -/Prev 600 0 R -/First 603 0 R -/Last 603 0 R -/Parent 596 0 R -/Next 604 0 R ->> -endobj -603 0 obj -<< -/Title (Set automountServiceAccountToken to false for default service accounts) -/Dest [ 53 0 R /XYZ 84.259843 522.092928 0 ] -/Count 0 -/Parent 602 0 R ->> -endobj -604 0 obj -<< -/Title (Configure Network Policy) -/Dest [ 67 0 R /XYZ 84.259843 599.840928 0 ] -/Count 1 -/Prev 602 0 R -/First 605 0 R -/Last 605 0 R -/Parent 596 0 R -/Next 606 0 R ->> -endobj -605 0 obj -<< -/Title (Ensure that all Namespaces have Network Policies defined) -/Dest [ 67 0 R /XYZ 84.259843 564.092928 0 ] -/Count 0 -/Parent 604 0 R ->> -endobj -606 0 obj -<< -/Title (Reference Hardened RKE cluster.yml Configuration) -/Dest [ 77 0 R /XYZ 84.259843 191.441066 0 ] -/Count 0 -/Prev 604 0 R -/Parent 596 0 R -/Next 607 0 R ->> -endobj -607 0 obj -<< -/Title (Reference Hardened RKE Template Configuration) -/Dest [ 390 0 R /XYZ 84.259843 518.211778 0 ] -/Count 0 -/Prev 606 0 R -/Parent 596 0 R -/Next 608 0 R ->> -endobj -608 0 obj -<< -/Title (Reference Hardened cloud-config Configuration) -/Dest [ 534 0 R /XYZ 84.259843 537.158799 0 ] -/Count 2 -/Prev 607 0 R -/First 609 0 R -/Last 610 0 R -/Parent 596 0 R ->> -endobj -609 0 obj -<< -/Title (Reference Hardened cloud-config for SUSE Linux Enterprise Server 15 \(SLES 15\) and openSUSE Leap 15) -/Dest [ 534 0 R /XYZ 84.259843 397.010799 0 ] -/Count 0 -/Parent 608 0 R -/Next 610 0 R ->> -endobj -610 0 obj -<< -/Title (Reference Hardened cloud-config for Red Hat Enterprise Linux 8 \(RHEL 8\) and Ubuntu 20.04 LTS) -/Dest [ 557 0 R /XYZ 84.259843 511.863778 0 ] -/Count 0 -/Prev 609 0 R -/Parent 608 0 R ->> -endobj -611 0 obj -<< -/Count 15 -/First 596 0 R -/Last 596 0 R ->> -endobj -612 0 obj -<< -/Length1 10704 -/Filter /FlateDecode -/Length 7088 ->> -stream -xœÕz xTE¶ð©:·nß^Òéît'„ìKga дaS ëŠ&„MH ,b` -„ - ‹#"$€#‚ˆè¼qG‰¢cDfu&&•ÿÜÛ ßÌüÎ|ßÿ¿ïÝ“[ë©SU§ÎV ‚(Q %;{äÝ«'ìÝï¦ÖðýúgófDª§P}ꀜ{Ft}63ƒê›pû€£ú&nÏz ÉGýUwß1r 9+m Õߧú÷÷Œèž:ío/.`µT=qz^1~¢¢± ¨¾}âÜÙÑ0%"ÀÒƒpdañ¤é3{ÌJ‹‰¦þ=“òJŠÁDñÕm“œ_ø×{ºeQ±À“0¹ /?ºcî(Û‡ú3&Sƒý¤JõÙTŸ<}öCkw9ßàj{ðÁ¢‰y û,™Gãi>¨ž÷P±²’@}¨=#ozAâ7·ˆ¥ý³ ÅE%³[>„qq_êýų -Š{›þLEåm1tÞñûkÿðùû|Qú2>øfK¹žÿa{è‹ÐSŽ6E¨:?5ààhœiºŒ ô,ôl¹hŠ0(µî5Zî…d@£ÎÁ‰(짡ØÙj´Ž4±‘ª‘þ…ÜE¬*¢¦p®øçûéÉ)ìŸ>ˆ†yª[ºÙ&Ótv9XË'-z¯r -Û0ù -ø÷a[Y„À§?臨Uÿ=±Έ*(1Êv8£çj”¨ -œá÷ùë"ËŸÿÃñ«h¼Êÿ9Ûå -”y!Ì$3•˜iФ²pÁaž 'ŒþmpXÏéDëíÊç~<ýÁÁTï E=©oŸrnSWÀhC"ôvSÊŒ\Õ”G(FÞ n ¸úà #  -` -Lƒ"˜×ÒÒ£/a Œá„1&Æt˜ÕÒÒrù_Á“»ÿö2©BAΠK´£†{å×ø†‰~slL×.?«F;LÑ5S0?º¶¥%gŒ&ÆÖˆðôj5Š7îÓÖùi×.CrÆD×4÷ï×Jµn?j1†Šzš©½?£OŸ´FxéoPnMôÄÉÑ9‹ëõ˜£ WW¨å‹|-?Jltãß½ø·Tü¡ -¿·ãw¯Kü«ÿbÇ?Wá5/~ûØâ[‰W«ð›*lhįñO¿ê…_öÅ+¿HÅÏëGˆÏ«°žëGàåϺ‹ËøYwüTâ%~’ŠpãÇUø‘Ä]øÁB¼tß—ø¡¿·/^ ..Ä ðüïÂÄy‰¿ Ãÿ’ø[‰ïJ|Gâ¹*|ûl¤x[âÙH|+ÏH<µÔ)N…ãÁxRâë#ñ„Äã_“xLâ«J<"ñ°ë–yEÄÚCGD­ÄCÇ‹CGðÐ"åà+^qp¼¯ú”W¼x@âËU¸_âKk$¾(q_>¾`ǽ{¼bo>îÙí{¼¸Û…ÏÓ¢ŸoÄ]Ÿ“¸Sân—øì6»x6·Ùñ™|¬&”ê*Ü*qËÓ6±EâÓ6ÜüT¨ØœOmrˆ§Bq“7ZpƒÄõUb½Äª¬¤A•U¸n­]¬Kµv\ÓˆO®>"ž”¸zÕx±ú®^¤¬zÂ+VÇU>å />.qåŠnb¥ÄÝð1Úæcw`År«¨pãr+–SCy>.#N-óâR'.‘øè#Nñ¨ÄGœ¸Xâ"‰e}-¿^¸PüZâÂ…¸ KGzD©–8_âCvœgùœ#qv#–4â¬FœÙˆÅ‹$Îø` N“8ÕÙWLS$N^ˆ“¨R(±@b¾Ä‰'HÌë…¹x¿ ÇK¼Wâ8‰cÇXÄØFcÁ_‡Š_¥âh‰£hæQ}q¤G0‡Ñ‡»qØà 1LbŽï‘8ôn‡*ñnÞ%qõ ‘8xC ÂAbà‰ÙUØ¿ -ûI¼“ww6bß#xÇôIÌ’xûm.q»oë(nsaŸÞ¢¯%{`/‰™oíé·6bÏ ‡èéÆŒt«Èp`º{DbZ¦Þb©o±bJw«H ÀîVìÖÕ,º9°«»¤bçN^Ñ9;%»D'/&»0)Ñ+’îÀD/&x­"!½VŒ—'16chŸ1.ŒÎǨFŒ¤-DæcD†Ã%†5bǾJ•P‰ò1„8"1˜‡¢G¢[bD!¸$:i¯Î¾èXˆùh—` m„m F«D‹Í5BÓ$šÜ¨æ£B -I€©%Y-‡à]‘9$²Z–¿ôqÖùÃÿÓ ø—OK‡Z8KpvÃf¶“jzÌ0“Zªù~X -s¨åuv–Uð®Ô¶®ÁyÂ,‡³¸[6Ò¨à’àp„D#“¹Y¦‰º2T9  Wj•+‰ôTJ”sJ®RÂÒp›-vÒ›‰oP|s¢ –}B1Áaü -Óð¨ÒO±Ã'xwÃç4‹î;ÏR”±¼w-¸Y”ñR>œZN‹s°‰ ˆúϱ-ì<­î0{.ÂTø@ØÂ.Ò¾ÎÂ÷ð(ŽäeäžÓx!­ÿ4Ñ:Gã7A‰â"³€ä©VOsM0Òì*.p Êhæ‘°]­Uݦ8šEçØNö:kP×B5œÇûp&~È–*qÊ.e ¬òssaÑÞ¤Q Ù|Ú»¥:u>OÉe»á+%×4h¿¡ïˆæ<À‡ =f;Jï<ÕA{êÍ–b­Tï€s¦ÁJwOL i×@qH:L¥R)ìƒýЫ`Q2ö«ößÓÈÍʧ´çUìqþ=œÃ~…*Wõø‹Âت_8¹ rþc`v6–`9Á‡ÜÌ»o8OýsPî#xNù«OpB4«^‚§ ¤©—i…¿Ñfjû´kæÅ–µíP\Êö¤hËyå,:(Ž¦†[ {CJÏ4O܇çÏKIx³*ãÄE°€Ïçé‹Õ -¯‹MPmÖ¢Ôp„(fu\R8rL!ûnÛpÒO$õzÃ…†Š]ÆƲ¨ðñ=cœ"Ý›æŒñÄH6Xndo±ÁMÛw+%k6^ÜM1ખËJÉŒâaŒ/>H…€e6¨V«Ãƒw8ªm±O†¯ôÚbÍá¡‘Aáæ¥E7\o¨¿õ×ë›êWupº2S|nÒLvŽŸÃsÊYqV5mÜÉdzñ,Võ¸ƒÓR3Ò{$0OBB\,ÇŒŒ´Tð¸!.œˆI æÛ—oݺœ^f¾ë©»Þ<Ø{ÿ´O™×>“Íò*Ëaaw=…½o{æÈ‘g¶æókãä_ä·¿/¿ýú ù'ö8›Ï&°‘zTKñ¸Ò@<ÔÀIQ꾸P¨´˜+]‹Y¥å…(§UãA¡QìáÁ"4¼›Â]J m+µ‰Xè ÉÌÌÔJ›t\ÍLÙËh Îcùq7 -^Z³Ç­š‚)UâbØZÖïÙ§Ÿ~Ve×=ùä:iåÊ•ÆE *wÈk?6ÉÏ4\¾båR^(o/š5³xçñ—*¶¹£Ïnxó:Æ’–Ë"‘N!2|ž±ï³T:Ù3®W†<é\ÙÑ)nGG}‰ ßµ}5å@`XT§åé\mådFOªÞ`«H,¼òH ÈkÌÁà‘+…S¿Y"_³elIJoÄ„‹Ü/OË÷å%yúþÎȶ²Il2Û:€V¥sqqÑ -Ý|µRá•°X«T^°f6a8(6}ANž¼Á­”ýQĬ 8gë{kš;òÓÍ™üoM·‹‹»eöîæË»[÷¼‚ö™¾ha¬Ã*5×3Î}žJû“ÚÊHáÎJZ‡P«#’&jªo:ycïòÂUgffŠ×“ãT•¶Ý*!íù ¼.r×ùEµÜ&ç°ìþ5ÌTTÜ´B^•ß° 暶ë"{rgsÙˆQl#›Îf°³ÿ@®|Gþ—ü|Çëçèmð ‹Ï­UòXlQi÷âV3kcý úÔS!eŽÁR:gš3ŽÒ¸3oñ?¼õVsì[âbófžßØYçøi³µD¡Û!x‘ëäÈ" ©qèº †nÖùR„Oäˆ\±JlªN¨½ÆέtÄTÃb|ëKÒœB&§ª -t*BáN!”¾šàˆð¢YLQ5}"«ÿ蜺¤÷iH ÉÔ-‡É¡|crˆÖWùflì~ i7¾5nÎnÖ‚y’HÒzò ÑCÀ³ÅÚ(>‰ÏåóÄ£|¹X¥­ãOiW¸GE³0«aj´˜:`’è¬v2e("CM7¥Øî@ŸÒ_øTŸÉg›€¹Êd1É4OÛVà -ñ„ºÊ´Ê¶ É–šâ+¦7ð Óïñ=Ó—ø•ò¥ø“úþMü]í2~&ŒŸIŒ`1Œþ .oaJsv”ß7§é¼®àóš6]æï6ߢßvu.$.A8¼äK7k&´¨NTP8ûRàAÅSivW,¶*BE'Ù…`»°„†*Î,·%ܦD‡}R7N¿‘è£]W¦~ú™GÄ;_¤Î»¾1‚ ®¢Iñ€‡¹y0†(^ð2/OÀD5Á” %˜£#3XÏfÙ|²˜£Ìó‚–«ËMÔ ¦¨ñ0ž‡Å!Iwœ.UѺéaN¿IÃÇï(½ýܥׯx裷؛ šm®k*+×ð£Á«-'³²ª Íââ{ï?~˜ßÓ|µüÑG—ê’SNÖé`"üÚ×'ÀÆíV©™¹É£¢"ûZ¬‘QŠ‡ç÷º•N¥ÖyÉ %EZ¬Qa&ˆ µw5…ºc“lhj¨'/`ðE÷ †rœr¶‰–]çJkFÌ L&æŒJîž|O2úí—á%BB ƒ›˜Üê3Ò{ħ¥+KÞ~`ÇËóv>üÙïåÇòÊÔo•6Ìzáhù¦ÒÏÞb!ßMù@l£gÆ¢¹ ¢B;_:xé)ÝÛ?{ù¯g,ˆêÐõøžSõ º,”Ò¾»Rlc/õ%†FYCÌvx>D­³;£—E¯‹«u® ±Av0kÖ(ÔÜýèô߾Кê4Žþdýõ&²D§tçGâ û¿))‘)Q)Ñ)1)±Y‰¾_¤/Êí‹ñÅæDäDæDåDçÄäÄæ$'.(,*.Y»:±:ñZbdÛжAmr#s£r£scŠ#‹£Š£‹cE.ŠZ½(¦ÃMž5½§3.ì~,q*#-F‹XÕ”®»Ù`~쓽‹‹6ÖÕÖf]¾÷lóŒ?·>÷àÈ‚cãþz§–N(¹t ù®æÅ» óNl{õ¸«lE·n»›t™Ùr¯¯B!ËËØrž,`¹¥Î©Ô…ÔêÎÉÝýÉ9Õ·9'‡¼~ÕñÝÕŸ50̶(luXu˜`í9­ÕIŶ:)¼2ô霗Oz9çé¡wïß,ßc]™:j›’¾·sçËçÎ]îÜyw|<»B6ëG'H«RÆ©np6ßê íXvwÐVÚkÙzR.Ðø§ËÚ_×Øëtdº­¿~²ÁqòjÊÁÜÈE‘Õ‘¨;õ´V¦q§ÃEŒbmQ --·ÕÖöziÁÙ––³ ^j>ýÜš5»v­Yóä÷ÿ½aW~ëÇ4‚~yÒsöÊ•³ôBëºÊˆ[nƒb_zóôG}-?“_ED¾Ü¥Ó«¯Ý;qëÅ)¬×„‰»uI>LñL>ÉLôð…¢ÐÎÔr»³Ö¶Þ¸CuMÏvë6þzƒáiÝNÙ¯ý¹#Œsú—L…4§¡YJ~í‚•{ëêú¾<çÄ)¾½ù>¾eë–cÛ›ËUwó–‚üouþ Éç«úï¬&è쳫ǔ—à(LS [s4õ1¢‡zŠ|V‡ÙgÎ1çš‹ÍÂ"h"O܉Zz”Ü«U÷WmûØLô,d»’ÿ¹¿? -ëÛ¾Ù7;üúêð6Ýi= p yûDž,:k£y!Ÿ¤•—„Wˆ'´µ¼J¬×žå.ÝËs+yø$LTtß™üùd̵UàR¥Bõ×ûœlH5Ó”Ÿ_¿:¾šàµøOâ[âÍtºÆyzÚŸñO‡íñvrÿã¼x¬nÖœU;ëfÍ{|g]]VÍü‡÷`Å‚¹ß}¦ý3›õ£ç[¶=õÚ³ÍåJî¾IÜ<ÚAÅ÷7IÞÑ,yõm’w ×ó®‡ÿ\ö<ÿÙ£‰uÑó[£9†æ†æ©u.¨³ÕºVv0»‡¡ËÓ¿ƒa|Z­6츬ÐR(UËLeZ™¹ÌRf-µ•”ÙËËeÎRWuèµPçÍ÷¹ÄTÝÎø-9/Y·wOåÚ½{×^c.yõÚŸå·Ì‰Ÿ\9sæÊ—ožþj³|S6ÈoÈôd’…q³[ýœÁÁ´B'ÐõQµÒIZ±Ü^k>j²¨hÙ.Ý”úA6òÂÛºQ<´5HçIÂÏ‚ƒ£uÙü\]]¯ÃKƒº…ã—óì±æýωBÐlEäËNÓl‰p¥5ÞÑîŒø)Ü!W¡¸—y*:è>Î[ûS¼3CZæÓYÌe¢œoäÄ:ËQ~T¼ÃOã»"Bp3ªŠUX4«™2›‡‡b°ÒQ„iaf·ÕcÓïƒq<c¯ˆUcM^-Ño‰±ÆÙ2‘nÎZ¦-ÅžÍb¶âSúúïÎZ?s?K?«Ïî³ë§8šç(ÃÄpu¸)Gaieù¬€OÅeª˜ªN5Í0çY'ÙŠìs`›ÏâCÊB:Ý2õaS™é!m¾¹Ì\j™k]h+×oóöõ°ž­ãkq³ò”Ðï¡5_÷*ÛVûNØɶóí¸GÙ#žWŸ7íѶÛ^´¿Â_ÂW•#¢Öüšý$ßVÞó ‰2þXbÜèÚ/>¿ôÅçµòÃKþË%’*œª¿?VcUÓTã×[ŒÓÿ#­˜I©RŒÿQëeÁTó—9h,»µŒíÚ•veØÐÖ² -nVwBÃ|˜S`L†ÙMñìDH¦<RÒ¨40¢¡/á̆zgAäÁtèB­ƒ`áw£Òð A4 ¿A«Ä¨P^@cæRšO˜–_0kÆYGÒLsi.ýò„­¯#Æü{3ö£ÒT7æÆDÂÍ3¨#òŒE•”΢;…ð¢i|ÍžgôýœÎƒJ ­ˆî0ZõYK·È ”Js§‘h?ªmŒÿ;hy_ÿžå>\ÿB¥¥ÅÀ4¾ ø ¼ÈøN£í{#×{l7F¶þå‚“€¿ø3º£†Rê…J“t¢“c´¶n”¦¯­°¥Ù0ÒÁp¥C ä7Œ¢5²ÖUXhTàý²ï öófπƗ`|ýÐV2°§Ìš¡#Ó:V1¾®`ú®ø}:&_Àß;xZ9ñ‘þêéÿïçß›³euûQ-›Zk?ϵ+Ÿ7Òí­µŸåÿ¯ŸÖuúi]F~â?£ó‹0ûÝT;O§z¾õtÏßL¥%ï?£ù/F¥Ëz'èL’ªK÷@’äa$Ç£`,É1‡êM0´ Õ: ¡ -a§“Ì PiÔ@²ººh4z˜‰Âp’þQV¢4–´nAÑiÕ7òVTÓ©£A]Ô•vÔ•V꺾™Hß²‰ú³1Ÿ…toQ¿‹ÀFº—Ce}îcn»1w Y‘Ñà€_8a ËXM±w«Ž®uà6tôá¼Yy`IÞ¬é3`É„YyS`Éļ%”N.˜EéüYÂ’IETž4«`,™œ7ƒp&L –iy3ò`ɃyEÑzJº¾dzÞìÉ°dÆ4½¥hRÞtX2kÎ Âœ]8c¥“uúíìAûsÑ×õGø’vÕǦõFþ™Œ\qѤ—Û?mu6¹µ<ê€èÎý’2ÎkØ߶r;7µkWŸõS™ß -ð£n“ûÜšD»´ÜØ1ürcS -endstream -endobj -613 0 obj -<< -/Length1 6944 -/Filter /FlateDecode -/Length 4153 ->> -stream -xœíYyxSו¿÷>Y2‹^dØ,KX€ñ¦'É»,[²v¯’ñ"y‘w[ÞmpÌbÌR¦Ð´$L“&¡”5àIø†¥_L iBšÌ4ÌŒÓL ’&:i:S:´CÀOs’Οó}3ïù¾ûî½çÞsÎïž{Îy2¡ùh1Ho..r78Ö#$‡Þ³³,o…EéƒöŸ \äLRU „!„-ЮkèôöÄž—ïF(d>´w¶t 5÷6°"$2">ÞÚäm” -E7aìm+t„Ê™=0_mEkçÀÃ}öch"Ä4vt7xÏ|ñÚË°Þ£Ð÷R§÷á\€:à}•§ËÛÙ$W¤³-Ž‚¾§{ºûü¯ È÷<GT:>?¦­]õ_ˆa>‡ôÁ±¿;Gë->å¿ÁÝbÎ1Ç¡)B.˜'rGP£@è¿B™süJ3¯Ë|Ïe¤œÁ< e9B_#Ú0Nü( -ÆR}ö@kŠG‹¡i~Ó—Õe*B¿D11±AºI BKLj‚œá5à¿Ì˜>}ûuÉñ[¨Šlªï-?G”(ý­åW@:¬Gq$±¤¥õhôYÉ&(±HFQÙ€¬èýýƒ.rèšP#@ñä<* ௠=Ú/¡t -¥+‡þçƒï¯ÁxŒ‚í:˜gGédŠ%G±c(šG’ïÐnšÿ1Xç̯åëxÒâ±Iø÷ž¿}å¿A˜€,!ÐŽð%0èðz¨ç¢$ܤÐo!)h>£FóñoQaÑüÿ‰ÿýï¾ðf´J ÿþSäü6:8ZAa DÁóµõ@½-„žPXg5J„“dêbTŽ†b–ÅÄúýˆžQ%œ–d”‹ì¨•"oÌR:â¿vÿýÉ Ÿœú†ùkWZƒ,ü½Õ ¸¡Sè"ŽÂɸïǧðÂ’œYw%yŒ¼F>#_1ó=SÉ4Ã=Âì…ûæ"s›¹-X.¨ô -ö N~õ€ûnHJˆ'd_È[!ׄ«…a›p¯ð„ð%á¢y¢,QŸhTtNÄ…. Í - íÝzðÿÀýBè¯à¾2ëþvSNÊÐ&f)µH‘\¹i~N³ôí·a¤ÃoÂÏ@¼Y€P4Ѩ#RY±ˆ£"$bù%_o[mO¯¯¥ÖƒcGOâxïœ6îòÁýÜïÚçÀL̬ -Ì”h´5QjØèq%·øz{jÛz}ugæ´céþƒXÙ6Ç˽r”û¸ ÝÏù{Ñsh˜Ê“ÊÈ#ŸëɶsÆal5[ð?âÇÁÖ?ø#EkýwÐq´AT‰ŽÓ¨µ¬*Z%”+ÒÅrùb¡B*UÐBO‡ò1Ð.A(b’46N£ˆ‹“Ç -…â¨èhV¥Õjt=ü §çôà³Áh–HÌFƒYB–½þúÉSo¼qª|Èf*¯Úh³m¬âÀÆ?#ïÑ ©aÃåáqg=dÄ9‘~#…’(ò œB¤ )'‘\ä.ÉÄ2Í 6䘌v¦B0ÒÔ2Ô0\+¸§vìÍϵ—™{6ö5: 9r©¾)þ»d!ùÅ5 ‹ˆÄ|EUQ²¼ -”\Ãjµ“ü #ÍÆÖœžëP·ZÛ¿Z!r™LÖÆ&É"OM¾^çU’¡Ö—FW²°Æ‘îVw7g9¬ö<ÎÔiôz-ày © Ð\8Ñ(UƒÙpV,Ë5‘X¶ -×v66V è6ÎÇ¿ãE‡ã Ü*³"x:ùWêÇ°L¬û>y©˜á22;,©R;[´Ý¥mÛª sé‹Š‹ 5Eëð‹dçõ˜ÕùÙ–¾¼Žªt}maa»? ²Q:ò ¼v“LA lâ4 eªh‰ü!0ÞI~øý•XâËkÙ¤ñ9Z1ªï™ëzÑ‘TQjr'vPgŽô;ôž#ƒ¸»½äq¹™uÔ–Û -+©V¡à»ä]šGa,Ç2 ßå¾ð`)7Œ?$L …ÔgùÿdÕ- Ù_µÒ©‹ž–P­MUP‚ -…Ó¢îÉÒú_ªN«³ê×;ýz‹/(6å;ó ÎOjÜU;þ‘+K[βåÚŒrqd­!׫Ñxs uäåéÒŒùiçóóõ……zƒ™ÇËOÔ`GRj½ZÊH9%Ç4nÊ)¢Â¼jÕ9‹ˆ¸>ËЖµ¹ï‘Þ_us_¨k|Ëar–îÖm:Mm·ûvüü¥ácëºÊö9ÍvO…ÅZAO.R!C‹Eáˆæ¯ðÄ'AÀ‘l#/CÏ\„VÊDòH6R®dü{n<­î^ÛݺÒááýûÉËö¸Ž;D1… ¤ƒ5¤H«a”…OâºròD*1‹ÇsVj[Lܽ;æF•!•ãžÒ›Ly?¹á(6üì0öªlk4e)d,©X¥+‰X™¥ÑdM|¤OÏ0ܦ{ï¿C~MÞ@Ëè©£øHä³\F*/ÞsÐÛ÷¬²sY§Ã:—7`uÀ«òÙ>ïA>ÔÓÕ”c4nq9· 9î#Í ?ÕåIÐe.ŠœÖDÎ%gñ“'*+Oô]¾ü7?Ú»kx˜Œ•ýÌç;à$cûönÛ¾oâ*•VÁoB¾ ~0RL%ø•p™x”ãðRn7$Ý¿·ÿÉNÎ؃´—€ã¨¨ÁgáKÜ»·o»É˜í6î- hý[ò:oé³Õc?D‚æÂãAª—uY­ë †õÖæó¸/ð`¨ç ÷Puõ!o÷sJ|3Û`ØRZºÙ°±ÕfZ·× º7uw5e'ÍÀdÇ ‰ - OÒìæ¸Ý¸45ã,îM2Æý3Vg Q˜A#Pº) /3]KÇ£‰d˜_³ã·¹Oa¥˜~îMœƒuÜ°Ô«ØÀåŽñø)Ìÿ Œhô/Üi·Í]Á{Y@K&ç—Äá,éusû`Å.7‰ŸxŸœ™¸HÖÀ^Æû¿&ÿˆ-@+à«,næQÊyï? #^ŃSÈã9TO‘°Ù(~"÷QŠûHKËw‘qØéÚÂÍ°1h-+xý"j(rjôb!X 5²bpã.÷§6=cùñ®]ø‰~î#2ÖWµ5/{›篆ùÑ/œÎŸ™H˜á¯u“-“I~åÄUB3}ÿ îú?S2{f$€”?ÿr¹T -%ÁfÖÄÅ­˜±ÎÄ|«±`¹‚<5Yï‚.4¢NF*([/¹Ýïm…ðÊܺü™»ÉýÇtlº>#6]ŸX -m~„9G'3–™¨LÃÈiöÊÄ4fT•ä›]ür§æ·K%í¹3ðr¯ã~3YEQ|¢.+C¦v 1S|“>»yÿj ꛿¢GŸZ|ØË¢¿;–ÝÜb¶[í#…)ë4jWŠÊ©J)M™öíÚ–Ÿ?RV¶ÍTœèÉËó$$xò žÞq÷À%<ÈñrÞïÎû‚6iò-ý†úcNÀå$q?aV5uÎò@ôtÜ{ g ÿ_aö-öx¤˃j:ù,QÜû‡’土ËZ„/b7Ÿ‹u¤<••@n®Ëm‚/^»vÚ_ PÕOQ±" ÉÝMuúšêrÉO…‘½‡­ø¨¬Ú^ëi³™U[,ê÷ 2›Õ¬™Ò:°_ÁS?Y¼_ázñãü·UýP+:Âÿ&Hß1ä|G‚ïÞŸ¾Ã*:| åèNð=ÍÅ‹‚ïB´Ç"êF=hõ¡6Ô‚ZÑÄBJæK rAOÔÅ~|¿ÒÌèG»’`í6žb=ªG‰0«uB/ík†÷õ°n#Ì‚¾Ù¼Vß×.ž-@ß¼@o M¨e>@ÆÙ””B œ“áVƒ i…~šv6]Â}t_gáò¿Lÿïó |¡ÌEKa°Ñäp¡P$àéý³Æ×?†jlÚ BËáé…9³iáúo/;Ðe -endstream -endobj -614 0 obj -<< -/Length1 7204 -/Filter /FlateDecode -/Length 4875 ->> -stream -xœÍ9kXUוkŸuö¹ï÷Áå}.y\¸€¢^ j  A#§òˆH Q¢V1iK'!ÄCmjhjRÔ4ôkÓ6µ~ÑIk-ÓvZ˜~6“8Ì:ç¢1™t:ýúcæ컟kíµ×^{íµÖ`B…ž¥KKVõV>×QD£‘Ë -—,†…—©ß@ýµËŠî*.ܱò>꟣¾gYñºÅEY[>¢þ¯©¿ø®bŸ¿ÑrÁÀ©¿~KcE –Šfl§þ¾-;Ú=§—{6€î ÂÙWÓRÛ¸=;o+Á‰|³¶¢­4” ¢úÆچΚ‰ß‡¶~ `¨«®¨Šz¬üÍM%øœ:0p%õ«¨_×ؾ³+ßBøuY{Có–Š%Ë?¤ù8ÛX±³ELdì ÂSEcõ¬èyIa÷+<·4·µO_†{hýxÞÒZݲrÍSY$œã”?EV½ÃÃ÷žÝl)ø3ÄhAùÞ}¿ÿ€RÿêxØór”xAê&\­Ê†òÑ5_Kù9Ê•”û‚073ÖLy€rÑmóçAPA‘²ƒJ¦Ö"´Pí¦sG:÷tȇEP›¡j ž`; szš0ÒTH± -ÙBmЪ@¦ßû¼ôßôìÖ÷²Fâ" - R=Ö!Á»¼j(°¦Ôó£ ±i©Ÿéz¬Ï ™:=ÃÓÓE¥bß0Ä#‡Ð«½q£ 8š–º¢¨Ô3tnIá Õ%å…4V\JM¥GÃ4¾¤P…)‹q/ý–—y¶Ôy²>—ÿµ:? †…=öWegÇoÊxò&~r¿aÂÁgæƒ2žŸ=±?û0>»G<ñL?±OÄgð¸Œ_÷ã1'>=°Œ?-ãÓÃÓÓâÀS‹øÀ2|jö?éçýÛðI?>!ã?OàÑ |\ÆÇBðk^ìsã—eü'•±WÆžj+ïéÂGŽ8ø#.<ò°•qàÃV<\Íûñ!#:x†’ñà2~ð Ü#ø’—(ÃñK^Ü¿ÏÂ÷‡á> îíÃeì&zÝ~ܳÛÎ÷Tán;>Ї]Ux1î"Š»üøEBø¢;ݸ“vVa‡Œ;dlo3ñ6¶nOç­2nOÇ‚¶ta³›Ïð&ÊxãlÜ#6Ô{yC6ÄmÛp+u¶žÁúÀ´ëhN]ÖRU[…5´RM4V[±JÆ-2VÊXÑ…å2Þ[…›îqðM2ÞãÀ~ÜÂ7¸°Ô…wC¿[Æõ~\'cI±—X±Ø€k׸øÚ>\Sdåk\XdÅ»d\½ªŠ¯îÃUU¸RÆ2Þ¹ÜÎïìÃåvüÂ.›À¥]¸¤ÐΗta¡ïpã"3.ôãÎ/0óù2Ì3ð3Î3`~^(Ïïü¹žŠy{Ĺœsç¸yn.Î!ææ¸1'ÛÍsV`v–ƒg»1ËþL7÷Wa&3ݘás\<£}nL§¡ôhLKµñ´L˜šbá©6L€z)³Í<Å‚)ÃìõfKz>ÛŒ³‡ÙžÀÝbò -L²`â -Lˆwó„xôRå]ñ$šx7Æ9pV¤ƒÏòc¬'›Ç.@{²1&ÂÁcÂ1šªh£%Ê‘Œ·óª”»¡ÃÃl<ÜŽáAžÂ´fÃ0…§»E·CW ‹È¹úЙ‹Ž\´“÷°O`ˆmV?·M • V?ZÌ¥ÜÒ…fê™KÑDdLÑh4X¸1 ÔÓ¸VcäZ jƒ;ÔÐ5FÔ(;Ô‰×qIÒ0 œ¹ù0ƒ@˜(ö! -&ŽÑT"#,!Ù0«Ú„¥ü¿þàÿpí(–ÅâØ)v^"Lãl5l‚]x™ ‰”Ã(kÉCY¼I Ö&èÃð,Á²àTL¦¬@+oRÔî8Jõ~8Žoâ^r]èÞz€\£þ^ò}ß…ðœ…!¸Á¼4ú:ó²Lèg>¢z0}ìÓ³<¨Ä7a-q{ ŽÃ°ãL‚6ø%xFá-ç—øcpŒÊKü:lgJ¬% KMí¬&`= ¡ò5øwl >Á¾¯J5ÂQáu±\M»hƸ°IØ%…Q±œ„«’ƒÖÛ G¡™vob®¸>‚ ?O¤œÄ~$˜ˆo-¼Å/ óa—Â%qу…0Ÿ0cá¼æ˜df>Ín>N³Û§ ¿ý_„.Hý+iõ§ÒÈßN,ŸmüÜÔLéì‚vþšÕ´ˆÒn|Nœ-V‹_¯‹×y2™ ¥H÷©éçÀX;‹Ç…«SX_$ñ0­š Td°X[,K:¦ Wå+„K1šé÷%è˜^AËßX÷5¶Jþk–¥WqÅDÂÕ@xÀ(t€Ø!q¦Ak½X0æWf] γ}2—²˜(Y~Q¡¡Äyâé†zøv`Å*".j8Y.2=õ:Ôk©ãÔÔ±°JÇuZ¤F/:¡w¬7V i‹W é×l,}…¨æn Í# -®MŽ…äePÌ¡±ò74ô³jßP›3ÝàȆY,jQâf!ƒeš ­˜EQ/æ°|!_“£mc÷ {XpšÌePÆ0–QBJBÝa*ŸcõìËò;›äû6Êïˆ?œz·O¤°írB·{ú=q=i["´¸œB¨#Í«-„›ì¤¦^; ˆúèî¨æØ–p}·®ÙÔ"5…·&%ÚoÕ%Å»Bc¬®(œ•d›»f É£ŽòÚ±cÖñÇm¡3;5¿AÍ™Š¶–“Ÿåw…ÚâfIN‡+4Ôår:ÄØY ‰6—+Ë?'';!‘ÉWû™ø^íϪ7”ok-Þ·ûôIùÏòŸš¯Öí¸Òи³h¥Ð³îLÿO~ïK—}ÇÒõE Ödf,~÷Äo®æd³Ì’µ[6ÜQ¥ì•bn±ƒÎUÕ Ih«èÙbAFš129B§rcÌŸ;£¤üŽ¼_Œ¢üdY‰X•”|™tËò"FYákñÕEzá€Xˆ3:MŽÃàì1Ùê M¸U1E:]`L7»"\Rr$q7F÷*(¬1ëoÇ=PÀpÞxÞtÞ|Þy>‚—Ý’_–lÎXõîä¢*G¸ºæâùwòÛ,ú?ÿÂìS:vôñê‘m m-Õ; ¹³g“1Ž`!l)üŽ}æ/dõí»¶ÓyÒëR•£²á`°j°‡Y{Ìí:ÖËmf²CàÒê%YÖ‘É‚P]ý“$E?YåZ8ÕË”Kº–•å$v„÷X©<(_–¯3ëàµþm±Oü~åèd7î]ýã'F3HJd˜Ä#R7èÀ³N£^Û½’УoÑÀ\ô³²¤²¦rlc~:·ŸeØi!º‡ŠU§|E(d “k”GY óÊ—ÅòÉîÑQ¡ù$ÌìííÍ@¬V§å§§§WËÄ^h×KZz‡J:æ’Ò!Ǩœƒr!Û=vmÆ Ý4Ò´2™\úil±§È•—³-r);'Ÿ•ß¬’/KŽÉó¬K¾wj±`,—KnZ¢¥´¶ ¼ZÖƒíÚ½Ö ]˜U{¤ -“TÓ–§*#í‹0ËI¶‘í•ßV¯­üƒ—/Ôçö…ù"}Q¾h_ÌBíBÝBýBÃBãBÛÂ…ö…Ž…Έ2FfÆï²Ùâlê=rÞÞÈrª@á…Øš;m¾žà÷'½Ÿä÷'\¿ÖTX؂חþH¡¨à|WÉú]S™Âù]ëKº¦2ÅòöÅ«ÖÐÞŸ£½ûhïvÈ„é™À¤:Û!c¯ž .ÈULlŽC1>“cª¾1¦ìiFÀ7Q´HeDôÉW–¬¾ëù -‹‹éÛúÔ1áí©dáäëy`j·X>XVó–r§+éN7Óª…¸€]ªsBå³Õ­s…¤£Ë˜ìV-Lð[Ç3>±ÄÙ ,xa­7 „ºú;ë·îÜ9ÕËÂÞgaòïÆß—‡G^yæ™W”,c6_~]þ€Òël>­Ý'¯;hmÅÎåbn·s‡Ì­ìQì"çW­]†béüþ '×n7uÞ[{±Yr ,û̾K¦7>½oÆԱʛ¦®jXÒVTÊ?•/_“^Æ>¸eéÅß îV-]rÀav N žœ¤ãj4FŒ\±MnÐ^I·B¨¸;£{UÙá·]¾Ì¼)/t´ecJjê¢ MS“bù©òú¨HåôéRhÅDx&0ßd̆˜h­NÐè£c¢½:½¨7DLjÌyØÑ鮳1òMb—v£€Îgæj8gl3¨–Hxí–»—¯ýpòù7ôhï—¿?:5¾bÑèÓï -â([@k¨±@ùgoc«žõ•›˜KWR½“A=ðrí6uA’Ä-'œ0À¼…wݵA±ä1_­ø:; ¼3UÒY÷ðÂÞN”Õ\¤5‹hŸÝ´¦õ¯D\äŒJ‰Œ:Í(x9B/“(œg2ѧ¡õCƒ^ë“h\ Ńá8m©ÄXYÀ…|ôÀE£´Öá:qƒ¤Uâm%Ú¶ÛÅnù ùkò,ù?®‹å»éíÄÂ<¹T|Œx²@G`‘Þ ‹¤Ñ"×XÌ°˜Œ&j™Ì& ½×dÐYÁÀ{ðQ³¡×j6õ: Ak-™Ÿ•øQÝõ¦ÀB>—q%+ -ª¸'NŒËQ"‚\âÕ+üpÞ3;þÔ±±$Å%¯§@þ̲;û½:¿¹@\D&îmz;jÈG!0‘Ø„WÕ¿ +mêÛháW3m„Ùô" ¶ÅÛÚÜÌ:Ó– %Á¤‹-Ð ­PµPíD1 ¶@2Õ~È ”E­JÂðÀbÂi§÷n;aWC4ÒËÕË¡‰ðÓ©µ(yÈçݤզöª©®¦9;¨¬"L=Rk+QX÷Æ­ *µ*¦‡Ú -}Qi¢²…p*‰n=áyh~3­[¡Â>K§X¥¢PXEXM”Sn 9 Ïs s½ÊiÑoVW÷¿Yû) -7çßœvk6úÓ¿PÿŸðySWNI˜žV1Uø»šÕÿÜüßZ+ã­ò'6‹¢Ä žƒ9Ä£uSYH‰ÁR: +)1XM<2X¨ÜD‰Í¬¦'¿ ¬péÊâCTyžY'_TxBEkE%dlélm€ŒÚÖêmÑPÑìQÊö&Ò‹OÏV¿ÿ}ø -endstream -endobj -615 0 obj -<< -/Length1 16324 -/Filter /FlateDecode -/Length 11654 ->> -stream -xœÝ{y|TEöo-wëÛ{§;µ³4€!d# Kš° aß¾*‹ÃÃ/$@D0M%2 b†1ЀD@‰ Š ê€ý9€âºÝAð7¾÷Çûã}>¯oêÞª»œ:uΩs¾§î Â!ì[P0lÀ³“ö¼„P7?œêݳW>‚F(/ Ú½ÚsqÿEОíØÞCŸÈœ1ù´WB;ÐДôYŸ~˜ŠÞ íá“çLœOºÑx„hh/œ¼xaì5Ÿl@Hÿ_‘Ô©ó§ÍMf]‚ëoÁõ=Ó&.˜dØP· m˜6{ÉÔU—v2=ƒP‡NŸ2±8Ú7a.Ðo׳¦Ã ƒ—¦C»Úm¦ÏYøŒÃ‘zhC÷™=oòDݬЄŒàD㜉ÏÌ?Æ_õ2Îÿ܉s¦DÝÌ‚ñvçΟ·`áýÏÑhèÿC~}þSSæçž< -üÓ’#—WÿÕð¿¼:ÞÜåŠQÿ]øî¥R~ürgø^„X´pNš -MEcƒÿà9y‹:çxö=úë¡™ˆr‘¨µ ² j €ÄØ !œÃÏò«b†X MWàH?AS‰ ÐK:ª„þ~ù žÚ«yQ,Z.Ù™o•çà+¾tÿR—é­wrî„sD€ž†@@i€%Î[à|-”1ÐޥꛠC¹í©PJ Ü†²ÊÚà¹Êàùr(«¡¬Ü7û,z˜[h{‚ô˃4N@i¥ÏÛ§‚÷ñú'P†ï]Äï ^« žK²)Àÿ/ôG|6xÕ:vìD%èt-ƒí¸Vö£C¨Õ 9P_‹ÐZ<5¡ÕÐâ×dw]ù_D££Pì°ÇÚQ@´£Î¨3êŠ -Ñ`4‹–ß¿Ï­ ÎvGýÐàÙñ÷ïß¿òëíØ‹ö{S–DŒÚÇZöOañ>ïãE±ïŒKnÿ«f¬EŽÝ‡ï3.‰­¿p‘)ŽÜ'Fí£eŸàq_þ­‹—“Û÷\[½zÉöšÐN-‚*oÁi8ß«§v÷ºOôÀ_á„}±“§Ç®³¬s箳LÉM>HVbÇþÍcÅîQت…ýJ$`;bPÑö6dƒ½U«[´½m…½I«÷Û[ìîÁF´ZP#Åz”{U£§ÓîR ö²V—´{D­.hç©v†hg°w$£ŒÑ–åÔÏè=Fï¦ÓŸÓ;ËéO·+ÄŸýé¨pûÖHñv½½R¸u3A¼5’Þò -7è¿Lÿ}—þ˜Bÿ›Ñý>Þ°Óïªh3°ØÌhsýýsÞû·½éõkÅâõ*z­˜þ‹Ño¾Ž¿aôëHú£WgÑ+Œþó0½üpñò]úpz©Š~ÉèEF¿øÜ!~Áèçz¡Š~ö©CüŒÑO×ëÅOô“åôã\Ú¦\zžÑþ®Š1úw•žcôCFÏ®³Šg£èßB錾_EÏ”{Ä3ŒžfôÔrú£'}—Ñ[b#£Ç=Æè;ŒzGíôˆ6¼}Xl`ôí·ÆŠo¦o¯Þ:ìßKßò -‡=ô£«h}ewñMFëàPw—¾´0úz1Ý_Lÿj¢ûlt/£¯1o ý £{ý³Ö2úên“øj:Ým¢¯ì²Š¯´¥»¬ôO;“Å?-§;“éÝÁèËŒÖlkŠéö—,âöpú’…¾¨ÒmŒ¾¼ÀèV#­ÞÒA¬ftKêƒþ}U´êùÃb£Ïƒm=˜>¿RØü¬GÜ<–nö -›}ŽÑÐÞx˜>ë¡• ŒÊîtŒvƒ®×Ó -8QQLËAhåºÎJ×2ZÆh)£kJ¬âFK¬ô¿]Íè¬ùâ†ÒUŒ®|†®øýrq£¿_N—»èï]f¢K}šÑÅŒ.Zh™é¢zŒ¼„…ºð¨°ÀFx…§}’ÑùŒÎ›;TœWEçÎi+ÎJç´¥³•Ng2:#N¿K§¦SÂh1£“'¹ÄÉŒNBq’‹Ndt£ã7J/Ž3ѱÅtÌ{t44FÛé(=‹.²ÓŒgô‰Èpñ‰t:ŒÑ¡Œaôñåt0£ƒìt £p²8€Ñþ‡i¿¶´oa˜Ø7›ö°‰…a´O¯0±£½¡Õ»˜@«à0íF{‰žÙ´G¾Uìa£=ê‰×«ò»›Å|+ͯ'Zݽ&±»™v¯ÇG¡åÍ3ˆ^õÖã•ÐÊ3èÄ<Í«Ç^o±ÐÑ®ÀB×»´ £ÛÒ\Fs@À9Å´SZ„Ø©Íf4+Ù.f1šÙvL;ö£pÈ`4nLg4 .§EÐÔšµ”0ÚA*v8L“Û‡ˆÉvš\Ox·í-V±}mÏÙ­’óˆIŒ>w>æ¡íH®ØŽÑ¶Œ&2š`¦žÐ|ÑÓ‹¶1S7£ñf³Ïh\l²·œÆ&Ó˜~Ô=»f4 -dÅh$h%2œF0Îh£N à, ¡Žd14Ÿ:ìÑ‘Lí÷…Ø© ž·1j…‘[ó©z°X©% ;³É šÍÔɨŠ&5dgÙUjÙ :jඕ-èUa$*£ºPªX¨Ì¨¤%FE;¥08z‚C²Hr)p2EŠëqqÉzœôÿÏý¿fàÿò°°P/µx#9v¬G¥d ŠÖ­Ç8òûêñ¼‚ú.ä‡ýjô#VéIœ 5Àº€Ëâàl%Ú¦=YI¿A‹_¸és¨}ƒs(<‹?BqøP[ûK/ð :ûe´á<íįÅeÐç<´‚À‘ ÊhhêT -Û&´̓:çl5ð@åè&ÚB®¡QP?ø-®)ÐnB·R-éJ¦Â}'€ÚV´¯Tµ@@ʺ,6‘$ zF€Ð$´Ml·pyÀ±Iü® -ÕKvÙ £àrÛ…ßÂid úž_††Ñ1ôIú9.ÜÂÓôª$ˆN@3ÑY±I²£JÙ*¥©x‰0AÛ–ññ‘§… ¸]š“èhÇgÛ´#t€ Š9…sÛ´}e`/YÐô.È}#a¸P@óàÊ2¡?Ú‚vÀ“‰ „æÑLè}Z&®l¨¶dq=­úš4p銶‘©¸¸½ ÒœG{¢lè#Z¼JðàÉËѱ‰Ãɇ~ ¨ŒÞƒw“'Èl²…4R+íJGÑù´„n& 녯ĞâÄ¥$i¤tLŽ’»ÊÓ`+ n?(=•µÊ1å{]¨nšî9ÝÛº·Õ6ªW­Qoè“õSa{ßÐ×0Ë°Ïpݸ¶ƒ°]€ížñžÉbJ7½búÞœa^f>kQ-s,²|fµ[Ÿ³6ØzÚ–ÙÞ A!…!ÏÚE{ž}±ý-ÇDÇÇ¡ýB7„þÛ©:ŸDZ¦B@'ÓèPŒ×LK¥5¨L¨Œ©„TËù.Íé99i(媿9gX©›Z3n"œq¼ì8sFljy’½€§´Ô3°ª!´–‚}ΖQ4„!¼VZH ’ (–óÍ_4§!ËM ˜Š­nm£+^;÷[ãE³N$| 6 HƒúzS£œrEá"v9t!f½Õ㊎ŠŒs††Ø¬³ÉhPuJ€GHöXËù÷œÝ.ç»tñwáûÆôætèf„dÐ GœVÜ!n(q™qZÁnšAöL¿5£fÆMöÍ°»ìÒôš·glŸÎn7ŒÝÆ)Ó±rkØm€dñv6q+Û_Í&á—x©Æ·âí-'Ù~uûHV"!#JAÅÞ¥m$· <ö‹3{ÊÛlˆi[é²—‡lÀ•¦8—EÚ(íE¤—"CĶ±&œËi¦rªå¼³K³3ÝߥÙâ¿zÆónzãÛ7,7Þ½}Ãj˱æXmN(9 Ȭ¬ÌŽ ‰VIrØCaX ‰™¡¡NkBBfǬìÌ '4pÒê°K290÷w󿜾hÎùb<õÔ¤â3“ß;ýÑ‘bžãuï$«…ØÌNƒÑ`r†äö¤C’òÈôŒŽ™YbZ¶c”ŸmÐIX”ÍiÆ0”Dãå4Ÿ->ÎãsUÙªe#j‹e‰Æ!;).¬m¤9NQÚÚâ"£%²ƒÍÑÉòEs£¿Ñòn@DÜ641ypé½{õöÿ—öbuæ¤BÚ([LßAõÁAüŽ¨ŽŒÇ˜Tbb·§;Q¹!nJšAqa‚5dÁÚdÍæ@ÖÙYYÙÄk(ÞÙ·_mÓÀ¡‡f~ʾ^Wžžzò/ÝWt^Þkâüܬ1£ß{á±1í#ÝZÞr.­jzlœøò¿‹¾šSÐß_{½¸ÏºÞU¯…9ßLôŒÐyÕÙÂ?Žñ sšF„‰…Ö’Í»ØÞĨL¿"€Sá.¥Qs(¤!èJ¸–ýHI6˜‰àÕ¤mè“QFÔ&¡0ÕO¥7[¹uY¸W“ˆÃnsºHfG[6]T²zuIoófŸd»Ê:ýËýú>þK¸±èŽº‰­teNWÆz… 6=Ðõ7§ÿB7#Ôæ°ÙeËìHðf P—lͬ˥ˬKó¿ð»W®âwùZÑ.ÒWH»±¢Þö£Æ”a„ -}Q´^T±©Ê¦Tª“¬Anôºp£dÓ\ôPœšSàâàgù h§bQ”= 1ÑãÉ­VĶâ©9l߶/Oe[sðàx°péØñIgX)^rfÒñc“Ïà%¬ô pV„ž–›`^'zíèe®_–©D(J‰P%ç<ô¨€2âqÐ%8W+y ¿Ízìf=ñ[ ö¬å•ZüHr»L~Ä)à9¼zúG´C¢ŽFhçüû­"t€ŸÆ·ý'¶NÆ)gÙ*¼‚ë¶_¢sÈj°kª!F`¼xºÆÅD×òY½î½“ò+œ÷ZêÐŒ&E gn|ÍïÇiì,Œsêý|![³/à‡€a".Êo`e+–4øo›~žw–ÀlïZÓ#'rcÕAÿ¤³ù\_X•«ºÃ)Å¡Èx³+.¦ ŒèXÀ™[®Þ„ãù©ÞSP -N!)4EHS¤9EIÑ¥¨)ú<”‡óHÍòÄ<)OÎSòtyjž~„‘Aê ýx4'ãÕñúíh;ÞN¶ÒØ.n—¶ËÛ•íºíêvý^´ï%{é^a¯¸WÚ+ïUöêöª{õGÐ|„¡G„#âéˆ|D9¢;¢Ñü3Á®èxa¼8^/WÆëxÇ¿E¨ÍX<k¾"àuCâ‰ÕbËH‡xMµ½[;ƒ¯ Èê4xPN§~%ëËË×o(/ßðý­[ßó&¹‘=xpv§ýÉ6ö!;ÅN³q*ÎÂÙ8µ†=ÃV±?°gpþ=^Ë@s·!ò€æT”àµSŸ@|b™Œ|:Å-¹(èE*lôkJO¿ JHõÄYÅLO7Sl¹ì5<ø4Îò¿W+,ê_ß÷nS-Ÿ‘[€ªt…÷¶CQQÃÂ#¨3Ò#Ib¾ÅúŠÑg¯ ‹J°êrÆ[h›h‹z:z|m°»›ï<®Øêjé#ã=ÐsfÊÎjS™Y /û\I‹ÈkþE‡qXfqÁ¦•£ß›?íäÄϱ~dq§¦ÚÚÚ¸C·¥¾AË7ä÷x?-ýÚÛŽ.ìÎÓÑZ°Ålà·-ê ü†øj¹n—Ñ'Å”ÇîŠò¹«¤jÇ«íBCµ‡»,.c×Å´~áóÍVÍu4ƒirãäP\›hCŠ`Lugþ\0M•MÛØ··¦}ÿ·oÚœÊìXµþÕ»–ÎY°¬mÛC±±Ÿ¿±l'›o ó@‡1pÌ¡‰¯¼qø•Ç·‚íÖ²3»q½™ýûAzÚ¾5û=F«‡ Cm€;·îSc|õϤ)_h•¥ÚïB ÆxYŠÂ!1îhüW›~ØûÊ¢AƒT¬n¢1È“;&!ŠKÅñÁ8ŒÒKy}7µvî§ßݼÈü?b7¶÷ÝÌ.®Ú¼yÕš²2ñÀ!O"»Ä¾)žÅ~ú÷Žáx)^Ó2ûзþú—×öDËA›Ü—J(Ó.z%Ô#ˆB¾ò¤"ÅŽG12pÚ¨…Ë”›Í­“„—‘ñ Iè8®œîi¹þQZ2ŦáwW‰I|m5Hd æsÝ€²{x=aäK”|®dŸ ¼nâ«©a†6¹m\fËO]渘TPZ³¦5.‹VSç­ÌCð´â>ƒöß΄<„*ÉôÒMÏ—”mzž^µñÇÏý¸qUÕvÆ®^e÷·X¹déÊË–¬$'|ëÖUû*Önw`Åþsçö¯8÷ÞöÓW¯œª9…'=óûß?³tå*nû+`DÚˆÚ ÎÞø ùBÿl1–6X|ñ’/ª*¾Ú"Q¯s¹Š¯Lnn %`·4 ·2£¡šíÙ¬¿q`“kãÚ õ¯1V}xLˆBDdr…ŠéQi:ä²¥ÆÁ¼LÆmv6k1'›Á)@[+ž¸‡&J\~òû}U/íþþÛçV¯ÚÌúâC_ÝY½zÓ+ì6û™S-—­n-™ÊºÍ_þdñ®wßXû’=ôlÍŽ¾Êa¤ÁG¼ᯣý¡>j|Ý°ßâÓUÑêˆtJ“R#8k¿¸6°üTˆÆîXðdΠ‹ãh#+[H°c4»ÌŽã<=zÇ€¾µÃO46ž(zµ0³];\…ç㹸º]»³]½2>`cz»‚ÞׂĆ%ÖÖë|º2ä3KȬ“iº!MvYRmÀ†Ÿgñ€™{Ò³¬–„8·5$ÀKœ¸úÔ}4¡Ç=Ù[¬–Ûu÷ÁýîÝ{ZLa›ÙJ@1ÏC?˜¿/Öó¿7Tâø•)>á¯*ui2„ž ƒ¦’ÆÆÊx`Á¼œ ‹[†‘ -O‘#þ§y,)¨m¹¢a˜¥BPÖ¡6Þ eá¯0!4²ÕÙÀ&ê¾F経!SZ^8Ãéõ©mÉÖòa0è(uñÆ…G Pá‹zDO®Èp—e…¤K™..£FN<¨,v>°tñ¿Ñ˜Õ' ~üÌbv•5b/Ž·gðãµãOœ8òn)í>Ã[—õ€}xW\fÖÙ…ì,¨íkŠ‰Ãwq ãí£I â#P™*ÁXÅ4ÀùÔ€5çÔå*TRCr÷{÷Ú3¤Ý™3-ŸðU­m¤øn9Ù’Ã¥x -¨JUðSª¦Á¾.›ºd”­3ð|2@”¾ôb„ô'îíÊNâÿqœÃN‚,ï­¨­V¡ ¯§4ª>oœâÑ)0e@KE$”¢ªÄ×µ$ü ã–£WÂS;Í“ÌnW³[‡`Ø -¹s7ILôGCî~D:Ú ›ã’án>Ÿ³}ŠebÒd+JU[]F€ßœ‡ðªÀ¹tb®Á' “Û‘¹“<‚“™ò"²TVÃ$`X*À…Ò< O—x>Ánaç.Çß9~1å¸Øt/Cøàn’ðÁ½ ðd‹`¾ŽiÍN½!:Ÿ™úUæê0”nÈ’Òm™aS­0"·ffBªÓµ¥[«KK«·–~ôSKËíŸü\_Ã…8‚}ÍÞdõìkŽ ÙR¶2²2\ŠW²•Ð;÷j‹4?‚’¼aØg”¬ÌfQ" 1ÝØÉŠ\º {`F©%gø¡à"püW^¯xqÛzÖ¸‹ »ïúi1¥åìæ’’M»®|~ñŸ-»yô¯ä_@!³Íôv‚@LUÉC*zæKrPÁáÓ°/Ó ¢5T'Q•ZQ”‰ªáé‚5Í®º ©Ñ§ÈY²æXƒëh]8k|õ±5†ó©g -.™…†:µ•W·–mhуA;ç9óÙþË&¿s×ÜÆÒË-^ܸÁ÷,yÇ>o›Ž—¼<¶e­Øôåß7&#[nüaͪµÁxØt—ˆþËÛÕh &½ÇãRtDV=11®|Uãuû+a>+~½"ø-ÙÁº]^³P'½IêÐÉhWž¤øµ$ů¥NqHqø,ÞýìH²Wþì¯ -£€i¥@ëð›"§€ºJ„¿fkÔr€‚5.ÀM&%¬è‡$û/+%¡’[ÿ>’ñLó¨Ò#’ò~pý`‹pî^ -›3x0_ku -7Èmi*Üéñêð!tPÀ]hëº{¿}ºaýö™†.:6çí4ž³ÄqøVvXšÊÊð3Á5 ·°Œã[4×ûx–ˆXC˜YFuar…-®<öHtE›[u˜‡ á&U2ôŒ$G·Ç,7¹ëJ¬©§4^½é¿Ìà­9š.R½Ñ©1©±©q©ñ5¨×µF¿#´ÆYV^a‹Ý­¹}v&‡—Útæ ~FfÂ/kX|Ö“†®/ÿqéì-¯áƒ;¿¾òÏïßû÷OxͦqGGO=\T~¢kB,Éxrþ”ùj׿eÕ®âñïì8|,zÍ’¬Žõ‰‰C†¤oâè)è F…R½a­0ë*Õæ†È‘ÍÖ;Ì IÑ0²ôôÀ’¤{­|¢5wn±¶J£-•&$r3 Ue%kÖ­[SRÖr¥ý SOÿëÚ™âêõõ$åã Ÿ7ÿâyfH@áïÙ·ìĈ¡ëùËjŒŽ?|8JñFÊG-¨<ühhµTèxZe3 © Âr³±5«²°›|5á?€ôV9 -ž¾/a~ö9ö`áñ­ 7ýË¡Ã{&léž“”„;a;lkÿN÷Ü|xörçn\.Ë€›Ä¿ÁÔä""{D…É^¡T›ð Ô)*ímµéûp¹p…?*Ð5ÍðHèÃ/é¨úúÕÅg®]?=e+3—•””——””Ñs¤ÇÏÍ뇎À±[qö¦ÿøÂç›>¿ÐÊOÈÅüôò&@&ƒÕrÝz)´KFüNxEHƒ±:š’(‹.TB…Q6K·ÆÀkI.ª«Ü-7ohI Ì› |­’Ê#ŠüWŽ¼VttÎŒã£Ù=vÇþðñOõÂƲ’=2n”ôæ{rÞáåàlÀ^ö副îÛÆõ+ä‚:‚Ô,Ø ÔI¸½`’Ž©$DF:Q2šõv¾¶¾9ø¦>/–¤Û¸ä\mŽoc¸á ‰ç&À«ØŠzÖ„“^}]²W?>mr¥?…ž«Xÿš&ÖG°çkob¸Á™¨£¶òP]…+´ÂLa¶ºÌÇÛ{,1I†Þ’Í×&kcPw–«WÕÒÄs¾œ_[wˆü‚º’‡TëÌÌ £JW•n¨,[QZã›þ»†Nªéñ|Yû-s¯_oœ]•ROrÎ~òÉÙ³Ÿ]`ýÌYסýŽ}Êòqcp.–±‚s‡Úˆ‚²‹Ôd×Þ¦3Qþ-j…µÁðdêkÔIú;Ÿ‡Ú4ìÒ¬¡€íMb€UmáJsBäÁ™O®*¯¯OÛ½àϯ’º–¾¤Î·áÍ?·”Jö–&k»ï‡þzB:dD¼áJ24ª/ c©h=–Äþ¨Ÿ*›@YWïË Š¶¤‹8Ãá<ÿ žãŸ‹ç°Ë8¦¾^˜àO©¬¤ù¤_tC‡Øpj~ŒÈŠ:y£E„Õ -×QK£ézL9nÓ+DGÌ‚dB—ƒA“Õ: Ì)Q{9g—ëùÚ'Eì8¾õúŸØõQ0¥ìô«Ê{Ç?Ú¶\úÓ5.ÍfÝ~ͳðæ*Î@¶ê”\8!v:eÈÎD§‚N@7$öz!˜Åê°$õD½ ïæôÖ¬íªóÑ -B+œÐ²Z™cˆ!Q”P&†)™¤£˜¥©dY,‚sU”pðab¸!‡)mi¢ØVîL; ÙbŽœ­ô¥…òHi¤<‹ÎfH3ä%ôq‰´DŽúUnÛÜ€¯üƒõÆì2›´¶A²û—áslTKÉ_Åò`ì50vUŠ‰'@…¨Zg8AëDlHÒ÷×ñ÷Éþ÷KAZŠ§}¡"…HÃÅLVŒùɵ?½Á>×pÕï~¿íü1úó³@wçó,ýÑ›f3ëEGJ²ÃPK"…[dd5+¤ÖæQa"z¹yÐ5@еjA7âþÑN#ý]üpÂ…ÚåêMíÅÿ Äëí*¤Š©Rªœª¤êRÕT}^hž3/,/ÿ¼éã ÛØßÙ?Á¢>ÂÉ8»p>wØpaôËã`†7êAl0UããôX4ÄÀÞZ4|!À¼} -=FÄ`†§ä¡ð›žZ( à…Òõ-§$µrèö.»ðàÔ|+8GkÙ!FxZC,ÀÑÄÒ`®Ž<~,ZÃ+½¹tû%6?ÌÑñ?êÈ!mï_ZR²vmII)‰H®žrêÚ¿Nh9x$q ·¬:gC|Ź#†Vþ|çL°„Õ #+š‘õY©ÏÔ ;&«’„ðiÚZ°pþ}nè©^Y°Å‹bq¬5¥â KªÕ‹¼¸‡ÅkŒãÁ–ÁVÛXœð+Kq -«;/-ÜSr;²ºçâ,º¤ÃcŸ¾ßò‘0áó§WÄ·ávÙ–"7‰h‘׫åáÎ`î„|´__·)bÛò]‡Ýî†ÌÌÉ#W¦Ș/®¹+âK0Ó¼a&QÌYñ1¥NUô:Fi±™EÍ7»4j¼¿øxÄëYÉT¼ƒ·èìå³µjˆ/±c•-5¿›´i×2¡w âÓHaܯf}µŠøŒï S_›õÕÕ`¦Þšªs<€† ÇëgÍÿúƒÓ^}rÏn¼›O{>éÉ’{;vO,¾ÌuY #œ#L€\|Š·Ä Hüœüb˜„$ìDHâùß1n|µQ(D½dèÞÀU¿‘òíO$|…ÑÄLª‚H<„ðµD-tÁ½pÁöÔwɇÑ=÷jZstàÅ€­Þ^z›ªNå+ŸzØÒO’“'éÎ@’î $é·’ôc¿•¤ßüí$=·&ëÖF+ô:Aƒbp4‰ QB¸¥‹T#ô1†”€Û‘±ÔNv+í 9$KÌ‘rä ¥‹¡—R¨+Ð÷5 WŠt#ô# SÉ :U˜!ÎÔMÑ/&KÅg”ßéžÒ'›ÕpÂÂÅ5FM"Ib7ÒMì¢öQGª3É qººŒ¬ K„ÂRñwê -5 äÖšÓcžÓׯyqÇñ:vwßëû÷Ÿ&ù- tí½2µe+×jd HR^õö "K€@™ …'˜: ȇu§:u*æ½ -²Õ9A²ùª,`A“`*Ç)þÆ N¹šîüšÿ– kòtÚ‘§âòb¼D–d ¼¨5W討†« -ŒPGÜZ¢ "Œcóp}«g›p=›÷>n‡… -ÿj©Çï°<Ò‡„±Yøy>Òé=VÁHm¨ÆÛËè4¹Ùè‰ÎÀ—Õi¼ç4[?X-F“Ñì4™Œù–#2é*äãVÓ±«Ålä+{6ÅVhêÂìÀ—ÚÜÊydyóÑ‘jK„,ëdÓÞP -–Å¢X[¸!ܘ`J0w²Z m#*_/”dÂ×Î4x™ÍÇ ¸¾CïÉñÖÙ<çñ1½Ù ã¸?î}O_t„ÝÉ8pë¸Fa 3ÍGztj&–.òFQ>'ᨲä¥P$àB$õR¹G .4ÿú#‚ýΨ#‹vRzѾÊZ¤L¡3•Et©¢ŽåŸpÐã®Ðä–ådµÿ0YÝò¼0i·ÿ‹ªZê..²ýô&`Þ6hª73ÜìÐK]„Å­cã(Ò×éP~WwÒQò†Ç SÅ6¡á(ZCˆņwUÍ¢çwX; -~Ôjñ²[ðú­lò ©¢æ=ùÌF[¨äp—¬<ÐÓ›ÞŸ_UÑ­Ûú™¯þì-¨xbôÜy£ž¨hxvóÅï} +Ÿªúáâ¦Ê!Ü3 è΀ûbáùyÐïDíÚ¯é Õ¨p -ஹPò¡ÌC³à:ï<5O£™\d ìGžo}ºõYüýOѨ_ÿ'tðÇ%Nîß×îÔ®_(W©ƒÿÇ­ùÃ'¸n\šÞbaß$ˆ5^0ÊD¹°ïFÝG€þ`Ÿ&h4xQAgðtÏ‚þàoAãï~vàz7xFÒ®'L|jâ$”:yÉS³Qê´§¦ÌB©³'΋åû…sA¯>­ýþÐZD -endstream -endobj -616 0 obj -<< -/Type /FontDescriptor -/FontName /GUHWDL+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 472 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 612 0 R ->> -endobj -617 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /GUHWDL+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 ] 25 [ 636 ] 37 [ 686 698 ] 40 [ 631 ] 42 [ 774 751 294 ] 46 [ 655 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] -/FontDescriptor 616 0 R ->> -endobj -618 0 obj -<< -/Length 744 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -30 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0003> <0020> -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0052> <006f> -<0056> <0073> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -619 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /GUHWDL+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 617 0 R ] -/ToUnicode 618 0 R ->> -endobj -620 0 obj -<< -/Type /FontDescriptor -/FontName /BNVYMD+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -260 563 736 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 736 -/StemV 80 -/StemH 80 -/FontFile2 613 0 R ->> -endobj -621 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /BNVYMD+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 10 [ 158 453 453 ] 15 [ 197 550 209 ] 19 [ 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 674 675 975 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 ] 206 [ 379 379 ] 209 [ 411 ] ] -/FontDescriptor 620 0 R ->> -endobj -622 0 obj -<< -/Length 1248 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -66 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0003> <0020> -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<001a> <0037> -<0015> <0032> -<0013> <0030> -<0032> <004f> -<0052> <006f> -<0049> <0066> -<004f> <006c> -<0033> <0050> -<0056> <0073> -<0053> <0070> -<0024> <0041> -<0031> <004e> -<005c> <0079> -<0037> <0054> -<0010> <002d> -<0045> <0062> -<0054> <0071> -<000b> <0028> -<000c> <0029> -<000f> <002c> -<001d> <003a> -<0039> <0056> -<001b> <0038> -<0027> <0044> -<0029> <0046> -<00d1> <2022> -<005b> <0078> -<003a> <0057> -<0038> <0055> -<00ce> <201c> -<00cf> <201d> -<004d> <006a> -<002f> <004c> -<000a> <0027> -<001c> <0039> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -623 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /BNVYMD+Poppins -/Encoding /Identity-H -/DescendantFonts [ 621 0 R ] -/ToUnicode 622 0 R ->> -endobj -624 0 obj -<< -/Type /FontDescriptor -/FontName /MQMIVM+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 5 -/FontBBox [ 0 -14 584 759 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 759 -/StemV 80 -/StemH 80 -/FontFile2 614 0 R ->> -endobj -625 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /MQMIVM+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 16 [ 601 601 ] 29 [ 601 ] 36 [ 601 ] 54 [ 601 601 ] 66 [ 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 ] 92 [ 601 ] ] -/FontDescriptor 624 0 R ->> -endobj -626 0 obj -<< -/Length 674 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -25 beginbfchar -<0048> <0065> -<0057> <0074> -<0046> <0063> -<0047> <0064> -<0049> <0066> -<0044> <0061> -<0058> <0075> -<004f> <006c> -<0056> <0073> -<0055> <0072> -<0011> <002e> -<005c> <0079> -<0050> <006d> -<0042> <005f> -<0053> <0070> -<0052> <006f> -<004c> <0069> -<001d> <003a> -<0010> <002d> -<0051> <006e> -<0036> <0053> -<0059> <0076> -<0024> <0041> -<0037> <0054> -<004e> <006b> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -627 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /MQMIVM+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 625 0 R ] -/ToUnicode 626 0 R ->> -endobj -628 0 obj -<< -/Type /FontDescriptor -/FontName /VZSVIB+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -235 585 699 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 699 -/StemV 80 -/StemH 80 -/FontFile2 615 0 R ->> -endobj -629 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /VZSVIB+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 601 602 601 601 601 601 602 602 601 601 602 602 602 602 601 602 602 ] 32 [ 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 602 602 602 602 602 ] 60 [ 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 602 602 601 601 601 601 601 602 602 602 602 601 601 602 601 601 602 602 602 601 601 601 602 601 602 601 602 602 602 602 ] ] -/FontDescriptor 628 0 R ->> -endobj -630 0 obj -<< -/Length 1500 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -84 beginbfchar -<0056> <0073> -<005c> <0079> -<0046> <0063> -<0057> <0074> -<004f> <006c> -<0012> <002f> -<0048> <0065> -<0011> <002e> -<0047> <0064> -<001c> <0039> -<0013> <0030> -<0010> <002d> -<004e> <006b> -<0058> <0075> -<0045> <0062> -<0052> <006f> -<0051> <006e> -<0049> <0066> -<0059> <0076> -<0050> <006d> -<0055> <0072> -<004c> <0069> -<0042> <005f> -<0020> <003d> -<0014> <0031> -<0053> <0070> -<0044> <0061> -<005b> <0078> -<0015> <0032> -<0018> <0035> -<0003> <0020> -<0016> <0033> -<0017> <0034> -<004a> <0067> -<0005> <0022> -<004b> <0068> -<001d> <003a> -<0036> <0053> -<0024> <0041> -<0037> <0054> -<0039> <0056> -<000e> <002b> -<0006> <0023> -<0004> <0021> -<0007> <0024> -<000b> <0028> -<004d> <006a> -<005e> <007b> -<003e> <005b> -<000d> <002a> -<0040> <005d> -<000a> <0027> -<0060> <007d> -<000c> <0029> -<001e> <003b> -<005a> <0077> -<0031> <004e> -<0033> <0050> -<001b> <0038> -<002c> <0049> -<0028> <0045> -<002e> <004b> -<000f> <002c> -<0035> <0052> -<0054> <0071> -<0027> <0044> -<0026> <0043> -<002f> <004c> -<002b> <0048> -<003a> <0057> -<002a> <0047> -<0030> <004d> -<0019> <0036> -<0032> <004f> -<003c> <0059> -<001a> <0037> -<005f> <007c> -<0038> <0055> -<0009> <0026> -<0029> <0046> -<005d> <007a> -<0025> <0042> -<0043> <0060> -<0008> <0025> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -631 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /VZSVIB+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 629 0 R ] -/ToUnicode 630 0 R ->> -endobj -632 0 obj -<< -/GUHWDL 619 0 R -/BNVYMD 623 0 R -/MQMIVM 627 0 R -/VZSVIB 631 0 R ->> -endobj -xref -0 633 -0000000000 65535 f -0000000015 00000 n -0000000235 00000 n -0000000355 00000 n -0000027529 00000 n -0000027662 00000 n -0000030321 00000 n -0000030520 00000 n -0000034117 00000 n -0000034467 00000 n -0000034601 00000 n -0000034737 00000 n -0000034899 00000 n -0000035062 00000 n -0000035218 00000 n -0000035375 00000 n -0000035532 00000 n -0000035692 00000 n -0000035853 00000 n -0000036014 00000 n -0000036165 00000 n -0000036317 00000 n -0000036492 00000 n -0000036668 00000 n -0000036844 00000 n -0000037016 00000 n -0000037189 00000 n -0000037361 00000 n -0000037534 00000 n -0000037707 00000 n -0000042713 00000 n -0000043017 00000 n -0000043267 00000 n -0000043403 00000 n -0000043566 00000 n -0000043723 00000 n -0000043880 00000 n -0000044041 00000 n -0000044202 00000 n -0000044354 00000 n -0000044527 00000 n -0000044700 00000 n -0000044873 00000 n -0000045135 00000 n -0000045395 00000 n -0000050582 00000 n -0000050837 00000 n -0000051092 00000 n -0000051225 00000 n -0000051356 00000 n -0000051487 00000 n -0000051618 00000 n -0000051749 00000 n -0000056758 00000 n -0000057055 00000 n -0000057188 00000 n -0000057319 00000 n -0000057452 00000 n -0000057583 00000 n -0000057714 00000 n -0000057845 00000 n -0000057978 00000 n -0000058111 00000 n -0000058242 00000 n -0000058373 00000 n -0000058504 00000 n -0000058635 00000 n -0000063613 00000 n -0000063882 00000 n -0000064015 00000 n -0000064146 00000 n -0000064277 00000 n -0000064408 00000 n -0000064539 00000 n -0000064735 00000 n -0000064994 00000 n -0000065225 00000 n -0000070848 00000 n -0000071201 00000 n -0000071334 00000 n -0000071465 00000 n -0000071596 00000 n -0000071727 00000 n -0000071858 00000 n -0000071989 00000 n -0000072120 00000 n -0000072251 00000 n -0000072382 00000 n -0000072514 00000 n -0000072646 00000 n -0000072778 00000 n -0000072910 00000 n -0000073042 00000 n -0000073175 00000 n -0000073306 00000 n -0000073437 00000 n -0000073568 00000 n -0000073699 00000 n -0000073928 00000 n -0000079347 00000 n -0000079784 00000 n -0000080022 00000 n -0000080156 00000 n -0000080288 00000 n -0000080420 00000 n -0000080552 00000 n -0000080684 00000 n -0000080816 00000 n -0000080948 00000 n -0000081080 00000 n -0000081212 00000 n -0000081345 00000 n -0000081478 00000 n -0000081611 00000 n -0000081744 00000 n -0000081877 00000 n -0000082010 00000 n -0000082143 00000 n -0000082276 00000 n -0000082409 00000 n -0000082542 00000 n -0000082675 00000 n -0000082808 00000 n -0000082941 00000 n -0000083074 00000 n -0000083207 00000 n -0000083340 00000 n -0000083473 00000 n -0000083605 00000 n -0000088733 00000 n -0000089212 00000 n -0000089345 00000 n -0000089478 00000 n -0000089611 00000 n -0000089744 00000 n -0000089877 00000 n -0000090010 00000 n -0000090143 00000 n -0000090276 00000 n -0000090409 00000 n -0000090542 00000 n -0000090675 00000 n -0000090808 00000 n -0000090941 00000 n -0000091074 00000 n -0000091207 00000 n -0000091340 00000 n -0000091473 00000 n -0000091606 00000 n -0000091739 00000 n -0000091872 00000 n -0000092005 00000 n -0000092138 00000 n -0000092271 00000 n -0000092404 00000 n -0000092537 00000 n -0000092670 00000 n -0000092803 00000 n -0000092936 00000 n -0000093069 00000 n -0000093202 00000 n -0000093335 00000 n -0000093467 00000 n -0000093598 00000 n -0000098570 00000 n -0000099009 00000 n -0000099142 00000 n -0000099275 00000 n -0000099408 00000 n -0000099541 00000 n -0000099674 00000 n -0000099807 00000 n -0000099940 00000 n -0000100073 00000 n -0000100206 00000 n -0000100339 00000 n -0000100472 00000 n -0000100605 00000 n -0000100738 00000 n -0000100871 00000 n -0000101004 00000 n -0000101137 00000 n -0000101270 00000 n -0000101403 00000 n -0000101536 00000 n -0000101669 00000 n -0000101802 00000 n -0000101935 00000 n -0000102068 00000 n -0000102201 00000 n -0000102334 00000 n -0000102467 00000 n -0000102599 00000 n -0000102730 00000 n -0000107838 00000 n -0000108341 00000 n -0000108474 00000 n -0000108607 00000 n -0000108740 00000 n -0000108873 00000 n -0000109006 00000 n -0000109139 00000 n -0000109272 00000 n -0000109405 00000 n -0000109538 00000 n -0000109671 00000 n -0000109804 00000 n -0000109938 00000 n -0000110072 00000 n -0000110206 00000 n -0000110340 00000 n -0000110474 00000 n -0000110608 00000 n -0000110742 00000 n -0000110876 00000 n -0000111010 00000 n -0000111144 00000 n -0000111278 00000 n -0000111412 00000 n -0000111546 00000 n -0000111680 00000 n -0000111814 00000 n -0000111948 00000 n -0000112082 00000 n -0000112216 00000 n -0000112350 00000 n -0000112484 00000 n -0000112618 00000 n -0000112752 00000 n -0000112886 00000 n -0000113019 00000 n -0000113151 00000 n -0000117686 00000 n -0000118189 00000 n -0000118323 00000 n -0000118457 00000 n -0000118591 00000 n -0000118725 00000 n -0000118859 00000 n -0000118993 00000 n -0000119127 00000 n -0000119261 00000 n -0000119395 00000 n -0000119529 00000 n -0000119663 00000 n -0000119797 00000 n -0000119931 00000 n -0000120065 00000 n -0000120199 00000 n -0000120333 00000 n -0000120467 00000 n -0000120601 00000 n -0000120735 00000 n -0000120869 00000 n -0000121003 00000 n -0000121137 00000 n -0000121271 00000 n -0000121405 00000 n -0000121539 00000 n -0000121673 00000 n -0000121807 00000 n -0000121941 00000 n -0000122075 00000 n -0000122209 00000 n -0000122343 00000 n -0000122477 00000 n -0000122611 00000 n -0000122745 00000 n -0000122878 00000 n -0000123010 00000 n -0000127251 00000 n -0000127770 00000 n -0000127904 00000 n -0000128038 00000 n -0000128172 00000 n -0000128306 00000 n -0000128440 00000 n -0000128574 00000 n -0000128708 00000 n -0000128842 00000 n -0000128976 00000 n -0000129110 00000 n -0000129244 00000 n -0000129378 00000 n -0000129512 00000 n -0000129646 00000 n -0000129780 00000 n -0000129914 00000 n -0000130048 00000 n -0000130182 00000 n -0000130316 00000 n -0000130450 00000 n -0000130584 00000 n -0000130718 00000 n -0000130852 00000 n -0000130986 00000 n -0000131120 00000 n -0000131254 00000 n -0000131388 00000 n -0000131522 00000 n -0000131656 00000 n -0000131790 00000 n -0000131924 00000 n -0000132058 00000 n -0000132192 00000 n -0000132326 00000 n -0000132460 00000 n -0000132594 00000 n -0000132727 00000 n -0000132859 00000 n -0000137871 00000 n -0000138390 00000 n -0000138524 00000 n -0000138658 00000 n -0000138792 00000 n -0000138926 00000 n -0000139060 00000 n -0000139194 00000 n -0000139328 00000 n -0000139462 00000 n -0000139596 00000 n -0000139730 00000 n -0000139864 00000 n -0000139998 00000 n -0000140132 00000 n -0000140266 00000 n -0000140400 00000 n -0000140534 00000 n -0000140668 00000 n -0000140802 00000 n -0000140936 00000 n -0000141070 00000 n -0000141204 00000 n -0000141338 00000 n -0000141472 00000 n -0000141606 00000 n -0000141740 00000 n -0000141874 00000 n -0000142008 00000 n -0000142142 00000 n -0000142276 00000 n -0000142410 00000 n -0000142544 00000 n -0000142678 00000 n -0000142812 00000 n -0000142946 00000 n -0000143080 00000 n -0000143214 00000 n -0000143347 00000 n -0000143479 00000 n -0000148519 00000 n -0000149038 00000 n -0000149172 00000 n -0000149306 00000 n -0000149440 00000 n -0000149574 00000 n -0000149708 00000 n -0000149842 00000 n -0000149976 00000 n -0000150110 00000 n -0000150244 00000 n -0000150378 00000 n -0000150512 00000 n -0000150646 00000 n -0000150780 00000 n -0000150914 00000 n -0000151048 00000 n -0000151182 00000 n -0000151316 00000 n -0000151450 00000 n -0000151584 00000 n -0000151718 00000 n -0000151852 00000 n -0000151986 00000 n -0000152120 00000 n -0000152254 00000 n -0000152388 00000 n -0000152522 00000 n -0000152656 00000 n -0000152790 00000 n -0000152924 00000 n -0000153058 00000 n -0000153192 00000 n -0000153326 00000 n -0000153460 00000 n -0000153594 00000 n -0000153728 00000 n -0000153862 00000 n -0000153995 00000 n -0000154127 00000 n -0000159321 00000 n -0000159800 00000 n -0000159934 00000 n -0000160068 00000 n -0000160202 00000 n -0000160336 00000 n -0000160470 00000 n -0000160604 00000 n -0000160738 00000 n -0000160872 00000 n -0000161006 00000 n -0000161140 00000 n -0000161274 00000 n -0000161408 00000 n -0000161542 00000 n -0000161676 00000 n -0000161906 00000 n -0000162041 00000 n -0000162174 00000 n -0000162307 00000 n -0000162440 00000 n -0000162573 00000 n -0000162706 00000 n -0000162839 00000 n -0000162972 00000 n -0000163105 00000 n -0000163239 00000 n -0000163373 00000 n -0000163507 00000 n -0000163641 00000 n -0000163775 00000 n -0000163909 00000 n -0000164043 00000 n -0000164176 00000 n -0000164308 00000 n -0000169178 00000 n -0000169689 00000 n -0000169823 00000 n -0000169957 00000 n -0000170091 00000 n -0000170225 00000 n -0000170359 00000 n -0000170493 00000 n -0000170627 00000 n -0000170761 00000 n -0000170895 00000 n -0000171029 00000 n -0000171163 00000 n -0000171297 00000 n -0000171431 00000 n -0000171565 00000 n -0000171699 00000 n -0000171833 00000 n -0000171967 00000 n -0000172101 00000 n -0000172235 00000 n -0000172369 00000 n -0000172503 00000 n -0000172637 00000 n -0000172771 00000 n -0000172905 00000 n -0000173039 00000 n -0000173173 00000 n -0000173307 00000 n -0000173441 00000 n -0000173575 00000 n -0000173709 00000 n -0000173843 00000 n -0000173977 00000 n -0000174111 00000 n -0000174245 00000 n -0000174379 00000 n -0000174512 00000 n -0000174644 00000 n -0000179360 00000 n -0000179839 00000 n -0000179973 00000 n -0000180107 00000 n -0000180241 00000 n -0000180375 00000 n -0000180509 00000 n -0000180643 00000 n -0000180777 00000 n -0000180911 00000 n -0000181045 00000 n -0000181179 00000 n -0000181313 00000 n -0000181447 00000 n -0000181581 00000 n -0000181715 00000 n -0000181849 00000 n -0000181983 00000 n -0000182117 00000 n -0000182251 00000 n -0000182385 00000 n -0000182519 00000 n -0000182653 00000 n -0000182787 00000 n -0000182921 00000 n -0000183055 00000 n -0000183189 00000 n -0000183323 00000 n -0000183457 00000 n -0000183591 00000 n -0000183725 00000 n -0000183859 00000 n -0000183993 00000 n -0000184126 00000 n -0000184258 00000 n -0000189459 00000 n -0000189938 00000 n -0000190072 00000 n -0000190206 00000 n -0000190340 00000 n -0000190474 00000 n -0000190608 00000 n -0000190742 00000 n -0000190876 00000 n -0000191010 00000 n -0000191144 00000 n -0000191278 00000 n -0000191412 00000 n -0000191547 00000 n -0000191682 00000 n -0000191817 00000 n -0000191952 00000 n -0000192087 00000 n -0000192222 00000 n -0000192357 00000 n -0000192492 00000 n -0000192627 00000 n -0000192762 00000 n -0000192897 00000 n -0000193032 00000 n -0000193167 00000 n -0000193302 00000 n -0000193437 00000 n -0000193572 00000 n -0000193707 00000 n -0000193842 00000 n -0000193977 00000 n -0000194112 00000 n -0000194246 00000 n -0000194379 00000 n -0000199526 00000 n -0000199909 00000 n -0000200044 00000 n -0000200179 00000 n -0000200314 00000 n -0000200449 00000 n -0000200584 00000 n -0000200719 00000 n -0000200854 00000 n -0000200989 00000 n -0000201124 00000 n -0000201257 00000 n -0000201390 00000 n -0000201523 00000 n -0000201656 00000 n -0000201789 00000 n -0000201922 00000 n -0000202055 00000 n -0000202188 00000 n -0000202322 00000 n -0000202456 00000 n -0000202590 00000 n -0000202723 00000 n -0000207709 00000 n -0000208180 00000 n -0000208314 00000 n -0000208448 00000 n -0000208582 00000 n -0000208716 00000 n -0000208850 00000 n -0000208984 00000 n -0000209118 00000 n -0000209252 00000 n -0000209386 00000 n -0000209520 00000 n -0000209654 00000 n -0000209788 00000 n -0000209922 00000 n -0000210057 00000 n -0000210190 00000 n -0000210323 00000 n -0000210456 00000 n -0000210589 00000 n -0000210722 00000 n -0000210855 00000 n -0000210988 00000 n -0000211121 00000 n -0000211255 00000 n -0000211389 00000 n -0000211523 00000 n -0000211657 00000 n -0000211791 00000 n -0000211925 00000 n -0000212059 00000 n -0000212193 00000 n -0000212327 00000 n -0000212460 00000 n -0000215704 00000 n -0000215951 00000 n -0000216085 00000 n -0000216219 00000 n -0000216353 00000 n -0000216487 00000 n -0000216662 00000 n -0000216816 00000 n -0000216931 00000 n -0000217097 00000 n -0000217286 00000 n -0000217415 00000 n -0000217608 00000 n -0000217781 00000 n -0000217965 00000 n -0000218124 00000 n -0000218303 00000 n -0000218480 00000 n -0000218672 00000 n -0000218890 00000 n -0000219102 00000 n -0000219164 00000 n -0000226342 00000 n -0000230584 00000 n -0000235548 00000 n -0000247293 00000 n -0000247525 00000 n -0000247941 00000 n -0000248738 00000 n -0000248888 00000 n -0000249117 00000 n -0000249649 00000 n -0000250951 00000 n -0000251098 00000 n -0000251339 00000 n -0000251712 00000 n -0000252439 00000 n -0000252593 00000 n -0000252835 00000 n -0000253429 00000 n -0000254983 00000 n -0000255137 00000 n -trailer -<< -/Size 633 -/Root 3 0 R -/Info 2 0 R ->> -startxref -255224 -%%EOF diff --git a/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-benchmark-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Benchmark_Assessment.pdf b/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-benchmark-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Benchmark_Assessment.pdf deleted file mode 100644 index a99a551e3d6..00000000000 --- a/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-benchmark-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Benchmark_Assessment.pdf +++ /dev/null @@ -1,14240 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 38 0 R 76 0 R 114 0 R 152 0 R 186 0 R 222 0 R 258 0 R 294 0 R 306 0 R 313 0 R 317 0 R 321 0 R 325 0 R 329 0 R 333 0 R 338 0 R 342 0 R 346 0 R 351 0 R 358 0 R 398 0 R 423 0 R 462 0 R 486 0 R 490 0 R 492 0 R 495 0 R 497 0 R 500 0 R 502 0 R 504 0 R 507 0 R 509 0 R 512 0 R 514 0 R 517 0 R 519 0 R 522 0 R 524 0 R 527 0 R 529 0 R 533 0 R 535 0 R 537 0 R 542 0 R 544 0 R 547 0 R 549 0 R 551 0 R 554 0 R 556 0 R 559 0 R 561 0 R 564 0 R 566 0 R 569 0 R 571 0 R 574 0 R 576 0 R 579 0 R 581 0 R 584 0 R 586 0 R 589 0 R 591 0 R 594 0 R 596 0 R 599 0 R 601 0 R 603 0 R 606 0 R 608 0 R 611 0 R 613 0 R 616 0 R 618 0 R 621 0 R 623 0 R 626 0 R 628 0 R 631 0 R 633 0 R 636 0 R 638 0 R 641 0 R 643 0 R 645 0 R 649 0 R 651 0 R 653 0 R 656 0 R 659 0 R 662 0 R 665 0 R 668 0 R 670 0 R 673 0 R 675 0 R 679 0 R 681 0 R 684 0 R 686 0 R 689 0 R 691 0 R 694 0 R 696 0 R 698 0 R 701 0 R 704 0 R 708 0 R 713 0 R 717 0 R 720 0 R 724 0 R 728 0 R 732 0 R 736 0 R 740 0 R 744 0 R 748 0 R 751 0 R 755 0 R 759 0 R 763 0 R 765 0 R 769 0 R 773 0 R 775 0 R 777 0 R 802 0 R 813 0 R 817 0 R 821 0 R 825 0 R 828 0 R 836 0 R 853 0 R 855 0 R 857 0 R 859 0 R ] -/Count 142 ->> -endobj -2 0 obj -<< -/Title (RKE2 CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Creator (pandoc) -/Producer (WeasyPrint 54.3) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 1003 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server) [ 486 0 R /XYZ 41.740157 784.430079 0 ] (apply-security-context-to-your-pods-and-containers-automated) [ 859 0 R /XYZ 84.259843 324.051496 0 ] (authentication-and-authorization) [ 696 0 R /XYZ 41.740157 784.430079 0 ] (cb1) [ 317 0 R /XYZ 84.259843 529.251496 0 ] (cb1-1) [ 317 0 R /XYZ 101.433071 527.554475 0 ] (cb10) [ 321 0 R /XYZ 84.259843 180.731993 0 ] (cb10-1) [ 321 0 R /XYZ 101.433071 179.034971 0 ] (cb100) [ 556 0 R /XYZ 84.259843 700.370079 0 ] (cb100-1) [ 556 0 R /XYZ 101.433071 698.673057 0 ] (cb103) [ 561 0 R /XYZ 84.259843 643.970079 0 ] (cb103-1) [ 561 0 R /XYZ 101.433071 642.273057 0 ] (cb106) [ 566 0 R /XYZ 84.259843 590.570079 0 ] (cb106-1) [ 566 0 R /XYZ 101.433071 588.873057 0 ] (cb109) [ 571 0 R /XYZ 84.259843 519.320079 0 ] (cb109-1) [ 571 0 R /XYZ 101.433071 517.623057 0 ] (cb112) [ 576 0 R /XYZ 84.259843 459.320079 0 ] (cb112-1) [ 576 0 R /XYZ 101.433071 457.623057 0 ] (cb115) [ 581 0 R /XYZ 84.259843 373.070079 0 ] (cb115-1) [ 581 0 R /XYZ 101.433071 371.373057 0 ] (cb118) [ 586 0 R /XYZ 84.259843 294.320079 0 ] (cb118-1) [ 586 0 R /XYZ 101.433071 292.623057 0 ] (cb121) [ 591 0 R /XYZ 84.259843 219.320079 0 ] (cb121-1) [ 591 0 R /XYZ 101.433071 217.623057 0 ] (cb124) [ 596 0 R /XYZ 84.259843 125.570079 0 ] (cb124-1) [ 596 0 R /XYZ 101.433071 123.873057 0 ] (cb127) [ 603 0 R /XYZ 84.259843 799.370079 0 ] (cb127-1) [ 603 0 R /XYZ 101.433071 797.673057 0 ] (cb13) [ 325 0 R /XYZ 84.259843 547.070079 0 ] (cb13-1) [ 325 0 R /XYZ 101.433071 545.373057 0 ] (cb130) [ 608 0 R /XYZ 84.259843 685.370079 0 ] (cb130-1) [ 608 0 R /XYZ 101.433071 683.673057 0 ] (cb133) [ 613 0 R /XYZ 84.259843 575.570079 0 ] (cb133-1) [ 613 0 R /XYZ 101.433071 573.873057 0 ] (cb136) [ 618 0 R /XYZ 84.259843 485.570079 0 ] (cb136-1) [ 618 0 R /XYZ 101.433071 483.873057 0 ] (cb139) [ 623 0 R /XYZ 84.259843 391.820079 0 ] (cb139-1) [ 623 0 R /XYZ 101.433071 390.123057 0 ] (cb142) [ 628 0 R /XYZ 84.259843 279.320079 0 ] (cb142-1) [ 628 0 R /XYZ 101.433071 277.623057 0 ] (cb145) [ 633 0 R /XYZ 84.259843 185.570079 0 ] (cb145-1) [ 633 0 R /XYZ 101.433071 183.873057 0 ] (cb148) [ 638 0 R /XYZ 84.259843 110.570079 0 ] (cb148-1) [ 638 0 R /XYZ 101.433071 108.873057 0 ] (cb151) [ 645 0 R /XYZ 84.259843 799.370079 0 ] (cb151-1) [ 645 0 R /XYZ 101.433071 797.673057 0 ] (cb154) [ 645 0 R /XYZ 84.259843 332.176036 0 ] (cb154-1) [ 645 0 R /XYZ 101.433071 330.479014 0 ] (cb157) [ 653 0 R /XYZ 84.259843 535.251496 0 ] (cb157-1) [ 653 0 R /XYZ 101.433071 533.554475 0 ] (cb16) [ 325 0 R /XYZ 84.259843 195.929014 0 ] (cb16-1) [ 325 0 R /XYZ 101.433071 194.231993 0 ] (cb160) [ 656 0 R /XYZ 84.259843 463.070079 0 ] (cb160-1) [ 656 0 R /XYZ 101.433071 461.373057 0 ] (cb163) [ 659 0 R /XYZ 84.259843 388.070079 0 ] (cb163-1) [ 659 0 R /XYZ 101.433071 386.373057 0 ] (cb166) [ 662 0 R /XYZ 84.259843 298.070079 0 ] (cb166-1) [ 662 0 R /XYZ 101.433071 296.373057 0 ] (cb169) [ 665 0 R /XYZ 84.259843 219.320079 0 ] (cb169-1) [ 665 0 R /XYZ 101.433071 217.623057 0 ] (cb172) [ 670 0 R /XYZ 84.259843 700.370079 0 ] (cb172-1) [ 670 0 R /XYZ 101.433071 698.673057 0 ] (cb175) [ 675 0 R /XYZ 84.259843 565.251496 0 ] (cb175-1) [ 675 0 R /XYZ 101.433071 563.554475 0 ] (cb178) [ 675 0 R /XYZ 84.259843 158.254475 0 ] (cb178-1) [ 675 0 R /XYZ 101.433071 156.557453 0 ] (cb181) [ 681 0 R /XYZ 84.259843 252.651496 0 ] (cb181-1) [ 681 0 R /XYZ 101.433071 250.954475 0 ] (cb184) [ 686 0 R /XYZ 84.259843 246.470079 0 ] (cb184-1) [ 686 0 R /XYZ 101.433071 244.773057 0 ] (cb187) [ 691 0 R /XYZ 84.259843 466.820079 0 ] (cb187-1) [ 691 0 R /XYZ 101.433071 465.123057 0 ] (cb19) [ 329 0 R /XYZ 84.259843 580.820079 0 ] (cb19-1) [ 329 0 R /XYZ 101.433071 579.123057 0 ] (cb190) [ 698 0 R /XYZ 84.259843 595.251496 0 ] (cb190-1) [ 698 0 R /XYZ 101.433071 593.554475 0 ] (cb193) [ 701 0 R /XYZ 84.259843 529.251496 0 ] (cb193-1) [ 701 0 R /XYZ 101.433071 527.554475 0 ] (cb195) [ 704 0 R /XYZ 84.259843 799.370079 0 ] (cb195-1) [ 704 0 R /XYZ 101.433071 797.673057 0 ] (cb198) [ 704 0 R /XYZ 84.259843 429.479014 0 ] (cb198-1) [ 704 0 R /XYZ 101.433071 427.781993 0 ] (cb201) [ 708 0 R /XYZ 84.259843 799.370079 0 ] (cb201-1) [ 708 0 R /XYZ 101.433071 797.673057 0 ] (cb204) [ 708 0 R /XYZ 84.259843 448.229014 0 ] (cb204-1) [ 708 0 R /XYZ 101.433071 446.531993 0 ] (cb207) [ 708 0 R /XYZ 84.259843 112.087950 0 ] (cb207-1) [ 708 0 R /XYZ 101.433071 110.390928 0 ] (cb208) [ 713 0 R /XYZ 84.259843 658.970079 0 ] (cb208-1) [ 713 0 R /XYZ 101.433071 657.273057 0 ] (cb211) [ 713 0 R /XYZ 84.259843 307.829014 0 ] (cb211-1) [ 713 0 R /XYZ 101.433071 306.131993 0 ] (cb214) [ 717 0 R /XYZ 84.259843 643.970079 0 ] (cb214-1) [ 717 0 R /XYZ 101.433071 642.273057 0 ] (cb217) [ 720 0 R /XYZ 84.259843 490.251496 0 ] (cb217-1) [ 720 0 R /XYZ 101.433071 488.554475 0 ] (cb218) [ 720 0 R /XYZ 84.259843 429.304475 0 ] (cb218-1) [ 720 0 R /XYZ 101.433071 427.607453 0 ] (cb22) [ 329 0 R /XYZ 84.259843 229.679014 0 ] (cb22-1) [ 329 0 R /XYZ 101.433071 227.981993 0 ] (cb221) [ 724 0 R /XYZ 84.259843 305.570079 0 ] (cb221-1) [ 724 0 R /XYZ 101.433071 303.873057 0 ] (cb222) [ 724 0 R /XYZ 84.259843 244.623057 0 ] (cb222-1) [ 724 0 R /XYZ 101.433071 242.926036 0 ] (cb225) [ 728 0 R /XYZ 84.259843 455.570079 0 ] (cb225-1) [ 728 0 R /XYZ 101.433071 453.873057 0 ] (cb226) [ 728 0 R /XYZ 84.259843 394.623057 0 ] (cb226-1) [ 728 0 R /XYZ 101.433071 392.926036 0 ] (cb229) [ 732 0 R /XYZ 84.259843 583.970079 0 ] (cb229-1) [ 732 0 R /XYZ 101.433071 582.273057 0 ] (cb230) [ 732 0 R /XYZ 84.259843 523.023057 0 ] (cb230-1) [ 732 0 R /XYZ 101.433071 521.326036 0 ] (cb233) [ 736 0 R /XYZ 84.259843 384.320079 0 ] (cb233-1) [ 736 0 R /XYZ 101.433071 382.623057 0 ] (cb234) [ 736 0 R /XYZ 84.259843 323.373057 0 ] (cb234-1) [ 736 0 R /XYZ 101.433071 321.676036 0 ] (cb237) [ 740 0 R /XYZ 84.259843 174.320079 0 ] (cb237-1) [ 740 0 R /XYZ 101.433071 172.623057 0 ] (cb238) [ 740 0 R /XYZ 84.259843 113.373057 0 ] (cb238-1) [ 740 0 R /XYZ 101.433071 111.676036 0 ] (cb241) [ 744 0 R /XYZ 84.259843 328.820079 0 ] (cb241-1) [ 744 0 R /XYZ 101.433071 327.123057 0 ] (cb242) [ 744 0 R /XYZ 84.259843 267.873057 0 ] (cb242-1) [ 744 0 R /XYZ 101.433071 266.176036 0 ] (cb245) [ 748 0 R /XYZ 84.259843 133.070079 0 ] (cb245-1) [ 748 0 R /XYZ 101.433071 131.373057 0 ] (cb246) [ 751 0 R /XYZ 84.259843 583.970079 0 ] (cb246-1) [ 751 0 R /XYZ 101.433071 582.273057 0 ] (cb247) [ 751 0 R /XYZ 84.259843 523.023057 0 ] (cb247-1) [ 751 0 R /XYZ 101.433071 521.326036 0 ] (cb25) [ 333 0 R /XYZ 84.259843 622.820079 0 ] (cb25-1) [ 333 0 R /XYZ 101.433071 621.123057 0 ] (cb250) [ 755 0 R /XYZ 84.259843 369.320079 0 ] (cb250-1) [ 755 0 R /XYZ 101.433071 367.623057 0 ] (cb251) [ 755 0 R /XYZ 84.259843 308.373057 0 ] (cb251-1) [ 755 0 R /XYZ 101.433071 306.676036 0 ] (cb254) [ 759 0 R /XYZ 84.259843 159.320079 0 ] (cb254-1) [ 759 0 R /XYZ 101.433071 157.623057 0 ] (cb255) [ 759 0 R /XYZ 84.259843 98.373057 0 ] (cb255-1) [ 759 0 R /XYZ 101.433071 96.676036 0 ] (cb258) [ 765 0 R /XYZ 84.259843 715.370079 0 ] (cb258-1) [ 765 0 R /XYZ 101.433071 713.673057 0 ] (cb259) [ 765 0 R /XYZ 84.259843 654.423057 0 ] (cb259-1) [ 765 0 R /XYZ 101.433071 652.726036 0 ] (cb26) [ 333 0 R /XYZ 84.259843 446.073057 0 ] (cb26-1) [ 333 0 R /XYZ 101.433071 444.376036 0 ] (cb262) [ 769 0 R /XYZ 84.259843 485.570079 0 ] (cb262-1) [ 769 0 R /XYZ 101.433071 483.873057 0 ] (cb263) [ 769 0 R /XYZ 84.259843 424.623057 0 ] (cb263-1) [ 769 0 R /XYZ 101.433071 422.926036 0 ] (cb266) [ 777 0 R /XYZ 84.259843 768.620079 0 ] (cb266-1) [ 777 0 R /XYZ 101.433071 766.923057 0 ] (cb266-10) [ 777 0 R /XYZ 99.933071 596.399864 0 ] (cb266-11) [ 777 0 R /XYZ 99.933071 577.452842 0 ] (cb266-12) [ 777 0 R /XYZ 99.933071 482.717735 0 ] (cb266-13) [ 777 0 R /XYZ 99.933071 463.770714 0 ] (cb266-14) [ 777 0 R /XYZ 99.933071 444.823692 0 ] (cb266-15) [ 777 0 R /XYZ 99.933071 425.876671 0 ] (cb266-16) [ 777 0 R /XYZ 99.933071 406.929649 0 ] (cb266-17) [ 777 0 R /XYZ 99.933071 387.982628 0 ] (cb266-18) [ 777 0 R /XYZ 99.933071 350.088585 0 ] (cb266-19) [ 777 0 R /XYZ 99.933071 331.141563 0 ] (cb266-2) [ 777 0 R /XYZ 99.933071 747.976036 0 ] (cb266-20) [ 777 0 R /XYZ 99.933071 198.512413 0 ] (cb266-21) [ 777 0 R /XYZ 99.933071 179.565391 0 ] (cb266-22) [ 777 0 R /XYZ 99.933071 160.618370 0 ] (cb266-23) [ 777 0 R /XYZ 99.933071 103.777305 0 ] (cb266-24) [ 802 0 R /XYZ 99.933071 799.173057 0 ] (cb266-25) [ 802 0 R /XYZ 99.933071 780.226036 0 ] (cb266-26) [ 802 0 R /XYZ 99.933071 761.279014 0 ] (cb266-27) [ 802 0 R /XYZ 99.933071 742.331993 0 ] (cb266-28) [ 802 0 R /XYZ 99.933071 723.384971 0 ] (cb266-29) [ 802 0 R /XYZ 99.933071 704.437950 0 ] (cb266-3) [ 777 0 R /XYZ 99.933071 729.029014 0 ] (cb266-30) [ 802 0 R /XYZ 99.933071 685.490928 0 ] (cb266-31) [ 802 0 R /XYZ 99.933071 666.543907 0 ] (cb266-4) [ 777 0 R /XYZ 99.933071 710.081993 0 ] (cb266-5) [ 777 0 R /XYZ 99.933071 691.134971 0 ] (cb266-6) [ 777 0 R /XYZ 99.933071 672.187950 0 ] (cb266-7) [ 777 0 R /XYZ 99.933071 653.240928 0 ] (cb266-8) [ 777 0 R /XYZ 99.933071 634.293907 0 ] (cb266-9) [ 777 0 R /XYZ 99.933071 615.346885 0 ] (cb267) [ 802 0 R /XYZ 84.259843 607.293907 0 ] (cb267-1) [ 802 0 R /XYZ 101.433071 605.596885 0 ] (cb27) [ 333 0 R /XYZ 84.259843 239.326036 0 ] (cb27-1) [ 333 0 R /XYZ 101.433071 237.629014 0 ] (cb270) [ 813 0 R /XYZ 84.259843 565.251496 0 ] (cb270-1) [ 813 0 R /XYZ 101.433071 563.554475 0 ] (cb273) [ 813 0 R /XYZ 84.259843 233.057453 0 ] (cb273-1) [ 813 0 R /XYZ 101.433071 231.360432 0 ] (cb276) [ 817 0 R /XYZ 84.259843 607.820079 0 ] (cb276-1) [ 817 0 R /XYZ 101.433071 606.123057 0 ] (cb279) [ 817 0 R /XYZ 84.259843 256.679014 0 ] (cb279-1) [ 817 0 R /XYZ 101.433071 254.981993 0 ] (cb282) [ 821 0 R /XYZ 84.259843 643.970079 0 ] (cb282-1) [ 821 0 R /XYZ 101.433071 642.273057 0 ] (cb285) [ 821 0 R /XYZ 84.259843 258.881993 0 ] (cb285-1) [ 821 0 R /XYZ 101.433071 257.184971 0 ] (cb288) [ 825 0 R /XYZ 84.259843 607.820079 0 ] (cb288-1) [ 825 0 R /XYZ 101.433071 606.123057 0 ] (cb291) [ 828 0 R /XYZ 84.259843 514.251496 0 ] (cb291-1) [ 828 0 R /XYZ 101.433071 512.554475 0 ] (cb294) [ 828 0 R /XYZ 84.259843 174.360432 0 ] (cb294-1) [ 828 0 R /XYZ 101.433071 172.663410 0 ] (cb294-10) [ 836 0 R /XYZ 99.933071 723.384971 0 ] (cb294-11) [ 836 0 R /XYZ 99.933071 704.437950 0 ] (cb294-12) [ 836 0 R /XYZ 99.933071 685.490928 0 ] (cb294-13) [ 836 0 R /XYZ 99.933071 628.649864 0 ] (cb294-14) [ 836 0 R /XYZ 99.933071 609.702842 0 ] (cb294-15) [ 836 0 R /XYZ 99.933071 590.755821 0 ] (cb294-16) [ 836 0 R /XYZ 99.933071 571.808799 0 ] (cb294-17) [ 836 0 R /XYZ 99.933071 552.861778 0 ] (cb294-18) [ 836 0 R /XYZ 99.933071 533.914756 0 ] (cb294-19) [ 836 0 R /XYZ 99.933071 514.967735 0 ] (cb294-2) [ 828 0 R /XYZ 99.933071 153.716389 0 ] (cb294-3) [ 828 0 R /XYZ 99.933071 134.769367 0 ] (cb294-4) [ 828 0 R /XYZ 99.933071 115.822346 0 ] (cb294-5) [ 828 0 R /XYZ 99.933071 96.875324 0 ] (cb294-6) [ 836 0 R /XYZ 99.933071 799.173057 0 ] (cb294-7) [ 836 0 R /XYZ 99.933071 780.226036 0 ] (cb294-8) [ 836 0 R /XYZ 99.933071 761.279014 0 ] (cb294-9) [ 836 0 R /XYZ 99.933071 742.331993 0 ] (cb295) [ 836 0 R /XYZ 84.259843 455.717735 0 ] (cb295-1) [ 836 0 R /XYZ 101.433071 454.020714 0 ] (cb30) [ 338 0 R /XYZ 84.259843 628.970079 0 ] (cb30-1) [ 338 0 R /XYZ 101.433071 627.273057 0 ] (cb33) [ 338 0 R /XYZ 84.259843 315.723057 0 ] (cb33-1) [ 338 0 R /XYZ 101.433071 314.026036 0 ] (cb36) [ 342 0 R /XYZ 84.259843 715.370079 0 ] (cb36-1) [ 342 0 R /XYZ 101.433071 713.673057 0 ] (cb39) [ 342 0 R /XYZ 84.259843 398.176036 0 ] (cb39-1) [ 342 0 R /XYZ 101.433071 396.479014 0 ] (cb4) [ 317 0 R /XYZ 84.259843 197.057453 0 ] (cb4-1) [ 317 0 R /XYZ 101.433071 195.360432 0 ] (cb42) [ 346 0 R /XYZ 84.259843 799.370079 0 ] (cb42-1) [ 346 0 R /XYZ 101.433071 797.673057 0 ] (cb45) [ 346 0 R /XYZ 84.259843 467.176036 0 ] (cb45-1) [ 346 0 R /XYZ 101.433071 465.479014 0 ] (cb48) [ 346 0 R /XYZ 84.259843 134.981993 0 ] (cb48-1) [ 346 0 R /XYZ 101.433071 133.284971 0 ] (cb51) [ 351 0 R /XYZ 84.259843 520.070079 0 ] (cb51-1) [ 351 0 R /XYZ 101.433071 518.373057 0 ] (cb54) [ 351 0 R /XYZ 84.259843 203.073057 0 ] (cb54-1) [ 351 0 R /XYZ 101.433071 201.376036 0 ] (cb54-10) [ 358 0 R /XYZ 99.933071 704.437950 0 ] (cb54-11) [ 358 0 R /XYZ 99.933071 685.490928 0 ] (cb54-12) [ 358 0 R /XYZ 99.933071 666.543907 0 ] (cb54-13) [ 358 0 R /XYZ 99.933071 647.596885 0 ] (cb54-14) [ 358 0 R /XYZ 99.933071 628.649864 0 ] (cb54-15) [ 358 0 R /XYZ 99.933071 609.702842 0 ] (cb54-16) [ 358 0 R /XYZ 99.933071 590.755821 0 ] (cb54-17) [ 358 0 R /XYZ 99.933071 571.808799 0 ] (cb54-18) [ 358 0 R /XYZ 99.933071 552.861778 0 ] (cb54-19) [ 358 0 R /XYZ 99.933071 533.914756 0 ] (cb54-2) [ 351 0 R /XYZ 99.933071 182.429014 0 ] (cb54-20) [ 358 0 R /XYZ 99.933071 514.967735 0 ] (cb54-21) [ 358 0 R /XYZ 99.933071 496.020714 0 ] (cb54-22) [ 358 0 R /XYZ 99.933071 477.073692 0 ] (cb54-23) [ 358 0 R /XYZ 99.933071 458.126671 0 ] (cb54-24) [ 358 0 R /XYZ 99.933071 439.179649 0 ] (cb54-25) [ 358 0 R /XYZ 99.933071 420.232628 0 ] (cb54-26) [ 358 0 R /XYZ 99.933071 401.285606 0 ] (cb54-27) [ 358 0 R /XYZ 99.933071 382.338585 0 ] (cb54-28) [ 358 0 R /XYZ 99.933071 363.391563 0 ] (cb54-29) [ 358 0 R /XYZ 99.933071 344.444542 0 ] (cb54-3) [ 351 0 R /XYZ 99.933071 163.481993 0 ] (cb54-30) [ 358 0 R /XYZ 99.933071 325.497520 0 ] (cb54-31) [ 358 0 R /XYZ 99.933071 306.550499 0 ] (cb54-32) [ 358 0 R /XYZ 99.933071 287.603477 0 ] (cb54-33) [ 358 0 R /XYZ 99.933071 268.656456 0 ] (cb54-34) [ 358 0 R /XYZ 99.933071 249.709434 0 ] (cb54-35) [ 358 0 R /XYZ 99.933071 230.762413 0 ] (cb54-36) [ 358 0 R /XYZ 99.933071 211.815391 0 ] (cb54-37) [ 358 0 R /XYZ 99.933071 192.868370 0 ] (cb54-38) [ 358 0 R /XYZ 99.933071 173.921348 0 ] (cb54-39) [ 358 0 R /XYZ 99.933071 154.974327 0 ] (cb54-4) [ 351 0 R /XYZ 99.933071 125.587950 0 ] (cb54-40) [ 358 0 R /XYZ 99.933071 136.027305 0 ] (cb54-41) [ 358 0 R /XYZ 99.933071 117.080284 0 ] (cb54-42) [ 358 0 R /XYZ 99.933071 98.133262 0 ] (cb54-43) [ 398 0 R /XYZ 99.933071 799.173057 0 ] (cb54-44) [ 398 0 R /XYZ 99.933071 780.226036 0 ] (cb54-45) [ 398 0 R /XYZ 99.933071 761.279014 0 ] (cb54-46) [ 398 0 R /XYZ 99.933071 742.331993 0 ] (cb54-47) [ 398 0 R /XYZ 99.933071 723.384971 0 ] (cb54-48) [ 398 0 R /XYZ 99.933071 704.437950 0 ] (cb54-49) [ 398 0 R /XYZ 99.933071 685.490928 0 ] (cb54-5) [ 358 0 R /XYZ 99.933071 799.173057 0 ] (cb54-50) [ 398 0 R /XYZ 99.933071 666.543907 0 ] (cb54-51) [ 398 0 R /XYZ 99.933071 647.596885 0 ] (cb54-52) [ 398 0 R /XYZ 99.933071 628.649864 0 ] (cb54-53) [ 398 0 R /XYZ 99.933071 590.755821 0 ] (cb54-54) [ 398 0 R /XYZ 99.933071 571.808799 0 ] (cb54-55) [ 398 0 R /XYZ 99.933071 552.861778 0 ] (cb54-56) [ 398 0 R /XYZ 99.933071 533.914756 0 ] (cb54-57) [ 398 0 R /XYZ 99.933071 514.967735 0 ] (cb54-58) [ 398 0 R /XYZ 99.933071 496.020714 0 ] (cb54-59) [ 398 0 R /XYZ 99.933071 477.073692 0 ] (cb54-6) [ 358 0 R /XYZ 99.933071 780.226036 0 ] (cb54-60) [ 398 0 R /XYZ 99.933071 458.126671 0 ] (cb54-61) [ 398 0 R /XYZ 99.933071 439.179649 0 ] (cb54-7) [ 358 0 R /XYZ 99.933071 761.279014 0 ] (cb54-8) [ 358 0 R /XYZ 99.933071 742.331993 0 ] (cb54-9) [ 358 0 R /XYZ 99.933071 723.384971 0 ] (cb55) [ 398 0 R /XYZ 84.259843 379.929649 0 ] (cb55-1) [ 398 0 R /XYZ 101.433071 378.232628 0 ] (cb56) [ 398 0 R /XYZ 84.259843 165.485606 0 ] (cb56-1) [ 398 0 R /XYZ 101.433071 163.788585 0 ] (cb56-10) [ 423 0 R /XYZ 99.933071 666.543907 0 ] (cb56-11) [ 423 0 R /XYZ 99.933071 647.596885 0 ] (cb56-12) [ 423 0 R /XYZ 99.933071 628.649864 0 ] (cb56-13) [ 423 0 R /XYZ 99.933071 609.702842 0 ] (cb56-14) [ 423 0 R /XYZ 99.933071 590.755821 0 ] (cb56-15) [ 423 0 R /XYZ 99.933071 571.808799 0 ] (cb56-16) [ 423 0 R /XYZ 99.933071 552.861778 0 ] (cb56-17) [ 423 0 R /XYZ 99.933071 533.914756 0 ] (cb56-18) [ 423 0 R /XYZ 99.933071 514.967735 0 ] (cb56-19) [ 423 0 R /XYZ 99.933071 496.020714 0 ] (cb56-2) [ 398 0 R /XYZ 99.933071 144.841563 0 ] (cb56-20) [ 423 0 R /XYZ 99.933071 477.073692 0 ] (cb56-21) [ 423 0 R /XYZ 99.933071 458.126671 0 ] (cb56-22) [ 423 0 R /XYZ 99.933071 439.179649 0 ] (cb56-23) [ 423 0 R /XYZ 99.933071 420.232628 0 ] (cb56-24) [ 423 0 R /XYZ 99.933071 401.285606 0 ] (cb56-25) [ 423 0 R /XYZ 99.933071 382.338585 0 ] (cb56-26) [ 423 0 R /XYZ 99.933071 363.391563 0 ] (cb56-27) [ 423 0 R /XYZ 99.933071 344.444542 0 ] (cb56-28) [ 423 0 R /XYZ 99.933071 325.497520 0 ] (cb56-29) [ 423 0 R /XYZ 99.933071 306.550499 0 ] (cb56-3) [ 398 0 R /XYZ 99.933071 125.894542 0 ] (cb56-30) [ 423 0 R /XYZ 99.933071 287.603477 0 ] (cb56-31) [ 423 0 R /XYZ 99.933071 268.656456 0 ] (cb56-32) [ 423 0 R /XYZ 99.933071 249.709434 0 ] (cb56-33) [ 423 0 R /XYZ 99.933071 230.762413 0 ] (cb56-34) [ 423 0 R /XYZ 99.933071 211.815391 0 ] (cb56-35) [ 423 0 R /XYZ 99.933071 192.868370 0 ] (cb56-36) [ 423 0 R /XYZ 99.933071 173.921348 0 ] (cb56-37) [ 423 0 R /XYZ 99.933071 154.974327 0 ] (cb56-38) [ 423 0 R /XYZ 99.933071 136.027305 0 ] (cb56-39) [ 423 0 R /XYZ 99.933071 117.080284 0 ] (cb56-4) [ 423 0 R /XYZ 99.933071 799.173057 0 ] (cb56-40) [ 423 0 R /XYZ 99.933071 98.133262 0 ] (cb56-41) [ 462 0 R /XYZ 99.933071 799.173057 0 ] (cb56-42) [ 462 0 R /XYZ 99.933071 780.226036 0 ] (cb56-43) [ 462 0 R /XYZ 99.933071 761.279014 0 ] (cb56-44) [ 462 0 R /XYZ 99.933071 742.331993 0 ] (cb56-45) [ 462 0 R /XYZ 99.933071 723.384971 0 ] (cb56-46) [ 462 0 R /XYZ 99.933071 704.437950 0 ] (cb56-47) [ 462 0 R /XYZ 99.933071 685.490928 0 ] (cb56-48) [ 462 0 R /XYZ 99.933071 666.543907 0 ] (cb56-49) [ 462 0 R /XYZ 99.933071 647.596885 0 ] (cb56-5) [ 423 0 R /XYZ 99.933071 761.279014 0 ] (cb56-50) [ 462 0 R /XYZ 99.933071 628.649864 0 ] (cb56-51) [ 462 0 R /XYZ 99.933071 609.702842 0 ] (cb56-52) [ 462 0 R /XYZ 99.933071 590.755821 0 ] (cb56-53) [ 462 0 R /XYZ 99.933071 552.861778 0 ] (cb56-54) [ 462 0 R /XYZ 99.933071 533.914756 0 ] (cb56-55) [ 462 0 R /XYZ 99.933071 514.967735 0 ] (cb56-56) [ 462 0 R /XYZ 99.933071 496.020714 0 ] (cb56-57) [ 462 0 R /XYZ 99.933071 477.073692 0 ] (cb56-58) [ 462 0 R /XYZ 99.933071 458.126671 0 ] (cb56-59) [ 462 0 R /XYZ 99.933071 439.179649 0 ] (cb56-6) [ 423 0 R /XYZ 99.933071 742.331993 0 ] (cb56-60) [ 462 0 R /XYZ 99.933071 420.232628 0 ] (cb56-61) [ 462 0 R /XYZ 99.933071 401.285606 0 ] (cb56-7) [ 423 0 R /XYZ 99.933071 723.384971 0 ] (cb56-8) [ 423 0 R /XYZ 99.933071 704.437950 0 ] (cb56-9) [ 423 0 R /XYZ 99.933071 685.490928 0 ] (cb57) [ 462 0 R /XYZ 84.259843 342.035606 0 ] (cb57-1) [ 462 0 R /XYZ 101.433071 340.338585 0 ] (cb60) [ 486 0 R /XYZ 84.259843 565.251496 0 ] (cb60-1) [ 486 0 R /XYZ 101.433071 563.554475 0 ] (cb61) [ 486 0 R /XYZ 84.259843 343.504475 0 ] (cb61-1) [ 486 0 R /XYZ 101.433071 341.807453 0 ] (cb64) [ 492 0 R /XYZ 84.259843 241.820079 0 ] (cb64-1) [ 492 0 R /XYZ 101.433071 240.123057 0 ] (cb67) [ 497 0 R /XYZ 84.259843 178.070079 0 ] (cb67-1) [ 497 0 R /XYZ 101.433071 176.373057 0 ] (cb7) [ 321 0 R /XYZ 84.259843 565.820079 0 ] (cb7-1) [ 321 0 R /XYZ 101.433071 564.123057 0 ] (cb70) [ 504 0 R /XYZ 84.259843 799.370079 0 ] (cb70-1) [ 504 0 R /XYZ 101.433071 797.673057 0 ] (cb73) [ 509 0 R /XYZ 84.259843 670.370079 0 ] (cb73-1) [ 509 0 R /XYZ 101.433071 668.673057 0 ] (cb76) [ 514 0 R /XYZ 84.259843 560.570079 0 ] (cb76-1) [ 514 0 R /XYZ 101.433071 558.873057 0 ] (cb79) [ 519 0 R /XYZ 84.259843 481.820079 0 ] (cb79-1) [ 519 0 R /XYZ 101.433071 480.123057 0 ] (cb82) [ 524 0 R /XYZ 84.259843 406.820079 0 ] (cb82-1) [ 524 0 R /XYZ 101.433071 405.123057 0 ] (cb85) [ 529 0 R /XYZ 84.259843 316.820079 0 ] (cb85-1) [ 529 0 R /XYZ 101.433071 315.123057 0 ] (cb86) [ 529 0 R /XYZ 84.259843 110.073057 0 ] (cb86-1) [ 529 0 R /XYZ 101.433071 108.376036 0 ] (cb89) [ 537 0 R /XYZ 84.259843 772.370079 0 ] (cb89-1) [ 537 0 R /XYZ 101.433071 770.673057 0 ] (cb90) [ 537 0 R /XYZ 84.259843 535.623057 0 ] (cb90-1) [ 537 0 R /XYZ 101.433071 533.926036 0 ] (cb91) [ 537 0 R /XYZ 84.259843 298.876036 0 ] (cb91-1) [ 537 0 R /XYZ 101.433071 297.179014 0 ] (cb94) [ 544 0 R /XYZ 84.259843 200.570079 0 ] (cb94-1) [ 544 0 R /XYZ 101.433071 198.873057 0 ] (cb97) [ 551 0 R /XYZ 84.259843 799.370079 0 ] (cb97-1) [ 551 0 R /XYZ 101.433071 797.673057 0 ] (cis-v1.6-kubernetes-benchmark---rancher-v2.6-rke2-with-kubernetes-v1.21-up-to-v1.23) [ 306 0 R /XYZ 84.259843 784.970079 0 ] (client-certificate-authentication-should-not-be-used-for-users-manual) [ 696 0 R /XYZ 84.259843 684.651496 0 ] (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) [ 855 0 R /XYZ 84.259843 684.651496 0 ] (consider-external-secret-storage-manual) [ 853 0 R /XYZ 84.259843 568.851496 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (controller-manager) [ 653 0 R /XYZ 41.740157 784.430079 0 ] (controls) [ 313 0 R /XYZ 84.259843 570.381496 0 ] (create-administrative-boundaries-between-resources-using-namespaces-manual) [ 859 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-minimal-audit-policy-is-created-automated) [ 698 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual) [ 691 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-all-namespaces-have-network-policies-defined-automated) [ 828 0 R /XYZ 84.259843 318.510432 0 ] (ensure-that-default-service-accounts-are-not-actively-used.-automated) [ 775 0 R /XYZ 84.259843 206.451496 0 ] (ensure-that-encryption-providers-are-appropriately-configured-automated) [ 643 0 R /XYZ 84.259843 220.970079 0 ] (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) [ 802 0 R /XYZ 84.259843 449.446885 0 ] (ensure-that-the---anonymous-auth-argument-is-set-to-false-manual) [ 486 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) [ 586 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) [ 591 0 R /XYZ 84.259843 389.720079 0 ] (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) [ 596 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---audit-log-path-argument-is-set-automated) [ 581 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the---authorization-mode-argument-includes-node-automated) [ 519 0 R /XYZ 84.259843 652.220079 0 ] (ensure-that-the---authorization-mode-argument-includes-rbac-automated) [ 524 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) [ 514 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) [ 724 0 R /XYZ 84.259843 520.970079 0 ] (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) [ 681 0 R /XYZ 84.259843 408.051496 0 ] (ensure-that-the---basic-auth-file-argument-is-not-set-automated) [ 486 0 R /XYZ 84.259843 528.904475 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) [ 668 0 R /XYZ 84.259843 133.670079 0 ] (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) [ 675 0 R /XYZ 84.259843 313.654475 0 ] (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) [ 681 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) [ 628 0 R /XYZ 84.259843 464.720079 0 ] (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) [ 728 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) [ 681 0 R /XYZ 84.259843 538.851496 0 ] (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) [ 638 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) [ 633 0 R /XYZ 84.259843 370.970079 0 ] (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) [ 618 0 R /XYZ 84.259843 670.970079 0 ] (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual) [ 751 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---hostname-override-argument-is-not-set-manual) [ 748 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) [ 561 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---insecure-port-argument-is-set-to-0-automated) [ 566 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) [ 708 0 R /XYZ 84.259843 603.629014 0 ] (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 704 0 R /XYZ 84.259843 214.987950 0 ] (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) [ 507 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) [ 502 0 R /XYZ 84.259843 277.220079 0 ] (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) [ 497 0 R /XYZ 84.259843 333.470079 0 ] (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) [ 744 0 R /XYZ 84.259843 544.220079 0 ] (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) [ 686 0 R /XYZ 84.259843 416.870079 0 ] (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) [ 686 0 R /XYZ 84.259843 708.470079 0 ] (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) [ 686 0 R /XYZ 84.259843 547.670079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated) [ 576 0 R /XYZ 84.259843 614.720079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-1) [ 656 0 R /XYZ 84.259843 633.470079 0 ] (ensure-that-the---profiling-argument-is-set-to-false-automated-2) [ 675 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) [ 740 0 R /XYZ 84.259843 389.720079 0 ] (ensure-that-the---read-only-port-argument-is-set-to-0-automated) [ 732 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) [ 601 0 R /XYZ 84.259843 239.720079 0 ] (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) [ 665 0 R /XYZ 84.259843 389.720079 0 ] (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-manual) [ 759 0 R /XYZ 84.259843 389.720079 0 ] (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) [ 571 0 R /XYZ 84.259843 689.720079 0 ] (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) [ 613 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) [ 606 0 R /XYZ 84.259843 164.720079 0 ] (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) [ 662 0 R /XYZ 84.259843 483.470079 0 ] (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) [ 736 0 R /XYZ 84.259843 614.720079 0 ] (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) [ 653 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) [ 623 0 R /XYZ 84.259843 577.220079 0 ] (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) [ 755 0 R /XYZ 84.259843 614.720079 0 ] (ensure-that-the---token-auth-file-parameter-is-not-set-automated) [ 492 0 R /XYZ 84.259843 427.220079 0 ] (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) [ 659 0 R /XYZ 84.259843 558.470079 0 ] (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) [ 338 0 R /XYZ 84.259843 157.876036 0 ] (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 338 0 R /XYZ 84.259843 471.123057 0 ] (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) [ 529 0 R /XYZ 84.259843 280.473057 0 ] (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) [ 535 0 R /XYZ 84.259843 202.220079 0 ] (ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual) [ 529 0 R /XYZ 84.259843 502.220079 0 ] (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) [ 544 0 R /XYZ 84.259843 370.970079 0 ] (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) [ 554 0 R /XYZ 84.259843 183.470079 0 ] (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) [ 549 0 R /XYZ 84.259843 295.970079 0 ] (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) [ 537 0 R /XYZ 84.259843 736.023057 0 ] (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) [ 537 0 R /XYZ 84.259843 499.276036 0 ] (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) [ 720 0 R /XYZ 84.259843 720.651496 0 ] (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual) [ 645 0 R /XYZ 84.259843 547.576036 0 ] (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 317 0 R /XYZ 84.259843 352.457453 0 ] (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 317 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-audit-policy-covers-key-security-concerns-manual) [ 698 0 R /XYZ 84.259843 418.457453 0 ] (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 708 0 R /XYZ 84.259843 252.487950 0 ] (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) [ 713 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) [ 775 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-cni-in-use-supports-network-policies-automated) [ 828 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) [ 333 0 R /XYZ 84.259843 586.473057 0 ] (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 333 0 R /XYZ 84.259843 763.220079 0 ] (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 321 0 R /XYZ 84.259843 351.131993 0 ] (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 321 0 R /XYZ 84.259843 736.220079 0 ] (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) [ 346 0 R /XYZ 84.259843 290.381993 0 ] (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 346 0 R /XYZ 84.259843 622.576036 0 ] (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) [ 338 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) [ 333 0 R /XYZ 84.259843 409.726036 0 ] (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 329 0 R /XYZ 84.259843 385.079014 0 ] (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 329 0 R /XYZ 84.259843 736.220079 0 ] (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) [ 713 0 R /XYZ 84.259843 463.229014 0 ] (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) [ 717 0 R /XYZ 84.259843 799.370079 0 ] (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual) [ 769 0 R /XYZ 84.259843 745.970079 0 ] (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) [ 701 0 R /XYZ 84.259843 394.260432 0 ] (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 701 0 R /XYZ 84.259843 684.651496 0 ] (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual) [ 351 0 R /XYZ 84.259843 362.223057 0 ] (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) [ 351 0 R /XYZ 84.259843 675.470079 0 ] (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual) [ 398 0 R /XYZ 84.259843 324.635606 0 ] (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-manual) [ 704 0 R /XYZ 84.259843 584.879014 0 ] (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) [ 668 0 R /XYZ 84.259843 294.470079 0 ] (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) [ 325 0 R /XYZ 84.259843 351.329014 0 ] (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 325 0 R /XYZ 84.259843 702.470079 0 ] (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) [ 342 0 R /XYZ 84.259843 221.381993 0 ] (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) [ 342 0 R /XYZ 84.259843 538.576036 0 ] (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) [ 859 0 R /XYZ 84.259843 604.851496 0 ] (etcd-node-configuration-files) [ 681 0 R /XYZ 41.740157 784.430079 0 ] (extensible-admission-control) [ 855 0 R /XYZ 41.740157 784.430079 0 ] (general-policies) [ 859 0 R /XYZ 41.740157 784.430079 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 392.718898 0 ] (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual) [ 701 0 R /XYZ 84.259843 263.460432 0 ] (kubelet) [ 720 0 R /XYZ 41.740157 784.430079 0 ] (logging) [ 698 0 R /XYZ 41.740157 784.430079 0 ] (master-node-configuration-files) [ 317 0 R /XYZ 41.740157 784.430079 0 ] (minimize-access-to-create-pods-manual) [ 775 0 R /XYZ 84.259843 307.251496 0 ] (minimize-access-to-secrets-manual) [ 775 0 R /XYZ 84.259843 523.851496 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) [ 817 0 R /XYZ 84.259843 763.220079 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) [ 817 0 R /XYZ 84.259843 412.079014 0 ] (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) [ 813 0 R /XYZ 84.259843 388.457453 0 ] (minimize-the-admission-of-containers-with-added-capabilities-manual) [ 825 0 R /XYZ 84.259843 431.026036 0 ] (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) [ 821 0 R /XYZ 84.259843 799.370079 0 ] (minimize-the-admission-of-containers-with-capabilities-assigned-manual) [ 825 0 R /XYZ 84.259843 315.226036 0 ] (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) [ 825 0 R /XYZ 84.259843 763.220079 0 ] (minimize-the-admission-of-privileged-containers-automated) [ 813 0 R /XYZ 84.259843 720.651496 0 ] (minimize-the-admission-of-root-containers-automated) [ 821 0 R /XYZ 84.259843 429.281993 0 ] (minimize-wildcard-use-in-roles-and-clusterroles-manual) [ 775 0 R /XYZ 84.259843 423.051496 0 ] (network-policies-and-cni) [ 828 0 R /XYZ 41.740157 784.430079 0 ] (overview) [ 306 0 R /XYZ 84.259843 704.822079 0 ] (pod-security-policies) [ 813 0 R /XYZ 41.740157 784.430079 0 ] (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) [ 853 0 R /XYZ 84.259843 684.651496 0 ] (rbac-and-service-accounts) [ 775 0 R /XYZ 41.740157 784.430079 0 ] (scheduler) [ 675 0 R /XYZ 41.740157 784.430079 0 ] (secrets-management) [ 853 0 R /XYZ 41.740157 784.430079 0 ] (testing-controls-methodology) [ 306 0 R /XYZ 84.259843 169.826079 0 ] (the-default-namespace-should-not-be-used-manual) [ 859 0 R /XYZ 84.259843 193.251496 0 ] (the-v1.5.1-guide-skips-5.6-and-goes-from-5.5-to-5.7.-we-are-including-it-here-merely-for-explanation.) [ 857 0 R /XYZ 41.740157 784.430079 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual) [ 763 0 R /XYZ 84.259843 187.970079 0 ] (worker-node-configuration-files) [ 701 0 R /XYZ 41.740157 784.430079 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 1024 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2633 ->> -stream -xœ½š]‹\¹†ïûWôõ‚µ%Ué Ã6!†…, „r±ì]Â8àÍEþ~Þ:Ýúèé×k‡xèñ9U:R©ôT•zâYðó"âW³ZëµØùñÝéýIBÍ‚G‹››Cý>5Ÿ£X 9öÒòù ´†Úsªåüt¯g·{ó§Ó_¾9ýëö™xN¡÷’b>ÿöÆU¦¡¶Z%U‡J¢UΡ֔ Q•ðŠ½3ÌÈÕ’Ý«*Ì°Þ2SÁ K©Uƒj5꽪ÌT£1̈=W¢Š;b¡:"fšˆ.æP0é…éR ¥õÔ©®Bkb:ÕPªÅ™®‡RJnLg°%w‰L—aKŽfÂt°Å´U¦+°E‹ -ÕÁ–Ôª2]…- ³Ó‰®ÁxW£:Ø"E"Óu ¹73ªëÐI«í^—$‡ÜT…éb ¾©T‡…E*•èl)’;ÕÁ–¬’˜Na‹á‡éÀ‰¬µ5²[“ïnL—aKJÕ¨¶`ñR-R CvPp.1¤Zƒõd ©i°fQ µ¬VeH=+½2¨DèRd P-Ù -#FØbعT[´c&Ø‚Œª°%™2(hkðÆnMzd,PðÖ$Æpa¦0(ˆ«­c¹p¥ÎX `®‚Œ -èb»WÆu5—ÄX À®Z+Œ -îªEa,0pWORl3€ŽAcSÆw5Je,0pÛ(1`Uü°0ÀWBjM ÜMMŒ±ÀÀÝT¨®ìAe,0p7e¼‹ÜànÊ’ ÜM– -c%€?B³pÉ<€-,câ=tI ÐYHHK 2¸;ÂÙÓ Uˆ­Æ‚ îƆ壺bÅŒ“}‹Y±”ÎXÁ]*e,Èà.ðÙ Àø€ˆš 2¸‘šéÀݘº0dpyCf,€;„ˆ€±ñ-DëR]Ò[c,Èà.°” …ƒ4„êj€#EÆÀ8òPÆ‚î"¼wÆ‚îJVe,(à®Òªƒ-Úcòè°mÉžF²$LîJÄ -3¸+R;cAw=l2”ê‚Ô ``@œ J³Ðk-Œ¥ tHù¨®ÜgÆ‚*d ‹ê`‹Uc,@bºöÆXPlÑ” j‚-H „‘}Óò¶À]h}`°™"cHZ7c,¨¹ ì2]I¡Uàšêt±2Ôj¡82 – - ›ž±€ž.1À è¢1Ô[°U ŠBKÈÌ™.Â$ÙŒÈt¡‹‘± %Ø‚l± ¥†*³c"4jIL5Ó™xÙ š•à©"c¶ *M’ê` 0ÁX€õñb;3 øA±‰2‡ê`‹fc,h-y¹Ù Zƒ-Ic|ÓëÍÊXж ãc,èR‚§ÉŒÀ8t"Œ=6Ô›É °/½ÞlŒ]õ&J<²o»¯7+cA7Ø’‘¢PlAÒÔɾ“Po‚NLW`KêÆXÐKñz³1 Í@½‰Œž 4¯7+=.ws™˜ÜEfZ pƒz™-«íàÍùW6¯8=1 7#¶Ò#{­*=3À×k$zh3QY¶BO V¡ŒB üE>fwL¸œ>íGTîP3[õ—ì؆ì~Ö«™~ Ùå|ì·_NßþŒà{þåߧ·ß'eã'ÂùÕŠÖÅÏyàDMÎïv¹‚˜ÐÚù rý”|ëçz¢ÆÊÈÇ£ ezÆvé©G7š †òæ¾Óð¯žï/î^ü~>^=œì"}á«…º#\7!µÏç ™êùáÝéÛ~|õý«¿bÅÞžþöWøpÉ7ø4ã(ùq ˜§G\–Ë}vª>XÔÅ—6hkx&CfhgÿÀ5TX1É®{óòïç‡×0 -™Îf”ÛåÒ¯éýÚ[|úËl‡îeŠø?yßåò9ƾ^ã^mÁô^ìû×ÞÞ.zè]Ž¾>fWyn—æËØÇ{mïzŒ—·ùÉc~.ýÿð€eºx(|\Px†€€Ý6‡÷Í¿úŒ&nkík{Däëq/ß×Ñ}WÇ玂q9.€xð£iÄ6DäƒNsw“×øÓÿüÓÿÃMƲ°å¿Èÿ7Ë~í?ÕR¾?•#3‰GuŠ*Õš_]A}múÙ³!¤JÇÒÅc²ãùO‡þïg«ë÷âGž^¾$Øn®íß‹À!“ðù÷ìërf'‡‰I~.ÞŠŸ5Ý‹òô™b^/eö…:=“=ž"¼¸?o‰B\®—}v®y\‚ e=ŸÇcK‘.¦qçûà20âÉïÅþöâUìçÞ-èõ®LSPô)\ÚÞvu¸ü¤8ªlÂ|/”m¸%N6ì‰^'Í©+K8Mߧ.nË?Ú¦º-çÇ„' «Ï¥OTê§m£«1»ÈF†L7£ú”æÑr.ˆÍu"¢Ç¾Ñµa1§~[5¯Y.Â6Éf»>ÚÑ㉶»ö–çJÕÙª­Gû˜ùeÊrumsâ‰ì˜£«´úyÛ—·ââ+0Ö äò›t'|h¿±‡ýÅÛë«×ýjr;À¥íSú´K狹tKõ¸-··3æèÙoÆæ]34ûÒmïéLrÖÖX©…ÝÜì>ºIÛzìÚ ïƒÚÝ :ÅÄd2d³Ç:l*×ÇÆ´oÜè,Õ™S,é¯ûLç}Uæ$æ}UÊ][ïwD¼™-éL€òîÎu½¬–3—lDVö§§ÔVK²û±ívìmÏÛkØ2¤¬ÌTÖcù®åñïKö=˜b­ÆÏq:Û:ôC >bôø;.i¥€!æ_ÅUkÛqÉï~æãç'÷§$ãüd ËLUjô¿Èã&> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3679 ->> -stream -xœí\[ܶ~Ÿ_1Ï¢ðvxŠ 61  AчõÔNPìpúпߒHJœ3»ã]7vÇÆÚÒ§#òð;7’’Vþ~©ñOtzŠ1‡Ãûƒš)ü™%º“ùòøá ¹‰L JGô¤B NZÙÉ:ï(pü¾ÇUûvþӇߺ›4#EƒCÒ“ŽZ+s$?ùd’¶Çßß>B:0i5ùü'÷¿ÿrøêºù÷áÝóÐ}0SRDÚ SÚ“›‡ A¢ÏÃõ·¦áh¾¶Ãñu¸í&['ü¦†£1¦w¸íµ 5Ñ­Ÿ÷~²­m†ÇÖJ뇫4ׯ¡§n< Ïä8b‹ÃBUºõØ¡ž·m†w¸j­´Sc¾{½¹±;;„Þž¶8wh¢Ìíì`ÎØáiÒ¦Ú¡ôCì ÏØA÷vÐn‹s—n=vhg}ÆšÛA™j‡ÒccjÌ÷ !šlþsÜ\Ñ6š‡3¡{>9Î-q Ñ[ˆÞBt¢×VQ¢\“~ô~0¢[ˆÞBô¢/¢ãP|úD÷\èÞBô¢·}¶‰n ãmxŠÉŒ«(Çw!#›M³›Þ‡hÃyp% PÓ(f¸54¥AˆZ¸om¥öhM*ÒL?†v®Áð.D΂‹õØ¡ÄÛ6C‚;\µVZˆ6¦Æ|÷.ÍÝÙ!ôv(ÓðÎeÒä÷!ÚÛÁœ±ƒáv»µ€ÚÛ¡á]ˆ2œ¹4ë±C;;è3v`QGÏC´15æûB”æáLèžÅΛ™%n!z Ñ[ˆîBôʵh¢\ó~ô~0¢[ˆÞBô¢/¢ãP|úD÷\èÞBô¢·}¶‰®óã*Úð>I«(Ç·!j]`³ivSûe8.—›H¬ã>D#•í•>D#Ûi=‚xÚ»FC{×hx¢ çÁÙVC‰·m†s¼ž÷ؘóÝëÍÝÙÁ÷v(ÓðÎeÒdv!º±ƒ9c†#ìC4©‘Ú§á}ˆ&¶µÖ\ºõØ¡ô;hn³ QÆÔ˜ï Ñ6š‡3¡{>;of–¸…è-Do!º Ñk×¢*#Èx3¹(y^&N.F¬ ÜäBRJâ0ªÉ!ÄÄaôQdt¦ü2€$N$pHðtØÌGCÒÐÙXga‡ ~¦Ià tÆ°’À!Á‘m‚' -Âw&x˜õ‡äò‹,A+CB[¢8$2“¥ˆð‘d ³KVIzèì”r‡ùå´$ƒÏ©Ž´Äa„ÎÚ'q˜S¦2) -9’›L²Áz¥&ÂL’ñ“ ¤“À¡×f2ž’8ôHx†0õ8ô:»`“À¡·ÐÙFmá](1zCï ³NˆTI:kÓ 2•VAðgï1£Iù IÆO:r‡¨Ó:X%Cœ´wJKFTHôD‡y“Ý‘“jŠOÐÙ¢t Ì•´¤ÀaPÐYŸê VÑI5Î>©”´TSê Š)I5CFy©¦ÔA´•jJ@T$pPå(”d ³C&“8D„§Z-qˆ:¨ )©¦ÔA¥)D!'ÔA¥^ß|Èñù‚Í#Ë^2mº¾ùˆÅÞ%Ó~HóÈÿ—L{w}ó)‡ñ‚ÍGsÑ´}óæ݂~™'ì7XPc­‹vnüÛ¾ùú›Ÿ[ãÆ+,HðƒjD(¡.¶cZc™¥2­ç ¸œö ‰É87lNJYü¯P-)­#ɵ1-˜y :Z;¦¥óù¸(³Þo¨)瀹78Æ%Ì­æûÜÛEN«åKë5&_ú¨úP¯O¾'ëdârm–»Ã}§UŸ7OÑ[$¯«d™¯ŽZŽçþs[v=‹±v|RK¼ãþúÂ62ü<œ»w—tïkXõPÝt¶Å.žñ±òiõÚÏŠÏ|2]° -˜ùvwëØ‹Ãj‡Un¾¯È¾ÛpnV½1Esy—`ÝÌÆâÉÖ|çÃLïcJDx¦Pl™kU°ÃÊàpÍÚ%æëž9MÚ8¥mäÙŒe™Ù‰OÚÞ½]‡¤¬×ß1-ëO­ò~ÕƒÝ[­TÜ踊D'zæ6;kX~Ô:Æ:fÕÎkŸ%°|sÎÙО95yõfá™b ’šVG›9=‰zÇü¢d§÷Ö'è3ñ ³$¶š´hÕáÍzïšpŠ¯\礶|–$3ÿdøç{>{V»$ÛÓ?=Lkrbþ^ “[Ý'ˆ|ú-ŸËkaþ$r@~’beŸ ÿ'>ó¤!qš·zN%?ù¸9"¯Íµlïø<öžÇÌ&¢Y·y¹µõg1ÈoŽèOpàSÚÎ]¶þ>ø(õ?è-—7¶™Kó¹»gÊåeáç™>™8ÞÖg‘Ó°åôÇQÑ¥¹ß›OÌöϳ­³"¿fËï3Ù-¿¡#ÛíôLk°íΗ[¹cü– ‹ÂáÌñïuÃÉœXE´¶çK„šÃŽÛP“-›»ÎõÍ-<È~Ÿ®^˜—åÿígâ ¥'»åô)õøJ;z{i>åžo¯m”‹]`9È1ìÔÚ/þ[ìIe_æ%ëíÝâ¿Å‡—¾E.ã–ËÿE½]A”§ h~L}$w‡§È??Y>üö‘<Öìü?¿Þª™H'HŸyv¼öžŸäkáÁk~dÝowy÷:X>«íû?êùÅSŸI¬î0‡~Zpã˜KÅv<·S¡l9¬{â³9C3áuÏЮºTþ µNrlV¸'‰ã¾f7b@»Ðd]:„곜/Õ@>'Ý*]ëPFÃC*êå$U“GëêuÎ)¬ðSs%UQÝ5˜ª+ßwpÓ“j¨æ÷±WÐkæîTÛm°¯¹óžÃ¡Z\{WÑê€g>_ÀÓ\ØÜήK' 6ªV»Ö›bH - niô~†K´Öì¤Sª‡-ÈF÷tøõ0—9cɤü]«_†çS/}üd^áç_wü¡¼à·Ôq£j¶05·v0¯dÆØb‹°1©‚5lhKû Ö±ÉRñ†ZÇaùÚµÛUKìER× ªëURãÁ¦º®Ñ–1CxÚ°X'2j›V°—S[‡nò[—U+œðáà4¶k¶•ä#kgY´•t\u†ÝˆÞ(NY‡©iÖ©™’wR©Ïú;n -›ûb'l‘Om»æZ™åMlqšÝìt×°Ó¼ÓÔé3Púêðú`»¯*û­©½¢÷­ËhMxcÔΧ¾?­5ÇóI ÞÆPm˲سu’ÓB£M-\wÂ}”¡±Ý¶ -ïԬ봊š.ò§@«-†¢“_o+´Ì#ŽC–BS4ôWÎ4q«T‰[Åïds»¥âÕÙ’­ âîÚèT“¬sÉ8À<¿»¢®IÚ‚íûv}ߥÚÙ0\SÄ·™©j·ÑNòªüwMì ß»IuÛ#:Öm åó—·Á{Lyº½GY¾Àr‘í—<ùye¿MR6PxO0íV ;£Âý!,5L¾ÀšZ¿q?s[RÃ!=€³ßŒßË·“]?ýŸw‰êiÈKEJÑÙ<éE'Ô™×ôi·öã½w -endstream -endobj -8 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 7 0 R -/Resources 4 0 R -/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R 25 0 R 26 0 R 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-rke2-with-kubernetes-v1.21-up-to-v1.23) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.750423 648.111024 496.429134 633.111024 ] -/BS << -/W 0 ->> -/Dest (cis-v1.6-kubernetes-benchmark---rancher-v2.6-rke2-with-kubernetes-v1.21-up-to-v1.23) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.690364 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (controls) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.521907 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (master-node-configuration-files) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.961024 498.679134 507.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 510.561024 491.179134 495.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 491.361024 498.679134 467.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 470.961024 491.179134 455.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.761024 498.679134 428.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 431.361024 491.179134 416.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 412.161024 498.679134 388.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 391.761024 491.179134 376.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.561024 498.679134 349.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 352.161024 491.179134 337.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -25 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 332.961024 498.679134 309.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -26 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 312.561024 491.179134 297.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 293.361024 498.679134 269.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 272.961024 491.179134 257.961024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -29 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.761024 498.679134 230.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -30 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 233.361024 491.179134 218.361024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-rootroot-automated) ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 214.161024 498.679134 190.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 193.761024 491.179134 178.761024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.561024 498.679134 151.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 154.161024 491.179134 139.161024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-container-network-interface-file-ownership-is-set-to-rootroot-manual) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.961024 498.679134 111.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 114.561024 491.179134 99.561024 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated) ->> -endobj -37 0 obj -<< -/Filter /FlateDecode -/Length 3697 ->> -stream -xœí\YÇ ~Ÿ_1Ï\.’Å:A@$±ˆ~0ò %ÁÊ€œ‡üýÝ]GÏtsö VÂîv³¿f±ø‘¬ª¾àèåÿ· ¿r—sI1OÞ%öòoB¬v¦Ã?ÊÏø 9=›ò‘;_°?Œò˜]œÅw"ÎWă–»ÃOß~ßVGt¥ÄÀþøÇ»’‚‹™³ÉÞÅ” ‰hA -º(b"ær -à÷!àÅ^ödb@ „¾X±˜"˜“±xŸ-ŒØŒP|20$6CÈ&&ˆÍ>%-ŒØì}41ŒŽ ±g “çLL ŽS! Lò‚AôFì@ŠŽ#ƒ‰Éb3gïè,6³/&¦ˆÍ²7B ½ØL1y#~ЋÍX¢‰±1#~P²”ÉÄ Øì3#ÆÄfPŒøAŠ.”àML@r”c&»J61ƒ©ñƒÑ»9#~0ŠÍœÙÄ$±™!#~0‰Í!‰Éb3%,FüHª ÆC±â§ˆÍBˆ…!/6—bÄy±ÙË@ba@lö²?Rå•mLt”g#ƈP0>d#~ˆ²£$¿-LŽbÄlÄT'G\Àƈ͌>1FQl¡d#~H†@¢”MŒŒD>e#~Ä7Ž$ÉlŒØ ‘³c$àDOÈVüÈ8(1D&È8ˆ…1ñ#©ÃœÁÆDÁ€OFü1QIFü%Ÿ³‰‘q¹¤dÄOq£›s2â'È8( 6Fl& dÄXqPj4&#~‚Œƒ lŒØ Þ'#~‚Œƒè±Ø˜ì pNFŒÉ8àd¼LɈ™¦ -¢‰N:ÅɈ–qP´#6GOш1–qP†JŒFü°Œƒ2#6Sñш–qŠ›e0ŒFü°Œƒ²›¢?,ã ÌG£›½T<#~dž%Óü.0Ë”c™ æIÀe Ke2øie²V;¢y=/fþøõðÝpþøë¿ï¿™–5QL*ž%Ž,£blKÍê.—E‹¨­Í -¤ÉcLUÏJ>÷¬Ÿ$•£72œ4ÈE™ä"\È%Ì;ºÈDé\:4|:Œrb)³M÷ O]Kk1R©è±S]zZ9¡ËÕ9²F¸ƒÌ$ºµ¸’ò¨7<ȇÞ-žÚö÷iÍCÜá!®yˆ|._…Lv%œKÏxÀyv>4–£"—§èsŠ>§è“&º«;DÓ-ô!ÝWÓK9ÍÄaż#mÜZëgÁ‘œ_2Ÿ¯®…)‚³‰‰Ž(fF“ÑçŒ`a²^ÀMÓå=LÑ Ê˜¸ìc’÷.`H˜-Lt!Ä8ÝlØúsŒ&&K’úHÑÀè À8ݬÚÃè  -<]€ÛÅDÇ9\¤€ŽSf0¸H!ëM¸-  œÀ_)êMÊÐà+ŨÃe‹/©½„‡…É.'´¸ÈÁ%B,EopŒ&&º”"’ÁW–:JFoð•½$"zH_‚Ë!\ˆ—c0¸È(5(GŸ- i-Ξ ¾²”ÌBÞƒÁWÁ†’ ¾2K­KTØà+st¥pAƒ‹õ@ÊÅâ"ç©ähaôƒ™,¾²Tdq€·øÊIg)Y|r€)‹ Ü!”2:H³…pP(ƒ¯"›,½70H)q6ø’¡Bo~H 20:¸f`4¸(y -§%$GÈóÅâ= “£|Ix9’AÃ|•ÈŽdL_” @,.’LûˆÉ[\drRå1™˜¢7°1X|Öê_ iìi¾K¹JŽ¥Î³Á†Ì†È±Ì©Ñ C@Åq.¾˜ dõvÂ9iwúìd¸ ‘.q!Âp>1á¼ ß½ðqãП_ÊüÌT‘é¥ÞZF¯£³—bã‹zâõ‡ÃwúþÕ÷?ý ]yýþðó qxŸ·/ÿy|ýêð—×¢ü¡ê£Ì;?zhdèÿtêe®¨?=^½>)€ŸP}"“Z–z¼ú ‘oQûTõ)›ÔªúðxõL`RûTõ2w³¨Uõñ~ê!.:Æ© tq‰º°&/“(màÕ_øÛ?~-ò ؉¥êù ê£Xª>=¡â{´3Kõ¿Yéß{\§'1}C:Yü£L3w+&œýÕÇe€Ù{Kûúd#³.çc,KìðV~¼½’-ý;Ét©¹`ôo=Gÿ6Ù©ëW¼gœe|Zôëþ›Ù¦°Ø£¶Mmêù´è;ÍòéœØí¨6ªž-ûà—sÙìóm¿êºÝ±êK/v`X|Uí÷Có⇓©W#¯ônroÄQ˜mšì<ͺ´‰\|] ôæl¿ôÓÀƒï~Ÿ|~êçW.&;Fû n hNÍ?û%.õOÝÙôe<÷emŸkŒñlk¹ÉîÒm¼§2W×9M_§7αé|\~–[Ë,¿ÉšõÌo·ácz@ø:ù6|Lþ‰]6q“»ß™_JÒ¿øJ<Œçþ2‰'³=‡×‰._+Ñ_U6ž;óF$éâþ:IonT¿×@ÔýÉïﻟÁ}¥ª¾ùª2Ötjºpê½3»ËçÏØ ·Ò®ÃÛÿå`¸YV›ŽÄsG^Ïþ›Éå>sžÓmˆÄw/!¾XÊ-~…î·ÌŠ§éù9=l Ò }QnÓ¹o?/·úÀü•ùÓt-ë+á6çL¹MÌ”°»Âª1s£ [âìq±UÿÚ,ö´øääo’¿3O¦ã¹¿ ŸÒ¡ÝeU%ôFÁV¦=~:0L}ëµi`;Oôú×—JàñÜaXg]zq&¼ÄòbŽ$U^MÇ—uúcØ[îÁÖû¼‰Å2}@)ËìôÊ›K…1Å陦Ãï÷hçR!—¦§–t -Ž¡ÄùÁ¨§––Öõy50•¹ÞòÐEA"Þ\ /K¥6ÔòQ-}Öô£ó·†???ðá ßRô;>àxÞ±~nè\|'Ô—úÖûJôÙšû‰U¸lú¦+@6Ùé¤okœ!IŸ¼›7KS®„Λúì_?Ÿëi4ç5Ö=M„¹á ¡œáR¬½×—{f1O_ˆ¢e/6Sô‰ã&ì -Èí -û‰WŲ²„|)ôCs],yY*ÛfiœvÓG×Á@Åbè´„§ƒ4KçÒ»M)B“aõ®~¯§Ú7Uš”+²O"}SæBø­¯ªƒÙŽ¬¡Ë‹0×@ - W*nCt:lâmܘJ •û©¥z¾›ÒCrsü†lòÑ"•2q7삧º¹Ge ríó7x!<´î\ˆïœ6ÐÜk…çz£½Mœ}—.M¹º*B“éãwú{.ܤZy¦ }Öª‚q¯7¢¹ÙÄk'òتNØò„Ô±ƒ» ¥³£¿d±µ×¢ÛÐÍc+éà²AžJ5O‹T+k1´¨kb-aÕ?­VŽB_溘[(ß­ÄÝNn©*Á^‹0„;7½][í¼Å©1®Ü«èã@b¾ -OÓÀÎÅú¹6ÒÅèÛhׄÝ0) -]ÜËèÝ$®ÙÚªè;ËfO²­÷tøí0 sHŒEß´Õo.­_ãƒãóJ~þuÇ¿×GËçq\¿Ç·´­¶®ÄãH†H•Â«bÄÒ„-m!†¡ìw1äŽå mGêuè§û^Ø+Z…vtr÷á ƺ4x† áéÌ‹m"óTnú€=ïRíœ4Cú©¢j•ìŒÝ‘ÝÜQ’ƒJÙShÒA?b8œ(;£RÙ,ݲ•™c#Íõj© mkئºKýXèÃ쨺ʦ^ ÃÉVŠŒ–•=F?:½žÌûbr¬ ÒVÚ›ôn”¶Ž©´¼m)M»q½ÛÆ:êNMÞ‹†Ü£6Éé©Ñ§aµ3Æè Íý´Àc£¡ÊVÖ¢• }§ºÊšÆTmŠËiÕ-Só¦—R›Stéo£§yd¥9‘GVâVõ͖֯¨M€x çÔ{ç;²Í%ó†,Žg7ièHª²Ë¶Ãºí:Ú‡n„nHì3SßOã ä£êßcrgóÁó-ÔêòävYÃëÇR!Ò±èt'Ç(5D:"«æ‡ë%>Ǿ€ry™¤^@[}k\¿¡ o;&ÜÉrýÀ jyë~ç4}y£KsÀî[mÛ¯ £åcÓU¢¶›t©È%ëÛå>K’H~çÎq¼¸öãíP -endstream -endobj -38 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 37 0 R -/Resources 4 0 R -/Annots [ 39 0 R 40 0 R 41 0 R 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R 48 0 R 49 0 R 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R 55 0 R 56 0 R 57 0 R 58 0 R 59 0 R 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R 71 0 R 72 0 R 73 0 R 74 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -39 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -40 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-etcd-data-directory-ownership-is-set-to-etcdetcd-automated) ->> -endobj -41 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -44 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admin.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -45 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -48 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-scheduler.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -49 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -52 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-controller-manager.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -53 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-rootroot-automated) ->> -endobj -55 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -56 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual) ->> -endobj -58 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual) ->> -endobj -59 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.910335 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (api-server) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-manual) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 338.270079 491.179134 323.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---anonymous-auth-argument-is-set-to-false-manual) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---basic-auth-file-argument-is-not-set-automated) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -66 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 259.070079 491.179134 244.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---token-auth-file-parameter-is-not-set-automated) ->> -endobj -67 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 219.470079 491.179134 204.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-https-argument-is-set-to-true-automated) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated) ->> -endobj -71 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -72 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated) ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated) ->> -endobj -75 0 obj -<< -/Filter /FlateDecode -/Length 3501 ->> -stream -xœå\M䶽÷¯è³Ó,²ŠdHb øä°Ûޱ̰sÈßÏ£ZüènMõÌtO‚Mv1»R©T¢Þ#«)ihïñ÷KÂ?…É•¢9ñþði÷ëλ,“åð÷ø™ÿeWÏŽeO>—Bðœ÷Ÿæ f Jqÿs¹bžÃ<î~øb÷Ëv,ÚGç½R ûß>Î.™]& -¹<íRpcAÃ%¹ÌÅûü´‹—SŠ™ —âráÓÓ.äÙ (?íCÞ•@œÄòI®D-A Ÿ\‘BÊ–¨ÈIÄÀ"Ú¬¬Á Ø;ðŠ îÈi¤$$Á)z!YJqšJ,”ØiI™- 3့0ÌÙù9[`ükaXÔù䃷0Tq>I†Á£Íš4ŸH50 Ř’a uãƒaâ(û¨F‘•’ÅÀ0ÄìÐn"ƒ‹ÀÑáz\ «ƒ_aƒ‹ ârY&r¡xÉ mVŒ Ã]¤½ÅEV#h·0,⢰J.æÕÂP³YØ~Ú'úè‚aôê8d$ÇÄ1KÃÈ1Rs00Œ!;.AŠaŒÑ!m uX>ê„ #‹“˜S60ŒBN$y6ús”ì$3{ Ä6kÈÙâ"©KD- ³ „âÖ-. -¹Ä¹$ Ã’]J ÃÕðÑèRaQ CU—=ÒÁ{AQFÁ00d"—#2½!c3 ª!‡è2$r@›rW(¢Œ>U`¡‡‘!36Y‘ ‰®¤ØÂPb.¡#>IœzFÅ0|PQÜñÇòɉ.©Åê H÷ÉÂuP!’‚Åê *† !:»ó€Y .Äç‘Xƒ¡;H€R .uÙ£´X>ÉyAƒ#ŸÔÒª‹£ Ñ«Âìˆc¶Ôªˆw”jEµ|ê²gK¯JB›µK¯ -dz€˜²ô*r¡ QÄÒ«Æ·^,½Š"àB† -°0„TŠnhôgV¾¨¥W1°jO´ôj‚VGÍÈ–^MÐê1¡\@Ž¸ˆánéÕ­Îa .´:“’¥Wчî#Ñà"A«³ˆZzBÞA‡dp‘ Õ!’¥W´zUá–^…8rè<ÑÒ«)''HT–^EJu‚”iéU'TX*;ÈùbéÕì=ê2&»ÖôÕ'—¢Š¥W3—éÐÀ0cJû–^ÍmV¨-C(U̧£·ô*&¸¨Ë$†è˜Qk¶ô*fܘRoéUL0§Fo4¸È óe…ha˜0_†²Q‹‹Œù2“Xz5gÌ—E5X\Ì—¡$,½šmÖ”,½šóeoéÕ‚:¨¨Ü–^-¨ƒ*H †uP³'K¯ÔA”¶ôjVGç)–^-Ðê˜TK¯huT&±ô*d(æÔUÐ>Ðê YzÌ©«2| Õ±ë-½Z Õ)Öfø@«“Ôäkø@«S®‰ÃòÁ_k§7| Õƒ¯„Y>˜/‡z±§}Z= XzU¡Õ‘åÕÒ«¨J˜S‡héUèPW³¥WZ#Ù[zU¡Õ1*¢¥W¡g1§–léUL 0§f²ôªB«G…<´0„VgŒ.K¯*´:æ!ÁÒ« -­ŽùƒXzU¡Õ¡ûÕÒ« -­Î…£¥WZ:;YzU¡Õ%†êÓ>ä=&̵oX‹ƒÞcÆ,IØr"L™s"{‰•Ðne$NË)`ÒLÈÑç@®kÐ ׂZ„Vh«Jçbä í0¼eÛû¸¾þÛO»¯Þ#7íúçîá‹u¥ýòÐÞíô¸|¯Ðd‹FôUÛy]šŒtôîÓî«ßóÝ7?|‹y÷°ûÛïêê)~_ÿ}ÿî»Ýß!øKÃ'ÌbðP6į¨Š';|º!|ÊÇõ«· QÕðå†ð9šÔÖðúúðŒ~Ú[ÂC]£öÃëÃK$“ZÌS)ÞÊÍ¢¶†—ׇO1›Ô–ÛzŠ¦Im ÿþõá1ë6©-·åœ edQ«·åÈq“Z½-)h}.s%ü ÔV‰aQ«·Q‹â›Lnõ‚ÛÍؘ¡5‡å oúRÓoÇfüT‰ ëÿ¼÷€¡,Ïæ¼ –IÝÆñúˆ¶¤†óqûĶúàÔågñ)ã8æÇXüÿ㈱ì‡ã5ëyõQxÝçÉýæÐ/Æ­ù®qÛúÃÝóccºå‘~ s}Vý9~Ë9q_c{Ñ,?÷ãQë·R×y¼Ó<÷&×5ÙeÎóq½~|NùÕœÊ9–ÿ%Nëw×9½ÓùN»þÿñÆçÊåëø¤úŠOúº>¬lD³ Uõ5ž’ŠP]esY%ä´¼ø³ûå9.õƲF———{öT¿²Rx?ñrÏzõú2]<0M+P ™££ÅŽ5×WgëóÒïþôíŸÿúýx^º<³úxìg½Ž¦ãúplêÔGÛš€ Þ—1ÿa‚NŽ9 õ¿y}kÑ#z´/Ч©¬Û[}*¬ým¡q¢°ÇoÏ„¦ö´õ´~m|]¾‘òëNP2.õµDÂ8²Ô×rCqy±ïë7Xɧõ½®úZׂ6íŸ8uùæù×îµ~íDÒÂûã7ÒÓÎê|ÐþiGË;áõzEý­nÁ\_9?7?‚z­oó_˜¹¾‚ònZu[hèßmqj”v«4ÏNwž6L‡Ý†ñKßB×ïWúñ‰µàÊj,­#q÷Óæ·a:ì6ýÖhÒ™ÊÝ«ŒSµ!?š2ºz,ø Û‚ÑjEšxœvÉǶyjN•Æµ/S¿ Æîæ óãNò†·Œ\á¥u½Ù§¸Ý\üè/ÚKƒ*Q·¥}âúï1UH·Ö̳lÔF¨˜÷ÆEêØìæSf{êY‡· ÎÃw‚«~‰/ìˆ]ü†MºÝ»#vb ›ìY[ój’êÉãÔL½×usMa Ÿž+g£oÀå†YzW~<1vJªèìíb‰¦î.=î0§ž;gsîŒ×_ÐnbÔ4õùf<,…Ï͵ë—v‘a¾W»q±É8†¤0Ì#>.æ6Z{v"Õ¾9ÙVÅ=ì~Þ-e.Äú¹!ºgýV)žH/Úÿ >ßáç;Þÿ¥½}¬ãÁ÷lzn=1Ï•,„Ø(¼jA»±›ÉxJûÃLeøJë ½Ž‡0åk§û‘Ø›'õ Jýèl”ád½ëÖß1Ãx8C± ™[¹û¸ÛÍùú{&ö½CÕùv°[Ʊ8Jò~ -‰½ê:J:Žr˜NÄλÓu´ì¤™µCÎéÐ×öóLE¬×šv&Qwã8Æ£ÌΡ›m¹‹É…i:™é$0Ó|Q=iÏF£_=¼næ}mrj# Z{jïÖÇÙÚo¬Z{ÂÛ¶Æe7îöš—_QÒï@¨ÇŠÓØ‹]䌡1¤ŸìÌ}t²–qÚê óE¹ÙN.Ú -EOõ N³õˆ¹µ)­§5X–;.›(å®)†õçi™Yé ÊÌJºð­q[Åëj)v$swÎãîüðìZ²lØÒ|v·òðŒÍvym>½v«¶ûé6x4$ eêÇiráùªü÷š±³ù†ö–×Éò•¾¬áQ¨™r q¯Uî”ú«‚0X꬙˴^òâsì”Ëe’¶€2_ t`Òë¯7øôTq@¯˜B­¿€ì‰ÓÔoÞÒËxòã¯í÷飋˟u•¨ïæ:U-õ³;_0È•²§Íõ"ÊKaßÿáà£% -endstream -endobj -76 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 75 0 R -/Resources 4 0 R -/Annots [ 77 0 R 78 0 R 79 0 R 80 0 R 81 0 R 82 0 R 83 0 R 84 0 R 85 0 R 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -77 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-node-automated) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -80 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-includes-rbac-automated) ->> -endobj -81 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual) ->> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -84 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated) ->> -endobj -85 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-podsecuritypolicy-is-set-automated) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-admission-control-plugin-noderestriction-is-set-automated) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 394.370079 498.679134 370.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -98 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 373.970079 491.179134 358.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-bind-address-argument-is-not-set-automated) ->> -endobj -99 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 354.770079 498.679134 331.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 349.370079 491.179134 334.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---insecure-port-argument-is-set-to-0-automated) ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 315.170079 498.679134 291.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 309.770079 491.179134 294.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---secure-port-argument-is-not-set-to-0-automated) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 275.570079 498.679134 252.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 270.170079 491.179134 255.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 235.970079 498.679134 212.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 230.570079 491.179134 215.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-path-argument-is-set-automated) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 196.370079 498.679134 172.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 175.970079 491.179134 160.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 156.770079 498.679134 133.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 136.370079 491.179134 121.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 117.170079 498.679134 93.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 96.770079 491.179134 81.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated) ->> -endobj -113 0 obj -<< -/Filter /FlateDecode -/Length 3643 ->> -stream -xœí\Ý‹ä6ï¿¢ŸqT¥RI‚¸ƒ»K.°‡p3ÍnÂ1ØÜÃýûW²-©Üm—w¦½ù€™¡gìòÏ¥R}J²Úpvòû%ÈŸD0¤”#Óùòáôñ䆜üŒˆÅÉxù{ùè_€8”»}:‡—1ƒ?ÐtNOä'!§²âòtúá‹Ó/ë¬àŒCÎLÁ}§!‘N!YäŽ)°É8° ˆˆ"Û†€yƒó&D`òè²…‰=ƒ‰A³sɈÌÙEãEf dbHdv1:¶0"³slb!ûà‚…ICHL&†i1{G&:Á :Ãw ò8€‰I"sHÎÞId.›˜,2“OÎp1t"³çè ÿA'2cf"3"eÃP¢4@ð&Ef—0>†^dvÙðô;6ü'HÙƈÌR ÙðŸ uPN#þ¤Êx”mŒÈì$ãþ#ã,æ3Ý`æ!ÿÊ4¡ˆ'—Ä-‹%É3“%[ëèi2óëO§¯`pçŸþ{zÿÅ8­a)» pR¹Me4©;]&-¶6+FgŽ•Ï‚>õ¬ß$™£7¢nRta&±7tqóŽÎ2Pº¦ª†/'M÷AÒlã­è±si-²Ï­;Õ©—…:½(Gæ7t‘DC·Ô y㪂]õ^µ¨4µ®ïËÒ¼a^ÚÃ5}á2iÈtM½²nØAÑÓà¨Ùan‘K¹µC§.íÐé“€®éÊ¥U‹ ê°a­÷ªE¥©u}_NnȾüœoìU½ù°ºÛ¡¸ðfe‰×} Ñ×½ Q.?ñ|{ðŒÕ.{Ï+=z Ñ×} ÑÏ¢ë¡øüîV辆èkˆ¾†è]ÝÅ"@£j®[–ršˆjƼA׌V­õ»àì‡ìR¼ž]‹¥¼ÌÓÇÓM >Gd00 ¢L>X˜Tðø@k S?-tn`¢+¢B†ÌQlÆ噡!såEpÞ2GQvd¤hÈ‘†ÄÁ’Ù»!±h‰- ²êlaHâ-´·‰ÉrÁ{J¦¬¥ÈDÃ0FΖÌÓsŠ–ÌÑèÑ‘%s”D›Á’9…Á{IÉ–ÌŸR`KfI¦D.zæÉù–œ·1y;±“ a'vJbÚ‰„qˆ;±“¼âNì$)hi'v…!íÄN -Rwb'É÷;±“$G¹ØçÜNì$ÉQ°;IrìÄN’…;±“$GáNìˆ$ƒß‰,9ÊïÄN–E;±“%GÑNìäòw'vryˆ»;YrïÄŽÓ¾§c#yu'vr !îÄNfÉ«;±“YòêNìä2ŽÙ‰,9ÊíÄN–åvb'KŽ‚ØÉ’£`'vÀI’ÂàP{ÝDÏͲ|.¨uy‰„Á­®ËkxX‡o.Ì\¹ô×·§ßÁ^Ê/í°|9ûòè öòñw°—eÚÂ>¼œ=a0M[ØÇ;ØÇdšöñ>Ó¦iï3mH´kÚ˧±ž÷òØc,ûSËL×;€±7ÿîÿú^5p¹Ï¸ÑÙu/{oÖå¾´À¬Ë}®™Ø¬Â>½œ};°.÷y~f;° -û‡;2¾C;²nù¯»=ÎnãÖHWuƒ£ˆàÖy“| ¸¦ú_F­Þ9L2¸Z`ù”c¹FiºdÎK’2m´#·ŽŸz_ ‰ÏxÌ~¼^î“>–mÀã5œÛ›ùŽm3½â@a.ÏQž¯ëûYûùæ¶æã£ö‡fo\×iÙ-Û•Zôè¤ßH]ÓüäS乘|Å)Ò‚ïª}¶OÕWÑGžõ0Ó`îÃxÎÊ6ÐíGïgº|èÝ|Ýc»ªËvª™zäk=dŸd²±kŸÇ?˜}Þ}ƒüõÌ£ä#=¼›ìVÛ:&Æ,Ý!\ëîÓcqj㎻u÷mx9Ö†UW£ª]´]ã†M`îÓ¯…ŸoßE~Ô}|¾ùZ¿¿e 7 mg.³…ƒc5Îù×llÄÞŠ¯yiy@éã¨8¿õSÇx­ãcjï¡~P–öý€Žwžõ~Yê·]£Ï™‡ë”ÞŸc¬Cå!Ö¾]Âo”‡éÏ` Âkd‹÷Æ5<}·Lúur™uRç8]×¹o¤Õ1Pì¹µÚqºg¶åÃo5¶¡x­¿ß'וå;c›bÇø2;~ª½Üu¿Wìµ5ÞxŽÞÆÚ8ÓÖl¯ûDÑÔ›¿ÖÛAöàð)ctL\y}ù?ëÄ_ÏæãñÞÙVZ‡µ‹qD‰Ôã¢ÞO¹·Óæf•o£®øÊxïÃÜ¿ÙÞc?Æy©Ït­ÏŸ.ŠÇ•;új7˜ú1öñ½²]_.„@óã„åBêlÅžTª2Æ‚ò~©|-Ð(ÌC½nuž“ž@m¯äðüÿàMÐÑëf­ÃmD´lªÂ>LÚø¬ÎXJ@â»ÉGÚ€’§é¢¯6ÉÊ·j"ÝŽTëNÙû]÷=íƒ:Ot¤î+ÚoÖ|gÿÑK þuÚ¨äYLm³š^ß>õÿx -ek¸@Ê; \y/‹§që$–€…~qé8aµŒÚ†óÆ­ãk«>6Ôü&«òÖ(oÚ˜^s¥Nfü´Gà鼄§ ì…!LGB.ïø¹&?‰ésýªù‚Leÿ̧‘ q>tA6Úå¾|Eâ -éCÝR¹1/_r˜1ÔÞ”ûC½ÍO1Šõ¬ÂÔð -Qîd¸%—Þ—oÔLä0¾–ÉÏgÜD \ebgHÛöwÉ’~1Üj®“%.sÅb;ÌÍæ»èZu Ì_±•9-âå$ÍúkêÓ*¡Ñ°j·¼$§Ê§„Ê*²„šVHåë)7Ä/]eMbÌv]Y ‡4Su$j¸\q+¤Ëi7s ÍR±¡R¿5WÍwQº«ûÔ¿Bu4S%M<©S(Ûc«4™‹ª­]R~ƒ7ÄË©äòÓ)Ätè¹Â…êzšèßFN®ûK§ÆTUÅÐhe‹]ù;¥ŠÐ¨%óŒeO Tú¬7Rb³‘—JÒtnY‡Ö4;V© bl>«õ%“Ž|Iº Ý4¶ *•)ú¸»²æ–<–dh^×È%…Uý´\©‰® -!Íurh®ü´ w9C UqöÚƒr÷Ðøv2·Üù¤É±Y¼¼å®v¢×V>_‰—±°Ñ5¹¸~ªt2ºVízcŠØ“¤ÐÉ=>ä­-;AÎí°ÙZŽœ~>e}À\¾ÞZ^t´üîœÿ'˜7òùωÎÿ¬Ûǧ:^^‚7·-·.Ⱥ’!újÂ]2bnÄ6Šˆ¤Ò~'CêØP½¡ÕqD•¯©ßîzb¯HhÚUM ]‡ŠŒÍu¼ÒL0ˆ—+-¶Ì½¶é{:õµsÒŒ/ïªRɉ¦~Í÷’|V,å¬@{I‡òæ@u£œh¦rªÌ]²…˜Å!u#MõE~Ò¦ð¥-u¢†åÔ÷kÔˬf]ic/„@ÝL°`L Í yV„~qxÝm÷Yd®P¨-µ7ꓦ¶ŽjKxëT?žòò´Õ.'5x»†/¯bÏ·AN>´ Å‰öQEMý¶t£Ti‹Fk¡hé·oÍ„Î1V™x¾­ªeìqZÕRlcŠNýYk:h«4%m¾Á¾µâµÑ’o  Ý9öÞ¹ŽlcÉ´Bc}w£RGúJ»m›–m×j{VÝ .÷‘©ë·…ä‹òßKbgusùj±<©-k¸ò†Rˆý9—áNb–R¾T"%µ^òì{ì”Ûe’º€¢[sȤݻâo"<É…¼A±š¿ê¾q[v«]zž6¿¹¶þU?øù ã*Q;eªr¢ò$Až!º'Üéf)ìûÿ¿^`è -endstream -endobj -114 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 113 0 R -/Resources 4 0 R -/Annots [ 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R 124 0 R 125 0 R 126 0 R 127 0 R 128 0 R 129 0 R 130 0 R 131 0 R 132 0 R 133 0 R 134 0 R 135 0 R 136 0 R 137 0 R 138 0 R 139 0 R 140 0 R 141 0 R 142 0 R 143 0 R 144 0 R 145 0 R 146 0 R 147 0 R 148 0 R 149 0 R 150 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-lookup-argument-is-set-to-true-automated) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -124 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -125 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -128 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated) ->> -endobj -129 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 473.570079 498.679134 450.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 453.170079 491.179134 438.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-encryption-providers-are-appropriately-configured-automated) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 433.970079 498.679134 410.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 413.570079 491.179134 398.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 394.370079 504.679134 361.670079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.970394 386.420079 496.429134 371.420079 ] -/BS << -/W 0 ->> -/Dest (controller-manager) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 323.270079 491.179134 308.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-automated) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-1) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 185.270079 498.679134 161.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 164.870079 491.179134 149.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 145.670079 498.679134 122.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 125.270079 491.179134 110.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 106.070079 498.679134 82.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.786556 85.670079 491.179134 70.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated) ->> -endobj -151 0 obj -<< -/Filter /FlateDecode -/Length 3770 ->> -stream -xœí][ݶ~?¿â<Ã!gx‚-Ð61P  ä!èƒ}j'(v8}èßïPâe(QÒîžuZ4Zcmé;#ù ¿áEÒ1\5ÿùø¯€ BˆÞáõöxùtÑÊ“æŸÉ¢;™>þžå犚ÌÕ墉`¯Ð\*jƒ€vö¶ÁÎùRˆ„øâò‹¼ÄÅæ@\Ò`.ÉkKØy¨ÅƒÂ5X}Þ.í•i <¶Bª;(Ö¢n½É¦<±‚\%ÚTëæ±C½,ÛŒ˜•0´2ª¿FÒç®Î2¾’þÐÓïh‹.ÂG\ýfƒþ†ƒV+ýÙ€Òo6è7=ý€K\ô`áQ¢=ý0¦¿ÁµéÂ_#iÈóÕmú¹®~ýéòÕ;PúúÓ¿.¿˜„Ù±T[ò8é¦ì$2§O9þîåèÒ¿®ž!Ç®-]ËÝ 5§ OAž‚|AŽ…÷ÜÙê–LO9žrüÝËñ9ÓU_ -1F 96¬-‡p„‹rŠ ‡…ÁÕ*˜~®¿~èlÐ(bÓ=› ¼õ–ÂŽ ¡Š)è -möl¼BÚàŽMŠ¡qýžMTº¸cœÒ^»;6ÑsÃ!‡†{Õ‡†;ò‡†‡æàz ql´öÁã5¤£i‡cÑiMCëySdÚgÒæÊ`”x7žt ‰¡Ã—ãŒAÓœtQXKýÄA @Âq7ؘ Kz~èqÓJi™8\e;vÙNàÝ`#p1NªeÙfHp‡c+¥ylLùîë-ƒÝÅú8ä1@à]—Iévvq0q¸Uf5ê˜@Ã8ÐF¨C.»tóØ¡]`# ã«qG05æûŽÑšÇ énK±cQDâ”è)ÑS¢+‰¾pó¤“hWó®õnТS¢§DO‰~&‰Ž¥øü‰î–tO‰ž=%z×DW,iy!ц۶[×m¥lᢜõ‹¸(-ǵq:øÅÚÚ)BJlÛP½q°gã•Ãˆ–vl¬U^ƒÓqÏ&*OÖ‡½:#© )Ò^‰ÃDì^™¼Úê½:;«bÚÍÙ«3÷u èh¯ÎÞ)í\0ndž“ -@L[;6Agwl"*c¬Å°mƒZ+㉌ٳqŠãêâNŒ²>¿SgäþŠÖhÜ©3N³ ìÕÙjE¸Wgë…@n¯ÎœJjowbŠØ¶W7m•?Ð:­üvÐqv9ÐNYv_;胊ÚÁ6Ðöµƒ‘óÖv0zî«ûÚ!mh‡8G™íç(s âe´Cœ£ìvˆsh‡8Gáv8§*:ЃŠ´Cœ£Üvˆs”;Ð9ΫÚ!OÊh‡»÷Õ}íPðuàÜ´‰œW´C1ªx Ç9JhÇqŽ‚í8ÎQp îÊÊhÇqŽ2Úqœ£ìvç({ Ç9 -´ã8GáH;Ë-y1Y[ò¬ƒñž|gNcó§lÊ;•¬UÞ­I\Úöl'tøêæ/Ïõ`Ž,ðþöoÃÅ*Ã1s†ãn­â™+qoSౕR=zN_n5Gh7Gx·Vxwó¶zìP/Ë6C‚;\̆Û=àÆÔ˜ïþ.° ¶Œƒ ¶¼Üðî©9Nõ«µÊ"f# 7¼FX­U¼1Ã8˜8˜>yå py·y”h؈È8ØõÍàÆÔ˜ï;6åEk7¤»-EÉ¢ŒÄ)ÑS¢§DW}á¦|'Ñ®=]ëÝ E§DO‰žýLKñùÝ-éž=%zJô®‰®XÓz_÷-ºMyN´¾-™7ñVÎzS^\”ä˜sG·¸öÔ=C8¶qZQ{oÃÆËc -G¾–¢ârƒ”ítÖ4´~Êö€qx+Sà]v ZÜŻ×Y3hÝœtu·¹j¸ÈwA·§ˆ%*n7JÜ™ Žº•Ò<¢©ùAÔ¯¡ZÞeM‹|'9‡ \tiáQ¢}`#¯­—y:ÆAzÇö€hÍã†t·¥(q‰S¢§DO‰®$úÂíN¢]{ºÖ»A‹N‰ž=%ú™$:–âó'º[Ò=%zJô”è]]±¤B¢ LPk}[0oᢜõö€¸hó5»à­²¯ô¼Ò)ðJ_ˆ¬Øƒ×"C ¼¬ß-2ên›alÜÿ^‹ŒÀQ=x-2{È!|Èa´tÈaD8ä0¢s¸ÜbÁÂk‘õ3_‹ü4øèo/àòwQ¹é!Ó#‹\vi5×ùíãå«7þî/ûž[òöãåǯµä_›~¿ùûõí›ËŸÞ²‡qv'`´%±3{Prñ‡oß|ûÃw¯ëÂpÀñõ\tLyî&‰ «q)‰SE/o‡Å¨ÂÚq‹ôpûçu,­§Dã¤SV:váïpáøóÏëÂ}R¸ïqO_|2¸d4½&ž6+ãýËÛÁéïIÑx¢‹e;ˆS=']CœÛq{y;BðOÒÆ.bš -?ÛÅMé0° y‡C¤^Ëãû±NkL¿ïù—'ÍÈ8¥?Îç”ÓOAg_c8O!—;ùq¯ÏçÔ>.ÞåöÙÅ¿¸Ë—]òõì8 t4“AðY=EM0;EßÈ6.Wrº òHTîÖì¦ëŠmQ¢Û#ÃÚ´²ÛV"}b‰.Í6¼JlJ ¢Ç@#©^ûáã¾Î×ßv®Ýém«^ƽnú\ÚZ™=ÚñDxí-»„“$üE½o\n°"¥v±{mõ»–1%§ã¸æ2C+ïµ³åŒ3 ?¯šYÓ›I8æÔ½2§‹ºN£”o#Æ‹8ËI¥úþïp¢2cýëêZÿ»7Ï ËûÍsÏ·Ó›X·OÏQ¯cJ›·ã‡ß(Æÿ³ùh—7·äí•â‘æòãxÄß ÿ·¹ŒÇ×­1öÝËxÅ<¯¢|ÝÔfìën}o9縵žÍ¢oOí,³u?笷¡ñYr`šp–kµm\ËIkâÔ!×9¯rögÊG; n1é\4Jv”Iô’ˆÅlx™Üw úǨœ½áÓ”gö,Ò5h#cM~F´—™ì9Ä„\?VÊ^ü„Þ"m¦v¸{{ÌÑN!ºLu?ÎJéeú­‹û½h†Äto;šw®‰ªæµ¨Ø­å£‰ ],Ñ+ѱ¹q[”Gºžð\—Už{µœ˜î¦,æwKž^iýñ">Ê":®{ãr.'Ç”u\æN¹0—½ž×Óó]Ù ôÄä¦{HÁ‚ôõÊÇô>útÛéòËSLR||L_Ù‘î,%¥ocl½qk){Owæ`g›‹Ìw°Òw>Dï- uÈ‹[m>Ì¡®agJ SgËpEB,Ó‘²aT(}/ºbúìC›vLû%%Lçä“p“—ê5ñäãÑÔÂäiÇÔ]DB­åS Üå¬ .Ê)ÕjS÷Ó…§.6áˆNïs[œ¾{Àå'üJ^qí\0%v0± ×K§ÿ=æSµÊÿ¡Lúv ˆ¯óÿ6#N²ý¼Ãüxž¦¤/[EóÃ쌖ð‡>Ýy[ÈåaðC8ùPײ°>L^±ÛlzZaai©Ü…X g0¦á ]Oå2;§&SÎ’fǯt°†SëÓÃ-3ÌA  l>sµ*äJl¢´m¶ a°Z€´µp×`Öe,¶¦ÆskÕ%u Â_láÜovk—èÃM_öQŠ*ì]1+*+JŲkœPzRd~©KÑÈÁ¬Ÿ‹¨2JGÂj‹Ýº]†v¹4ª‘òÕ*´Kca¾U¥uu*ñlâ(£œ&Ä)h[{Ø¥”XO÷Yç4é6ðvIyg?\Ȭ©å -ž×Ç5hE¹ºõ—†úP¨bi,ÝïLÏ©‚*š2Ït¾tJò¬9IÚ¬pO’Ä]Í:8bÐ7[Ax_û¬ä ‚ا¤[­+c*(xzeªíjòèa¨½®Â)…~j®” .•`w ¦Ú•:¸Õ“ªT¹³gDw§Znƒ]Íö5âà°6¢NôùÞ¦ —pêú¡8i°Ñu´kÎØ*ÆI¡Á->LpQkÍNc=l"¸·ËÏ—i˜3–LLOšZîÓýclpý7Û¼áß^ðú×òüÏ<Ž]³…©¹µƒåHfŒ-!<„ÓÓ6¬² A‘ö ¡ÙRé u7Fäkl—ë–Ø‹%Ô -õS RãPÀ¦v]V0C;àmÁbÈÜ›6`ϧ¶4ŽÝX¸Ö•Ndsø4´Ïl’¯¢H>K¦mH‡ô“âB>‘…ò©p[ͺj¦)TêSýQ†Â&_âDL#Ò©mŸafeÑ›Z!LÄÅ]ÁÒiìê3¨ô‹åuwÜs•]Q@Bkj¯èƒDkÃZÞµÓ©ëOë˜c¯é¤ˆ·1T˲B{¶Nrš4ÚÔ»ÙGÚeÙ€¤S,Xç´ 5]ØúÅSÔJô¥N._Vh™Z†,ù:§hèÏ’i’Q©$’ŒŠ[Ù¦rˈWgK¶N€HvgßZ§›eK†æäÕÅfi ¶ö½ï2Ú^E3°Uĵ™©n—ÑÊòEùï%Ú>—4²ê¶G Ôm Í5‚·Æ^cšîç8‡pCxÕŒAì—<ûšý ”õ6IÙ@‘ž ½B`­öÀým£ -?aûˆ¢òsç—E=lÒóØ|ôxü™U6?Œ?íÕSŸ–Š¦úCz&¼ÞØ·«­°ïÿr¦¹¬ -endstream -endobj -152 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 151 0 R -/Resources 4 0 R -/Annots [ 153 0 R 154 0 R 155 0 R 156 0 R 157 0 R 158 0 R 159 0 R 160 0 R 161 0 R 162 0 R 163 0 R 164 0 R 165 0 R 166 0 R 167 0 R 168 0 R 169 0 R 170 0 R 171 0 R 172 0 R 173 0 R 174 0 R 175 0 R 176 0 R 177 0 R 178 0 R 179 0 R 180 0 R 181 0 R 182 0 R 183 0 R 184 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.518001 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (scheduler) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 734.270079 491.179134 719.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---profiling-argument-is-set-to-false-automated-2) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---bind-address-argument-is-set-to-127.0.0.1-automated-1) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 660.470079 504.679134 627.770079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.154476 652.520079 496.429134 637.520079 ] -/BS << -/W 0 ->> -/Dest (etcd-node-configuration-files) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 609.770079 498.679134 586.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 589.370079 491.179134 574.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -163 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 570.170079 498.679134 546.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -164 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 564.770079 491.179134 549.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -165 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 530.570079 498.679134 507.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 525.170079 491.179134 510.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 490.970079 498.679134 467.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 470.570079 491.179134 455.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 451.370079 498.679134 427.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 430.970079 491.179134 415.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 411.770079 498.679134 388.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 391.370079 491.179134 376.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 372.170079 498.679134 348.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 366.770079 491.179134 351.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 332.570079 504.679134 299.870079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.482112 324.620079 496.429134 309.620079 ] -/BS << -/W 0 ->> -/Dest (authentication-and-authorization) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 281.870079 498.679134 258.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 261.470079 491.179134 246.470079 ] -/BS << -/W 0 ->> -/Dest (client-certificate-authentication-should-not-be-used-for-users-manual) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 242.270079 504.679134 209.570079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.494564 234.320079 496.429134 219.320079 ] -/BS << -/W 0 ->> -/Dest (logging) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 191.570079 498.679134 168.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 186.170079 491.179134 171.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-a-minimal-audit-policy-is-created-automated) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 151.970079 498.679134 128.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 146.570079 491.179134 131.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-audit-policy-covers-key-security-concerns-manual) ->> -endobj -185 0 obj -<< -/Filter /FlateDecode -/Length 3781 ->> -stream -xœí\ÛŽÇ}çWð9€Ç}©ê `H€$¶€1 ÀAV´d#XóßÏé™éî²YË]Rk'¦dÊ35gºN×¥/5CÚ½Áß/,þId§”r ´?|Ü}Ú™)²ÁŸ±9™/‡ü¢›²a¶nÒ²ËÖï?î¬A«hÔ'!~„8Tqô]B¬Hñ÷Øý,o ¹+·t1ZŠf²ÇâmkÞNt*l:;!¶&N®7,ä¹7ÒÔYk+Zp҃슫˭q Ý5n¤Q¶íF–•bÛÛhúº‘†vÞp–þ•æO[ó>‹ÁåL'ÂùÝów¹5“¡fþUµnh~wÆünk~KÇrÁB£”nÍoÇæïâÖu¡¯ihç²1ûògzðË»/ìdö?þ{÷ásbn¬Ôzòqœ¤gÓNÚOúàžŽ÷tüݧc(âþôàé¸é˦çaЛ{BÞòž7IÈqâ=wµz.MïéxOÇß}:>g¹jml›Ç.·>ˆžÛô”\´SrؘÝÃA9›ý/ï74à'“&S,;‹aÆÌä ·VÀ3G²FÁ Ú¯cÀ™¼3YÁ$pöÁª˜ Î.“4 8; ãyŒC¦;RÇ€³‰ÑcÁÙ˜ b†½ìÙ°† “MTŒw“ÙÒ0 hTâÇ2*°U1 ÎœŒQâÇ18³É*&€3ùd”sHaäF4Jü¸Î.“ÀÙ9ÊJü¸Ζ½ŠÉàl’ËJŒá"0Öf%~à¨Éd2*¦ –)àš† “‰9©ç€q1+ñã]šLà•øñœ9±Š!pfKY‰OàLäU ƒ³0·†golVâÇpvÞ¨L(ÆrÎJüøÎ&%“ÀÙ`4SâÇ'̨™‚ŠÉ~Ê)rRb A -Œ¡¤ÄŒ)GïU VI9„¾†gÎVÅ8pfŒŠJŒaÎÆÄM9)ñCœ}L*†ÀÙ›˜”ø!gL*†Áƒ]RbŒœ‘¨I‰ -àŒ S1±,_ÆÁaJVÅ$ LJüPÊSŠ>G%~(ó”BH†Ë’‹sŒJü0–n‰]P1œ‰9*ñÃœ}"ãÀÙ[•cÎŽ0%hÚhU ³5&*ñÃÎÆeÃ7Vž¸§è=Eï)z’¢/|t¶IÑ óMïàG÷½§è=E?SŠŽSñù Ýs©{OÑ{ŠÞSôª…®ÜÓ—¦àœ¡¸}ÂK1§Qì{æsrÙÐé#6qײ%»óíö:–ÒvÔd Í%¸ÜÊ#CL)Ájåýû÷Á™Lç:gÄQ -Æ$sg¦`4Îœ æÑ8'p&ßË##L¶¥”g³Æ9ãлèÎÉ€3 ¤pNœí%ÊÆ‚³ Þ(œÑF)÷%¯p—)öAã\JC9§¤qö„˜Æ™¸”3iœ¹” =E3Ç)ÆdÚ£±&”²¡c—4Ì\64L,eCË­t?¤R6 ¶=zbbyµ;Æ9ƒ3q/-1¥lˆ4U8cü†œS8g νS8gFç{y„q¾”“Q8cxÆy¯qöàlB -ggc}Ö8SÄ,ËÙiœ¹¼‚aˆ4Îœ§€#jœ1a‡˜Ùhœ±† ‘Œ×8Gp‰ƒÆ93Ò=iœ83¢UãœÁ™%%¿¬ÁÄ(ôºüÖdmVFÌÀ í9:eX¼=¦ e\(3 -fAêÏÇ*è¸ö,fDQ{v9 –!<œÇð³µçOƒKz»ƒ–¯{„=,4Ì1#4¡Èk÷o?î¾|ó—oÿú÷ïЗ·vÿø -§õã¿þçþí›ÝŸßBƒ¢#/*ò>ø0YW*÷{ÄÙÐ"ñ‹Š?~óæ›ï¿½­ -‡\¦Ï¬"¹É}^ÞO?­‚®P‘ÊÄúYU™‹ÜÍW¨À”t‰»¯PÜEîW¨À¤y‰»¯P°n¹ÄÝñ2ã“ÖD !éåýˆñ²ä»BEr—%_¾BE¼,ù^®"ÛË’ïÝ*ÒeÉwبx*žÊ;¬TKêŒñ±‹ãñ߃1ìðacè=>i9ž¯ÙåÅE^d.¬x\£ŒÏŸÒÆz†/Ãq‘WÜ|_Å~Xu¬i‰åõÒ,¥Ê Yë€Ë2{.36’è„ìŒK‹B‚ÐJ|&õ®ÜÈVL1@¹ÖûÙŠÝ@\;êýÖ?¼ï÷Ìx/ðf5JXÛ*ç³~:âŽôÇåžrlój‡zÍuÇ•ÿ5§&ÕÐQºØ¶êŸyÆõ|ígslî ìçhµ÷Êoîk „´9h<@`¢ óoÔÇ¥¿kBÔûªó°ÄÀ¬÷Ðý¬ùu¾ß­ŸbƒŽeªý±oäì¼îŸµoî° 5þwðàôAeµïÃØÖ³ÍÞu[Îý âÚ¹¸xõµ^zwCŸþ²ûªñð*¹Ìtl××ÍeÜýÔZéð:û”6^ŸŸr}“>XoWŽÕ_ÏÌùî_ͦÙôeûÜ_sžÞ=µ^›«Ûÿ?±ñ:ùøØ®Ÿ-߇Ŵ§Š³Õɵ8qÖ1Z'#Ë áùj߸ÚUgµšµ‘QkÙj113lfó9f0û\¸ëšËˆë¬Zq·ËÌdÎînÙÜ´²Ô²N›IgX¹¯Ú^–[ŸmçêÏãjÖÅ—ܱ½\õÍCáóµË_­±úµùú:"ÜÐw|v\}nì»3«©v­Œâf0S^™r–«%uf;Hª¶‹Ç¶»OÊ;&gv¤Õ'7ªUŸÔûæ1bõEÛY~Xbq–‰ÕÁÆ®7§êì}#;†³»ÂjÇtc;ÊÑj϶Š³‹¶«Óf÷ÍêIŒYs<Æž ³žŠ«¶vÝV×iª=ÓÉð3ør}WŸúE‘òBJ -‰mùî}ù -­‹a~‡e÷ó%Ò—X^›ßR)‹7±Í@ŸyKeÕ^^ã±Ê#A4¹¾ ã¨,g¢çáÆó²n)a֦°ò}uAœ¸»Ö…_3]¹ö¾‡_ù¿bM”¹[‡½æªõxn —ré¨ýºx|ê´õ¡¦ÖécèO;NXöR¾´mà0òÄ1æÒgùžãv!¹ê;;[ÛîÏÜ:ÿÖ맆ZþÕLìmùiå·aÅÉŠ_ž&ÜÙLSq@y%ÒN¼A e|,~„ësýfíFLóO»\$.Âõд¶ÈV`“vÖ—7Âóû7ËanC¸–w½úý\oóK»zVaQ<âÎ`OÅ¥÷å ‹NÀÂÁ¯g¡QáP9CØ$‰í öŸc4B>¡®‹‘—¹b];ÌÍçÞuêÒtV¸¿bK½é"áaµþXú8”:Ûd®Z×™&ó‚TnR®Èæj~ˆÊÛø'Â/Lmº¼VÜ® ¯a[¸ -S $j¸\qÑa7Ä­­qóTl¨ÔoÍÕòJuŸšá²ÙF«ÃÄ£8µÆ×í8T_Ï?ã´¸ §nveÜ9?î8ÐÜÇŠòÓ+§B/Úmâdz¼tiLÕTHÍ*+¯8•—¡‚›´Œ<óAù‰0[g]IÉÍ&ÞIÊCuhdK±c…¹Ê«þDŽ¶“àË ÛÐÍb©0™Ç\é•Aª [±mQ×Äe«öic¥šJ꺘[(?nÄ'·TE°WeÁŠpçÖn‡6v>Jql·XÏÖNôy ˆ˜¯ÂÃ<±Ñ±¸„~ªJº¸üÄY Ÿ¦L;1 -]܇ÑÇY\³µN6çvØ“l4ãv?íæiÎyv¹|›¯ü²Ëö«Bvÿ`Þàó¯íÿV_%^æqgÚháÚغË™Ì9_]ø¤¸¼¸[…-m„Бö»Ø¦Žå mwNŒ×Ôo7}`¯HÛFPÛ®J!w -±k¡ë¬–aEx8²b[È\ë›>a/§¾vj|y)½²Â‰ìNS¿æû”¼Mâ¬@û”Ž«äÄ8‘âT(ÌÙ†f H©¤™¾ð'é -_t‰±Œ(§¾_£>Íʦ«lî…€7“Ý4LV*Í>Ò/N¯«ý¾R5Š´ íMú(¥­cEÚ¼±Ôϧa{Úæ¿/'5y»…Z[^äžo‹œž}iA›£Bšúm+€¥Rª²Ò:Q´á2Se­ÅX9…õ¶j–¹Çih¥ØÖ]ú“´4K¯4#²ôJ8Á–vëŒ×VK¾-€X†sì½3ÙÖ’i òî&¥ŽôUvª›¶ºël»Ý N$ô•©é·ñ òEãßKrgøòµ)ØÔÊ5Ùèß—ä2)Œ!T~Î0Rõ’gߣPNË$µ€"5ÁØ´{-âí …G\ÈO_M­ßì=s[6Ã.=Ïg¿Å4~cÜO~ýÂó\%j§±l9§ò 2“äÙFsæ™×ÃI)ì»ÿ¬Áœt -endstream -endobj -186 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 185 0 R -/Resources 4 0 R -/Annots [ 187 0 R 188 0 R 189 0 R 190 0 R 191 0 R 192 0 R 193 0 R 194 0 R 195 0 R 196 0 R 197 0 R 198 0 R 199 0 R 200 0 R 201 0 R 202 0 R 203 0 R 204 0 R 205 0 R 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.214534 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (worker-node-configuration-files) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-service-file-ownership-is-set-to-rootroot-automated) ->> -endobj -193 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -194 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 640.070079 491.179134 625.070079 ] -/BS << -/W 0 ->> -/Dest (if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-manual) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 600.470079 491.179134 585.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-proxy-kubeconfig-file-ownership-is-set-to-rootroot-manual) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 581.270079 498.679134 557.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 560.870079 491.179134 545.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-permissions-are-set-to-644-or-more-restrictive-automated) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 541.670079 498.679134 518.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 521.270079 491.179134 506.270079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---kubeconfig-kubelet.conf-file-ownership-is-set-to-rootroot-automated) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 502.070079 498.679134 478.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 481.670079 491.179134 466.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 462.470079 498.679134 439.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -204 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 442.070079 491.179134 427.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-rootroot-automated) ->> -endobj -205 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-rootroot-automated) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.214534 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (kubelet) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-anonymous-auth-argument-is-set-to-false-automated) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 232.970079 491.179134 217.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated-1) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 213.770079 498.679134 190.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 193.370079 491.179134 178.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated-1) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 174.170079 498.679134 150.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 168.770079 491.179134 153.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---read-only-port-argument-is-set-to-0-automated) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 114.170079 491.179134 99.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-automated) ->> -endobj -221 0 obj -<< -/Filter /FlateDecode -/Length 4009 ->> -stream -xœí\[«$¹ ~ï_ÑÏ8¶,ùË@¹-²0‡‡ÙÎL–pfa“‡üýÈÕ¾¨ª\ê>§Ï²/}†3§J%[²>I–]w¶üï׎ÿKèLJ9<_¾ž~:YÉòϱ:Y.Ç¿òŸsÑ”Ö>1dƒ²ó篒’ Wò “Ó ²èååô·_~œwåÎÞXçÉãù?Ÿ%KD]Îɳ$F‹Ya &Ft.³d0ɲ⨰ð¨ Á1‹³h‘wŠ2ÎY†|ŠO0Ùf$RxLö@Ó’ÉÁS¶ -G“³ ”v+ëbMŒÆ"ƬÀéˆ/D—‚‚§£llN4}”³‚¨‹Î°<HyHÆ1î^Ó'y¶x¡Æ“ x„ ašÉ@pÞ+ú€uRB«`ʺïˆ]^áqÞ°:ä}ÀeãCVÁ€ŒÏ!DSðÎ øˆš>>$›¬‚) 7cŠ -¦€Ù‡:júòlISÆÁGET0e0 ±§¢¦Oô†!§a³ ŒhÒ0MdŠ•µ$Ɖ’Ó%¢Ó0ÍÑDÖ&)˜zë9ar–Rôñ6sƤ -¦ìƒœ2!$S¶ ç̵<æ)pFTx¼çœéSV0õ>›ìlÖò˜GâœY´VxÈqÎ$ξOäœ .h6 È2€‚©–sf` i)qÎ,€Â“‘s&2ÇCt¢¡üÄóþà!ºÏjôa2¢gˆ>Cô¢?SˆÎCñõ…îQè>Cô¢Ï}¨Ð•·¨#¿ºA4¿qqDýìohˆFËr=ä¼Y[S@c¦¶=9åa,S}›aÎL&ˆ6*<‰/øìÛïœ'/[éVÓ¹l]3“Uteë:g›CÙºN²¢spe +:— Û:eEçdfMgN*уMšÎž] -IÓ}‰2HšÎ˜MÎ.µmà)•­¾„m;gÊÀ¸@̦ñ$äBÛJŸòD4Þ'h[bSžd ¦¨éœ‚agî·#¦<œJ)'43ÇNBžmy¢-±ã (:Çr{b -ŠÎ±Ü^CÄ è¡ÄÏlŠÎ‘ÓŸ2l -çر¤éŒ%vl"Mgä؉QñÕÈÉ ZT|5R‰Ë¡¡ðŽ•øb Û(¡_1–ØáKšÎ©$Ôh½¦3稜|ßržò”©&ZðŠÎ‰+G!yEçd9v°LN -+±c-(:'àØq­ŠÎ 8v¬Ðtæ —stMgϱ:MgäØ Þ:ÅWqìðœí¶¾ºÝNØO†2MÌö“Wì4g¿gC9EÏ$ŒrBÐWõt*ùk²^Ñ·uvâ‰'õ ¯êlArŠìF{꼪³3;”¨=Œ^ºDžEzE9ôÔU}'è«:[ÐE…,$®¨(û†©%}Œ^H–šÛû²Æp 5µêô•ËDwuö8À$iWgg—§8äò‡Zõ -ºpi!qE]áàpÑG/$ -KÍíýÀ†²Í׃Ð=Å•Ï}†è3Dw!úÆ åUˆ®4_>LFô Ñgˆ>Côg -Ñy(¾¾Ð= -Ýgˆ>Cô¢º«G½µe³eµ£œÑ‹á5ó]v´ßR­Ü™abÅÓvy1•­E\¶òŽxx™ž²µËÊO°&¦DËSÕ‡<Á„E…'–- Š.i<É ã¾<{Ä“Ðøiy²øˆ'[Éá²5}ÈŒ‹ü?ó8ËAmc"P ÍLìý1Ú¤Xš½Òö±ëÛ1SyÂÁ*¶fÏ ÃÁÃÖØÛýá%b?&‘¡BÛ½È ¹iÊ}¸óÓäÒï>žòõ”|žm ìf<.Ëñn³<üzúÍoÿôíŸþögÈÇ/§¿c-cfñ¯ÿðóÇoO¿ÿÈ^+"p¸C> "sZ¿C½]DyÒïÞ.‡É"â"¢¿ îôvtÜùœ—îûûûD¸PßÍ -Ë$ï0dw&ŽEȾ¼¢P„|û‡?ÿñ¯ßm„„Ç"ƒòíà{PD¹{v GE¤ÛÁ÷ ˆèo߃"’»|Š·ƒ/ÜŸ¥6n›}™ñÏÙ–7Pn»íy*ó8îAc-b>¨càY-Ox×¹¯¼pÁÙyÿ‘] ñò—+&[nô$k‰Ï‰eS9æ똮׈Ûà÷ü‹×ã­òpÓå—üµ-Aåáë®Çå:~þá›+}ás•çK½ÞÚä*¯^+í‹nEÖB/ú}ªºÚÚŸúáeð—¿Ëu¡{ѯS•S÷Ü®å­ÆaØbKË㇪cësÑÅØ‹Ì‹Ú/òZkÕï£OïŒQÕQb±ØþRñ‹õ:]m¿Ø.Ô¶u¬…·c†ì¥÷‹c¶6}'¬ryäBÅêû÷ŪÐ]k -ñ‚ÃŽ &åz1EŸ8ú{5nÄð —bOßìç*&xõ ݆Àk9Ômxyg&a7raõ÷ŸÁW¯4¸öÙú_þ~Yë´Ø¬ð~ªú_ZL©v [;â½Vãó›í…¿ˆXXø'v[èAô÷ؼÝ7|yÄJ÷ ¶}·|ëD>k±´øŠóŸ>ܺ-]ÍJ_Ò¾”×6Þ͇E–â—;ÿUscycumã­/ý¼ÑgÞ'Ïú²Ä¿íøÎ~ ë–-NŸÀKÅ)¬yßœKnä[™[ZmÔüìÞqkË·ÇgyëõF­R—E€ÏÈ‹Zoñ—|õó{±ñ˜Àç®ÄÍ¢;<Úlæ%^bn„;qüåj„­À‹ò­z¥®7Þ#ŽnaÒçCW}·ùÁ¤í6Mî­=Ö5‹®­ßV+‡J5íÒöSWÍkc¾Uí·v\üè"úh>^1Ž5¨s`°>Jvcë$ àZ€]“.Èä#&§]0´£‡õä7>DAŠõñvE¿[Ummßs‰õvö¤–­ßÅbÞ­ ¶ãkÉ앹EÛqZÍêÉÕä¹­ÌçÕ^ë£í¬È•áQrN³Wr[{½Oe^²¶:oÜQ|d’ZÚÇÎÃ7Õéd)1ÛŽåĬÙ -¸+ù·­ÌMÐ4™¤6¼©LŸ–·¶±Óf‘*‘@‰Ü¥zÍeÓæ‹@êÒ® 4ó@ñŽ’A¨w§öm™°-"—ü¶¨Ü-ØÛTQ òií Ý›—ˆ ÐYAøšð«ÿíþB$¶d¹óx6teUgby9.,7ËO?ÞÃRÀˆÙ›¸Ü/†\fîƒâUzyðÀ)7P–WNëÞ^qÁèiêwK©úùššï•Y.WŸ[ÌŸ'™¤UÎö½ænºrí³íëø•ÿ~¹ÂZè€~œ³5ÔõÞvµ÷ßÖBŸwC¿¿²»UôÓ‰‡*³0bΖ%y\>rÉÄ…~¦hX» açk»óAÓå[—?u®úùKkʇž¯ßÆ'•ÿzßêëéú@ùa¯0t=b2 £-ù…¡Ï'džàNr!ÖCÛû*ïˆmh—“+w綜¾<Óq=̽sß_¶)•ŒöÔšùk‚vVá*xBä–ÁíÉeôåé½+™A d|= ] -Mg&ŽQòŽGÛdç­ Òžh…¸Aæ¸Ìúaî˜3±«.Mçü¢€S#^N,Öo©/S*¸Nƒf]°æ…R¹S©qv@°ã4!•GávÄ_ÛÖuy˜©_¨Aû&X¹oQ:_n|Òå4嫽QG*v®4šæfù¡Êpõò2Ü1m±Q¥ršx§Îúv¸&‡‚@ú¼X!¡;ˆ—SÉ;;òˉℛF®°Ô\O½è·““þ2¨15Sqh6Z8,ÿ_SujÉ<ËA¹ÁêZòl)±ÙÉk#IzèYg(߇u;*÷c÷Yi/.u&ü%évîn±U˜LÐcnê•$Õ“Çšìº×urIaÍ>=WJ¢mJ°¸A¦îÊ/+òГz¨²³7aÁ w§Þï ‡ž;_$9vÄ]ù¾@×·÷+|¾/ËĆ[rqýÔ„ 2Ø>Û a‚8ã¤0È#¾,ä­=;¹œûá²ÙŒ{9ýpZ¦9ð¹çøåãÔ-x‡…z_^ÄžïEÎQZàêDú¨ ¦Ñ¬2Š¶Ú&Šž.˜f­÷›N¡6kfYFœ¦VŠ½¦Ô¤¥I¢ÒH•°ã-ý¶¯WK¾@$Ý9ŽÑÙÁÙkÉ4¡ÙºSqpúFÛËƵì6ÛžÅ0p(FejG3Úq¾)ÿ½%v¦O;θVÛ#.õm [>ì¢Î¥Ü)ß:ûò©jŠ˜Ä~É«Ûè(ûm’¶"%1¼h÷6:ö·^øB¾}AtU_«9h–ítH¯3Àá ógS½ñõm£e—¨ŸÆ²T¤œÊ—Wl*ï­¹hö)¿ßm…}÷½=÷j -endstream -endobj -222 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 221 0 R -/Resources 4 0 R -/Annots [ 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 705.770079 491.179134 690.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---hostname-override-argument-is-not-set-manual) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual) ->> -endobj -231 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -232 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 611.570079 491.179134 596.570079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated-1) ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-manual) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the---rotate-certificates-argument-is-not-set-to-false-manual) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.986019 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (rbac-and-service-accounts) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 402.470079 491.179134 387.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cluster-admin-role-is-only-used-where-required-manual) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -244 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 377.870079 491.179134 362.870079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-secrets-manual) ->> -endobj -245 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 343.670079 498.679134 320.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 338.270079 491.179134 323.270079 ] -/BS << -/W 0 ->> -/Dest (minimize-wildcard-use-in-roles-and-clusterroles-manual) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 304.070079 498.679134 280.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 298.670079 491.179134 283.670079 ] -/BS << -/W 0 ->> -/Dest (minimize-access-to-create-pods-manual) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 264.470079 498.679134 241.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 244.070079 491.179134 229.070079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-default-service-accounts-are-not-actively-used.-automated) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 224.870079 498.679134 201.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 204.470079 491.179134 189.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 185.270079 504.679134 152.570079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.454036 177.320079 496.429134 162.320079 ] -/BS << -/W 0 ->> -/Dest (pod-security-policies) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 134.570079 498.679134 111.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-automated) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 129.170079 491.179134 114.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-privileged-containers-automated) ->> -endobj -257 0 obj -<< -/Filter /FlateDecode -/Length 4115 ->> -stream -xœí]K#·¾ëWèlÀ4Y,¾cHb/ ðÁÈaVÙµÌXç¿Ÿ"›b7›Òhv,ÜckÕý©šU¬UER-I%ý÷µ¢<*á}pÏ—§Ó§“ÎHúKÝIzùzðÿ”r"^­ým (}~â¸õÂ.ð#Áþ -ÌZy<ýøÕé×qSꬅTÚh<ÿö‹8N…àÕ¾ˆ§n¡“&"V8‡JÙ}‘ÂK2'"Ô+ð``_DIÞ­&Æ(%‰"ÐÞÍd¬2 1´50³¼V› '2EÒ?‘¡a%•s0³ˆ.LèT†^pÊÛ ŸÊ!ƒ0³Ç¡À„0aT9%HŸ´J©KBïzf×d…3™ @#اÁ°Jë‰= •ïQN8%[„V††üDFiAæ=±TÚ+'œ¡ƒµnÂ)h%´Ã™=Ú 4ÒË §€Z sÞM8 ÂP¨ãÌc„ÑäÉ §Äƒ0nÂ)‘) TœÙã´ JAÍ8uAXbÔÏ8õFD/Ï’%JJ—ˆjÆip‘5~©–š&e©‰=ZʘÆ„Sƒ”2Áú §äÊ™ÁÍò˜:4–2âDFkʙڇ §Z” ³<¦ÑPÎŒVOdŒ¢œi(ûÎdåLPvæC‹ôB˜pª¤œiÉC3K9SS¦ŸÈxJJÔ3{¼§œg™€”3‘ØØ—A))g*ª*3K9Ó;9áPÎ4ÎM8EšI€¯göRÎŒl"£%åLÜ„SÔ–r&JœÙƒ ´£ ->áÑSÎôTZ&2)gÀ™=VRΤì:á­±âú5§yª5˜žR-%¥YLLz™f„}³\ÚŒ¥—Iäo?Ÿ¾y ©Áùçÿœ>~•¦“ÖÑ´DCf#e,Y§TÚŠÕ §É" •ŠÛ†S:lí0|é¿š’î"`Qœ© ni†P¥)Á Ъørb¸Ðf»תµR5J^YšÙÇÐ ïãsNÖ¸’Ф«FŽ6ûbÛ0tp‡ëÖJÕÈ<5ö÷¥çAíð z¬YãÝI— Úñ;<4\ƒ@¬ô4Ê®ùÐ+ûp½ÅÂÈ¿a‹¥“¾‹ÅÇ{•‡á]…ñ gÉ¡ÃוÇÓÅAÆcxWyÎj†G9¨GLqWy¼ãïåsÜ·VšF/k=bö5´Ëx ï*ÃYÍ`;Ôò¶aèà—­•¦±yjìïÞnNvǃëyÈu€áÝ Âm*ÏŠØá8~Sy¼WCÔªç!׆ó!Ý4vhǃÚáFí=×Ø<5ö÷ ¶XXožvBw?9î&7š!z„è¢÷n±t!Ê-ñã·È{!z„袯¢ãP|þDw/t=BôÑMtùGPµeo÷3¼mÝu[)»xkg»ÅÂ.ŠËq̹£ÿ,,-ÙÙ!;2^„¶ôË@ÝëÙ—Ñ4òGºÖÛÌp¶= •€Ñö@'m†Ò·l3Þ˜fx—ƒ¿wÔáë¬INlJøE ï²&ÃY¾ VÖûÂ8Ê69,Ï ÷­•ªQ‘Ëj‚hr¸‹WþB—8ù ,ç1­jyë0tr‡ËÖJUɼ5öù¥çÂípáz.rc86d‰ÚdΰÃÀMæ$ª1j Õs‘Sí¦µC;.ÔŠs¡6Ù“ykìólðî<íÄð~LrœÓqÄê«G¬îÆêû}¬2SÖ°ƒ>Áz묯¬;1ùüIð^ ±zÄê«Ÿeüi°”ýó»SX¾8,œ­¶BÔÆ’Â@kaZßãùÝÓé›?}÷ö»¿§…÷»§Ÿ¾%W =l|¼ùçùÝÛÓ_Þ‘‚窰ÔÿT¸ûU@üÉ+« A…7¨ð÷«Ð”à•U8}Ýá~÷x^Y…ó7Ñ}£ -eó7êYRB-ƒSAr‚Ž_,•¼ýë÷ûÇ%÷÷øۂï*¬¹-ønTѹŠüã5¢:ÛË×uW]îpKl¼@…;„ŸOEç*+¬3õÙÛøq×¹«=ôýýh®fªg¨àý@Eq§ÁX&QÈ:‚–±È¨^c|%oØ -‰”÷ÂÓ#ÖjÓž¥NÿK¼HiT~.çÿ¢g¿È² ß·s$[Ñ1Y»<Ò1,m¥ëèC¾Æ¶×R{ÈôR»Æ,m¤ëZ»Io‘{höĶÒq‘Á¥]›ßgýÑŽ\ÖÆ~Œ_@Ù}gt¶–~${m³È>pY¯Ê¶H&W|f›=’ì(ç[Ò5˜m÷‹åej+Ò¼©³uóý#óÜøÑñÙN}i×¾ü¹ ñ¾æ)—îÌåÌw Ö¾«6ºÅ¶ÔNÔõáÿ§€^àœ[ÿp›õV—Gjça‰±äã(–ç$ã—qŸ!û:ù¸´Q|YíúÒ®}ùy8ÒñËeç…ß—£RsÒÃ=Ÿ·Ïä—ø^ñÜ/_ÖØ]Û Õ2.uÄ©]m¢ßÞ ¦¾ê‡¦3ù­ØlØøÎ훹ÝÚ‘]øP O%&æœÄ/½R÷ßYœÈÇå~Oç¾÷wúÕ„k5øò…ùõÿ%yf[ÌÝENë0ºµÿn⢭˜”Š÷¥¶®í'bÊ÷JÁ×ű¹ãhw:®Úà›“ÃtÐÛÊËægÌûì›3ôh&„-ó¯GS3.a#¨TÙÒ^Ñ¡ó#;'9ë3:ðóT«wW5Vv«×çúÏZjŸ¯Ìëà(m…¾r¼xÐ%¿(ýðáÖ(³fíŸgû}q׶¥ - e’”R”aŽàKÎQ(ë°:;¥´YGÑlJ¶Y®¬:õK-y²‹ŒõúäJgJN$ÊSe^[s/´‘QuÝÜ&sHž7×¹ŸZ;,·d[?]Xn¯vMëôj®{ÍŒaÜ™ºU´òZV"Áõ>KÇïÛ¨M~PÌ–‰_k¦+`úwóÜ`×v"K§Kz^w„wš•doœttmàÇA,[0íG‘_Õ§ª,ø‡mŽ…2óYy¹D`ªy¯°÷"rÔö(Ÿš¸»óðF›oó¨0²í@ËÅ×g_S'¢]­:×3³F‹BóÒQü|Û¸V–¦«IBt~ÚZ\åaXÃëCvŒn)j­k=[Â\»âØ@«vX¡.[Cõµ‡å9õ‰ ¬õ–Q4vq¦É…® ¦™sW›ò‰ÕKË%őݬBöXRza…A.Ó²ís”(èö;bg»}ÿòƒ3du¼[Û[oT\D - 8›nð>ýz‹Hì¸ Z¸twì?£IïÜĵÇÈ«É»éËBóöVô¨Óf8FÓrúÃ’y)HÛ²v0Nóø‚’Ú ¿ï[Bà“,%Wó‘ ¾”ñíxTRa'jûf•ÀØð¨}¨[E›7‹>Œ§‘G"Ę’ñ'.4¦Ÿ§/\ÂÏÆ ²Îz(Ü©ämuÞ¹4ýJÙ§*•¸LŠø[Ï˯š±“,¿¼sõtR!ÞÿhT³LÊÌ~$êƒÀŒX>pŽ`>”µ-¬Ÿ)¨Øå¤t¼'e%©MùrjãæC0¥7ñzS.ÓK"‡raQ<éJ«¶pì}¼i‰ã…Îg¶šbl±™ÀÖ rÙÖ`»ð*¬´d Ù‚’©k0Åe(²PCå\C3»N1ú‹,8Fç ¼œH­^£CTÅ xdÅ43*TÔÉJVžP¼h~-KÓHdÖ×kP~Í%nÝç£*ŠÜºœ†r¹5S™rUÊ·KCñ|3¥ õx¯Å>–|”QJìTI]{8Þ T¹–žØ€—SÌ;øñdÜ@Ú´\!MzÔ¬Ý -{ÙÆKC/®¢Ð,X|w=þ»¤ -SјyÒA|oT•øYSc³Â½“8nkÖÁ‘â/û© Jmǯ ø‹æ8ù˜t«tõX‡2—1<ÝSš¶5yô°ª£®Â1…ÿÔ\ÉAYŒ u 6u(?vp³ÓÔP¥Á^”Yņ»©í6ØÖÜùÈaWWk'Z°lÌð’ -®á8ô}QÒ`µÚ5e l†QRhpK£ .ÑZ³“ -¡¶ UÜËé—S*s  „xW±Ž_ÍÜM½Ôù¿$ó–ÿ>áùïåÎÅ¥Žƒ¬Ùjní`^Ét¡ð* *XÆ€,í7Xù&kÊh¨u€åkl—Ë–Ø‹¤ªTÕW9hš uèÆ_zlž1ð²òbȼ”›V°—S]:'ãoCžë€Š'¼;têÛkº•ä3k’΢h+éô*»Nx£tʆfYgf\Iu}´9:êb'lOu{ [™åM,õ‚‰ b£êFÅ•†ÎžÑw‡×‹yÏ&Û­©½¢­‹hMxcT§SÛŸÖš£ÓÏŠ–àmªmi{ºNrZh´©v'|Œ2Է˲€áJ±`ÒR(jº L¬¶èŠM6_VÜ’zì‡^ruNÑÐ_¸§ g¥:ÑpVìF6¶[*^-é:2|8»Ö;Ù$ë\Ò0˯®(6I]°­nìu—j{fÝÀfˆm3SÙ.3É»òß=±3¼Ùq$Õm(_·5dü±Gå4èsˆÓo-åø#£Æ¡gû%Ͼf¾²Ý&)(\“ŠŸXÑZ:EãmÇ„Gz!\5•?´sYÃ.=Ï»òßšª…Ο·H»DõÔÅ¥¢ >þ4±ôäA9¹³§yÙl…ýð?Óë -endstream -endobj -258 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 257 0 R -/Resources 4 0 R -/Annots [ 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R 275 0 R 276 0 R 277 0 R 278 0 R 279 0 R 280 0 R 281 0 R 282 0 R 283 0 R 284 0 R 285 0 R 286 0 R 287 0 R 288 0 R 289 0 R 290 0 R 291 0 R 292 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -259 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 790.370079 498.679134 766.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -260 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 769.970079 491.179134 754.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated) ->> -endobj -261 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 750.770079 498.679134 727.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -262 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 730.370079 491.179134 715.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated) ->> -endobj -263 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 711.170079 498.679134 687.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -264 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 690.770079 491.179134 675.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated) ->> -endobj -265 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 671.570079 498.679134 648.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -266 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 651.170079 491.179134 636.170079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-allowprivilegeescalation-automated) ->> -endobj -267 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 631.970079 498.679134 608.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-automated) ->> -endobj -268 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 626.570079 491.179134 611.570079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-root-containers-automated) ->> -endobj -269 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 592.370079 498.679134 568.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -270 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 571.970079 491.179134 556.970079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-the-net_raw-capability-manual) ->> -endobj -271 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 552.770079 498.679134 529.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -272 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 532.370079 491.179134 517.370079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-added-capabilities-manual) ->> -endobj -273 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 513.170079 498.679134 489.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -274 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 492.770079 491.179134 477.770079 ] -/BS << -/W 0 ->> -/Dest (minimize-the-admission-of-containers-with-capabilities-assigned-manual) ->> -endobj -275 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 473.570079 504.679134 440.870079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -276 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.970394 465.620079 496.429134 450.620079 ] -/BS << -/W 0 ->> -/Dest (network-policies-and-cni) ->> -endobj -277 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 422.870079 498.679134 399.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-automated) ->> -endobj -278 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 417.470079 491.179134 402.470079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-cni-in-use-supports-network-policies-automated) ->> -endobj -279 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 383.270079 498.679134 359.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -280 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 362.870079 491.179134 347.870079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-all-namespaces-have-network-policies-defined-automated) ->> -endobj -281 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 343.670079 504.679134 310.970079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -282 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.962581 335.720079 496.429134 320.720079 ] -/BS << -/W 0 ->> -/Dest (secrets-management) ->> -endobj -283 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 292.970079 498.679134 269.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -284 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 272.570079 491.179134 257.570079 ] -/BS << -/W 0 ->> -/Dest (prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual) ->> -endobj -285 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 253.370079 498.679134 229.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -286 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 247.970079 491.179134 232.970079 ] -/BS << -/W 0 ->> -/Dest (consider-external-secret-storage-manual) ->> -endobj -287 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 213.770079 504.679134 181.070079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -288 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.506282 205.820079 496.429134 190.820079 ] -/BS << -/W 0 ->> -/Dest (extensible-admission-control) ->> -endobj -289 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 163.070079 498.679134 139.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -290 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 142.670079 491.179134 127.670079 ] -/BS << -/W 0 ->> -/Dest (configure-image-provenance-using-imagepolicywebhook-admission-controller-manual) ->> -endobj -291 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 123.470079 504.679134 90.770079 ] -/BS << -/W 0 ->> -/Dest (the-v1.5.1-guide-skips-5.6-and-goes-from-5.5-to-5.7.-we-are-including-it-here-merely-for-explanation.) ->> -endobj -292 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 481.202815 100.520079 496.429134 85.520079 ] -/BS << -/W 0 ->> -/Dest (the-v1.5.1-guide-skips-5.6-and-goes-from-5.5-to-5.7.-we-are-including-it-here-merely-for-explanation.) ->> -endobj -293 0 obj -<< -/Filter /FlateDecode -/Length 2240 ->> -stream -xœíZÍ«7¿÷_Ñç@:ªÒ7Ã’M kxò¿æ9aœ=äßOI­*UOkzüìä”g3žÖ¯KU¥úRIc˜ ýýèŸä`I)ÇàæõÃôq2Kô†þTŠÝ ¾~Ký7D\²ñpi 3ØùƸS›|!80m‡CˆÌDÃ?}5ýª§„ܨ)&NÑ,p ‡ÂwEæ:)L\°3VxîLD0µÒM¡«^ŠÂ‹U)pƒA¡îwhÔ¼qdY Cç!òº‘†vÞé¬ý«ÍŸöæþ -V!B¯³;€;óã ówÌbœ˜¿‰À¡ùñ†ùqo~p׸Š`%Q£{óÃØü–¥+yÝHC;¯”Ù–?óñá·Ÿ§oÞÁbæŸÿ?½ÿª&æÎJ²’ã$½™vÚ~Ú/éø’Žût åOœÏHÇÝZv+ƒÕ¼$äKB¾$䟒ãÄ{n·z+M_Òñ%ÿöéøœv 2‹ž9;6¨•Cº‡+>œCf0ÛŘìÑÍ¿=íh. 8£I‹µ@ïNh¼[,}8¡ f±!“ÏhÂbS¦E›3ò™>1-ºxB“ÜâœÇ|¦O6‹ Î:<£ ‹KÖfs›)Ó½AgOôA“dmBnñÎx{¢¢Y¼Ï>éƒañ1L'4–t¦Çx¦¥tÊÿ“CGÍúO|Š¾Ô -—àL–m -'1F.—œ½M“–x'æ1º%Þ‰yLÛ}ÑYÌc -K¼ó”£K¼ó˜)çïļ¥Ê•îÄ<-iIwbÞ»;1o‘v®QÌ·"4ª\žj„11E’h3õªí*—4¹“o×sƒûqðêÛ‡ B»þ s°‘R̆æLÆÊÖ̦oÞ|ÿã?ÿý–Öòð~úÏ+cÀÑ'ÒÇ¿þïüðfúî$œÈÈ›ˆLÂhl ŠHñj2aŠˆüð懟~üsE Rëñ‹ ŒÂ¿V„…âé犸çëÒ-¸-ªîø:чRÞQ€Yc¾aÚ7å¸#Üûí½¥ÇmìVú„ö]hæ#u7›”CŽúÞ%ã\D0ã…*Eê·k -…¦DÚñq{.ïªb4.÷ÖE‰ªtù+_ç<«¹~[ˆçÅÆFëõ‚:mžÍ@l¤òžõ«r™§oÆQ||{]ß,jƒÕ9®­—å±®d™Çí«ÒÃ&[¹žÉ%Ôh¹ßøæ›fƒªGêv¨k-ö|ìößaLÓt®º³í̶¦ú¾Ù–ûî©ûoUv Ý?,§ðªtí¹ÊxzáUlÀæ÷¢Cnº¦Mób_U¾ëÞ¿¢cåsjS{mÓMî¶.‰[ŽSìvýB_»à¹/› tm-¶­m ¯|$>nº2 ¥s³§ûî¯3¼:ÚQ -KTyçznå8•K—¶6²|Ï6dŸÇ{ö+í€9·_ÓÍ^Åö½¸ú”\–Ø~ìöª9 xTœcUçךÔé?%ŽÚÃûõ¿¦6/)$O *õ‘Úê!J¿CíÎ'»Æl—X;š²7QoM-(õú㎦I/-!œlrÄRºì²ÛEë‡{\9›áÓV®¤t‘ipÝ»š+·½¶¸47.ëÐ\ò¨B¨¼{ÚèJuØ¥ÊûÍí¯!T‰jÏâvèî+{ouÉÚÃgÇßw×±>N—¢¼­o[á%ù8ùT´Ó¡ÆèÍõHñŽt&¨øL{4i²ï ZæSëïÄ…ªýtLG0 9¹ö»²4ú­?¢Ó?5'­·XüöDpBt˜Îþ¡4|G˜ŽXø‰pÛ£^˜P°u[®j®(méÕ¶Ç,Ì lèy5e¾çiv+)È£’›àH3á²úr¡·ÁäŸÛFAT¡Cb°3tš¶3ìïÂ`ý4J\‡)/3Ó¢<Êy¦€¢º6(÷3-FåÎ3pH¬½F/CA0dë¢Ì*¥² ž)Å!Nü4€ÊUÙüÚ0kGΔ÷ÊktÆl`â@rB—™n­Ó®qóâ©(T©OÍlù®Jõrßq«6j(•‰‹‚±ü¸‡CñûÚ$7xשÔ|™|Pû^+ŒçÐÓ U|N¦ÇKGcbSQj2FjWþÝJ…´TžúP®èQRrSད4¤ê¸‘ÀÅN«ÌUö€ïdô¥è -µXl‡*“)'WþCC¢$ÏÍÉï_öpööXªO -endstream -endobj -294 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 293 0 R -/Resources 4 0 R -/Annots [ 295 0 R 296 0 R 297 0 R 298 0 R 299 0 R 300 0 R 301 0 R 302 0 R 303 0 R 304 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -295 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 790.370079 504.679134 757.670079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -296 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 478.142757 782.420079 496.429134 767.420079 ] -/BS << -/W 0 ->> -/Dest (general-policies) ->> -endobj -297 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 739.670079 498.679134 716.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -298 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 719.270079 491.179134 704.270079 ] -/BS << -/W 0 ->> -/Dest (create-administrative-boundaries-between-resources-using-namespaces-manual) ->> -endobj -299 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 700.070079 498.679134 676.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -300 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 679.670079 491.179134 664.670079 ] -/BS << -/W 0 ->> -/Dest (ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual) ->> -endobj -301 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 660.470079 498.679134 637.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-automated) ->> -endobj -302 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 655.070079 491.179134 640.070079 ] -/BS << -/W 0 ->> -/Dest (apply-security-context-to-your-pods-and-containers-automated) ->> -endobj -303 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.673228 620.870079 498.679134 597.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-manual) ->> -endobj -304 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 477.090267 615.470079 491.179134 600.470079 ] -/BS << -/W 0 ->> -/Dest (the-default-namespace-should-not-be-used-manual) ->> -endobj -305 0 obj -<< -/Filter /FlateDecode -/Length 4758 ->> -stream -xœ½\ß$¹m~ï¿¢Ÿ l$ê'`H€ÄÈÁ6|öÂ~ò°×¹±Ì8çÁÿ¾?ªJUÅ®î™Ùd³ÓEªX¤H}¤XÕe¯?Ÿ,þËÞ.9—ýõöõòóÅ,)ü«#¦ƒÊþ¿)\­ñi ¶Ä®_™@iI%¸¯¯ü·;”Ã_/þÅåoó9öê–R¢³áú÷Ÿ˜åiI9%VËXRX!,)¹V´ L,EcA¼óGV‚¾ä ± †w.+¬ 5È'KGV.Y¯± †-!),k ‡uƨ<(b¼'§ðlX"&=jk(àrY|J¤Á€+añ±$ ÈXðœÕ€€ t >jH@ºx¬\•]¨x ÈA а€º8OÐÖ#Z4, À­7ÅjX@À[olÔ°€¸PÓhX@@\ÊÑkX@€\„RÑ°€€¹ìÔ°€ºXîIÃêRˆNÃì’ÏQÃî’·FÃÜ%™*º €5,:.d3iXà»dMÒ°Àw±Œœ†ðê‚8Œ V—³Ñ°Àw]6^ÃÜu )@å¥k4,ðÀ]`‚–¹».§aî:”øcÔj¸  z9]° ߃çHÃ[Ê pפ?eM­›KÔ° wm†ûT^YlÂŒ+볼؋†¸‹DEà.à3kXŒ_Q†¸k ™Zãw­+FÂÜEÝ4,@8,€†Èo‹5]•WSrÖ° wKNÃdáÅd ‰ÊK ÉjX0^ êP "pé½hX»&iX»Æ£ìQyÐ…²Ó°u xX¶ÊšF±º¤ÐxÀ]cáaÜ5& "p—Ó¦†11Áe  à‚*ØiX³_JJQÂX x(ùT^\p4,H„ÈRyÐÅ'¯a -ë¥PÉ$]È9 ’ƒ.(4,@E°‹ê[Ý@„‹º?ðЕ¢†@²%ï5,H!b?†YÕxÑ-9®U^Ï& Rò R±Õ°{©%cÑkX€_¸\Ò°j€g½†©@, Š–ìP™k< ]PdkX€J3kX}\¸TÔ°Ë;M ¥Êƒ.€ àÞl °ùÁfÛ•](x rv¼ÝÌä ]œq 6y¿™4,(º âÓ° ˜¸p™¬a`l<»_gº°c’³·O†”€ýTBA·Ú§‹£Þc_àBÍ Jýlo,v¿ÎtaÇ$goŸ.Œ{c%ZÎùÕ>]´õû¾ çÚù/`eí~éÂŽIÎÞ>]:ïÍ9GUûtÑbÔ{ì“AÜöÄú£‡ô!çtýìÖu§‰„1+ûmöÈ —öÜ_oþÌôƒ=º°f.òÝö=H÷O!éÍŸìÑ…áãña|‹Vúë>~hx:Óöéš¿t‘ïôפéñW¦¼¥Åë{tagx/üõQ¼ $ýuµü0Óöéš¿t‘ïôפéñW¦<¬Åë{tagùKøë£ùËö¼#ý%éÒ/z¾›éûtaÍ_ºÈwúkÒƒôø+S]¡Åë{tagùXøë›åãÂ3xOèBÎ)Þ›kfƒê]í]Zƒ`Ó4êÝÙy²î>:jÙo¢­Ó…í¬Ó%Ô:¡•^K úë_?°Nv’«…ˆo—«'ïÝÇJ-Nô£}º°÷tÉóÞ¤•^9NÞÓcùuº°“Ì-½÷Í2÷ä½ûÈ©eƉ~´O¶óž.ùcÞ›´ÒëÈÉ{z,?°Nv’Ç¥÷¾YŸ¼7å÷;ûÍ;ô£}º°÷tÉóÞ¤•^UNÞÓcùuº°“¬.½÷‘¬~l‚ýëç‹-‹3ý ²OãP@wá(Y—¯Ÿ¿^¾ûþßÿã׿ÿáj¯Ÿ_.ÿùKc\ÄïÍŠ¿údÉw¯ 7÷‘=~-~ËJs?ž×1>à7ãƒÝh|œ¶¿B–kcÛ8\Ïÿ¸~ægL¼_åøŸÖñÖ¬)l<å¼ví®kXéR_>Ÿuv›ÎmL=çË&ç¶éÌrÿëúùû§æ“?Ž ­søι™æ¹Ùà7Þ&/ÐvŒóƒ{pnüÕjEÜÔ“ÞÁ,±?!Öôæ9}Yç¡Îïæÿã°ÿŽëoüísøÂ6®2ø˜ýż:f³ƒ8@seèÝç'n>p«œÊg9e\³êr[ÇÊk³¾!o1”×óCZíÿ·Ïü eƒ?üúòÝ¿lëeš ·¸BÖ”Šü_0ÅHú+?ªYJ6áúËï.À1Õ“9Õ‡5gíª§ÃjÑ6…¦üüg,¥yÜnËæÁ\#û$\ˆ‹qVD½y†·1rüæé:Þ­ãµÕ«xXDR÷p²ƒîÞòM»bÔtâqŽÚ ÷PaåÕqq=¯Û2„ÛiDMú¥úÌc(~˜!DçR’ô7G”t]’æ"ªÚÞ4 U;øï—ÍG_Vk¼ÔqÏ®~î¯ÛçêüH%9I³}“˜Sûì;4ÅËGìÞ|OÛjkJð[|·1Vã¤ÅH‹áÛX“êõdœæÓ5ZöqÎhXõ o´Ùm¬k»ÅzÓ[¬Í¾ß2ÄËvMå‰Ø×ä™uµ5y67d÷s£ùoŸUêÚN£j¶ÊÂF‘Ì˘»zn:ÉDAÌýf«VÑÜ‹=)«al»nHG¬lsYõoUA³ó4¦ˆ1•·ùòc>ºóÎæ¦ï‹8oÓã±O±ô$Ã?ZÏOú°ùŽç¼þÝÅsåo¶nåÙ¼rNÏq›úºz™×jÛñÒ*ƒ;úpSàqþ¾oM÷0ãY ±V’ˆI™§·qÍ·UvÃË6þ¤²ë2ßãûg°üålÞ¼=ÌÛNm¾;£ýNæÁzßaǺ;0»Ùí -àûÿ>ÚàF÷4” îÉùrwrþë¤ýuè®_r\ýЃ¾÷çüTÎGôñftøŽó÷fÿžÊÿˆžü0±ÙzYG=ŸŠŸS™ÑMÄFü¿Ä`ð‡ëì|5w(NeѬ·ûYÄ#Pð›Ä5®´¯evû•ú—±í4î>?´Óø‹ÑÞ´AT¿¼^X!âÌhd¶Þ,v#óKÌk¶£ØU ±é âèåØ!pœølÉb8¸Ü ;ßôáYûXºÏAìªË©³Âým¬KÂgÄÛ—¥=õU¥ò«“š¨6»ÈíFB©Ò©¡ìñÝO -évQˆŸLíáÌÎ^s­Â€÷¶@ò}\iãÒí¢ŽÛ¤…î©ÔGåqji3?T¡Îݼû´›x–4ñ[Å1Ô>ÎäÈh¾6YÄ;o¤ ¿^BRF‡&´Ð“Dr;9›/ƒšr›*,ÍFã¯ïóÿ+T„Ne䩬ï!ůàGã"¼6;yž$Iu¼6Ö§1VL—M©Ç¬œ/›2žA·î36QÅ” :ßjí¢c™l{Ôu2CX›ŸŽ•’hš¸Ü ‡ʯyèúRå;q1Zî¡ËäرóU’S÷¸å÷©t}»\óx«‰ÍïÉú¹]déÙn\L‡b…A0úZÉmµvtâwD¶c‘i÷vù륦9GÁñ͈H–_&+/‹­•¹~ßÿ¹øëoÛ7Ö<îLG ×±u"ËLÆ/“ÌO’ùå’Ø— :/`mcC‹†žÇxíÇéf{i;‚ÚΕÄ0æP]]gIÌL8!Þv³Ø ™úf$ìõšq¸ ñ›LšVüí¡ óàÑHÉW!G> -endobj -307 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 740.570079 409.271317 725.570079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_RKE2_v2-6_CIS_v1-6_Benchmark_Assessment.pdf) ->> ->> -endobj -308 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 311.068925 661.574079 469.171708 646.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke2-1.6-hardening-2.6/) ->> ->> -endobj -309 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 646.574079 183.998124 631.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke2-1.6-hardening-2.6/) ->> ->> -endobj -310 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 351.653153 220.574079 461.230790 205.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -311 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 205.574079 165.615800 190.574079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://www.cisecurity.org/benchmark/kubernetes/) ->> ->> -endobj -312 0 obj -<< -/Filter /FlateDecode -/Length 3687 ->> -stream -xœí[K$· ¾÷¯èsË’H½Ã@$FŒ8ˆ“E|rX·=6‚Þëü÷óQU’XÝìÏ:0|Èf¶EêAññ‘RU‡³ÇÏG*Wk+™Ï—w§÷'ïJòø×{ý%~K:ÏÅ¥ÐrMçwB âJK±äóõ„?7MÝýzúê7§Ç„st­åÒù‡o…ÅäJ-Å'ƒÕÀò VJ®”˜²ÁÊÁa‹­Y,ˆ‘ -G¾gˆÁ­&‹18Æj°*Ä .îY bÄØbAŒÐR1XÁCŽ½7yÄ3S4x!¹ ¥g‹ƒËµÅfò -x¡D‹Gärá‚Åk.眪ÅcÈ’š/A–˜½Åƒ,LµX¼ Y(“7y%ÖB¯@–í4ƒW! ¼«š<È⳯‘K­2›¼ž¯¥Þó¢O.U"oñBp ¾I&#åbð"dÉ>5“Yùhñ²0~,p"Q©ÕˆÖ(ÑMž‚ÅK%ÆÂ&²ÀøÄ Y|É ‚œà’…±Ç-²±’ãÊÕBX›ãRÈ‚Ø’ãÜŠ…äx1X@@²$ÎP€,ŒÈ5y…[X@² ƒ…D%2YX@@[†·XX@€[ö-XX@À[ö![X@\ˆé-, .ÕÌ ®Ô,, `.;-, €.½XX@@]J9ZX@€]âš-, à.qð0p—#Md[Xtt*YXÀÀ] -¾XXÀÀ]„Q´°VuðÃla|ÅÅZ½… ÜÕ³… Ü)Àä‡$ ¸¶`enànL>ZXÀÀÝÈ1[XGqÀoVÀ]@H²ËÈ€µ°ù¼H`2Q–XX€»¡!ý1 ´r¡¶laAî† -ó™¼æBƸ…–]ȹYX€»HTdaAî>«…Àx‡Œ-,HÀÝ@ÈÔ¸bó$à.ê†daÜÁ ¿¹àáº&¯9ßjµ° wKÑÂdaç+ÄäG -ŒGjaAî"½7 2p×'" 2p×3Ê“Y¨F P×€‡°5bŪóHañ€»>À¸ë}idதM rB¬@@‡*8ZX+»VJ¶° 7J>“—ÚÉ‚âAH€,“Y¸°…(¬]£V-,(²PŒ”YP2XX€ŠÀµ€êÛ<@¸‹y>`È‚JÑ ™«Ù‚’2ÎcЪÅËÑÕ¸6y¼P,,(…Rq°°g)Wôà”K@ ð[XPdA¨XX€TäjDenñdA‘ma*]ðB°° FÈ‚jЂ+N™Ù[X€ ³$TmñØË9³ZXP9;)-,@˜à¤ ¤4y0aaì#‡ída?8lâ˜cò %¶° Ö(ÇÍjaA­%úha|SΛÅ‚æ! *> šÏNÊd ãàyoaA çÍÈ .å¼Y-,häqÞÄψÛFYΛÅ‚Æ%¡D1yES3☄ó&ÐÉâeÈÐr–ófµ°eΛ¨èÍ+*çÍb^wS2Y<à.*Óla8o¢²µÎöÀ› -ê3›YåÄYÍèMÈ­æ•ö"[óÎÀ|åŒd^@Lœ,k6o VÁ Þ¼6ðÀ_Ôc|‡ Û퓾¢Êp‡‚œY‹l²!,Õýï©W\aÑYdž®°¯(æ²\!éîÑökѯÊh¯Ùž½×ûä#ú/ì“ÇíÝÇáïÞœP¬o -óY­ˆŠ5¢ôFMöæÝéãÏÿðÇÏþò%Š¬7O§|‚ -g­ñ‹" 9Õó¿oÑ®øMøÌø¿lôÑÏÓÞÎûgá×5¾ÏU7zçcžtÙ?ó>ïXÃo}eŒ¬3æL£oÞ~õ|½_\ŸùëßçWûé<>Ê”’’£ÜÎñé?Ïo> Ç¦õ(ª›jñkyYZÔ0Uöÿ÷¾]œ§öÍcõöÏ»¨©­±·[|•ÉFߧMÞžÛnÀIü¸_z»TÝ×y ráu=<)Uïæº8¸Îe—­Ý˜¨­¹úsmÃÜCOCSç¼Ö S^î8\Nd—ùº ‡k~‹ÆÓ÷ºÛ˳:ä[N]yµfØæ›®Ÿw÷¯»|C?—­}”Ô<ùh£CÈÕZS¯cÞÂEé^ûàÎï²½‡Mça÷¯ƒ<ï[ùV/c¿]NµvבZËôÙº‡ýF Œ¾oU Œ>®ôþy×eVsº?†};ÿÉàhúp¸ïYýÕ;¿úzŸGëàø¸oñ›_‚ié¢Q:ö}Å^g|ïk¦¬t¶÷•8›:¨ æoå>êøN/òh!”Ö!ßëåÛ=^ÓŠ§>ßÓ6ÏïßÈK4}®¿~vúø·{2=ÌÙ\m|“Ê/5¹ší²ý*¯á´V}:ÿxúÛë²sôõ¹ôì¿^>;ô0ô:sƒÊ)ÓÏþG9Âë´=ýøÎý±¬Çé.Ül¨Ûy.ñ³ú>ŒWúf(Ê×TBÒôWëû0ÍóúVñ=rØOÆ]Öš;rÌÈ—E›6º¼6îã]N~—ïí¶÷U>Óe{¦9Ä Zç°Ç¼Ïó´°gÔ°·Üö -ö&²w s„xÆÙgZ–K,›Àæò”½ãOǪov<þýä÷òRù˜ÜD¸HóçX²éÕíöÿ<ílí-[àóáËý¹BIX6%y®[S¨ê1ÅôÆ»¼à}÷sûêÓÎ’#¦”Š±íÈŽ[‘gp& åâíÑJLx+Þ:âO9n¡_Øx4NûO[úz¼¹ Ÿooúz†[æá¸Ô÷Æ>½5åûSîÏ“C§Èã$¢¼t|Îì$C•v\©žäÞf3]èÊç#û«Úïg¯ýím//tÉÃüíÕnÕØûo…Ô;87»<ܹ¿ié;¹ÆÑXäëIÞ´eƒÌ¼bâ²÷~ÎÅa†Ø ]N^Ün{"‰øýãŠCR mìFƧ1Lž€²¨?Ü6ˆ™Ã=Yvï]ØÉò¶ru´·ò%å!3ˆkBÖ}ׄkà‹ä@^Ó=Ñ«å9ò'ÈÛ-Suy§èZuA™ôE™ó9âåÐØï¢^Mª¼#9¦Ú~ÒH Õ&5žÓ <íd.'ƒø‘S3Œ9ùÊjò¦ÉF¬Ã‘xök£ŸAºœÌ~ûliZªÌ^u mCóK”åêT§â ÚEåª"_¿P1"·ØÚœÅÃÖr¾ÙM°Bw/'¤¾#_O©½Ó -Ÿ†ëi"©y'¹úå/‹Šôº« -¡9hòœ^þnP‘&U§<]JÞµY­µˆÄæ$•¤éy¢[\V_¥®PÊôY­¯P½Ñ_@wöž;P•Ê½´!ž€Ô#9L¯›d°¡Ÿ‰•šè‡ò`p’Ótåë¼äL3T“Ÿ‹å Ü=Íy9Oì¼jr™òâÔ”wΫ|~/=±ñ-Y\¿ŽE9ú™íÖbŠ¸(,ò‚Ñk'hè$_WY÷rúþÔÓ\¤›<šBÉ[èPy…óèó9~ÿuâóãQÕ–ÇQõãÄÖYg2ùÖHý‰dùÉ Î°QÄÈ -ö9ÔÕ7 o˜y®=²íYmƒ— yU¦~ Kw=?ÿ>$vÌËx«×øé·#¡®W5‘¨9ŠÔ¿}ëkÎòê”|¢pU×%¯óüýÉý-ɸ?Ñ+ÁŽ‰| ò=j[„+íe†šj|ÇÚÖ¼¹¥×)àá;¯ö£šW˜ý’h6‹å{³$Eo•¯ûo?Ié×@ép}Òþ %ù{º -endstream -endobj -313 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 312 0 R -/Resources 4 0 R -/Annots [ 314 0 R 315 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -314 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 450.884598 712.370079 494.898026 697.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/tasks/tools/) ->> ->> -endobj -315 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 297.976884 697.370079 309.064286 682.370079 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://stedolan.github.io/jq/) ->> ->> -endobj -316 0 obj -<< -/Filter /FlateDecode -/Length 4307 ->> -stream -xœí\K$· ¾÷¯è³Ë”D½Ã‡I#b`ŒÆ]Ál€uùûù¨Ò«ºÙÝ3»ëرÇãÞ®"õ (ò©®’=þ>µø'³59—ùxz{xw “á¿ZbwSÙ_ã“ÂÑ'l‰9ß -Á'“Jp)øçìv-þxøæ“ÿöuìÑ™R¢³áøãka±7)§DAa°Èz…‚IÉ…¨°¢5b) b„ÄŽ/Y bpÉAcA v.+¬ 1<'ë/Yb¸dYcA [BRX– ‡uD*‚³w -Ï¡ô¨ñœ51WT^Ï&§ñ¼71± Vãc Yã1d …¬Æ %XfÒx…}N/B=©<Èârò/Aí…—! ¬+«<ÈB‘¬Æ+Þ„’™U^rÊ—³†ÀxƒÕiX€»Öc¥ÖxÀ]ë -iX€»ˆ‚†0chX€õÍX‚骼b¨ä¬aAî–œ†X… e ‰ÊK†d5,BªaAîby/Dà.ï5,ˆÀ]b„=*²øì4,@\ÜVñi«†BãwÉb†5p—( "pW–M b‚Ë@@ƒ(ØiX3›’RÔ° !ŸÊ‹÷AÂD @–ʃ,œXÃÖ¦ø’5,H²xç4,H² dа)Ñ·š@˜‹š0dA¤¨aÌä¬aA -ù´ªñ¢39®U^Ï& Rbƒ¥ØjX€\Êd8½†x#á’†<ˤYà*`)2Ù!2×x² ÈÖ°‘.xÖjXdA4¨aAvYf$ °B#—„ª5“ä™YÂÌÑH¨¨aÜ™&RåAÀ„†˜I¶ƒ†H~l"ÍQyÅÖ° g'éfÖ° gÈâÈiXÛ”|3iXP² âÓ° P4&kXHÂb3òMÇÀ/%ßÌOÈ7‘â)~[|”|3iXP²„(*² h*Šß“o4^„,®°†%FÉ7³†3o"¢W·²ä›IÝ.î†dÒxÀ]D¦QÃÜ ßDd«åöà ñ™ÎÌ’qfuÇ€½k«ºe@À^¬VIÝ3 €¯äHê¦ÄDf™£ºk€eLKê¶ñ&l»OëU„9$¬™9É Ü‚ÝœcóWŠmûc?~øì‹ïñûÞ|RwÊúŸØF'Lc¶]Ál¿=@!H×Æ…ürFdzFö€é^àωu×¢O‡…Œ´è`Åb÷tdƒ¹Ò—î×öÒ‹l õ´Œd!?, #=#‡0ËŽîV"Ïv'yŽäq¡ÎAÏ®¦v4ýžß`¢ß­mLmT–5q:ăÆg©ªÈ\¦2çÚbui{—(!†h÷s©–É^§h™e­ÿÇEëx­¯äj²Ë“nCim( ÂíÉ’>÷²¸º îlh’÷6´Ò5ukÝYYWʺ åņ2JŸ“CœeGw+qµ¡¨ÚРÎAÏ®¦v4ýž^<÷gñ\ Õå¿ãå…‚²;íŒ1¼Õòª“íô¶èþÅù^œï7æ|QþKÇË‹g8ß*ð2âU;Ë~q¾ç{q¾g:ŸêdÏ 9¯8ä‹ã½8ÞoÌñžr")4ž£üRβ16q™š4âRv‚/¶g•ïSçv&*{ë.p9Ž =/µÞšºUÁ»~ƒEÞKÎGUÖg×ùè²Êi>E¶»~]Q…¼Wø®tOšûK!#ñÓ…¼Wøã -9­-xYëwZ›<À”3å¨Zèë|ôY_û:Òd}v.k)Öh‹è “¯ðGœüËíÈß½:À}ë3ø.l˜sýµR"Jò‹ËñÕÛÃg_þáOüë×ø«7‡o?'²ŒÝ¾É×ÿ £¡ñ œñå‚­Ò¿øûñÕ—Wú”{FŸÒ‹[U€ qÁç„Ïî[óµË´Ñ{9éÒõ²oš(qëÖ¬Qã±ÅOçíbßÎEyÌÄùÜ¥X»Úå/>µŸK¯í;¶ïN[ïR¶JùÝFïR_Ð[Y¾—ïS+'_Ú e¯à ×ʤ}áIYŽM#]3ñ\{û±H¼Óâ34ÈçìRTé©õ÷ZÓ¤è¼* ŸitÕÊ¢ÍÞ†Ü[ùY)mZ´44G{Úh; »Ùx©Ñšæ†ÖʬCßm37f‘%ТíÜféÔ4›*ãN‡ˆj8€0|Á™6û—Y‘öì?.Û‰^~1”§Ò.Ûé3Ü5Þ’Ã;º&ͱT½(¾¨È&O'b¹s±(mW¸Í¿íê!SÏÜú¯ã—~½c-ú¶Ó#d~8Ìqyð{ì¸èï K*­õ}éEK;õú¦nù|ü¡·±zwlôZÅåN÷ezP`9ì`yC¶ŽµÍV®Öù®µCÍvº.ÞLÝK¿›?M½žûŸ<©\}¦ù²Ü׶NÛÜXwS_ñB_}>픡Ѷ1ðë6¾Þok7«>ä:Šn²ÛsêÈ™§.延÷ºùc³KÛëùŽs:r‹¾Ãiê•ßÜ{‰gcß°fúߊ¿UC ?"u„ ¾xyô P4ÎrfFæd¤s¢5,yn÷ŠZ4bœ<ƒñ¢#'Ï T2ñyˆb¹÷º©fÜZ†¼ò³¾õÎoËŸ¿üÛ_¾Z"– å}^î7Å_íDÂ\›‚wglµµS§},Wí;Ï~F¹á}Ù™t˜@[ -Û÷ÂëåF=;ûÛÌþ²½QçõäO7h¼‡¥®úÙ\¢ÑGp1ÇH‘§Ë]–6ÏôÞï§ëìÇ:ä¤+¦Ì²»SCzD0»„óž)?­ÎÏmÊSÞhMN¡¸¨šòP¹ß›ËŒˆö¦Šb}z„Òê¾éîÅtAäVa)Èóx)ëÔ4ÁµµcBw1¿×\Æ ò”z‘çAÏ:­úÜ .÷‰—7ðMòËMcybÉÊ~ -ø ìnÙ =,örn¤ÛÑŒÌ÷0Pa¢CÝĶóú¾E{<¿—å6. é¶™ý-Ûv—f¼UAlµÍ«T›Ì4³ Õ.Ù”$iÝwxË.#•nckKºc–O«òK³Ê¸½a•3>üB×'$›QÞ*(1ºrw£¢~‡™¾äïWTšW•~»zþþ—1¢ˆ,¹¼oR,¹þSóöÚfïs ‡øÓuÞÇÏÁ“¼t³óç÷ËÁ/Ûy^ž¢¿&Ççà—mÿ¶rð”ÏÇÿŸƒ·ùò„Fsç>4izn~Ko™Îõ¶Ïãé7”›g_ÎtñœÜÔUtÓ,6˜Ìõ'X.É„ºÙyÇ4ŸXç—cš’6F¦–_˜æ/ -A~®²…±Í´ô”W0Š¼^«’ÿ‡ÛlûNomgÈ›cÍ:ÌrIò2èµMB÷zó0Û’1y(E¶v|l VY¶—J+Ó½mI~FÒÒŸštQóΞ ¿ÙPBènl,ži$ý=Aªýµ‡bj2Ô<×þdlŒ!ô1\Lå»C¬/6Ûz¸Ål¬“Ó¯ŽQž[“CŽò25’BýÙªl{¼R³žön”jLj‘œ,"o•ogŒ-7­ü»:éo¶°ý׫zäUrvýf’rä+dæ¹ýu‡,ÄvI£-¶c7­ÓN9y´ô¬$„ÚåÜrXÙ.]裑ú¡W“Wq™z!__FÝ:Vˆ¨í%YF±‘åجl|»‹C”»Ì Îy-;œï’­§….‰´t7ÉŽ»~Õ_”ØÖqG-ÜÀÖy]ÉäøÂüD²g؉Ãm¢ãö'ÙæY6tkë¸s ^ó¬NØ{I;ÔîJ S‡ Ù ÓuÖ/š 7ˆ§3-Ž@æCçf.ØۭQ9;£K…›u8¸Í“çç’|\šÄK:¸ì–Š¸YÅíÒa™’íă\;ªùy -/}-7K!·~òx.³kÓVG±Aì×›µa¶k§e'"ô{»×Ï{9vê€öA}\©c`B€§S}½ûÛ±æøº Ñwjh´åßó#È™®1C Þݬ6ºPó¬Ö -„µSî´]§}¡puÚh1u™b«ÖÕRGœU-¥SLꫦÃ:+C‰a•xQVÚí+Þˆ–ü€ÂjÎiŽŽfÉKf…×ڃʳ¤ï´Ë¾yßw_mË0x -gdJ³Z¸(ù^ø÷>¾£¾X£•êuwÄæyfj¶É;_¦#0„å$¿ÄyÙ.yv÷=±fí ÓaØ{JVôÖEx£Üg,Mõþõj…Ô!=OW_R_ƒ²õD׺‡X7‰Æ­<¾áäg/Ao–s'Ýx-*î¶Oêß»¨ã -endstream -endobj -317 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 316 0 R -/Resources 4 0 R -/Annots [ 318 0 R 319 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -318 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 527.554475 101.433071 508.804475 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -319 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 195.360432 101.433071 176.610432 ] -/BS << -/W 0 ->> -/Dest (cb4-1) ->> -endobj -320 0 obj -<< -/Filter /FlateDecode -/Length 4053 ->> -stream -xœí\KÇ ¾Ï¯˜³—«Š¬è bÄA É!Èa5ÖÚVäò÷ó±»^=Íy¬´¶¥ÄZŒfš¬‹E~ErºÇ-þ¾tø/³39—ùxzwx°&‹K‹ÍÅÂþ¯ŽÎr2Á•˜Ãñ(™T‚OñøtÀg—só§Ãß¾8ükÛǽ)%zŽ?¾“I9%VË:RX!˜”|ˆ -+:ƒ%–¢± FHìyÏJƒK b°÷YaeˆAœíYbøäXcA WBRXÎBç­UyÄ2“Wx.˜¥G特ø¢òx.yGdbbœÆ+&ƲÆcÈŠu/@–à˜­Æƒ,L9i¼Y(’UyÅçD/Aí…—! ¬+«<Èb£u¯ %3«¼žÍ)ïyÞ2‘ÕxΙÛ$•Â&ŤðÃ)‘¾ñ$ È:ð¼Ó€€,d 5$ Yž«ò Ö°€³†ÀxƒÕkX€»ŽpRk<à®óÅjX€»ˆ‚†0ãhX€óÍ8 ÓUyÅØ’³†¸ Xòà66IT^20$§aÀØXÄ¡Dà.Ž÷¢aAîÚ@¤aAîZFØ£ò e¯aâðඊO#X5Ö)4p×:ì°ÆîZ›Š†¸+Ǧ†1 Ág  Aì5,ˆ™MI)jX‹!ŸÊ‹×AÂdA€,•Y8±†¬M¡’5,H²÷$Y2hX€ˆÀ‡è[M ÌEͲ RÔ°HfraÖ° …ˆ| ZÕxÑ›œ×*/ƒç’†)±ÁQì4,@.e2œ^ü‘pIÈžc R,p p™ì™k<YdkX€H<ç4,Ȳ Ô° ûŒ,3Z pB#—„ª5[É3³†™£‘PQø 2M ¥Êƒ,€ °?’l ü ÙDš£ò Ö° g/éfÖ° gÈâ­×°¶)ùfÒ° XÈ‚ˆOÂb£‘0YÃÀ8xÖjXP\F¾éYÃø¥ä›YÂBù&R<Åo EÉ7“†…!K@ˆ¢ò ‚¦¢ø-0 ù&ÐIãEÈâ kXPb”|3kX€0ù&"zµ$%ßLj¹¸ -Iãw™F p|‘­–Û[oHˆÏtf–Œ3« è 8[Õ’öâ´JjÍÀ|%GR‹™eŽjÕÇ*˜Îªe üE<Æ;LX«Os‰*ÂÎÌœd‘nÁˆî{Î1šÑ…fk}ìÇï_=àð=~ÿïÃãK¥¬ý9Kk†=à |ÁvDß˧ˆs‘ ‚=§­LšÊÊk‘M„Âq'ÿŽûI!¨ˆŠÞȃ¢äþ„£ÄÖy<Ëè°\+>»IÖçwº)tBLPŽýƒÓ¥Jš'ZR¥}~§—AÂr’Pãöþßjü²0ææÜ/ä­Æ?••"en¬óÞm¥÷vzñ}Ÿ'¾ÛJïíôÒî1ì·¯8¬×/ -âqR"N,£˜üúÝ᫯ÿÇ?üå[Œùúñð÷ßHQÎZΑ ^òŽëàVÐ $ÁgÆëqmÃùÕ?Ž¯¿žçt´‚Áí|2…ûnmþ»×‹¾¨ãe’ŠS#ðAÖˆ1Ž-d&„“†Ÿ×ãc,¸* @.€Õ*^b'ˆÈz-ï4ÎmòUýÒQhBËV8ÄE>,ð§¯ÿúço¦ áÕ—NÞýÙ{ZßÝw7Ú4Ýv“¹Šñv’«_Nv±”êa¾>«†Ð{8½ÇÕ|®s»úë{£Wƒ’¶bTüf¥‹bBRèµ-Çi]mìT ²ÒÅ—W5Ôe,[Çvc~8kCÓM†&7UcÇü|«Ô÷8d–ël«ùߣä4+YôÚÇœôDCÞe=§I¾ú¾“aâ-úã3ÝÇ¡ßYïm ¹vá§õe'ͺi}ìq»OMo]ge‹{´UεeßÀâx²®i}çÓW§4MãË7&qƒMþb…¶Çu¼†Yó8‘$哯öãô]ä:V¼*Gr—ä°c-‹67¸B³"›|½-ûX”±ÞÝì“÷Õù—õË<³WVKèž6¼Högé[×=M^u>Å ÚÜ{Ï›ÆY>_Õm9_hc̈+½YkÕ½=Ý–½ëaîÛÆuu •îê8PÖ1k»¥Ï›:Ž­¶Ótñ8t/ó®^8ôzîµòUs(äzë´îó×ôEn§¯¶ŸnÈÐÖèêøm]_›oF]W}È7ä]ewç6ÔÐ6]Êû2ÞÛêÕ.¥o·E7Ÿ ûSa7ÏÙ‰ {šoI»Ç«úát¦Ÿ†ÎxqãÈ÷c‘°ªrÄôÆa´oD9wöù 0ò§p('“ñz«8Ëv†vˆµ¬šG;¤ÞÔ-¸8]‰ÈåK‚³éV€«¡Òb$íxëÇô¥1=Y©ÁÂ.´1†´b¤mŽ–qÞÁ¾‘%ŸÑº£¶#uÐa„ ñÄkíz?7Ö¹:ç~¼Þçíàg­¼‡©¯kXwjrãÙ †.Eä’ &Ÿ‡}q‘âÒuC¿¯Ï/mè]^v„¬™\Ô#y«lÓdB—L¦]ÜÛš@߾ɼG$8s–%t“zÜŽÓÍÄ^Y3Ö§cg‹Á¶s¸·Š«¼ÙšYçŸé¡©¹RÜÒlío»—n²ìÙ «)8¥d³H7LöÎ>ŸŽÉR6”¡v§šìçƒ:Ÿ£{]0;¹EÇ/e"·Ü‰#¨Ü2»ûú|:f'·ú1yû ¤|!ÔY3‹Š ¯ÔêˆèËòµ]*^­‡ø±Ïõ‚MæI—²I¥X&7½Émg“^«–É YMÀ[’/ÕýÍHòÎ>ŸZÅ,0_³ Í69Ðôû§­Ówz³¨©–Ð-îqÛ¶;¼ßÒ÷ó>Ǻä6ãËÖõòeØí„×,+:׬ö"'«|«}Õ°îëò©Ù•ÜtÅ®ÆÞêûzG+&H±Q徚jÝÙ_kª¯žQSeVòÅšjûa»þ^g©gEŽUîEoSýõÞZê¬ÓQŸoõ{×*h/WáLrßâÆë?¬Â¹çyÎÃ%9ìXˇU8÷cÿU8S>_ÿg_á¬ûÑå©•½åµñ¡AÓ+Ÿ×ô†4èLoÛ*©ý¨|^]¿ßÙÍ,ÓGUIstgc?§JšsB!~•ôÎ>¿tJÔƒ eH¬Õÿ,UÒít/S%UÆüµJz¡^qá–‡ÅcŠÍò„Ãæ–;y¯ßôp_Ÿ_ÚЇ¼r‡ ¦-é×*é'P%¥¼žŸòÙ?ÌnvÁDI¾ƒ—*÷‘K009Î7ï˹¯Ï§c¢Á™L΋?ôùÝì‚9.Q0Ë å÷VKïìóé˜cB(#OÂäϧZê,ôé ->òÏX.=›õ¬ªõm½‹;ô Až¢ÉÁåé¦ðn-7›Ü0Žý-äí&Ò£;»as«B )?ß@ùèa -Øy - ‚þíªGWS*=yl,Õ[ñ§z)©Ô6M§S -ÓÃüš¾,©“­{ÐRÚÇÕ„î{Š?íO´=uoiÈ2ßCÝ»“í)áfü+)U_ChkØmåûC\žÞqËœ6b÷½üÄÃ1²!Ù›r”'†²%î÷׺EÙîx¡çòÃï{«ú[VŸ•G§ÖÒ˜.jû÷˦¿;ÀúLl5©å¹v»³oƒütß5`…Ì< -[7ÈB¬m‹]¯“5Ú ˜L9o‰ ÄÖ£˜&iÉúQJ¢£hÝäy¶­-O\¬+DôŒnO–Õ#1«dùmˆl¨^Å.JˆMfÇ€<·ŽŽ7ÉŽìD {¢¦dÏM'ÏvÕÅAì¢ÏªsÓö·¶>MÛyx:`Z:§>©Ty"½ Õ´ëm§Ñ$TéÔÐZö á¾O -étPˆ_Ú64c3;Ú5y®o%æfHÜÛ•ÖN!j»:Zè;•z«<º–¦ù!Ê0uÊ]ñ -í4œ“üØÍä#–ÚÇ-Yj‘}¯mžìÆŽÞ‘Ÿ!)­ÃÀ -šéÍDšÆíäl‡½ jÊMUpÍF“§¢äÿ*B§ -ò,w“’/tÆÕ˜D|³“·Jšé±£kpœFÛI]r¿4íè;[¥½€noÝ5¶¡N*›è©4ñ¤:xlÉ®[]' „5ýt¬œ‰¶ é9tS~Ú‡œ¡»j°}²è&s}ÜAŽ;Ÿfrê;îä1Õ.ow²ùF<-Ÿ“Åôs›d½í§Ý˜l"Á -ƒ<`ôi!7oíè$?½Ó>'ÓNÜÓá‡ÃrÌy -^‚ôHN~uaŽ¼Üñ?hó5^ÿ<ðñ›ö˜ßzŽ{ÛÑÂwlÝç“L~£'ßI–ßìiÄî6Ñóûƒìòhš5ôsÜû ¯yt·Ø[K×ÔuîL C‡ÙwÓõŽ&Í„+ÄÓ™{ ó±{3ìõ’Úâ¤)ˆ6©p1/—yðhÉÇiH\IÓq¤ƒË~ꈋyP\N–!ÙFL1Èy’®z‘Ÿç­ ™kº˜Â¹¤ÁãqÌÎC7Ú²Š© B`š/æÙÍ“–<ŠÐì^½ïUäØ<@¨Ú;õi¦ö… µžN¥å2n/û™CK²Ùœwh¨E“ïQr†kŒÐ‚7³NÔ<ºÕaž”m3i;(:\€f­˜šL±vkjYVœU-¥S 곦ü+]‰aÞ•¸k+㶯GKÔ 0›s«³£e%³B‹sïNåÑ’m?7oçn§íqZAâˆLíèv-?ÿ>ÄwÔAµVío©Ž¸<ŒÇAÍ.‘§å·mŽÂòs5‰óT.yvŸëõ“}•¤ÕOæ™°†‰lrò«•ºO`”ÛŒi¨ö‹–z·bÕ%=OJyhÀÜþ±ÝågË– –"Q¿L’*ʯ’½ò¼KVŒw)¥Mùdùû/|¥ìQ -endstream -endobj -321 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 320 0 R -/Resources 4 0 R -/Annots [ 322 0 R 323 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -322 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 564.123057 101.433071 545.373057 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -323 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 179.034971 101.433071 160.284971 ] -/BS << -/W 0 ->> -/Dest (cb10-1) ->> -endobj -324 0 obj -<< -/Filter /FlateDecode -/Length 4066 ->> -stream -xœí\KÇ ¾Ï¯˜³—‹U¬ø "ÄA ÉAÈa5ÑÚVäò÷ó±»^ÝÙ]­l%–«&ëÁb‘_‘œî¦£ÅÏׄÿ2“ɹ¤ÈÇÓûǃ5)Xü[Zl.ö÷øMáH–“ TbÇ÷Bðɤ\ŠÇ‡þÛ]ÎÍûêð¯m::SJtŽ?½{“rJ6(¬–%¯°B0)¹V$ƒ%–¢± FHìøœ• —4Ä`ç²ÂÊÃs"Î*Ã%b1¨„¤°ÈBrÖª<b™½SxL„Ò£Æsdb.®¨¼%§ñ¼711ÒxÅÄCÖx YB±¤ñd Äl5daŸ“Æ‹ÅGoUdq9y— ‹ƒvŠÂËÖ•Ud±Ñ’Æ+Þ„’™U^Ïæ”Ïyβ÷Vã™Ûô*…MŠIá9Èm(*²oÆó…ñ£ñ€Á§œouâÝÞzÒx²8—XåAl¾†.B›¢ð #¸¤a€KÉpq¬€ËÞp次€ËÅpJ^ƒW‚áX’†ÞxŽ4 ð²Žx‚, ÏUyÅÖ°À;È‚xY{ <Жa-xÀ-ÛBxà-[Šx.Ä´x ®Ï‘5,ð€\˜RÑ°Às=°SÃÐ…»' öÓ‡oîpøø÷áþ«¥RÖ~ÂÒš_Á \ÁvDß„åûˆs‘ ‚=¥­LšÊŠƒµÈ&BḓÇóI!è÷Ûi k¾YÆk_VH€ˆç( -1mð¸ŒÎKU‰hÈúä>WEN[ʱ k -ç:Òd}rŸ—5o1C)å½ÒøSYhDòv³×* jIæ½Ì{«…ÞØçÅw}ž÷V ½±Ï‹ËZÄ3JäpÃæ_küÂê»Ñ‘¬G¼×ãØt1-]6àJ(:‰úÄ./(°5N2”ˆ6¾8‰èpL#·¼iüÛ×îUŠõ{£~I>4ñ‡‚5Ž¯ß¾ùÓ«¿þù»ï±™¯ïo~ƒ¦wÖ†ðíׄÏÁíþ¦õ/ýãzÇúõ3Ÿ*/V^£çJ‡Œ¡~f®ï·mÛ¸mžF9y¿ýûñõ«Ãï^(A«&ãqò~¢„-ñò‰èðÕïÿø‡¿L:ôAÖ&c˺dnüÒJCœƒ’ÛËZekèb™šA¡€4k7á›eM]Þq"ÑkÖ‰¤Â1܈¯Øóm]>Æž?…Ë÷Mìø£mBµ†bœäê—“m U“ï¥ÈeÕ6c§¿¹Ù3búæ´õ—æ¡Ú•´Ûâ·ÍgÖë3zk[Çá¸åqšüî¾Úl¨}üÐG³Ù.¯ýe¼~Ký‡,rÝõIc½íýdó·¨ÕÍj}3I±x—­3Æ­æ4) -Uiƒ¢©¼Õè@ì˜$Çiýµ“–ºæì–ÖÇn¨ÐdL•V5×µVFûV1¡ã,˲æ¦í†,§3™u(©ïE:RÅŠB÷ëx ]æq¢—º‡|·v>N³˜Ež¸¬ñ’%>&‡kYô²±¦EÙä;ÖhÙÅ¢Œ½ m¨HL³— =sY¿ÌsWé±^ÛIß4÷¢iœåó%ÝzÚ¯?´1fÞì®êÞž®ËÞõ0÷mãR]C¥SÀ¿ŽYÛ-}ÞÖqlµ¦‹û¡{™wõ§¡×½ÿÉý¡ _–ëe¬Óº7ä.êËŸé«í' Ú©®ßÕõµùä$¿«í¨úk(ºÊN{jÈ™‡.åï2Þ»êÕ.—¾q+§á³]>Z÷µéQÔ¥µKIk³ök†ÿÍX°4|É&zHUŽ˜Þçã•PãÆ>ÏJE>EÁPVF>â¬d,[vA.Õ­oGÉÛºNIJE¾ÛM÷f -sÅxŸ/鼕/`Ú˜wCZ1À}ˆÝÃò¸¥odÉ;ZwÂvð z åûœ¯µëýh¬s5ôóñzŸwƒ?±ò4Ö°:å6ÜãƳº¡³ó&—ìaB,_´¸L.\1ôûüÒ†>äõ9wÊ5š¶Ê6M&ô˜É´ëi[èÛg'‡Q¶¿mшVw¦ÚÌ£ã_‹‘¶íébîo·¦Òù»µô15wØe¶6öç"˜$Cq)épI&8â|-Í»±Ïçc’8}Æ–ÐÅïó@ŽÿOYÃÔjÆO)‹Í„cMM‚] ÿæDr“ÆøÇR¥H"·Ê)»I/I0os¹%’‘ŒË7iÝçÆ>Ÿ[™$0_ò¢¥|¶/Ç…eìÊw#¹ÞzÃâ- o(ÿ­É‚ªÝÓv^0ô‡>Á6s¸d›/_¼ÛNxÉ.£Ü϶Ú¬M‘ŠÑ·tùܬRnÒº`•#ÅÓ1ç†zQLˆ€ªÄ·•áŠýR‚»¦Ò2«ôÍìùwÛYzYnä@ VÉ)¦rÝ­¥·e̳bm+æê¼—/£%—MÞøóóÊhçã<­Œ–"?&‡ky^í|ì_W-åýúÿçËhu?º<¡ÒÜÞ‡M/¯]ÒÛr×àFoÛRœý•×äÎÄ­.žR^ËQÊ^îu½¹¼vcŸ_:Åëa´c,{gõªÃK—׶ӽLyMóKyí‘$ùC/qkDL} pžb³“û!/úm}~iCïòÊ ·^vÐ})¯½PyÍçõÌ’Ïîîc]E7ÍBòÌÙrSÒÍe¶û|>¦éIî5þRfûù]åÙe¶åžôX(ûŸ±Ì¶ôR9£”Ü\ -ý¼¾ÂÜØçs+h ë’ýœ·Õ=»vö}½>¬3y)ÊÓ­õ}Ç®6¹²Aç7â·[3´»³tkýE¾WKòt­Ã>”$Ï«Ž¦íom]š¶óñtÀ´~O}P©ò\ªi×ÙNó“P¥SCkÙ7„û>)¤ÓA!~mÛÐŒÍìüi×äéÈ•˜›!qoWZ;…t:¨íêh¡ïTê­òèZšæ‡(ÃÔ}îŠWh§©pœä•A“Xß>nÉRgì{-7Ð×-®;ˆ§Ž>#?BRZ‡64Ó›‰~·“³ö2¨)7UÁ5Mž-“ÿW¨*ȳ|[©© 0_IÄ7;y«¤™;ê°¦â4ÚNꢔºÍÎú¢l•öº½u×؆:©l¢§ÒÄêà±%S·ºNkúéX9mÓ rè¦ü°!9CwÕ`ûd‘&s}ÜAŽ;frê;Nò°o—·;Ù|#ž–ƒ÷d1ýÜ&d¹I¼™OŸl"Á -ƒ<`ôa!7oíè$/0j‡“i'îéðãa9æœNòÌèIÞ]1G^tüÚ¼Âï?|ü®=,¹žãÎv´p[7äù$“7åÉòæ£Fìn3O°?È”GÛЬ¡ŸãrÿxÚѤ»ÀÞZRGPêÜ™†'²ë¦ëÈOš ˆ§{ ó±{3ìõÒ·ÅIíR³mRáb^.óàùq$§!q%MÇ‘.»©#.æAq9MX†d1Å çIºêE~ž·ÂË\ÓÅFÈ¥<Çì> -endobj -326 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 545.373057 101.433071 526.623057 ] -/BS << -/W 0 ->> -/Dest (cb13-1) ->> -endobj -327 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 194.231993 101.433071 175.481993 ] -/BS << -/W 0 ->> -/Dest (cb16-1) ->> -endobj -328 0 obj -<< -/Filter /FlateDecode -/Length 3986 ->> -stream -xœí\Ko$·¾Ï¯˜sÓ$«ø$AŒ8ˆEr0rÐŽW6m€uùûùŠÍWÏ”F£]ÙVKfºŠb±øÕcºÇ-~?sø—Ù™œKŠ|<½?|8X“‚ÅOm±»¨ì¯ñ—ÂÑYN&¸s8¾%“Jð)øwv¹68üý7‡íû¸£7¥DïÂñ‡wÂb2)§dƒÂ*`YG -+“’QaEg°ÄR4ĉ=_²Äà’ƒÆ‚ì}VXb'G—¬1|r¬± †+!),g!‡óÖª<b™É+<L„Ò£ÆóÎÄ\|Qy <—¼Æ#21± Nãc Yã1d Å: KpÌVãA¦œ4^„,ɪ<Èâs"— ‹‡vŠÂËÖ•Ud±Ñ:WÈ„’™U^Ïæ”/yÞ2‘ÕxΙÛ$•‡…MŠIáyÈm(*²²^ãdaüj<àD ”³rZ½œn²ä4^€,Þ'Vy›¯!€Å¦¨AN\Ò0À§d¸xÖ@Àg2œ9k(às1œi0àK0KÒp€¬Ï; ÈB–ÀQCr…qrUd¡Â‡,h adñLЖa-à–mqð–­‹bZ ˆK9²†È…) ˜KÀN  ‹ãž4,  .…è5, À.qŽp—ØY ¸K„ž*²À€5,:r™4,`à.9›4,`à.Ž‘×°»j`‡QÃØŠñ9[ ¸ë³e ¸ë\€ÊKg4,`à®X‚æ¹»>X¯aw=û¨a Ŭ w!A VÃø{ð• ®ƒ†É‚Y*²pb X›B%kX­%ªsHð™9É" Ž#º9ÇlF4Ûêc?|wøüÎ÷øÝ¿÷¿©•²þë ÔÖ {Æ1ðÛ};,Ÿ"Ì*{N[™4•)” ¶"›w'?ÇË7;I!¨ˆŠÞȃ¢äþHxvmóyêè\ ^È1p¶§¨Ïîó¤È A9Ž7N—uªhwêH“õÙ}^\V$pí¶”rÃÞ?Õøe7΀c7 ùTãËB%ðmÞ[-ôÆ>/¾ëë¼·Zè}^\Vq~^:‡[Ðé‰Æ/¸ù—û»7DÛ§ñ¸l3Ü©G\‡ñæýáó/ÿð§?þõk,üÍýá›ßJÅÐZÎaþä×Ám4¸ -4ôï÷[Î_üãøæËu>øx”€Hu?ŸLá¾ÝšÿþMU u%ÙDeHi1ÆqÌ„ØtQðóz|Š–›r±$*X¡â%°ƒ·FJnùBãÜ'ß1.….´l…CÐæCÝ€?ù·¿|µl@_|æäÕŸ½¦íÕ}ûD›®Ûa"W1Þ.rËÅ.êç°^ŸUÃ@^=\^ï6cð¹ÍíÚkl¯Þ JÚŠQñÛ.Š I¡·¶Ý9Nà 4×:h}¾Ö§¶?᯴×8ç’ë¡«&o«·½_dí2È°­oܯQ¯ò¶ãp‹ÒÓªôoº^VÅ©—U_}^¹v’6¤íÏ.: -¡]Û=mŒÝ{_Wj´¦·¡³2ûØ·Øs^öw‘¥ê©ëºÆé–õûúÜŠ€b—ûm¼Žë8‘$#”O.Ç{Èm¬xUù€M—ÃεT½ìliGE6ùô)Zö±(cW `Ýzûoó×õË<í¼Õ}ñmO»¾Ý<²?µo[÷ -Ü]^u>å ô¹/ÏÐ2N}U·é|ý¡‘Þí®éÞžž–}èaíÛÇum îÚ€ômÌ°àÍÛ6Žm¶Óuq?u/ónçiêõüüÉ'ѡ̳,×u¬Ó¶7Î_ÕW¹ÐWßO7eèktm ü®­¯Ï'ú®µsí ùŽ¡›ìî܆:næ©Ky­ãá±è1œ¦¾øþÚšH>0ß­iÃy®Ö3~P±!I9B ã´ÆøDlpcŸŠŒ°@>ò˽Uº¡»îrÚ–vñ¶mÁ£Ó•ˆ¼NêþgÓm Ô ÙÌØËpféÉJYö¡y7¥Ãêsô`†óYЖy»,ùŒ6Wwh“#Üiˆ^o7ú¹¹Îí@]Ž7ú¼›üyÀïnéëæ¶Ã¶иóì#†ž²É%Lj4H¼”¨®úm}~nCŸòBç28=þµÊ6-&ô˜Éôë «ÎÌ,ž©`W[¿™{§˜êÛý6þ™cLÍ”ãžfólÿºÌ[7O¶l\¬Y·Gî%÷„IÿªyÞØçÕ˜'C4ÊPŸSÍóÓNýë3ï-ìk&x÷…š<ªC1œ܉š.úN­iÙ.- ÇB}¥– 7,ÉGàg“^+&pÃì,É¢þÉáÆ>¯­  7q\±XñÁ»õnÙýÓÞº½[Ø’è Ë¿ß·ê÷ôËyŸa]˜øšu½|•j?á5Ë -1v+Aè#.ŸH^5¬Ûº¼6»‚Ò®ÙÕÜ[}_o¨~È-#æø¶’ÓÛYòøÅ–z»»}ûQŠš±~;Á› u¼^¢º¹ü„Ë|³èñZ¹©ÊqQzì¥I÷ò¥£˜Éä݉ý¸ÒÑå8Ï+%W“Ãε|\éèrìÿ¯ÒQ¢óõÿÏ—ŽÚ~ yB£ùó34izIéªÞ¹Þöå'û ()¥ÎÖøœ’RöÎdOrGÛÍ%¥ûüÜ©Ìpà™¢±LÞê™öK—”öÓ½LIIó×’Ò#Éå#†Î gD4| r7fÎõÎÂë†~[ŸŸÛЧ¼ò(…ì ÿµ¤ü£¼ùyïï^›™?b¦I€½Þ+qsiéÆ>¯ÇLs”ûCKj--=âÙ‹|X‹Ëô––ö“^½O%P7;²Ùø˜Â“€û¼¶@‰éšÅŠ/þäûUÚ8?UIêeä}†5×Û‚¯˜óËײÎf<³å¯Û·) gòàC./÷ñ~²Éözy×o¿£îèÎîµÛ«CÊ÷”fY’ܤþ˜îü» \ËÆ<Ž¼DQlVY*H¥µé:_²Ÿ‘µ´Ì§f]¶é¿gÃ÷¬ ÝêÀ5ÑŽ¬¿gHu¾»¶o§™MîÆ¿’5„¾†‹­üpˆõ Wº³1çå©ücdC²7å(ydKìúÖ¹ªlw|¤gý.ƒ£Uûz+O<ÊÓ.Ûw,­ý‡ºéï®°‰½ÜTE¶•œ}¿˜ä‡ƒ<ŠÎ -™yÖ¬ž ±½µc,v£Öi' r2å¼% ϶·³N&8¸½õ¡¯Fú‡ÞM`ÛQ½I~›X!¢gt—dY=rÉF–Çù³¡v‡(!v™AœòÚv8;>Ivdb¸$ÚeºIöÜåqòø×P]œÄ!úª:·lo Çëo"ž˜–Ω*U"îCuíz;h´U5ô–cCxì“B:âg¶ÍØÌÁ_vMÅÚˆ¹v¥·SH§ƒÚ®ÆN¥Ñ*Ï®¥k~Š2MòP¼B;-µä$ßO²œKýíž,e̱×ñ´-˜GwO¸¾ ?BRZ‡‰6tÓ[‰´Œ;ÈÙN{™Ô”»ªp4;Md‘ÿT„Aä©o“’ n^ÍIälò^I+=ÔaMŽÓl»¨Kî¥ :ÆÎVi/ ;Zí¨‹Êz*]<©{²V7Èa]?+W¢íB`ºIÔvä)gG5Ø1Yt‹¹‡1î$Ç+9wòdáwŒ»Ø|'žªcãs²˜~î“L²·ÃÛÍÉâ  0ÉF*¹ŸÖNòm)ýí> -endobj -330 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 579.123057 101.433071 560.373057 ] -/BS << -/W 0 ->> -/Dest (cb19-1) ->> -endobj -331 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 227.981993 101.433071 209.231993 ] -/BS << -/W 0 ->> -/Dest (cb22-1) ->> -endobj -332 0 obj -<< -/Filter /FlateDecode -/Length 4004 ->> -stream -xœí\K·¾Ï¯˜s3,²ø $AŒ$ˆ!99¬ÇZÁ:€Cþ~¾bóÕÓµ³³Ò -PHfºŠb±øÕGv÷ÐÙâï„ÿ2“ɹ¤ÈçËO§ŸOÖ¤`ñ§–Ø]Tõ7ø—™,'¨ÄÎ?‰À'“Jp)žŸNøïêr-þtúÛ¯NÿÜס³3¥DGáüË{Q±7)§dƒ¢*PYòŠ*“’ QQE2b)š -f„ÄŽª3¸ä ©`;—U†žù£ªÀ —ˆ5Ì ’¢" ;ÈY«ê`ˆeöNÑQ0NšÎ‘‰¹¸¢êt”œ¦óÞÄÄHÓc YÓ1l Å’¦ °%³Õt°…}Nš.½Uu°Ååä5]‚-Þ)Š.ÃDWVu°ÅFKš®xJfVu:›S>êœ &dï­¦#2±éUV&)&Eç`K´¡¨:ؼušÎÃÆ_Mœ>嬬V'«Û[Oš.Àç«:Ø‚É×ÀEØbSÔ +È.iàR2\k à²7œ9k(àr1œ’×`À•`8–¤á€·# ¼…-£†ž` cåª:Øâ kXàlA ¼‡-Ž½†hˈ <à–m! <ð–-E <fZ <×çÈx@.B©hXà¹Ø©aèb¹' `Âvú´QE„CBÎÌIY°,ì~ì9f1ÿL±í|ì—N¿~@ò=ÿð¯Óã¯êIYÿK µ4ƒ_a¸‚é`ß„áûˆ fµ †½¦¬tšÊ4ŠƒíMŒBº“?çã—¥0TLEm샢ìý±!íÚúòÔÖRìœäÈiê«ë¼hr#(çñ…t[§‹Ö~Wm}u7²uúQˆ ˜÷ûõÎ:oî×µß{ýzg7÷+R¿al·-ßï×;ë¼¹_×~ïõëuÞÞV¤˜˜m)å¬z©ðÛ‚Õì;ñû|©ðé{¿Ø“Áé8`dØÎ"/Áy ^ºXúºoh®5Nv+e|qÂî²±/GÌ­…óî„D߬Øî!Kò¡[NJ n.œßýtúõ¿þëŸÿô âíÝãéÛ/­ á«/H>ÝÕgÚ>éûÊüýüîëÓoßͼ+fa9ØŬq¹,úzÏáàrµëëßýá÷YìÂÞ{Õåó"›ep¢Üú¦öÛg—k9oe&–¿Ûäâ¹>È[Y—qõ¶ÓV/S&åCØê€îl×(®|#v¼om_®ÚlmpiíÇiG•¡©?WÆ­ÿ:~·¥Êc»¶Í6ÞÚà4ç¥Öå͇Ýö-nô·‹þ&k}×U¢Œ{¶yÓ·þzü¡·±¬è:ß—ö™¦ïíåeÛ‡Öº½]jchrjmç·6[¹Zç»ÖŽmk¸ûâqú^úÝÖÑôë~ÝÝôE¢+_8nqÞ}»Ä:°}— ]APùÊ,]d“%ßÑ ôÎ:Äš>EÎôD&ƒ•8«'͸O’Ì× ñùN„àR -Øòï;Ù–dKºJ†ÛgžýTÙí~œ·r‰ÈQú¡Ç¯^ª]Lˆ¸HJíà•Q¹¥<ѯ;È“›£© qYäe^ócO.K"ºm§ÏÉx¹k;}õ¡äÄË ·²ãûȉ|ú™ÿORžqkZÝúíjÉÃ~Tƒ¸tÂÑ=qÙ@±Z±š{ÉImó@c;ÍÕuoG4ê½è€6ãÇc;¯#r¯ù;>šhÛþß"œ®Çÿ_O4Ú| {B“¹ëµ3e· ¢øÊG¯! ¡>}Q`0,“Û¡›äÎ:Ÿ  õM¤ø Ⱦ“{ˆÏÛtËw÷p Ñ”OF¥¿—‰ˆ1sJíψˆ°ÑiXÅèí_½î}¶X®9ÿ±aK¿Þùë昳¿ókl–Çæb½óÅh3dyüú{gφÀæúø-¦Ÿ>!Ýwòê´/×°èiz¡„vZ¸èz¹QfÛ<¶7꼟zj¡7Éʾ޶LÛÒѦQ®ëz›ÏÞ¦Sc[~s™lI*åtmQvÊÆË.tÂ#™8&ky ¢ÈÇWVjûÜâÉ¥/yÕ…Awå ©Û‹ç¾:s ÷S¬¡bùÖ²’–ü3qc÷±{$ÓWç\4uöa®ëú]¾QŸ}¼ ßÛ²ÛF­×´®÷»b³Ô(žÍwÉŽÓ–@W±ÙÏ3[lf%.Ù”ˆ¥«oÅe,µó¨z‹ã…°¼¯Êg•9ÜŠÊ™x‡Ÿ¾iÏߥ€FC矱½ÊËã|Ã;/yÁLJÿú gºzÈfdhR^¼õPJò¬ês!æÞo0H§È±¼ŸûÆ7´ÇŽ¼qN×C“öœepë÷“«Ö0í<ïqãS"wW¼½×ø¸k\½ò›¾?YÛï|r±g··)-9Õ1¦òçS¬Ï]S}÷ÆÆlÈÉ˹gท¹ÒfyfÛ3õ©£êl:?S³¾Òüó(ÕÞr¶òâ“<ô¾½½\´ò?×Iÿ [{6±oæ뉶Š³ëSüt’7RY3ÏÄ"l_íh‹i0tÙK>™r] ʶ¯óBVÙöÕ…>©z5yR˜m/äë³²[ÇŠ5#Å2zk¨‰å­Þl|»ŠÃ9¶ÂÙ ¯egƒ³â‹b€Ã" G¡]º›bÇÝ’·@†ëâÓW×Ñ2ý½,vxî.áå„nýµôI•Ê»„½©î]g‡Ì/F•! ½ä˜ó¤ˆ.'Eø…íM3&sè—Y“726aîÄ£\éåÑ外k­…1Si”ʳj鞟¦ÌP÷y8^‘]–“º$?S°¬ëû×½XÆ\c·4ãÆ„—R ÄO§”Òab… =ôV¡_Úâlg¼LiÊÝUXš]&ϳËÿT„!ä©_ˆGH E˜W³Y›C¼wÒ*uXóqšewQJ#fW(åtGéá±tqÙ"O¥›' 5Àc/¦uC,Öý3°rÚnº›â0Bùi'žv†±TƒEZÂ=Œv§8ì|ZÅiÌ8É FÃÞÑîó]x©‰¯Åú¹w2ÅÎŽl7;[„Ó0€ÂO}ªâ¾Z:É&ô¯s‘i÷rúñTÓœóÁÉACô$ïˮ̋ÎÿF™¯ñï'>ÿ©¿ ±åqgZ¸­;ñšÉä×òbùµ….Ëf:^`Š)ϲ¡GÃÈãÎ-xͳºÀÞKÒ@PÚU¦±¡ëÈ/ž 7„—+/"ó±s3övéûàä‘!yµ§[…‹u8¸ÌSçgJ>/MâJŠÎ”-»¥".ÖFq¹tX¦e;3% ×N†ëÅ~^§B”Ö‹…FÈ¥Ÿ:živmºËê(–" À~½XfZ;-;{£?xy}ô¼7“c_"Ð>¤O«t L¤ðt©¯—q9rŽ¯gE}ñN¶ü²öü 9siLjÁ»‹5FižÕZ°vÊ]¶ë´'ŠÙ.-¦nSlÕº[ꈳê¥48Å”þ¸z:¬³2œÖY‰‡²ÒnÏxƒ-ùA€ÂÎiŽÎÎ’ƒKfE×ÚCʳ¤ï²cß¼ï»gÛó2 ž†ÄÉLí¬%?ÿ>dílu®N"´Rýo=¡<_iD¢fJÞùú+U6Ç aù¡Äy9.yuÛç'ÇS’~~²ö„é0ì½M$¿7¦›ðEyY±4Õ‹L¯V¬:¤×9àÙwC -9ª?8SÔê!Ѹ”;„N~_Ê éÍò³ÉÒóh<ìŽOêßÿÖç›O -endstream -endobj -333 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 332 0 R -/Resources 4 0 R -/Annots [ 334 0 R 335 0 R 336 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -334 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 621.123057 101.433071 602.373057 ] -/BS << -/W 0 ->> -/Dest (cb25-1) ->> -endobj -335 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 444.376036 101.433071 425.626036 ] -/BS << -/W 0 ->> -/Dest (cb26-1) ->> -endobj -336 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 237.629014 101.433071 218.879014 ] -/BS << -/W 0 ->> -/Dest (cb27-1) ->> -endobj -337 0 obj -<< -/Filter /FlateDecode -/Length 3870 ->> -stream -xœÕ\KÇ ¾Ï¯˜³•«Š¬ ø "ÄA ñÁÈAkm«rùûùXÝõèiÎcW«@Öb5Ód=X,ò#YݽîhñóÊá¿ÌÎä\RäãéãáÓÁš,þÕ›‹Êþ¿)åd‚+1‡ãG!P2©Ÿâññ€ÿÎ.ç懿9ü{Ûǽ)%zŽ¿}“I9%VË:RX!˜”|ˆ -+:ƒ%–¢± FHìyÏJƒK b°÷YaeˆAœíYbøäXcA WBRXÎBç­UyÄ2“Wx.˜¥G特ø¢òx.yGdbbœÆ+&ƲÆcÈŠu/@–à˜­Æƒ,L9i¼Y(’UyÅçD/Aí…—! ¬+«<Èb£u¯ %3«¼žÍ)ïyÞ2‘ÕxΙÛ$•Â&ŤðÃ)‘¾ñ$ È:ð¼Ó€€,d 5$ Yž«ò Ö°€X¯aw=û¨a Ŭš w!AO VÃÄ{ð ŠFÒd ãàY«aAqõ¦g à—Rof -YÔ›(ñ¿-¥ÞL†,)ŠÊƒ,HšŠâ·À$Ô›@'!‹/¬aA‰QêͬaÒ Ô›ÈèÕ#,õfR €»¡™4p™iÔ°¨7‘Ùjµ½ð†„üLgf©8³zb`½±U=2°À^D«¤žX€¯ÔHê¡ÄDe™£zj€° -¦³ê±þ"ã&,§OóU„9$ÄÌœd‘nÁÈî{Í1šÑ…fËùØo¿¾}‡à{üå?‡‡oêIYûq0~â(…µÔ rì‚ý^™:£ÂD²í%‰„ð9}DˆT†°¸º‰Å·åØ¿¸­ÈXdvHfêÊx3/J‡½¢¨Êúä>/.+IÞ²·í¼ª·ß”Žäßqÿå†@¸û…¼Õøe…Ö†„ ÞºÌ{¯…ÞÙçÅw}ž÷^ ½³ÏËËŠhŒì†,ß±ù·) Í(íïòVãr±x{@¹æm¿?ñj\ΖI‰¯óùøöãáÛ7úËŸÿþöêíÃá§×ÈF¿îì3|÷ʽ–: á0/߃[?ãúÙèÁZÎK[¾å÷ ú©×;úÚV>+‰)¯íä³õ“ÏN;y¤½ðƒó‡Ó:O£½ÛÊ\ç -Cö.‹ŒKë<§Á¯cÅ©ï´Ž:Ç?oßÜ¥û2ëþ§×ûe»ŸuUØ÷P=Ojž—l'5åµÏé»E¨¸Jg1Äb¹"’ˆUZÕD2ÆÃ2žûy?lyy=ûÝSÕB«<±ªíš1]’ÃŽµÈVôõɶxÙJU6¹-µ”±E6Zû3¼n‚²†n.e|¯<·È«ÞíÃ:λ½™Üšçi¦>™ùÃUýæsl÷f²—‰Þ¿»é{XÖ¦½©ë_ûJSù=_G§­ëè:*ëü2žª§¶î‡µÝ»•G¿nûnøO³Á¶×l©¬¼«:óö\guÝÍ.éòŠí†|žž±žæûµ/ï÷,<ÑžŸggWõåwú*kß¼]‡ÌÇmÏW_²§%ÌÔÐRÆœ]þ÷«¼vµÝ‡3_‹Ëš›>»ÍÞ‰«®É²Ú¸\×9N‹¬õzÓïª.[],˜=éxÂÔ?¾­ÉBAnrÕ4ŒQÈ¡Ž/‚cÙÔ²sÂñÔ>ÏJÝÖ<Ãx9µÃz /§(]mÉHqΓn³.ªé—ŽB¯3,™ˆÔÈÛš}üõÍ?þöý”}ôl"µ¬aº^qɲ] -(ã·“,пŒS¡ GõõÛCy…|úwSûn-»t~hYÃú9ñZ»ÞÏyÝ×û||·šàÈ>¶ý7RdK{™z»ÆkcvÝ {V)û©Ú8±ËÁŽ£š?úÕimÁd-=ÙØs¹A[äVÈÙ¤5O½àD3X˜] ‚N×èÎ>Ÿ“¼_Ê|Í—ì»{þºÁâõ6vò‡fëá̇mm°yn·nöå»ì}¸foÝ–ÒpÂêm³½­_í,Wiö¶Æ¦”“;›ðš­ÉÝâÕnPœê1Ê S»¯Ë×fiÃ5Kûl+S­áŽrJnK£Éžï¯eã®cy±»šÈÆøεDï¬-#!®IÇÃ4oKdÂ4^<ó¬Ó~̹níÉ{óEêØ@³â«®åNFZ~7µw+–ì–Öåé±`*lê‹;NSÂøâÅpˆEN'^1¼çiÅp´á’Ÿ] ïÇþ* ÅÚÜ5ùVÖ=Ƽª[¾þÐƘ ú¸Ò§œ¥§§Û²w=Ì}/¼HÁcǘµ9ó¿óÂÅù«úásýHZm?Œµ´¸Ú××yv˜7ãÝÚ¯\?»³ùŸR8%yº¥,§®ˆã¾p‘»nWñ}¾šÂ)Õ§äRvñ NÛIî)œÚ<¿û‚)ni­MOaü­Ñ‚=KŠ›Ù¡‰ÏÇkóøieÒÉ»ïîOåévIäÿ±ÛNz-=N97“ç¡éW¼é–÷õùÚälý5•H;‹<·¢]‚··˜žàÝSš¹©o:ã}¹²-ËÔ—móå˶í„×ì2ÇÒlŒ}Ylè†YÞ×嫳ÊL׬r¤ :æÜs?Kž%“ÇÚÊýXú`_ß DžþÓª§.g÷ó¥è¾Ä{ù"ªÈƒ‘ï{^µçRkýa}¤( ‚<Ò Íäé ¥îË7›ÜðÝýóLíI£;{Ða ‰EþIò’‚‡‹–$ß]Dÿa Ún­<–ëaF´žYHòÒ]i5[ßÔ춵A¯û?Ø~¬‚j«Ç“º?»!ؾk7úüz°ºJ®ÒÇouß$Ϧ*k’V×°ÛÊO‡X%uõu³q^Þ7D…bHö¦r²%vmë\U¶;^èYßÒüÔ[­/nZy—Cžã]Þêœ.ÖöŸê¦„W²‰ÍëKV¶’³oƒüx—ìX!3g¾AâúÕö±Øulh´T2å¼%àß®_€HLX¾¢Ž£hÝäáG¶­ÕÇÿ–‰"zF·'Ëê­q+Y^T̆֫ØE ±É âç¶cÀÑñ&Ù‘ˆaO´Ótƒì¹ÉãäÁö®º8ˆ]ôYunÚþÖÖ§i;¯OLKçÔG•*5Yªi×ÛN£I¨Ò©¡µìÂ}ŸÒé _Ù64c3;Ú5yÈ|!æfHÜÛ•ÖN!j»u´Ðw*õVyt-MóC”aêrô2í4Ù$o^O>b©}Ý’å ­ïµÍ“Ýøñt@ˆáùñ’Ò: ¬°¡™ÞL¤iÜNÎvØË ¦ÜT×l4yDWþ_ "tª Oý⸛”$´ãjL"¾ÙÉ[%ÍôØQ‡5 8N£í¤.—R·ÙY_.[¥½€noÝ5¶¡N*›è©4ñ¤:xlÉ®[]' „5ýt¬œ‰¶ é9tS~܇œ¡»j°}²è&s}ÜAŽ;grê;îä‰.ow²ùF<ÕÀÆçd1ýÜ&do{´“MÄ!@aŒ>VróÖŽNòxû:œL‹¸§Ã¯‡æ</n‘œ¼8g^îø_´yƒßøø}{æ|‰ãÞv´ð[7ä9’É ãùN²¼@ÞˆÝm&¢ç öÙåÑ64kèqÜû ¯yt·Ø[K×ÔuîL C‡ÙwÓõŽ&Í„+ÄÓ™{"ó¹{3örImq˜†äm…&.æåà2|œ†Ä•4!\öSG\̃ârš° É6bŠAΓtÕ‹üY}¿9>©?ÿz÷ -endstream -endobj -338 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 337 0 R -/Resources 4 0 R -/Annots [ 339 0 R 340 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -339 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 627.273057 101.433071 608.523057 ] -/BS << -/W 0 ->> -/Dest (cb30-1) ->> -endobj -340 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 314.026036 101.433071 295.276036 ] -/BS << -/W 0 ->> -/Dest (cb33-1) ->> -endobj -341 0 obj -<< -/Filter /FlateDecode -/Length 3869 ->> -stream -xœå\K$· ¾÷¯è³Ë”D½€À‡IEÄÀ"99ŒÛ;6‚Ùëò÷ó±J¯êb?fgÖx³ÝEJ"EQIUÕØ#áçs‹ÿ2[“sI‘§÷‡2)þ--6 ûkü¦p´ÄÉ[bÇ÷Bðɤ\ŠÇ§þ;»œ›?þñÙáßÛ>öèL)ÑÙpüñ°Ø›”S¢ ° -Xd½Â -Á¤äBTXÑL±5BbÇ{V‚\rÐXPƒË -+C ÏÉú=«@ —,k,¨aKH -Ëô°ŽHåAböNáÙ`"Œ5ž³&æâŠÊKàÙä4ž÷&&¶Áj¼bbŒ!k<†.¡ÕxºËLº°ÏIãEèâ£'•]\N^ã%èâ`¢ð2twe•](’ÕxÅ›P2³Ê+àQNyÏsLÈޓƳÖø¦WyØQX¤˜žƒ.‘BQyÐ%xrÏCÆÆNŸrVv«“ÝíÉ[ ‹s‰UtÁâkà"t¡5À2‚K¸” Ǹì gÎ -¸\ §ä5p%Ž%i8àɂ笞 Kà¨!·Ð…±sUtñ…5,𺠆ÞCÇ^ôex‹†pËT¬†xËd£†€ 5IÃÄõ9²† W*x`®vjXàºØîIÃÔõ!: <`×sŽxà®gK0p×{ôTyЬaÐÑx›½† Üõ–’† ÜÅ6r`U ü0jX_1.gÒ°€».kXÀÀ]—T^2؃^Ã)h‘¸ë9 ¸ëØE à(øCj6Ü„=€.X ïÁs^à fÒ pׄ?eO­ŒÍ%jX€»6cùT^16Áâʾ…•±hX€»T^ÂÜ|f €ñÕiX€»Ö#Rk<à®u…4,À]ä Aøƒ±H4,@|3–àº*¯*9kX€»€%§a¢°¡ $QyÉÀ‘¬†cCÈC5,ˆÀ]„÷¢aAîRð^ÂÜ%FÚ£ò ‹ÏNÃä5àaÛ*{ɪ!¤ÐxÀ]²XaÜ%JEÂÜ•°©aALBpYÃ(h; bfSRŠÄBà!åSyÑà:hX„ÈRyÐ…kX€ÄÚ_²†ÉAÉA¤  #0Å"ûVËèwQë†.È5,’™\˜5,H!¢ƒU5^t&'ÀµÊËàÙ¤aAJlŠ­†¨¥LƦװo$]Ò°j€gYÂT  ¶Š†E&;dæÏB$Ù ÓÏZ ²ƒ.È5,È.£ÊŒ¤a"4jI˜Zã1I™5,ȤŠ`› ÒRª<è˜Ð°ë#ÅvаÅŠM”9*ºøÀäì¤ÜÌä ]9 à›Ro& -Ad|ŠFÒd ãàiXPlF½éXÃìK©7³†ÅêM”xʾ->J½™4,( ]R•]4eß“Po4^„.®°†%F©7³†H3Po"£W²Ô›I=.î†dÒxÀ]d¦QÃ\ ÞDf«Õöà ù™ÎÌRqfõÄ€½±U=2 `/¢URÏ à+5’zh5QY樞 ¬‚iI=6 à/ò1ÞaÂzú4QE¸CBÌÌI&Y°-Ù}¯9F3¡Ùz>öã÷‡/|ßÿçðøÙrRÖ~,œßs\ -kàt,®`½Wf‘ÉAÙ€:eÑ -~LQ"•¡¤,ÖC7Q¡á¶û»U‹ÎÉÌ23ÞÈE©`±V>ªº>»Ï«ëꤶ@ÍE<ËuEUòVã›Úyùwܹ¡$ -Ôû•¼Õøu•Þä"­rïõÐ;û¼úªÏrïõÐ;û¼º®Y€^²ÌÛ‹«ñ§òДÊýJÞjüŠJî!ö÷oÈ%Öûñ8ù"ªCf€ñöýá‹7üóŸþö5Vçíãá›ßÉ™!g"9?”Oâ~´ú=8üãíw_þóøöÍ,GŽ]#±‹e+G†F)· òÚ]®—!¿]EÉ5WñüXÅò½\•üv+ßq•ßÜ ÏÿÃÛeÇûÝQI:&ä=låÐѺ€+Q %Ö„ÏíóQx[Á3B©ù_œ”&È7© ÔÜ!7©«iú¥õ¡ë‹ÊˆgŽùË›¿ÿõ« @Büòs+Ÿiýdž®WÃ_"¡Ñ¦ ¹÷FÈŠë8â}\e4ay|^]P¾»‡©½,{™ôƒÎUÇSýœx­]ïg‡ÜuîÇë}Þ ¾ •×úžõ[tSÆj²ú˜µ §Öæ‚ –b¸,áÛ2V¶ ®¸é‚÷õù¹]°ëë¬ÜðM[WsÁ¶dÍT¶ËÜQaA–íÒw37ó»iùËä*Ýü=ö^ ¹°†Ü095溊¡"2OˆÞ‚X˱¢Ñã²¥vñWnc90>*r.¡ä·å÷(b]LË1ËU—¹³ÏKRœO^n9º¹è9ô0mLwöÙ6Þw·ÛÐ@ÝëÎ@«ozž¼°yîã¶m·ÉéÀ÷jú>Û=ÌyÅ›»§¦‘ë´xݽ¹ÔXýX½9+žÌ¦”“=xÍ“å®jõÊŒ<=<ßpäûºüÒü}Í_ìª7 9¡I¯~9ù†Ü¾µr²]Tß°¼"ïæ37Ÿ$lh»Ý3¡È)ÿ]òá¶oF¾¹¡·¶-øÆ-oÉÛÞ{ùåÈ·úH¸T64ô^ü½åŸq;µŒÐ縌ËgsŒC׎ö÷,ÏË°xDšÑ3”³æ´þ®•Æ°p«.fZרǡæ-•všâÖ©¥5£8sÊͺô*fŽw§k:'¹k=£ÕúT‰Bn#ªìÇé«ØªªxM`Ã%=^\;ïÇþmÏrÇ;ÿ_}õLcLuÿÅÑv ÓŒJWí•ì™½žSµ†’ŒEýYÊÑËã"˜pr7Âæ}~î’¡Ìhåy+,­ý„UëVÈ=Uk“ó[­V#üÝrD*Oæ˜Pùßp½;ûüÜ®7ô•[­ì]ÈÕzn²_®^ÁöE_–Ÿ´š)ÉíöT~Êjv+ôZ È7÷o9f¼…fwöù¥UɦkžµT‡çÕfÛÈçg"»Luï1=S½£º]cèY•Ùx~«K×ít,]©Fô›òÉeß|ýÚt+ðª_fn>æ1²øÐ-·¼«Ë/Î+K¾æ•#óÑ1çŽò&3ŠX¨gT™åÿ ÂlmÎú4Oîdª6}ïD›Js[YŽy-2î®3婬±ßTûíOæ»C{Þë׈…œÜyvåÇÕˆûqžW#Ÿ/éñâq?öo«FþžÍÿW_#>ûëUû¤}^Tc.Ï°m¼Qd~]òJ£¹˜dóôÌXz7›Ürû'ÌÚ³G{öèÉ6wÀòv§ÏHük&y òRæàÞ­Ù­­kë`K‡iûX׫L1§Å›¶ß-mÎúIß»z@uÿ¶½õ¸î¡»Ž5†Å!kžTå=Ô%9 ßÜŒßö°ÝúB÷ëR‹Àe»¥üpˆËývyÁƒ"\ÌÉ G/kSŽò@q&ÏýI!»Û/ô\Þ›ýÐ[ÕWiIÞ®‘'«×÷l§‹Úþòèï¦ØĘ–×Þh!g×.ùé ¯=²BFBáî$ ±~¥>Û,í„L.™rÞyÕ¯#¢Jò´~u¡ÍFú‡ÖMn‰3µF~y s¬Ñ3Ú=YfOÆV²¼:š¯W±«bÓÄ1 ÏmÇ€£ãM²õ4ÞH“¸AvÜô±òªA7]Ä®úl:;-këÒ´œ×ˆ§Äúsê“J•ÖÚPͺŽ:ÍOJ•N ­e_îë¤N…ø9µ¡‹ÙùÓªÉcÿ+17GâÞ®´v -étPÛÕÑB_©Ô[åѵ4ËU†«ûÜ ¯ÐNSÖ™ä]øio_·dIŠúZË­èºcëâé€Ã;òÓ!$¥uXA¡¹ÞLôÓ¸œiøË J0^¿ÉýÆJ“‡¦åÿ*B§ -ò,_,w—’Êo\ !²7;yk¤™;ê°fËi´ÌeSê>;ÛËfRÚ èöÖÝbêd²‰žJSO@ªƒÇ–l»×u²@X³OÇÊ™HM ˆäÐ]ùiCz†¾UuaÑNîú¸ƒ;v>ÍäÔWÜÊ[,]ß>îäóxZŸ“Åõs2ÈŽz´Â&âP  0ÈFŸrÛ­äÁ öul2-âž?–0ç|prª½•—2çÌËÿ‹6oðû¯¿jo¬qÜQG ×±uCž#™¼ÂŸï$Ë+ýØ·ÍDt<Áþ Û<Ú†æ =Ž;7á5î4€½µ´AmçÎÄ0l8‘]wÝåi§n™p…x:³bOd^º6#`¯—¾Mb¼¼?Ò´ÂÅ<\æÁó#$§!q%MGH—ÝÔ󠸜–¡ÙFMqÈYH7½èÏóRx‘5]Li„\úÁãfç¡m™ÅÔ)°Ÿ/æÙÎBËFEéÞ^/^÷ªrl;@¨Ú;õi¦ö‰ µžNõËeÜ^ö˜ã—[mó õ±ü´÷|OrÆÖ©o.f¨yt« Â,”m#´Š Q£õSÓ)ÖnÍ,ËŒ³j¥ÔsŠAýa¶t˜W¥1Ì«wmeÜñz¶ä{fwNcv4Zö\2+´8÷îT-}£íeóVv‹¶Çi<‰#3¥Ñ-ìZ~þ}ÌÞQ_ÄÐZµŸåtÄæñÞ5Ûä_þå!,o³'ÎÓqɳû\??ÙŸ’´ó“Y–ð÷”¬üQ+]…'0ÊmÆ4TûƒWz·Bꔞg€‹/ ê¯Í,Õd¹S²õË$¥¢ü#/Io–¿½Hf9:mŽO–Ÿÿ`M“ -endstream -endobj -342 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 341 0 R -/Resources 4 0 R -/Annots [ 343 0 R 344 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -343 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb36-1) ->> -endobj -344 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 396.479014 101.433071 377.729014 ] -/BS << -/W 0 ->> -/Dest (cb39-1) ->> -endobj -345 0 obj -<< -/Filter /FlateDecode -/Length 3885 ->> -stream -xœí\KÇ ¾Ï¯˜³—‹U¬ø "ÄAÉÁÈa=ÒÚVäò÷ó±ºëÑ3Ü™ÞÕ*’ãh±Úi²,ù‘¬î:Zü|Mø/3™œKŠ|<½?|8X“‚Å¿ÚbsQÙ¯ñ›Â‘,'¨ÄŽï…à“I%¸üwv978üí«Ã?·}èèL)ÑQ8þüNXìMÊ)Ù ° -X–¼Â -Á¤äBTX‘ –XŠÆ‚!±ãKV‚\rÐXƒË -+C ωü%«@ —ˆ5Ä ’Â" 9ÈY«ò ˆeöNáQ0JÏ‘‰¹¸¢òx”œÆóÞÄÄHãc Yã1d Å’Æ %³Õx…}N/B½UyÅåä5^‚,Ú) -/CXWVyÅFK¯xJfVy<›S¾ä9LÈÞ[GdlÓ«GÖ°ÀraJEÃÌõÀN <@îž4,ð@]¢Ó°Àv=ç¨aîz&«aw½GO•Y`À§ì5,`à®'›4,`à.ÜÈiX€]5°Ã¨alŸœ­† ÜuÙ²† Üu !@å%ô0p×,A‹ÜÀ]¬Ó°€»Ž]Ô°†b€?VÍ€»€ §«aâ=xÎkX€ÁŒCZ¢aAîRAøS|he(—¨aAîRÆö©¼b(AãŠßBˆb,à.•×° wŸYÃ`¼ADuà.yDjÜ%W¬†¸‹¼!hXs0„@ÃÄ7C¦«òŠ±%g p°ä4,@66IT^20$Ò°`l,òP "pá½hX»6x¯aAîZFÚ£ò ‹ÏNÃä5àÁmŸF²j¬Rh<à®%ì°ÆîZ›Š†¸+aS˜„ಆÐ vÄ̦¤5,ˆÅ‚‡”OåEƒë aA² @–ʃ,œXÃ$Ö¦ø’5,H²xç4,H² eа)„ì[- ÌE­² SÔ°HfraÖ° …ˆz ZÕxÑ™œ×*/ƒGIÂ”Ø “†¨¥L†ÓkX€7’.iX1À#Ö° ÈWÑ°¡Èd‡Ì\ãdA’­a2]ðˆ4,Ȳ Ô° »Œ*3Z ¡QKBÕ­Ô™YÂÌÑHª¨aÜ•&RåAÀ„†Ø)¶ƒ†(~Pl¢ÌQyÅÖ° g'åfÖ° gÈâ¬Ó°¶)õfÒ° XÈ‚ŒOÂb£‘4YÃÀ8xÖjXP(£Þt¬aüRêͬaAñõ&J<Åo‹Ro& -C–€EåA$MEñ[`êM “Æ‹ÅÖ° Ä(õfÖ°iêMdôê‘@–z3©ÇÀÝP€L¸‹Ì4jX€ Ô›ÈlµÚÞxCB~¦3³TœY=1°€Þ€ØªX`/¢URÏ ,ÀWj$õÐb¢²ÌQ=5@X“¬zl`¿ÈÇø–Ó§ùˆ*ÂbfN²È·`d÷½æÍü#Í–ó±Ÿ<|s‡à{üñ_‡û¯êIYû!¿ç(…uqÛ ¸2u8F"YÊ”* ä{F!•!"×#7Á¶ûÚ - yEbB*S×Åó´¨å£*éS»¼¸¤r÷ò–çy]Qe¼Õø¦t^þ/?Üö y«ñË -9LM*¦¸Î»×/¾ëó¼{-tgŸ—’Õ÷ýtrü‚â÷È$§Iä"g6àJî<‰úÄ./!©5Nj©ˆV¾8É=‘PØ‚ZbÓø·oHCÖé—;\ý’|hr#cfèÖÙã›÷‡oþôê¯þî5¦}søþ7Ö†øí×$Óò—yºþûñÍ«+sˆqQ -È­6sÈ°Ö/à u°¼NÑh6ã#~éíòÙÝMí¦.“aÐù~ñ´þx­]ïGc^þ¿ùr¼ÞçÝàSXy­ïY¿*›2V›«¹¶áÔÚ|[•ù»7[£Êr|_ZîÒ tAÚ|Ã÷uy–¾ ùuq‘+£ºJ(h¯ÚŸ¶YMy¡]ßë›B´lbow¾ msÜde2¤»¾9=·•ÕÅuYñ8¡+±Pµ³uu=¯~ÿÇ?üeZƒA¬!x™_æ_Z?'1t¹‘³\á ý¾úÛâmcR'÷0ŠœžM*óÐ[Ý (æfŒ‹©ÖØW-jgŸ‰qŸØHêýÇ-ËÞMnëÎþ6·|{»à©YL8ƒ´n‘aù¼dOýÜæùµÖÍp=Ш÷°åÖPDên™Þ¾>ŸÛô†¼Ìò,¨³z^¨Uµ½¶8Ë» | t'†Ù§ò߬ ·“^«;"Q3yÒ“‘×Æ[¨¶³Ï—VyÈS>W,¬V¤çn³,«WÄ#‡U¬³ÙŽŠz‰Ég•mãù­,]¶sði±ß6cŒ×lóåëáí„Wí²¸fc2 7vöuùÒ¬2És[åy&õŒÊ6glÄF=¡²ýaÔRÿÛÕíY}xwÖ§Y}O¦šÕ﯌Sš·àû6ÂTåî©jgÍ ´hg":ïå+Ty‹6>ü¼ -õrœ§U¨ò Ö#r|t…z9ö¯«BÍñ|ý¿ø -uÝ.ÏZYÖß5ÚUýäsý|Úʵ Hmç{Jå*½Ù,ð³ÿþïÎ>Ÿ»|èa´D(K -/÷ +×í$ÿ¿ó»¿‚-òæð*?¡‚ÝÙçs›à7×·öäͼ_Pûz}˜1,,y˜<ÊÓ³‘}on6¹±—OR¶GUŽtöhȶdÁò³Ï¨7Qâ&yð÷±‚Ž[ŠjZƒ„0;¤+ð—)Õ]SBײ›#Í~ëáÝÒN¼¼&-Hß/jºëIË” Å‘Œ´ÀPç»[Áû4‚Üfü– LòldY=¸®áb+?b}ˆê‹L6fCNÞt>F6^ö¦åÁùl=÷gŽ¨*šÞ³¾þ¡·Z_·ò™¼A°¼O>]¬í?ÔM™MlYq}½ÓVrvíbòz/+dynr'YˆëGÛÇbê™z£8É”ó–ˆ+vý8Òy 6ËG9HýCë&]³m|}ðx™X!¢g¤K²¬yñJ–W¤³ñëU좄Ødq ÈsÛ1àèx“LÞNÄpI´Ótƒì¸ÉCòJMW]Ä.ú¬:š¶¿µuiÚÎkÄÓÓúsêƒJ•3ÛPM»ÎvšŸ„*Z˾!Ü÷I! -ñkÛ†flfçO»&¯·,ÄÜ ‰{»ÒÚ)¤ÓAm·ŽúN¥Þ*®¥i~ˆ2LÝç®x…všJÞ$ßù0ùˆÜÙkû0“¥ºê{-Oݬ[0\wO„¾ ?BRZ‡64Ó›‰~·“³ö2¨)7UÁ5M^ÿ¨*ÈS?ÈãJÔ˜¯Æ$⛼UÒLuXÓqm'uQJÝfg}Q¶J{ÝÞºklCT6ÑSiâ HuðØ’©[]' „5ýt¬œ‰¶ é9tS~؇œ¡»j°}²H“¹‡>î ÇŽ39õ'y[«ËÛÇl¾O5°ñ9YL?·IÙÙíÆdqP䣕ܼµ£“|Eû8œL‹¸§ÃO‡æœNRâèI^>ž3/:þm^á÷>~×ÞvY⸳-\ÇÖ yŽdõé§dùêŠFìn3O°?È”GÛЬ¡Çqç&¼æÑÝ`o-©#(uîL C‡ÙuÓuä'Í„+ÄÓ™{"ó±{3öréÛâ0—÷¤šT¸˜—ƒËbj2ŵ[SK]qVµ”zN1¨?Íšó®t%†yWâE[·E¼ž-ùž…ÙœÓX-{.™Zœ{w*–¾Ñ.çæíÜ-Ú§eð$ŽÌÔŽná¢å³ðï9¾³ô9;‰ÐZµŸz:By¼Š@Í”¼óõ+¿lŽÂò­ ‰ót\òä>×ÏO.OIÚùÉ<¶Ã°÷6‘|y›.Âå6cª}±›Þ­XuIOSÀ£/Ú^2ät¨~{O½A[‰úe’RQ¾¬ËKÒ›å;F’%ýΧ¡øÍñIýùjæÓ -endstream -endobj -346 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 345 0 R -/Resources 4 0 R -/Annots [ 347 0 R 348 0 R 349 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -347 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb42-1) ->> -endobj -348 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 465.479014 101.433071 446.729014 ] -/BS << -/W 0 ->> -/Dest (cb45-1) ->> -endobj -349 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 133.284971 101.433071 114.534971 ] -/BS << -/W 0 ->> -/Dest (cb48-1) ->> -endobj -350 0 obj -<< -/Filter /FlateDecode -/Length 4178 ->> -stream -xœí\KÇ ¾Ï¯˜s—«Š¬ø "ÄAÉÁÈAK6‚U9‡üý|¬îzt7ç!imËH¼^í4Y‹üHVw;[ü|áðOfgr.)òùòîôþdM -ÿÕ›‹Ê~‰ßÎÎr2Á•˜Ãù(™T‚OñütÂ?»Ë¹ùÓéï¿9ýkÛǽ)%zÎ?¾“I9%VË:RX!˜”|ˆ -+:ƒ%–¢± FHìùÈJƒK b°÷YaeˆAœYbøäXcA WBRXÎBç­UyÄ2“Wx.˜¥G特ø¢òx.yGdbbœÆ+&ƲÆcÈŠu/@–à˜­Æƒ,L9i¼Y(’UyÅçD/Aí…—! ¬+«<Èb£u¯ %3«¼žÍ)yÞ2‘ÕxΙÛ$•Â&ŤðÃ)‘¾ñ$ È:ð¼Ó€€,d 5$ Yž«ò Ö°€X¯aw=û¨a Ŭš w!AO VÃÄ{ð ŠFÒd ãàY«aAqõ¦g à—Rof -YÔ›(ñ¿-¥ÞL†,)ŠÊƒ,HšŠâ·À$Ô›@'!‹/¬aA‰QêͬaÒ Ô›ÈèÕ#,õfR €»¡™4p™iÔ°¨7‘Ùjµ½ð†„üLgf©8³zb`½±U=2°À^D«¤žX€¯ÔHê¡ÄDe™£zj€° -¦³ê±þ"ã&,§OóU„9$ÄÌœd‘nÁÈî{Í1šÑ•fËùØߟ¾|à{þþߧ·¿©'eíÇ!A¨­ö 7ðÛ};,Ÿ" -Ì*û¶2i*C(\ÙD(„;ùï|ü°‘‚¾ÜN ›z\Æ{ŸWH€q” -ö’7.óëèŒyQ´x äCÖîsWä„´¥œûwO¡ó¼³ŽŽ²~pŸg—5 £®GüÀæßküSYh‚þa!ï4þ©,é"ú2ï°6‡x#°¤¨&úh§gß÷yâ¡%UÚïôÒAöw¯NÈ&–;ñ<)!Õ#7@Ðxõîôå‹?üé}‰1_½=}ó[„¸lmø¿H¨ŸÉ!t½|NRÉÉâr„'ô·Òæ«œ_½˜çôr¨V¤|ÝÎ)Ó¸ï–æ¿UuFÔ“¬RüšP}L5åË\IR'5`—O±ãUÅXJ¬ÏPñ’â!ncu–zç6ù¢Š~é(ôÈ€ qHß|¨ÛðçûË×Ó6Ø×Piøê ‡ÏÁïþ¦å¯ûî~ÇÒò™/+/®¼FÏ+e;W¯ßnÛ¶qÛ<þ|òv»è&}Õ’] [¦ÜÍ4-fp LÞšr‘µ®&œ«.ŽfŒZµ^» oÙ±“CÅ*Qfx†ëó;~¬ËggÇ冲M¨Ö€8o'¹úådé/2nç³j¨”±‹»¿—Å&|ó·õ—æaµ+i[¡ñÛæ3Ëõ¾¶õo&ÿj¶Æ<ÍVhmþ…ÿ×¾~•Ol—/CŽÑ]o2fkËÓø«l\–þbóÝÞQi˜UúͼS¯·ë+[WÑ5qYK•â²]eo›·ZH³Žy°’fE:OúY4?¡ÛF[vì\G†Ëf=)ägÐâ@‡yœHr’!wËŽãÔ5¶]‹U'7ä ò×ä°c-u§ÛúDç~AAE6¹k-#ƒVÆn¿"©›­|Xx³êº~™çõJëµôí†EÊþÔ¾ëºg„nòªóm,y¥­s˜ںǘ7uöëmŒÕ¶›]éS’T ¹Ü—½ëaîÛÆuëVº[Çp/c®íxMÖê8vµ¦‹·C÷2oÛ&OýÓæ +ßïýiÐjSgi¯³ŽhQúâï›Õ?6è·G¾¥m]Ë›eïnÏËHû¶ó.¾>!eº©™äتférG3äî„êû|TbÿSiæl2joõ ·A¹%#_ŸDÊ0—ùÝ$ßLÉ¡˜ï’N‹í¡¼˜š|öS¢Z·¿Lr„Ao iKfyâµv½Ÿó.®w¯÷y3ø.¬¼’¶ýªlÚXMo§Äáñt–s1%ÀVãÏX™m'½•Òy^j1ú‡k³û|nI­ÜŽ¾á/ÿ/ΰf9 ¹aÍÏ_œm'¼iÉ’x-VùhqöX—ÏÍŽ£Ü2¼û¿TqC4>…ìù±â¬al³ç_C‘§¾- oéꜚª©ìãEYL³*ë®Ò4³ÝZ=¢]¦Üi°—³(ΜܿLËï’üŽh ïLëc‡­6ë¸ahª'ðeô‘‚ì´£n»û 5nròDmãã -¹ã8u]¯‡oòÄÃ9>¹;Žý¿UÈ¥´_ÿ¯¾³cÌ}!·÷Á‘I/s-ôªëp¯°Jå »¶·nÈÓÖëÖõ,™ôœEOxTvíÓºÏkÑg¿[tTí¬"ç-ùäé•àRvñVáWí=Ž1Û!Ô¿öVíLX·2>2ª‘QÔÐ)g¶çìÈÄåV< -^VQ;`÷”âÃûü -MÁYÞ…»‡Íæ7ŠÓìvGß.ïq„÷‡ÏÍwŠî³ûù÷þÔ}ùí±ï5?øæ÷ã÷ë׺¬›>û5ít³_û~mË]\§Ê¥rF¢é$u8Ç"O“fyô¶?Ôåó1ã‚xMN^×Uqáµ²õi»8žÏ·^®Ï«B ö‚¼/ƒËÓã¯]‰w›ÜQÚñaÙ–ÒœÝ.ؽ¹•ä 8•$Ïv_;x­Uk‰VËѸ\Q\ËÖ2¾•µM;’˜J¿^ú®e_+G{ɵ!ˆï Ý÷ûÚ£¨¿vŒÝJ6¹!TK¹Ë(Ÿ7ãß(EûB[ÃWû­|Šõ=WßU³1çåeösd#©QBU–åb׶ÎUeÃ%ôžõ+Þ÷Vë·XyQP^Y¾2`ºXÛ¿¯›þîä -›¸T]nyƒ×V²dÉ{òÓIÞàf…Ì< ï…¸~´},T¢~G»’)û–(MìúqLÒ¨C[ô­›ÍäÔwÜÉ y]Þ>îdóx©÷d1ýÜ&do{´“MÄ!@aŒ>UróÖŽNò%#íãp2-â^N?œj˜ó¼$¯‘œ¼_>g^îü´yßžøüu{¡i‰ãÞv´ð[7ä9’É·‘äÉòí$ØÝf"zž`]mC³†ǽŸðšGw;€½µtA]çÎÄ0t8‘}7]9Lš 7ˆ—{"ó©{3örImq˜†äU¸&.æåà2|ž†Ä•4!\öSG\̃ârš° É6bŠAΓtÕ‹üyßW‘có¡vhïÔ§™Ú&Ôx:•êeÜ^ö˜Cõ™«æ¼CC},š|z’3\c¤¼¹˜mt¢æÑmmæI¹Ñ6“¶@Ñá4Ûh}ÄÔdŠk·¦–ºâ¬j)õœbP˜5æ]éJ ó®ÄC[·E¼ž-QO€ÂlÎi¬ÎŽ–=—Ì --ν;•GKj´ãܼ»EÛó´ ‚Ä‘™ÚÑ-Z~þ}Œï¨o”i­ÚO=qy¼Œ@Í.‘§ú­n6Ç aùbŽÄy:.ùà>·ÏOŽ§$íüdž Ûa˜È&'ßϧ‹ðF¹Ï˜†jßݧw+V]Ò‡)àê»Ôúûõ šêƒfõ¨_&)åûØH’Þ,_#“¬þU=BáÍñIýù/ÂŒL{ -endstream -endobj -351 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 350 0 R -/Resources 4 0 R -/Annots [ 352 0 R 353 0 R 354 0 R 355 0 R 356 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -352 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 518.373057 101.433071 499.623057 ] -/BS << -/W 0 ->> -/Dest (cb51-1) ->> -endobj -353 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 201.376036 101.433071 182.626036 ] -/BS << -/W 0 ->> -/Dest (cb54-1) ->> -endobj -354 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 182.429014 99.933071 163.679014 ] -/BS << -/W 0 ->> -/Dest (cb54-2) ->> -endobj -355 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 163.481993 99.933071 144.731993 ] -/BS << -/W 0 ->> -/Dest (cb54-3) ->> -endobj -356 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 125.587950 99.933071 106.837950 ] -/BS << -/W 0 ->> -/Dest (cb54-4) ->> -endobj -357 0 obj -<< -/Filter /FlateDecode -/Length 4592 ->> -stream -xœå]M$9n½ç¯Èó£•DRÀ` ìx а ºkºw±¨10ëÃþý}Œ )̌Țj#w¡*3H}0$ò‘T(Ôáìñó]ÀŸÂÁ•RsâóË/§_OÞeñø7•X]LìŸð›åÁq9GI+‡[¬ÕbA ÉyËʃk‹18Æb° -Ä Î¶¬ -1bl± F¨’ Vð#DïMñÌ ^—0èÉâÅàR©±š¼ ^ÈÑâ¹”9H°xÕ¥”¤X<†,R}°xY$0{‹Y˜J¶x ²P"oò K,™,^†,£S ^,Юbò ‹O>X¼JNja6y<_rÙò¢'…È[¼œ@7ÉäÁ¢0I)¼Y’—jò ‹ ãÇâ'„r)†µFµnò,ž@–3›<È‚É· &Èâs² ä—, ˆ9;®‘-ˆ…. -ÄRçL Ä*ŽSÍàÅ`yÈ"œ,$ Y–kò U¶°€"dA ˆ Kd²°€€¶ m±°€·ìk°°€€·ìC²°€¸Ó[X@@\*‰-, @.T©ZX@À\vZX@]˜{¶°€€º$)ZX@€]â’,, à.qð0p—5Md[Xtt -YXÀÀ] ->[XÀÀ]˜Q´°³ê ‡ÉÂ芋¥x ¸‹g ¸3\€ÉË6H0p7 -nÁòÜÀÝ(>ZXÀÀÝÈ1YXEqÀoFÀ]@ˆØádÀZX^$ И‹K,,àn¨p†M­\(5YX ÀÝP0}&¯º1â†Ýb”]H©ZX À]8*²°@€»€Ïba0ÞÁ£F ¸žÚâwC¬ÞÂî"n  . °°þÍÕ5yÕùZŠ…Ü,E à…/@“—)XX0vq¨… ¸ ÷^-,HÀ]/D$à®g„=&²P‰ ®fkØ4‚Uç#Ââw}À [<à®÷¹ZX€»ê6-,HY ±XX¢àhaA*ìjÎÉ‚T=xùL^r¸ ²AY&²pf X»JµXX#d¡-,Ȳ d°°«Ñ·™@¨‹™0dA¤haÌ•ÊlaA–„| £jñRt%®M^/d rfW,,@.å -ŒÞ¼ÓpɈ^` r…,0 àŠ\‰ˆÌ-^€,²-,@¤ ^”Y ZXPbA–™¼…ðÐÈ%1Ô½æ™Å‚ÂÉi¨haÌ™&ÒäAÀ„…˜M¶ÅÂ$?H6‘æ˜<ÈB”5Ý,”Y¢@75ßÌTYñYXP}r&[XÏ{ j(È7#[X»Ô|³XXPÉ#ßDŠgØm¥¤ùf¶° 2d„(&² hª†Ý“o,^‚,±²…5%Í7‹…3o"¢7—Šæ›Ù\.îJ2Y<à."Óda.o"²µr{à•ŒøÌfÍ8‹¹bà½ßj.x`/¼U6× <ÀWs$sÑb"³,É\5€[3xsÙÀñ.«OãU‚:døÌ’õ&+Ì‚Ý÷œc)F7Š]ÖÇþþ—Óï?Áùžÿò¿§¯¿›VÊÚO€ò'M¬EM$VL7àÊMÍ1&:¸‰È“„ð-uTˆ\!`q^tS!áŠánë¹ k‘!±ÊÌLwÆc¿È¦Š’-ëÃuÞKVjýÂü> x;Ã$àí2Ìí \W±õÁ*ï!):ÒX ¡Õ¨Ø ƒ@ÔëyUøN0£¹ûË -m¿ä†7g nôç¿œ~ÿo?þç¿ÿù'tûáëéã÷(ª¾Ž~ø.໤Ë'—ùóëÕõÌ—<_¿Ì×qþ C[3ëBÓï­ÎuÛSßÿ}þðãéÖãŽL¤áæo•H]ì݉:RáMÓô-f9'Â0„+7fçsL`(|­Qˆ0Þ•cUžf\A#‰€J…]µíjõ“¦~e­ªMµÃÏ7þ_±§jz­wÂU}Óý=Vçy†yDdŠþ–®-Cºù„ð—ëè—ïú¤A-[®QãëÂoÓÂ|… Ÿg~^£ÆÔæ5ÊÈ}4ê(4—“—-5Þ(û›dÛC2ýü4È>´y«¿^¦\ÝG¸¡²HÝcITý™k†S{>ì`çQÙ¬ËúR}|\eÿŸv5R5þyàë ƒæAã/C95ü†E;ÏßrΡh8^‘øõ·j<FÍ_Ñ-òÞGü³>Š+Aýú9…>ß%Í2îÌÁ:Ï34ÈÄ<}$ü&w"Ãõç¢dß 2t6èõÔ®i£Ç2èóØvZÞ lUÖ[¶tÅ‚.¿þå†jè -ofFŠxÐbÕxµÐ§Dº¬Z³˜„ü• -‡3bºÉ½ˆöX•ç˜ à“” -í'bMﮣØ7F·±d]ý™VöbÀPdîÞè«ó4ëOÖK¨”oéÝm8êÃ(ëámfÞ#¾+ØYåËæÀ]IQ—ËýÎxß/ú†yÝ âôl†%:/œ´¹û’«ó|+$º&ܬ»*Ay°*Ù¢¾é dí 6|’˜¦Rù*Jû4¨S[2‘¥ýqéäV#ÅPÇï·²K1þÓ ~úx1î{Hbz¢Óî©õÇk¹&¾m 9GÑÒi󗇵ʮ]«ó<8”u×WæĦÒõIºòLw»#}~|©áª£Ã„ëüµ~¬t +ê-å³'¯ úŸ¸ìcÙÝ¢ï…eÈU\3DzƒužË8„‘¬‹¼–M.m\žýlDÄGW®Êôö. ØÕ±ä -{×rÓúúZ¾ëE—n‘úxÿ×x9àx¸`¤Ué>*Ø£§r†*…„”&í©ß¡*Oƒe,ÀÞ*"ö³ƒÍ$À/Ñ}p¬Ï!×wüÚ©ŸŠó! E£¾Îqü|c²Ú€!ÞE¯ûEß ½ŠîÄQD7JyoÅù`çC/ñ€Ýˆoöj>üÁ¢~jT5£EÊP˜QæryÎñ§%i{²Ewö$Ö]8{“}¿è{M¶0Æ3¦ýçׄ0fo­ö`'œlQj"²'»»€ÁõÐýýápì³îâ(vèƒAè–˜õe¯÷Ê>u› U[]î—Ç9ù^uOxÀœ–ø™)ˆÃ$B½ß6b@j}” -C3ê«Æ]ù§÷…X÷7½M&æâ³Y_ŽŒAÊj๖[|ñò¼{/ª<í-Ú¶¾ºA÷ãËÆL>Ô:p¹q Ê\ª9¾¤s°ÎÓ„¢oMùª/Ÿ˜1︌³vx—È—iOÌØèÇ17¿NÍŽÃɦÍ#2 €²­/–œبGÕ—ñbÔÆƦǪŒôQGgO »E߃Z…ãDo5žcªðÂxßÖy¾ˆ1{ÝI‘%|³ˆqÝÅã㶾f›¼ŸñF]®¾¦ú6ô±0¦hÖÿfqçùÝúpÔ´DpÆ‹š†nÛÆ#Q Ýù$ºæu7ôÓw­ê`§A謻k º¾ñÔãMŽqÝèÇY"/+ŽS^>«_S¹Ýô FTŒvCû§—X0ëVíofKJ³íUêΚ[qYæè(B>§º¤›<öÖŽUyõõ“¹TûùÇõÞâýg¨9éƒh}vz‹ˆ¦·¤îÙ±:Ï3hE^{=FàmvÕè7±ÙMÙì¶öÿ…ÍÞ”y£xúΚPÖwfóǪ<Ú•éÍWÒcIæ î+„Äiÿyàý¢ïÌÝÑškHt|Eý`ç ™‹(ÂAÁìç“¥7Ëö³å¤Ùªô{|Èâ»Í®»½^„Û¨HҷゾyºÖy*ºo'†¾Yî²îâñÜŨÿÀj·Q{Ú¾¹§4KÞò†þ'ó¦»Uv[Ÿ(=§éÔŠ”Þ(°«½4ëY¹ŽyÚßXøZÉÎÁb…ù8'2Z:šƒ-϶m<’ƒXmõ<½O:ê©î­l¬ó4 P½n™cŸn¼jó¦xnÝèã(¿6Üëi©¡ºç§Ãr0Ú9Våy&…h2Ýx.y7Ú©Œ&c­,»ÑÎý¢ïíT=±¬ÆÄú`ªê²ûè`ç‹vjÑm[z–Œ9uèjÒ÷øu¶‡´ä ØÈD›íÄ>þhv-Þ¸5¦ãø²×á\eÛî¸Å¯ö<ù²€î‘‡˜ÛÖéë!Lb–ån´EzÔ#P„¬¶Z>x oÕ p·Þ¹€- Ñã½[ô7ïOó+þYÖg¿t%”áÄ€.În‘1¦16Ÿ/œÃ•±ªý¥yN äôlO*çiù7ëqjo?þé_ÿå?Æìã¿\æàò¾§Å¶ôZwýé+£ú>Y¨s™iÇô¼Ó.ÍOZU“Ywø]ÞGÓrªÝú9Ù±êÓ× *_=ô›\“_Ozè%dø¯x¬Äù«ïm飻+Ú l,»z]’Äùùkí“´¯QÚÝh}iÕô0ÝÕ®Ô.DÔLaKÖ»GŠ1“õàÐâh¾J]IMf—y,»4¸TÜ%k»eKôCw Y_ŠoecÿZûœƒØE‡. ÓßÊÆô*?SAÚ×p1„zI 7;6ÝhÓ] EÓx16¬kŠK[u%!ô›Íë7Ïû,rj Ôíú:Rû)µžM¥é2­/»Ï¡é$€f¼Ëõ¶h°=êAÎbKhÁ«‹QGjYªÍdì”mÕis.@óÖ[ÌM¦4WkÃ2Ýq1G)÷˜b¡þuig¥¢Œ³’6eµÝæñz´D=’Qórw~)ÙcÉbÐÒX»Sy)I¶í›×}7o{nƒAÒ™ú¥šlJ¾ ÿÞb;—:W+V©ÕêH(Ë©‰pÔú¦X¤é?Âð%%=EÏ2Î\†å’‡ëÜ_?Ù®’´õ“±'L‡c"Ÿƒþ—&¶¯`Ô}ÆÐTûïNìjºCÛ¸¥ÇÀXZ`ÎoV‡¦3íño^$ê—YSEý/,HƒÞ¢'ogÌå¢i EVË'ÓÏ?è“I -endstream -endobj -358 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 357 0 R -/Resources 4 0 R -/Annots [ 359 0 R 360 0 R 361 0 R 362 0 R 363 0 R 364 0 R 365 0 R 366 0 R 367 0 R 368 0 R 369 0 R 370 0 R 371 0 R 372 0 R 373 0 R 374 0 R 375 0 R 376 0 R 377 0 R 378 0 R 379 0 R 380 0 R 381 0 R 382 0 R 383 0 R 384 0 R 385 0 R 386 0 R 387 0 R 388 0 R 389 0 R 390 0 R 391 0 R 392 0 R 393 0 R 394 0 R 395 0 R 396 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -359 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb54-5) ->> -endobj -360 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb54-6) ->> -endobj -361 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb54-7) ->> -endobj -362 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb54-8) ->> -endobj -363 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb54-9) ->> -endobj -364 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb54-10) ->> -endobj -365 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb54-11) ->> -endobj -366 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb54-12) ->> -endobj -367 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb54-13) ->> -endobj -368 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb54-14) ->> -endobj -369 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb54-15) ->> -endobj -370 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb54-16) ->> -endobj -371 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb54-17) ->> -endobj -372 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb54-18) ->> -endobj -373 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb54-19) ->> -endobj -374 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb54-20) ->> -endobj -375 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb54-21) ->> -endobj -376 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb54-22) ->> -endobj -377 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb54-23) ->> -endobj -378 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb54-24) ->> -endobj -379 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb54-25) ->> -endobj -380 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb54-26) ->> -endobj -381 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb54-27) ->> -endobj -382 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb54-28) ->> -endobj -383 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb54-29) ->> -endobj -384 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb54-30) ->> -endobj -385 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb54-31) ->> -endobj -386 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb54-32) ->> -endobj -387 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb54-33) ->> -endobj -388 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb54-34) ->> -endobj -389 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb54-35) ->> -endobj -390 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb54-36) ->> -endobj -391 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb54-37) ->> -endobj -392 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb54-38) ->> -endobj -393 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb54-39) ->> -endobj -394 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb54-40) ->> -endobj -395 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb54-41) ->> -endobj -396 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb54-42) ->> -endobj -397 0 obj -<< -/Filter /FlateDecode -/Length 5075 ->> -stream -xœÍ]K$¹¾ç¯È³ K"õs0`/ž~>ür0KôÿJ‰ÕEaÿ„ßèÖp\¼Í!ùãÏB ¸Äì] Ç·þ»¸œ‹¿þû7‡ÿ]×±G·äœõǼ‹i‰)FãVËXRXÞ/1:V° n1g1|dÇ׬18'¯± ;—V‚ÄÑÒ5+C -k,ˆa³ -ËÈa1*‚fr -Ïú%@éAã9»„”]Vy<Æ#ZBdë­ÆËKÁ'ÇÅgc5ž‡,Þ2Y˜RÔx²P £ò ‹K‘4^„,ÚÉ -/AXWRyÅc5^¦ÅçĬò2x&ÅtÍsÆ/>gíâa›¤òàQ¤žƒ,Áø¬ò ‹'ã4AÆÆNxŠ))ÞêÄ»ÉÕx²8YåA ¾†.@ƒð EpIÃãÂÙ±.щ“†.å…c$ \ö ‡5 cÁsV2ÅsЀ,dax®Êƒ,”YÃr4, ‚,ŽIÃÚ2¬EÃܲÉVÃÞ²±AÃàBL£aq)Ö°€¹0¥¬as Ø©atáîQÃê’NÃ짠aw‰­Ñ°€»D¨©ò XàãB6‘† Ü%k¢† Ü…9 0ª ì0hX[Y\JFÃîºdXÃ)@åÅ>H0p×yÜ‚6sw7NÃî:vAÃÊü1j4Ü„x=€,X 0߃çHÃ4¶8„%xà®Í˜þŸZ-6å aîÚ„áSyy±WüZ^lYÃÜÅDExà.à3iXŒ_0£: ’l{ ü ÙDš£ò yÖ° %'éfÒ° %ÈâŒÓ°¶)ùfÔ° È‚ˆOÂlÂ"a²†€qðŒÑ° Û„|Ó±†ðKÉ7“†™ òM¤xŠßf -’oF 2CEåAMYñ[`òM “Æ ÅeÖ° ‡ ùfÒ°aòMDôê’@’|3ªËÀ]ŸL¸‹È4hX€ 䛈lµÜÞx}D|¦3“dœI]10€^¹U]20À^ÌVQ]30_É‘ÔEˆ‰Ì2uÕÓ*˜Ö¨Ëø‹xŒ¯0á¼ú4/Q˜CÄœ™¢Üd†[0¢ûžsŒbt£Øy}ì=üö3&ßã_ÿyxýMY)k?ÆO$±öâ".c¸WKiŽŒ"Àõÿ)BÀgêˆ1!-`±.º‰˜Š1Ýæcÿb×"Cb‘Ù"˜)wÆs¿È,†Š‚.ëÃuÞIÖ¡£€œ+3PĬ”$F€Ž­ª×uÞ]¯s¿“’Y®óîzE ƒ¸Â9»Ò‘…ÓÊÊ(EU±{+½»f率–Ti¯ô^ÒRS#)/Ž#âRDû‘ZJ ¸¯L²>Xå=$EG¿”¢ìd¾ˆ#S3¼*ü»O@íþüT¡_Nr#e(ÖûéçÃoÿýÇÿú?ý„n?½þü½1þ³1ü¿§¾³¸æ×ú™ðù?ÇO?ÞéCâdIpUÒ¬¡íêÉ/lØy¥º÷“òÉõ3n6ë0ãYÉŠÒ ©ð‰I¤w±CR ’" e¸n’ó ÝáÓÐ=—ñn³B¼«‡x×ÝØ—]’Ry¤Ä_KÏR I~ÿimá2 ð:˜R`¶%d¼ëûª<åßÂ2b‘Ш¾ÐÌcñ" d&ÛU›Åxk3NJâ–Í—v{ÂUcÝBýü²Ë–&/¸jrÅ»’Ò¢w¥:nÉ¿^!€ç˜œyOè\7Zœ¥JmÒ‹ünahæÅdYyVZ݃xâ'Ùäµú[ö,‹9¡ŽZ»&ܸ$ÏNñkÎ ´*¿å»l3°ƒåòNXù”¶&¸Tê³Ì}[ø¼”íéI B\rà˜Õú~ÊcKë%`Ñ%ø¾Ü -~·ÐLFŸ¬¿r“"· ^¯ÛðqLþmŠõöLdW) ㇎ä’-Ôû¨´¯Î‡ ãd‰7>· F‚SH‹Aó²F·êä«Ài†‡«Vw…c=šSêo‚Óæ”Ú±¬mp(ÏCxJ‚‘@=wÿ²Ûˆ™“×êï—`a„lèÒxöJʪ£ôÔýg¸’Ù©µ¿Åô0CÒãò²Ø›ãìojk74ŠÝŽUÚ #X¼nã!hL²Þ˜‘ðHÄæy ÷Õù0Ðèä!ºÍñqh|*GÖºîô}ÒÖë6Ë[•ú¾&­m1©&­¾ÉXenîqi>‚âÉJ®r„Qd"¿9±î«òqŒG6’ù‰yõyãYu:ŸÖ%GÖ|5,²Í#22©£w‹ È>·²°}U>ΰÈf1Ù]‘¾a¸³îdµ´©«=¸…©»Ý¯ö]U>ŽÚ# ß‡èSÞu£+¨ÔàHW}ŠòZ6xÙ“RÙÓq_÷ûê|åËæÞd3ÅoióëNÞ+Ä¿nõ±_©ÿ@ˆ¯Ô~8ÄF‚â?wÿ#ÄWê?â?'ÁñµûG¸*+›ñüûÈ -Ë iä3×߇Ö;žiAùiû Yaã²è ¦uè§FgJhž´i…å9 H^¤²!nÚíÑG M’L¼‹}xëdHÙ¨#¼%—ÕDöN÷ý}ö!Û¥¡Ý¬{ð¦òÅyy¦þÔèÈÆjgSÔ½}xñãÙ=i!-ý˜´y¥Ûí´ ›'ƒ÷ñž}ìJÁ9ÖTß_§à—ÐtIÁÉUÙ¯©,×Þ3öUù8a†C&’}wÄ« „°ÊºóVí½« ;ë|uyÙh„¼)ÿ Äu§ï³ºpÝæc« Jý¯\] @”dÃãîÕ…}U>ŽñDy‡3rÐ}íϪÓÇW(%DN&`Ì÷¦¹ûª|˜a‘È ó¦¼’ûí2­u'Û« liAôŒÙc÷̳¯ÊÇQ;ÀÄ’KÞ¿ãêºÑj&y5.hÊ…¼pfË[+ ;ë|E{ dö0UE¯¶Å}_·-íØü8Ùöªƒ½»ÇæÉëúöµýnå¼c×ÂSRL«JýíU‡>Ÿ*µëc- ey|å^ëã­ýV]?òÈKhÛ»"FŽzû~®œ  >æQâãÖÆ¢ûE¿Âä×½ÈJ„±ì¶w:Ý/ú”@÷¶M{¨:–Wò²ä²§ ÷UyIß6Ê[à !–¾áéÉt‚uÆRߌ¥mon»·ÂOÏPŸ+/9PØ7áî«òaæï…ˆìݽžÛFÇÒ_¨…ãü²P–Cûå„ZÑÙ²ŠZ–«‹µÏ6€ÜЫ/‹­]¡øÙ¤lAµ/Íè®èµ¬{™&¯Ú†´Õúᆒiô)õ¨Ö•øQ®Ï†Š2í:Ÿ‘•_'¹hjßTä½réÙ×¼Ò.·{­.½GõnVýŸW«Ekí´žåú¼Ž\GÝ|‘I»v=B“»nìõI,JˆœŠUe¢¦ý:7I"S›“ævÉ«ôr\Óu;]Ó\Û -÷ä@G·ä0u®¬sd³$m¾œÚ–c»¹ÒuÛÅr|{íl•ÃJš–û—~>Wz¨×¦ÊÆJã—R·Þw“½ôáîô§Xjë[úÔî{´yW·îòþ}k£zAi'Tz˜YŽ³³,oñÛ+OÒ·Ò³u~íا‡ùYŽÅ¼­~#Épõª‹p}𶵅à-=HãÚO»{ø2¾ͯ†‚Üb Æn.ÎÜ/ú^«EÙÇ%3Ð3arÎrÈ}ÉöÕùx«2rf‹õ¨}c[XKmJ:]k}aD½|+×õn¶w™C¶°ë¢¾¿Xp6—9æ”ú‹¬©¯â\´5gk½½;yn¯ÿ òÛÞ?oÈ~™-ÎzÒ]/á+Œ6»# S¡£­G¤ûªüÚ8½ŸÌvÎ}Ëé-ÓYíL£‹¡ñ“:ªgãD4eA,ámšŽÚéJÜ,²¡´–…^/'íP¬ÔФŠ-— ¢å)-1•ð®$zé¼QBÈ0"”P3O‰k®eZØf×ácOà^FÙC«ö——›M ÃÚ\žÆ÷–šhË{ŸkÈv!ïªý–Lò¬Âå\WXÊ=üp9”¿ÊG´å\LRys'É1†‹@`ÌGÙJ” q?ªÆeÛãšå¸ñ_z)ù$#‡’Š#•¡/jù_Ê ÿ|WqCËuËiÁ¦“kƒüvÓ¢Y!3„yƒ,ÄúÕô¶qº Ú È€yï²$BS¿Ž$F„èÛÝH}ߪÉM²Þ®ÄÎ+DÔ öš,wo[Éò†QZ¨^….ŠMfYfï ò\v48*n’-™‰è¯‰fên7y¬œÐØU±‹>«ÎNÃßʺ8 ç=âé€né’ú¦RåœßÖTÓ.2ÞF£I¨Ü©¾•ìÂ}œÒé ¿3­iÆ`vþ4jrZ♘š!q/—[9…t:¨åjk¾Tì¥Ò¨š›æ‡(ÃÔ)uÅ+´Ó´åOL>b¨}]“e­¥µI“ݸ+âé e®Èo•Ò~`…ñÍôf"Mívr2Ã^ñ@U\³Ñä¬9ùÿ ¾SyÊËݤä¼Èq5:ßìäµ’fzè¨Ãš,ÇQvR—±Ûì¬/›ŒR^@·—î[Q'•Mô˜›xR<ÖdÛ­®“š~:VÎDÓ„@wƒì»)¿­ÈCNß]Õ›ÞY°“¹ûÞî ‡Žo39ö·røg—··;Ù|#žÊÄÆ—d1ýÔ:dÙ™Ņ̃w6‡`…A0úVÈÍ[;:É4h_‡“i3îéð·C™æyÙ€äÚÊYÖsäeÿ‡2?â÷ï>þ©žxžÇéhá:¶®ÈóL&ù í$Ë_BhÄî6ÑñûƒlÓ(ë›5ôyܹ ¯yT7Ø[IÛÔvîLôC‡ÙuÓ•E£¡‡xºÐbd¾vlÆ„}¾¤vsè†äØÍ&.æÛÁe<SòqjWRtLéಛ*âbn—S‡yH¶S r^äçy(Húš.¦0B.iðxL³sÓVîb*‚˜æ‹¹a¶s§y%"ôÓîõÕã^EÍ„Ú¡½Sßfj¿1¡vÀÓ©T.Ãú²Ï9T^žmÎ;4ÔÛ¢É÷¨9Ã5FhÁ«‹ÙF'jÕj?wʶê´M.@3Ö[ŒM¦P«5µ”;Nª–b)õo³¦ý<*]‰~•pUVÚm3^–¨@~6ç8îÎŒ’=–L --̵;•GIj´ë¾yÝw›mÓmð$ŒÈÔŒjþªäSø÷Œïœë\¬Dh¥ÚOY±i7Œ‰šm$Gå/H™‚•ýÅHÉ#§i¹äá:÷×O®WIÚúÉÜ“•™D&Zù[`ºo`ämÆÔTû;azµlÔ[zLÊòЀ9sµ:Tþ þÕE¢~%U”¿ýDô&ù“ÑX}ƒ,¡„ÕòIùù¹þP -endstream -endobj -398 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 397 0 R -/Resources 4 0 R -/Annots [ 399 0 R 400 0 R 401 0 R 402 0 R 403 0 R 404 0 R 405 0 R 406 0 R 407 0 R 408 0 R 409 0 R 410 0 R 411 0 R 412 0 R 413 0 R 414 0 R 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R 421 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -399 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb54-43) ->> -endobj -400 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb54-44) ->> -endobj -401 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb54-45) ->> -endobj -402 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb54-46) ->> -endobj -403 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb54-47) ->> -endobj -404 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb54-48) ->> -endobj -405 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb54-49) ->> -endobj -406 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb54-50) ->> -endobj -407 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb54-51) ->> -endobj -408 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb54-52) ->> -endobj -409 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb54-53) ->> -endobj -410 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb54-54) ->> -endobj -411 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb54-55) ->> -endobj -412 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb54-56) ->> -endobj -413 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb54-57) ->> -endobj -414 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb54-58) ->> -endobj -415 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb54-59) ->> -endobj -416 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb54-60) ->> -endobj -417 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb54-61) ->> -endobj -418 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 378.232628 101.433071 359.482628 ] -/BS << -/W 0 ->> -/Dest (cb55-1) ->> -endobj -419 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 163.788585 101.433071 145.038585 ] -/BS << -/W 0 ->> -/Dest (cb56-1) ->> -endobj -420 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 144.841563 99.933071 126.091563 ] -/BS << -/W 0 ->> -/Dest (cb56-2) ->> -endobj -421 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 125.894542 99.933071 107.144542 ] -/BS << -/W 0 ->> -/Dest (cb56-3) ->> -endobj -422 0 obj -<< -/Filter /FlateDecode -/Length 4555 ->> -stream -xœå][¯ä¶ ~Ÿ_1Ï¢H"© ä¡@[4hŠX´‹>lNv'’>ôï÷£Ç–e›3öLN‚ºç̘ԅ¦¨¤,kÃÙãç³€?…ƒ+¥æÄç—O?¼Ëâño(±¸Øßà7Ë9xÎNBMEÎ?*²ËUbNç×þ¬.û⯧üîôïepŽ®Öƒœþ¨,&—KÎ^ VË2X".ç(É`¥àp‹µZ,ˆ!™#oYbp-b± ÇX VÄ9ЖU!FÌ-ÄU²Á -r„è½Éƒ ž™¢Á ┞,^ .•«ÉËà…-‘K™ƒ‹W]JIŠÅcÈ"Õ‹'E³·x…©d‹— %ò&²Ä’ÉâeÈ¡jð -du“Y|òÁâUrR ³É«àù’Ë–½8)DÞâ…à¶I&3 -ƒ”²Á‹%y©&²ùhñ²0~,pB(—bÌÖ¨³›<‹'%ÆÌ&²`ð-ˆ ²øœ,À rŠKÄœ×ÈÄBŽ  b©Žs& bÇ©f Èðb°€€W pWݦ…)+!  C-,H…]Í9YXª!ŸÉK×baAö  ËäAÎlakW© r„,£…9B„  "p5 ú6ÓÈs1ó†,ˆ-,’¹R™-,È’A«/EW2àÚäðB¶° gvpÅÁÂäR®`Ò[X€w.YX1À laA®SŸ"W""s‹ ‚l é‚‚…%BDƒ”Xe&oa<4rI¨Úâ±×<³XXP89 -,À4A¦ ¤4y0aaÆG“m±°É’M¤9&²°…¥DM7‹…¥@–装°MÍ7³…ÕCD|TŸœ†ÉÆÁóÞ‚ -òÍÈ`^j¾Y,,¨ä‘o"Å3æm¥¤ùf¶° 2d„(&² hªÆ¼&!ß:Y¼Ybe jJšo f ßDDo. Í7³¹\Ü• -d²xÀ]D¦ÉÂ\ ßDdkåöÀ+ñ™Í,šqsÅÀz¾Õ\2ðÀ^x«l®x€¯æHæ¢ÄDfY’¹j· -fðæ²þ"ã &\VŸú%ªsÈð™%ëMVL FtßrŽ¹])vYûùûÓçà|ÏßÿçôéwÃJÙô`üÄIkÑ)+†på†æÜ@äABøH"×YÈXÝTH¸b¸Ûzn_ÂRdH¬23Ãqß/2…€¡¢dËzw·’•¦~1ý> xC„ŽáöÃaý9ö°€Ù‰zg•·i,PŠjTìÄ„@ÔëyQø÷ïN˜Fc÷—ÚvÙÉ oÎPnôçw?ž>ÿËWÿë×ß ÛwŸNï¿@QõuôågßÅŸqü”Ë'—Ëg+·¢K?óŠÿ2~®ø]ê¶m®ÛþÇÏOËϾnëó“-c+;ɶí·ë¶¬‹:ë{Zéf}ïë{“—N¯;÷=\ÿóüî«ÓÞ-m³ˆc²0äӀǢ˜vÓšÕxȘ FfŽ`AiÃòÁ÷¼Ôÿ¤Ã6>ùš.BÉ|­¸ŸLˆ„3\ñŽ6Öy}"?AŠCû Vý鶷‰·“e¢éD=–D·Q@Ä óž^UyÅd]èÇ]Ëí!^& ,Kk¬;|wE¡EÃM8{]vÓ;áª1ëm«ó4*š£¡[äv{*Ý|BøÀóuôów}9xó5p|šù²òp D¾ù+¯9´ùx܇e;ôÞªoóZ­LYÝG°MV– ÞòÌÈAHÓ¬=ÿu°Îó˜,²@OAGßm²ÿçŸÍŒÔŒ¿ëøªdÐTãy PŸ…éâq¹Ë?Ç„,ʆ3qÖ}´©¬ó<ªÉp’R¡Ç܉t×ßv=Aö8s úê{×´±céì¹o;-?oŶ*ëµ¹t%“.¿þåŠi”¬+tºúztÆ©ñ4f¡;J¨”ï›1y¤SQ8 ¬nr/¢=Våy|%ûös±ÉîÖQìƒÑ-Qq!^žÔÅUd8Õ=í«ó<ê]…[©wÃÑz=«E²eñ­`g‘2ÛŠO²Š®Cî}ß,ú Ô¼ì¥BÄ'.g†Âü°"´'Ù±:Ï·"ŠוìuCßžIPîf•lQßô²ô›>tIÌdRy¥}èÌiZ5‘¹ý#Ë¥R süb+{¿ã?Œ‘à‡®c©ôm—Ü8«¸Ö'W¤<áìÍ‹ƒuž‡87‘U‰Øk˜“Ò®…<ƒâ®w¤Ïuƒ/5¬:zß ¸ŽßfÜ2ÔkÆgéV¥ä©ìbÙí¢o…eœ @&ñq,;Xç ±LúJ‰l›Õ#X6¸´~…ö[#">²¸²*³~œ!v5,Yá`ëo-÷úQÔJ¾k}Üê#õþþ×xÙáwx8c¤UqÑ=öc=ÔB‚£I{æw¨ÊÓ`™x`oÄ7ûñÁfà—èþXÖý ËÆ~íÔOÅù…¢Q_Ç8~k–è&°Äºak½n}+ôÆXÅ„„mnŠRÞ[q>XçùÐKD©‰È6$*ø‚EýÔ¨jD‹”¡0¢åò˜ãKÒW;‰ÓýüAöûfÑ7ìªïLÅüµÖ„0fo­ö`çìäuïçðž5ØÍt®‡>êï—‡cŸeG±CŸ…öĬ/{½WFð©Û‡­Úêr?ÞoÈÉïôªïŠŒi‰ÈLAXö˜Æ€Ôº{ͨ¯“0îÊ?¼GȺïñ1 –˜‹Ïf}9¢ƒ”Ís-×$øââåy÷^ÔxØs¸m)|9ººÀ‘’n ð7²¾è6lø¾­öCUžGíE£Ô¶—÷Ûƒq[=Þ·Z÷—Co}«¸ ðë|]ØèvÑ7߸š9"Q*ÇS…Qrà=|?Xçù"F}»E8—j?y‹ˆqÙÅý㶾f›¼ŸñF]®¾¦ú˜ ºeƒ S4ëÿjqçù]‘úpÔ4Gp†EM] ·m㞨)'}”ªïÙž£¾å}ÞÝ~°ÎÓ t.úÖëQoç—¾Í)ò¼â8äå£ùM&·›Äè]Ð׋ÑÃnhãðrFݪý«M9¥Ùöª -ug͵¸lx?N(g:«-é&½u€cUžÆüÊð–-é(&–—­½ç÷BâT†Ó-ˆhx{òö®÷cužGi¤{4¬zÃ9»lôט³ÛFíß`Î^—ycxºC2×èp0¬Êó˜¨kƒ”öC¥ÛÁ|IúJdÐWa÷bçÛEß*˜/h£zÞ»>º¢~°Îó…ÌÕëööÉ~q`˜éÓÌöãÌIã¬Òïñ®ßæì²Ûõ"ÜÚDj¨.@¡ÐÈaè>XçiæP%&z²m¼Eî²ìâþÜŨÇj·Q{ؾ¹g4sÞò@ÿ“yèî{“ÝÖç#FÏi8Í–þ˜® -ìÒ¬då:æaCpᵑ݃ŊéH’ÑÒÑl~–°m㞬2ÚŒµ²ž ça£žêÞÊÆÁ:Ï -¢â^y­ë¡xnÙèý(¿œ¸›aÑ“ñjLúÚüÁhçX•ç”¢;Éô ¢¢Ø¦³ rÜvnýêøf<= kÃúHq•„ÒFÐÄÙ-²#Æ Fs‰òVÑj?jW¬szl(RÔa)ëIªí¯þøç?ý­P`²ñãÅ|/¯à{šMX¯uã¾u¦¯¤„:–6]Ž›uÒø°F1u“Ðå•-§«sú©miyþtáaˆ–M—ß¡­ñûÐÎض䱿ºaH-CWû.üEû2öÝÉ3´!Ý=ÈtmêMCùÓ) §Æ„áä0Ÿ†èª=èÉif“=qÌ4taPv8_©9ÈúS+¥AòzlÛe5?ýÅXþ§aÐ<©çWýëܹœ§èr‰ÓÅL~=éyšl×ñ Y‰ãWßÚÒgQ+Ú æXvu]’Äùñkm“L_£Lw£õeª¦çœèfšéJçÁ¥cƒˆš)lÉz÷ˆRF²žIZW©‰"i’ĹAîËÎ ÎwÉêg¢l‰¾ën&ëáSÙؾÖ6æ 6Ñ{Õ…nø§²1wÃy‹ørB·´¦¾šT= qjjÒ.¢Á‰FPµQe*Ù„Û8¤—“AüÌOMk˜ÑøݨéyRb™ ‰[¹:•3H/'³ÜØš´‘Ê­T™«ÖIó³(³©SiŠ7hƒŽFjÖC–»9âiúº$'i¬‘îÍv7Ä—“nìÚ_O’Ò2c…—Éôz"uí6rñ³½ÌÔ\&UajN4=Gÿ^ BU‘gø¸™”ž¨5_ÍèÜl䥒zzj¨Ã–ç¹l§.ä4Íf{}…âò -º­tÓØ‚Ú©¬£ç:‰§ ÕÀcIÍêY!lÒOÃÊžè'!ÐÝL–fʯ ò,§´©*¾u–BgîÒÚÉ©açkOÎmăÖämív6?_ÇÆk²š~™:™ÉúÐn2ŸÖYGœ(ÌäF_ò4[:é‘ÏÓ×y’Y÷åôÃips‘$j8˜(èiŸ}äÎÿE™¯ðû¯Ÿ¿žŽ—ºøñèZĆ­ rïÉôlèr¬gEOÄ6m:bäögr(sY™¬¡ùñ;¼æ¹ºŸ}*‚†Æí‰2ë°#Çfº1P§¹A|Yi±2¿tlf‡}¹¤éæÐ éÁd“T¸èo—eæÑì’Ï]“¸Ò¢³K—cW}£¸ì:¬³d 1Õ ûNšêU~´¯î¢ #ô’fÏn¶oz¢ wÑALýEß0‡¾ÓºÇúáéõ‹Ç}9M3@© Úõµ§¶Sj<›JÃeZ^6ŸCÃë÷Óä5ÔÚ¢nîQ ræ©1‡¼¸èm´£–¹ÚX@úNy¢-:Eƒ ÐüDk-æI¦4V›Ô2Üq1µ”[L1Sè5-ý¨4%J?*iSVÛ<^‹–¨@Ò›sžïÎÏ%[,Y Zêk7*Ï%i¢mûæeß“·=w·Á³ iŽLý\M6%¿GæÎ¥Îj%Â*µX e>ŽZ_6Ñ…O wJJzº‚“œ¹tË%w×¹½~²]%™ÖOúž0Ž‰|ú¿¥Ø"¼‚Q÷]SÓÿ¤bWÓ— -Œ[ºOÆòÐ s~³:4—ã"Q»Ìš*êÿŽAô=Ô;û`. K(y±|2üüð½ª+ -endstream -endobj -423 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 422 0 R -/Resources 4 0 R -/Annots [ 424 0 R 425 0 R 426 0 R 427 0 R 428 0 R 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R 445 0 R 446 0 R 447 0 R 448 0 R 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R 458 0 R 459 0 R 460 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -424 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb56-4) ->> -endobj -425 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb56-5) ->> -endobj -426 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb56-6) ->> -endobj -427 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb56-7) ->> -endobj -428 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb56-8) ->> -endobj -429 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb56-9) ->> -endobj -430 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb56-10) ->> -endobj -431 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb56-11) ->> -endobj -432 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb56-12) ->> -endobj -433 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb56-13) ->> -endobj -434 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb56-14) ->> -endobj -435 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb56-15) ->> -endobj -436 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb56-16) ->> -endobj -437 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb56-17) ->> -endobj -438 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb56-18) ->> -endobj -439 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb56-19) ->> -endobj -440 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb56-20) ->> -endobj -441 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb56-21) ->> -endobj -442 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb56-22) ->> -endobj -443 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb56-23) ->> -endobj -444 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb56-24) ->> -endobj -445 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb56-25) ->> -endobj -446 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb56-26) ->> -endobj -447 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb56-27) ->> -endobj -448 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb56-28) ->> -endobj -449 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb56-29) ->> -endobj -450 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb56-30) ->> -endobj -451 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb56-31) ->> -endobj -452 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb56-32) ->> -endobj -453 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb56-33) ->> -endobj -454 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb56-34) ->> -endobj -455 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb56-35) ->> -endobj -456 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb56-36) ->> -endobj -457 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb56-37) ->> -endobj -458 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb56-38) ->> -endobj -459 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb56-39) ->> -endobj -460 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb56-40) ->> -endobj -461 0 obj -<< -/Filter /FlateDecode -/Length 4707 ->> -stream -xœÍ]M$9n½ç¯Èó£•DRÀ`lïáöaàCOm×.Œ³>øïû12ô•¬ŒÈìêÙêBVg¢ÄÈ'R¡P…³ÇÏw¿ -WJ͉ÏO¿ž~;y—ÅãßRbs±°Â'Ë9xÎNBMEο*²ËUbNç—~½ºœ‹¿œþó§ÿÙÊ„stµ¦äü·/Êbr¹äìÅ`U°| ƒ%ârŽ’ V -·X«Å‚’9ò5+C ®E,Ôà‹Á*Pƒ8ºfU¨s`‹5B•l°‚‡!zoò ˆg¦hð‚¸„NO/—JÕäeðBŽÈ¥ÌA‚Å«.¥$Åâ1t‘êƒÅè"Ù[<èÂT²ÅKÐ…y“]bÉdñ2t‰èjð -tu“]|òÁâUrR ³É«àù’Ë5/zqRˆ¼Å Á l“L< -ƒ”²Á‹Ð%y©&ºùhñº0~,pB(—bxkTï&OÁâ t‰1³Éƒ.| b‚.>' àANqÉ€˜³ãÙXÈqáb¡@,ÕqÎdÁ@¬â8Õláù^ ‡.ÂÉB -Ð…á¹&ºPe (B°°€ºD& hË° p˾ xË>$ € 5½…Ä¥’ØÂ䔪…Ì%`§…Ð…»g ¨K’¢…Ø%.ÉÂîoaw‰ iò  Ø ££PÈÂîRðÙÂU;LÀV\,Å[XÀÀÝX<[XÀÀݘ1˜¼ìàƒdaw£à¬™¸ÅG ¸9& `(øãÍh¸ ;€.X 0߃ÉÂTæ" ¸*¦?çV.”š,,àn(>“W]ÈèqÃoÑË.¤T-,à.&*²°@€»€Ïba0ÞaFp7fj‹Ü ±z ¸‹¸A,,€9¸€ÀÂÌo.x˜®É«Î×R,,à.`)ZX€YØù$1yÙÁ‚…cç‡ZX€»˜Þ«… ¸ë…È‚ÜõŒ°ÇäA*ÑÂÄ5àÁm ŸF°ê|RX<à®a‹Üõ>W pW§M RVB,@A‡(8ZX -»šs²° UB>“—®Å‚ìA@–Ƀ.œÙÂÖ®R-ä](F r„.,,@Dàj@ôm¦Ðæbæ ])ZX$s¥2[X%!C¯Z¼]É€k“WÀ Ù‚œÙa* —rNoaÞi¸daÔ/°…¹B¸Š…˜Š\‰ˆÌ-^€.²-,@¤ ^”] ZXPbA–™¼…˜¡‘K¢«-{Í3‹……“ÓPѸ 2M ¥Éƒ.€ 0>šl‹…H~l"Í1yÐ…„-,(%jºY,,(ºD-,€mj¾™-,¨º â³° úä4L¶°0ž÷ÔPoF¶°~©ùf±° ’G¾‰ÏðÛJIóÍlaAeè"QLtAÐT ¿&!ß:Y¼]be jJšo f ßDDo. Í7³¹\Ü• -d²xÀ]D¦ÉÂ\ ßDdkåöÀ+ñ™Í,šqsÅÀzs«¹dམ­²¹fྚ#™‹P™eI檦U0ƒ7— <ðñ_aÂeõi^¢J0‡Œ9³d½É -·`D÷=çÅèb—õ±¿ýåôÇϘ|ÏùßÓó–•²ö`üÄIkQ‰à ¸rKuŒ€ ­Qጪ!|DF•Èu(‹ë¢›*‰©Óm=÷/a«24V‚™åÎxn™BÀPQ²u½[æt}„hù{ŒÁo:I@ÿ™ýzPæÝûunwê$C×»eÞ]׼ąáöÜn¬¦’{…wµ#ýw¾þ²£$ÂùãJî~g%© ×éÅ™—bŽv1ó«Ñɤê"ï1æhH£Õ„RT£Îî€läež7…ÿáÓ @¿6y†Ð/'½o2ú6úó§_Oü×ÿãßþôšýô|úù{Ì1â>Ïøä#ˆÎ8þð]h¥ >þRNùúY¾ë*xXË*M›Æû_~ø¯ó§ßÖN×â>"ÁÙj§ -IºT(ùò?ót½Síòø„5Ü»ªÖӥ̞×&Íã%ìéŒ8 ÊhìsU9=¯•Ý®‚CÐåBy=(?¯:´[=Ré3œ€x˨ -C _Öá[«D ´|úp®Ã¦±¸ºÜú?~Ú|ÇÈß`u~Ç5n–|È# —6 ˜÷µÖ32Gä㙘w;(óñœ).²|Xe0½V>ÃZ~Áçiu’çõÿ²k9As”à ¦©m#?³¼ ƒ ˆK^dÒcr^ÞwÞˆ¸4èÚEyK¯Õ{[tÅ`¹Šjb2êäúFÿ}A7 —2÷•Ã ŸÑNørH× ¼ ]W0º¼vÖ@jÞ¤Ë&DH–ìî¶w“ù -~g§Ôǘu’éÎ1jJä‹&z›J#^ë9<Í.qU[w…uÒQ·=`R³;\ÕyÄôã²…æ-ùu†¸Ë–Ùbo’œá­¹¹€|%yk\ž÷ZŸ\è¡Ö!$¹ølÉ·ñ“r<ɺìQ–å[Ÿì×Åy1•¨K(×u}ž¬ÿóN/±ZF(dÚþF+]!’½Ú’>jÙ´ý·"‹”DÕ‹¾[lQtÝ£ú¢H¬âœd=É|¼Ø"êª!Ú¯ùat[éâ0 Xꨓ4,ý²§iW}ddÔzúÔUª¯©Zò{­û<¸ÀŒMé9´>˜Ýšè;AæC½5¦!Ï: îi Õ-û¨Êƒ¤ìjâ\My9ÒË~ƒ ˆ^ÞÐàûåVðÙƒ³‘¢]×t0’›öºŽžÖþ2¦Ú–{¾†I5ÅB.}¤O‚Ãwn¡ÒA™Ó-iÝú¶ Fw‚S*Îcb¢øª‘¯§®j=—õ¸ÎߧÕÒy]wêà´lIé! FJõØýë6Af.bÉ›XÂ"æ_ÏQ Êò¸@=tÿ®r¦ô·˜fHº__V{‹\åÍÞ: j7€cÓŸŽBãˆ¯ë¸ u'GfÖ'‘’à‘ˆÏë4“ù8Ш;Ât E¹ï„Ê‘Àn}ŸöºÎûXC^Öäµ­/­Ék[Ì°èå*å|úp¸³md³Öiv;PØ•uÛÑÑn?&òqº=úKú¿cÊ»­t•Ù]OÓó²›Ot[)Ëf¬Û}Læãt¾èC~L»õ[Úü¦‘÷ -ñ¯k½/Ä7äïñ é»CüG4!þc÷?B|CþÎÿ1 FˆoÝ?ÂU]ÚÌ—Ï=+,oh£ÿ×õs×zÇ£3-*?lÓ³ì4˜–¢)¡yÐ>¦–Ç4OÏw샎ôGQ -šL¼‹}H‡ ©zs„÷´]Md‰¶ï³}Ͻ[mÞÕ@£DÑ'펾Cɶ÷±QñÂñAû„´Hôs±æ•ntÐ>’îzN"ù–}JÁ¹ÖLßߦàW@™Šîž<ëFëLË&åÛqÆ!‘fd}!4s²c¼{V¨`¬OËÃÓƒ« e>Lw)ŠÃÇô½Ûß/AÜ6ú>« ×uÞ·º`Èåêrˆà/‡WŽ‰|ãA÷ŠEä÷4žM£÷¯.è›™!';šæù8Ã"@ì*˜€¿a¦µmdu€ìôÌâÃ3Ï1‘Óíújˆ$︺°­ô@7kÎã냩TW¼·’pPæÃt´x dÄ7{Wäf—Ü÷ëö¥;"‡mo8º#r쨼–Ïí³—óŽ] i1­Zòû«}>5¤×ÇZï¹W|WÄÈQß¾Ÿ×N Gj­/ˆîm,º]ô+L~Û -Ãb*Ñï+t³èC -ÝzBß-×Ó7‚¾Jçü_hOÃC"ï¡é;Æž„ä;Úž AgØØ4ðl\ËËÈXÚ†ç¶óp/ü”ªGE-o'Q:6áù0ó@òúžûr&Ò­}3,¼Ô†µ½´6”ÎóÛhœœÏQOÒ~ü§ùçŸßšaq´­Ý/°§¸´ª¼t)#­L¼ÌHáÏö°éKÿ˜‹«O zpPæï=pÒõEr‰9Øž´{âÖ¯¼ó˘tní_îÉZ è¿y•_éO[¹.ßèSPÑxaúλ/=]:íÂm7löݪ‘L©gÓré•ç­F<ñú‹<´´zQ,™/ƒdå¥7z«¾QW[]y•*‡ø†±×ìb^Þûc=Ï)e}÷ý¶­ù{›úxíNã1€TxãüŸ/æ3w¾ŒíÒû¸vRsªÕF¨‰„&4Êë÷­4VÓkY‘ŠŸ—¼˜ñhT÷ÍÀÓtûŶÑÅeß@³ k_GKO$CbáõEö›#|Pfwˆo¼ú-@MO߸5ÒŸ¿ øÌ›þ_Ë7úR¾ÉæW<Úêrœeªã¾Ù³ݲÍnwy!¥åj“m. ¸ÚdY´¹¶KDUŠîÈÙ4xË.˲Yy±1*Ç‚£c"Í*K¦[Vy3¸l=÷ÓzpB–³>–уkŠ„2ÃÐûk·ÈNÿ4›ºNYÎáUŠ°5;T©'¦êæsÖÖCFÞ2ºøåŒAÖp-DU¯uvè\⺖iÆ. ºdþbœj¸üåRNߘY 7­†ü¼¾Aã×p1]>pÓZOi.¶¶÷y5ø§5¼,¯ê—µíI^¨ßƒ´{øáõPþvJË9a94ͧ²ì-zÆ•Ó„s=ëãªâ‰û9aéìp~Cr9‹ö·^JƒäõÄ:=­hÚùb-ÿÛ2è¿žôuå5d_Ž’ô ¹Äv1È/'=J” 2³‹ÉJ\¿ú^‡V°ÓžÙÕ×%áb~ýZ{åêw—¯QÚݨ¼41=âEüv¥~piØ B2…k²Þ½wa%ë‹`ÅÑz•º*’šÎšÊõ -y.;*‚»ä@~"Ê5ÑOÍ ²¾ÌÚÊÆþµö1±«>w]˜†¿•yÎ[ħš¥×Ô“ª‡@¶ªZïFßi4)U;UZÉ> ÜÇÉ = âw¾UÍÌΟFMÒºK3$îåj+gžNf¹µ6é#•{©2Dkëù¡Ê0u*½ã ÚÒG+5ëùÒ“xj_·ä¤#ÐÆÚ—Énâñé„)†¯È/'ÉFiXᥙÞL¤©ÞN.~ØË "6]» -®Ùhz‘þ¾@…tª"Ïò%p7)=Ll\FÔ7;yÛI3=uÔa«çQvê®s·Ù¹¿BñFyÝ^º÷؆:uÙDϵ©§ ÕÁcKÝê:Y!¬õOÇÊ™è›hn¥›òˆ<ô”îªâ{c)Læ.½ÞAN;_frî#ôd¸®o¯w²ùF|Z&6~MVÓ/­‘AÖÕÿf>½±‰8( ò€Ñ—…ܼµ£“žvݾ'³fܧÓ_OË4I¢&ȉ‚t:G^áü(ó#>ÿ}âóŸÚÉZ—y<úŽ±cë†<Ïdz,v9HÖc²±»ÍDŒ<Áþ ‡2ÊJ³†>Ç8á5q?€½• ACçÎD}8‘c7Ýhê¹A|zÕ‹=ùÚ±öå’ÚÍ¡Ò3ÙšV¸˜o—eðhLÉç©J\iÑ1¥kþ'A\Ì•ârj°Í6jªAÎô®Wýy -Ò¶¦‹)ŒÐK<Óì\u£-w1ALóÅ\1‡¹ÑºÑÇPúa÷úêq_UN͔ڡ½S_fj¿1¥vÀ³©´\¦íeŸshY=jÎ;z¨×E“ïQr†kŒÐ‚7³NÔ2ÄÖ27ʶi´M.@óÖkÌM§´ŠµnY½”{L1¨{ZæQé(󨤫²Zo›ñz´D=’Ùœó¸;?JöX²´4Kw*’Ôh×mó¶í6Ûž§Ûà¡H‘©brUò!ü{Äw.2¯V"¬RígY eœE©'†L‘–?/âKJA÷° %Ï\¦å’»en¯Ÿ\¯’´õ“¹% ‡c"Ÿƒþ¡[…0ê>cªªý[LŸ,·t_ËCæüÕêÐò—–E¶e‘¨_fMõƒ½EÏ3Ï>˜ËEËJÙ,Ÿ,?ÿ}èÉé -endstream -endobj -462 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 461 0 R -/Resources 4 0 R -/Annots [ 463 0 R 464 0 R 465 0 R 466 0 R 467 0 R 468 0 R 469 0 R 470 0 R 471 0 R 472 0 R 473 0 R 474 0 R 475 0 R 476 0 R 477 0 R 478 0 R 479 0 R 480 0 R 481 0 R 482 0 R 483 0 R 484 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -463 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb56-41) ->> -endobj -464 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb56-42) ->> -endobj -465 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb56-43) ->> -endobj -466 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb56-44) ->> -endobj -467 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb56-45) ->> -endobj -468 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb56-46) ->> -endobj -469 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb56-47) ->> -endobj -470 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb56-48) ->> -endobj -471 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb56-49) ->> -endobj -472 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb56-50) ->> -endobj -473 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb56-51) ->> -endobj -474 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb56-52) ->> -endobj -475 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb56-53) ->> -endobj -476 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb56-54) ->> -endobj -477 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb56-55) ->> -endobj -478 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb56-56) ->> -endobj -479 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb56-57) ->> -endobj -480 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb56-58) ->> -endobj -481 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb56-59) ->> -endobj -482 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb56-60) ->> -endobj -483 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb56-61) ->> -endobj -484 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 340.338585 101.433071 321.588585 ] -/BS << -/W 0 ->> -/Dest (cb57-1) ->> -endobj -485 0 obj -<< -/Filter /FlateDecode -/Length 4634 ->> -stream -xœí]KIn¾×¯¨óÆ Ìaµá×ð‚÷°ðAª‘va´ h}ðß÷ÇÈŒf&ëÑ­¶¦Õšª$ãÁ`ÉȬ”;[üùÁá…œ)¥æDçËçÓ—“59Zü×Zl.ûüÍñì,e]M%ž?3!d“kô9ŸNøßîR6:ýùw§ÿÞöqgojMÞÅóß?2‹‚É%gV˺ °b49û˜VrK¬UcAŒ˜ÉÓ‘•!Õ5Ä ï‹Â*#PváȪÃgG b¸³Ârr8o­Êƒ –(x…ç¢IPzÒxÞ™Tª¯*/ƒç²×x!˜”ÉE§ñªI)Å¢ñ²ÄjÆ‹%:"«ñ …’5^‚,!«ò ‹/9h¼ Y<´S^,°®¢ò ‹MÖi¼L¬…HåUðlÉåÈó6šXB°Ï9a›AåÁ£°I)+<Y’UåA–¬×x²þh<àD ¹Å[={w°Ái¼Y¼Ï¤ò 6_CŸ ‹ÍIƒxa\Ò0Àçl¨zÒ@À—`¨PÑPÀ—j(ç Á€¯ÑPªYÃ`xÞi@,d‰”4$²#¨¼làƒAÃîúˆ%h‘¸ë£õpדOÀP ðǪÙpõt²`5,@¼Ï 0˜ñHK4,ˆÀ]WþŸZWjÒ° w]Áö©¼j\†Æ¿…–K©jX»TAÂÜ| €ñÕkX». Rk<à®óÕjX»È¢†0ãhX€øfœ…骼jl-EÂÜ,y …-@•— ÉiX06y¨† ¸‹ð^5,HÀ]Cа w-!íQy%¯aòðඊO#Y5Ö)4p×:ì°ÆîZ›«† ¸ËaS”™à‹†Ð ö¤B¦æœ4,HÕ‚‡”Oå%ƒë¨aA¶ D@–ʃ,”IÃ$Ö¦†Z4,Ȳï5,Ȳ eа©Ù·Z@˜‹ZdA¦¨aÌ”J¤aAŽ õ´ªñ’7%®U^Ïe r&ƒPì4,@-e -œ^üátIÈž# r…,p ŠLñÈÌ5žƒ,H²5,@¦ žsY jXP|A•™¬†ˆÐ¨%¡jG–ëÌ¢aA¡d8UÔ°n‚JH©ò `BÃìÛQÃ?(6Qæ¨<È"iXPŠçr³hXP -dñÖkXÛäz3kXP-dAƧaAµÉpš¬a`~Q@Vjg®á³îWLêMêþ»ó}w¾0çKü_>¿<Ãù„ÀrÅB[Ëþî|ßï»ó=ÓùT'{^ÊyÅ!¿;ÞwÇûs¼ç¤œ( -M Ä7ÊŸ»ÆEÜlM+éì«ñÉóòZU¾¤ÏíJ”Ö}¤z_ôºÔgÚImæu¯õ!©²>»Ï+É:u”a€Àç¨ëõÁ>¯®W9ï£z}°Ï«Ëš‰’Jävû© -y¯ñ]éò©£Å'm^ëL¡˜¸¿"ì£^QèãÁßÞà)íé:|V2D¥ÝäÇu2ßÛ8¿û|úýÏÿô/ÿüï¿`·Þ}:ýåGk,¶®=ÖbámøàÏËr’µT¬àÇÚ¿ÿôŸçw?ŸlÆŽ§ô~˜—Â30¶æCáé·3þôƒûqýNëìe¡E·~¦õ³Óã"·…£Yú°Ð±íú@_ÛbŠö·µëcûÝ\X1+aÐËV†Ñ¿ÓÅ<­íeŽÛdNS^¹Ž&Ë㺮{]S]ä¢OÛ9x|û?„þÜvݽŸ½¬»Ö©“œ–Ž ‚ës†ubâ±Ö¹±÷ëqœøÖ?Þt§éàýÔ+ä»%Gö×äX÷€ò¢÷n+m<«Êƹ%K€DeìÅVç˜[Û›:Þ{ST½iå…Eʳ-Óšìi•½®ŸI_G³­Þæ“°¿Î·ê’¯ŸÛ­×Ívi§ÿaÊçüMÝ×½~ÚX—þ®ÏG‹o,þ°Ú„ß®›—­£¯¹ÛS^>ÛxWûZ÷yøçð/]׌7±Û]måÿè¶3𧯫leuNù^›žæMYw¶¸rwÝTvëöë˜Òºþñ]‹®aä™L¨-_áGØ|q>ö0$5ù¹}^”ã¬Øx~ÈëÅDžoJ[m-–öQÙQŸuQ͸t!yKág}X‚ô¿þüÿö'¤Ù¼ÖpI—¶ºûˆ0µlÂÕ k2¶òãI» Ha®‡€ºÒoëQ8Å„‹¬Œ?ýt§7¬ƒŸéKéšTwú£ê­l]ZÿŒ»æzP~`Ìö¸<'o74µÐú}7Çâ8b>¹si'ÏÚw©-íõShÏ®§ÉzWûü'”—òÕ•ÞéÏ»Üþõ´OÅÃã -!ôÞ¶ÓXÅnÜœ  2Rföɲ) -d¼k ;‰³HcÇ®}ƒT¶C}·¦5-¸•¦ºÝ»ôà«R×}:=B™Li/(Jµ·ÿÐÆœaÌf§Æz’w;a%$+Î…âò×%¬Çq685 Ü#úrMŽ¯NXc7‹¬k¢òII ö‰F^Û®:™Ö°¶½–|îšÖåË{¿Ž)<`$"ai}ÆÞÞÔ%í×;tØY‘P¶½±ËgO˜£Ÿ Ý>áÙ¬ûFòݬ°ëgדv Ïë 7u“ºyS……ýŠ…›:+{ýö……î_Q`FôSm®cäТÆì§E SoÉlí¡Âäæ˜D»1ŸS<$>íhîáâáÁ>o¦xàá}Ž ð·)¶¾^ñp÷9Åé.Žý¿¾x¸®©·W<¼@û¢xx‘öEñðjÚÅÃm;}yñ âœÜ„œ¢ój¹À§…ñÃ6ðn’Öp-=&züƒÊÊ?]ÚMÚ¼ý -æè:¨yþQp´Õ;@ø`Ÿ¯¹­ñÿ‡ÐÇ-<´ïe(ìE×λVo£¤xä(CÖ6›P¹Ò>mmɾ¶¶óäN_ÂývìÁ [Ϧݽ‰qíÖ¾Ûm±é–Ý›Ì3io ˆ´[yX¬–¬{ÓµF¾ µð–Í–à»ýEtòŽ -Ñ›}°Ï[³YþaÏ ›(ïwŸ;;q=…~¿|?Ðc¿Ó·Òi׎¯[:µöù0yÞ‹vaýûëúIëw_âê·Šr?Êsí­ŸRÞ{û+Vó° ~UÅ¿J¹muõy#V7ÅÎî¦Õ…­µ TÛ¡#=÷§e¢{ôìëºõt“¿2Ûßôù(,k‘ZÂ3×: -½~µíór‹œc 9Þß°Ô2±.°ePõw-õ±>oÎRëm| ;˱¹[ÞrLq´ ÃNkÖõJù\“²IkˆÂc¶,§õ­,µÚülK}°Ï[³ÔêocªÝYÔ‡ù}9ðx™–èúú»tEŽµKQ¼{Z“¾­|ûì<þºÓÍÌd+Ó«œ¹¢÷ÉXŸÃÝüòÁ>oÎ*oç—·ò´}$W£æ¾‚g‡6Ò -hg)Yï3n¢ºìÊÎÆàÍc}ÞÜÎÞÉáº&/"Jî´É¾Ã7Fõ¨E('viµîÃ7+øÇ8ßxiÿ¢ªI[K“}.ôÊú -ö «ÝáK|År;¦ÜÈa%>w eÝŵO’2êv:³1â¹~7Õ=;}¬Ï›³ÓÛÜ!vÈÓñtÒn/Õ'4w¼]&Hõh#û¬ìj<ÛU©Ä:y2CûìOø ߟa·¾_—¬¯?kúeýµŽP|Œü¶•]/&t·É‹9ü2}{Ø„!ù5Ÿ¡œ= £f~3Ƶ£&ÿq’ñ8rZab½WËî9ž¼¨k›~D%î/Žûjë½Å~ÿK>ÒÜîiÕ…îÇ={;`×ûÄòd›o½Ý{scü÷;Çb_Ãa+¿œR{Ë‹koú²|ûÖó«@ω ßZÎõÌo–)6ë[çš²ÝùJÏöÕ/£ÕúNU˯YãWì,/\kû/mÓ?Ÿ\%Ãúoj´÷ÚFÅ=ùéÄï¿$…L4Ÿö¸CfâúÕŽ±È‡G:í\äÚìZ†hìúu>aÂgmËWûj¸ìÝø½$d{£ÐÞ̱L¬Ñ3¹#™Wo[ÉüÑbÂz•†(|Ïiç€$ÛÎgÇ»d¬ Æ#ÑŠé&ÙS—Çñ;§†êÒ$Ñ¥êœØþÞÖg±·ˆ—¦ {ê“Jå7ö¡ºv½´ „ªƒ{˱!4öI!ñ/±Älš°™ƒ/vßÿ´K7$íjo§.'µÝ:Z;•G«2»Ö®ù)Ê4õP†âÚE<…•ù¥ÈÂGlè_·d~¸hìµ-Ânüx9!ÄÐÜ~}wl'VØØMOƒw‹ö2©¹tUÁ5;ßžÃÿ_ "*#Oûâh˜¿k^ÍIØ7y«$IOuHÓ€£<Û -u¹œ‡ÍJ}¹b•ö º£õÐ؆*T&è¹vñ¤xlÉnXÝ 3„uý ¬”DÛ…Àt“‡)?mÈSÎ8\5Ú1YrÂÜãw’ÓÀÎ'IÎcÇ¿ÎlÈ;Æ6߉—ØhOfÓ/}’IövD»9™ NÁ -“> -endobj -487 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb60-1) ->> -endobj -488 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 341.807453 101.433071 323.057453 ] -/BS << -/W 0 ->> -/Dest (cb61-1) ->> -endobj -489 0 obj -<< -/Filter /FlateDecode -/Length 4569 ->> -stream -xœí]Kܸ¾÷¯ès€åòý‚=H‚Ù Œää`׻Ƽ9äïç£Z$KT©Åî™±åͺўV%òãÇâC¢:K|¾Qø/Z%bLÁÛóÃÇÓ§“ÁIü›B,.&õk|ƒ;+iƒp*ùèγÀ’ÓÁŸOø¯»¤ÁOÿÍéßË8ê¬EJ^+wþù‡¬²F„‚tŒ*A%•aTΉ´óŒÊ+[L‰SÁ ¬¶kU€6EÇ©`†Õ:2ª3Œ ʬU fè ,§‚*¹À¨”„JKÉê`ˆ´ÖhF§œð(tÏé´>&X]€NÍéŒ>Xå§KÂ{ï"§³°Å%©8ƒ-NY+9l±&Nça‹ñF²:Ø¢c0œ.ÀÒIŒ. +²:Ø"½Tœ.áR´–Õ%èd q­ÓÒ ‘œN)á€MÃêТPI>0: [¼t‰ÕÁg¤æt¶X|8x™#ÓZunÝFÅélÑ:XV[Pùh[dð ‰ÌKè„MÚr$ £6Úȱ€ŽIØ G:9a} -© ÓŠ##a‹³žc£`‹EËeu°Å$ËqÑ°8.0¶hk8.0`[ ´p\`@·V&ÅqßZ©<Ç„ 3%ÇŒk¢·P. ”8.0à\îä¸À€tÑÜǬkœ×Ю±Ñs\`À»Æ*Éq¬¶À€…QÑp\`Á»FÉÀqï¢iŽ P«8ô+BÇ(9.°à]¥å¸À‚wu@Àê‚@4Xð®v¸®çïj'5Ǽ«­ö(ü#Yo¼ -q¼;[@° ¿‡NŽ ˜ÐpK8.pà]•Ðý1ml%TLžãÞUÕÇê’P%δ[”²PÞ'Ž x•á¸ÀwAŸ‘ãp¼@ª9.pà]eÐSs:ð®ÒIr\àÀ»ðÇ€ƒPp8.@ÿ&”tY]2ÅÈqï‚–4Çè……Œ`V€¤8. ?”ãÞE÷ž8.ðà]éŒá¸Àƒw¥…ÛÃê`‹‰šãø5СÙ2mΪLÁéÀ»R¡†9xWÊ8.ðàÝÜmr\àCèÈq ð‚5Ç>Z‘Bðø$¡ƒËÇê¼Àµã¸ H(‹ÕÁ,Çp¬E2)r\4l1Zs\4lËÀq<‘¼ovx[v|`a Ž ’ô"»É€Æ¡“’イ"Æ›Úr\€v™Ç›‘ã‚d$Æ›â1í6ŸÇ›ã‚da‹ƒ‹Âê` œ¦Ä´[pÆ›`'Nça‹N–ã‚ä}oFŽ àf`¼ žˆy¼Øéð®K`&NÞ…gê9.ÀÆ›ðl¹±½ñºÿŒWÆ<âŒìŒõ:ô­ì”÷¢· -ìœùæ1;i31²Œž5@· -¥’ì´ÿ³+N¸Ì>Ñ)*8ô™1ä›LhÞ}s´`f#Øe~ìçOß¾Eç{þñ?§¿™fÊÊGÁA˜B[øWh:¡º¼o…Û7­Ä$´“…0ðž8Ùˆš‘ -´8Oºe#Ñýåçõ…å0üõ”½©Ù'ôâ—ìAÞZa G _§¹AbñQžÑ`‰Áz[0&éÌN€üJi÷æ ÎV\æ@ë%1ý%ÃV»ó›§oÿüêoùþ5`ôæÃé¿•Òþ ¥‹ß}£òo7ÿ¯Ý|í‘….Œ¿üU9L§³ HkçpEöa™NŽWÒp9î*ã ˆ]Eb©eKÐQjêCFz›`&ÝV-§´JX¢k¡+ñJ«1áô÷Pò|C^És±=ºb+«z;Ržd‰Äû°ŒÕÈ5MFŠMÙ¯»ŽÜ±8‡C®½Ê¡Ûmþب~2ªÈ½ôH^!˜¤YyÞuùG’W×”Wù¸ënéúUs<-Oeð~¹cq‡ÜëNjá¯Þ´o—½4íi÷¼ì ¬zê¾'/HëN¦'ï¬ó3ž8Ä~iÿÊY,ù?tiõÈ÷-ÜU÷¨ }ÁΨŠwpéXœÃ!rÇ5]É–Ò£½×Öð„p-õEÏ÷ö)>Ü—çóyµæ‘ª‰ï©´H2êçh(4×}KegԽݘնsiæ0~ÇÕ83†ß3“Y˜­ùÍRÃeæ}•ï•Å¯žÿئ-O ´Ê§wÒÏÕnd ™‹í™ãm;>ã=ËodFå8>Øórôçó“7JüÀü nÒïÍ - Æ9Bï_Lâ“[g¸Ÿ‘~™­c±Ä'ÌÛuTÚí!v,Îá{ݼyW¾Ø"a–éÝT£·Œr>W‹ë|Öç^_·Ä?tZHg}FÏUDÆ9"í×»¾~ØÖruDµ8sû΢Á8‡CÜu¿rk-‡ ¡{‚æ5ºÍ­GMÝ{ÔñÖæúÑ;¹Þ…ñL^ÁÓvW<·°J²~=:C>çp¨Ü™‡<*§]… !û†ÞýEZIÇ•›üH×­w¼ Æ9w|ÄÃpÆ/¼UÜÑ‹»;öeÆ9JÝ ßXJÐßkcŸEÙjW/7sÒõòý&s÷–¤Gg«Én²ºC¬³I“Yíi÷ÃÖ&÷9¾zÿtÔ­øöÅËpÅæöñø`œÃ¡xgŽó‹î ýzùúän¢ñŽùÌÁ8‡CãÎ|æ­üø„Ÿ…¿‹Œ®v¨žÂÝnE!÷5 Ò"sÞÓþÔ™£ûP»§\F׈™›ô õ¬¬Ü[‘Œs8Ä^÷UuܯÝ/‚¼·L/\Â{îAÞýhBÜ»FüPOæ"G8çhô_Þí„\!㊿ù%Pfⶭ«Öxóúÿ"›˜_ÕµnoÝ|0Îá98¿ymwD~›A˜¿Ì3‘W}µ~…‘™á®º~‡ñ–_»ñü̪%¹vϱ·Çß±r0ÎáPóëƒá dö†é08OéÉœãèhe0Îáûë<å¢eí¥µ…Ê=˜÷¡Gh·¿sc0ÎÑvžÅ¹“ ú§G§Ñ„’«ÕHž7þ[ÆÍík:ƒq‡ÄŸðP¼ñ„úŠÄ™o;ÔçÝÉe§òì÷®v1ë9\zaŽ¼ã½Dƒq‡Ìuo%7ŸÙÙë=\û~®aú-ò²§=]þnÕ|el¼Wƒæ9!µ×tÐVEüeMç,·ž†àFk[¼¸…¾;öCÆ9ú÷Cömú{hŽågö^ÈöηW]ÝñÌö`œ£¡0Žù‰Ÿkí6_ÈõšÆÉsóY–¯ÙÝ@§¹ýÙÃÁ8‡Cç|Ç/Ê+ÏØr6üÜÕZI7ë][Vœ¿N._%g_³÷)K/ÎcÏݾËg0Îá°wÝ;œÊ-Ìó¸¹,ßµ2Ôš”gñèÞw¿»rßÅS?B'#óÕ~ánW»rSVc(S1ÞâÖêÈÄ }úe·OZÛRÇQÌ*Ðè[•6ûë;žÆŒs8TîxÏþÆëÈÜ|²E߆‚[ß«µé7ô¬Ú¿®GöktÜÖíï*xÛZã"Ó»!ã ‘igš>Û¯ÞÏhÅ]tMÐÊÅèxkwöní_©avôN=·®ÕpÏ_¬ø¸[#Üzï]ïoxâ}»Ow<Ë=çpø¼îC®êbcGíþSórwƨ¦ñÀ×÷bî­XâpÉì Q¬Q{vç/6˜“z‹ƒoöŒs8dî¬{¿@_~䙯Âæ1{ÇÛ(ã³×ýÏUë¿ge‡%ÙÇ0Ó•“§Øwëè‹Ï4&}=Ÿ*й|>Qt*’ã6*wƒì o}8G9ââœ?=´üŒ)7BäƒqM<Ãq´)ä³d2”^ýáOü+Òô‚ü.i/——äë‡Ë«lóu.Ž©ŠU©æËKõm,Ô6;—SQç"»T‰œ—XòßËkq3.ƒÚ,×9¬¿|§´æßS:±PÏœ_®þ?¿¶,\ô‹ôÝœ7±gJÑ{(ðM«ªütòÓ¹Hj:Oz Uu><÷ì­0¹nÒ9ŸÅ¥±ªTš -[7bNGª¡æSˆe>˜0Ju9¢˜\Ìá?M•þñ¤’¹ü31\N •“8êrÑħ|b¬eÄÖ -=(ÎÂù§¬iYUVÙø5ˆÔ‡4NÈùgª‰W~jWî&Çw%Z>ÉÇÊÈLgÙ\2f„ˆéÕZœï^ -5‹ó©»Q˜ùÊWSœ/6CØ´4lK°EÜ+#‰Ð­…’d×ÄÚ{T>¥­oÂj:-:Eª¿„ÕTç5áà ٚ^úÈJóYŸ%©RºZV™!F¥*u%d­[ë‰=œá7²$mQ™UOj-Ÿ˜vÆ$[Ã¥Ž=œØpsj®ÖT¨¡b‹šJÉ7SÔM¬ÏȦ2š¥!#NÚˆ4åçRìs ”º–‘àF¯„'t1v%~<¹À„v+¤+УBCÒ­â(^š4Oê]~¡iY>o*ÿ¡ -W¥™y¦ÊVHå3ãÚUË$·Í*^•ûÊ:–+eC KŠK…P1KËKEɄϤ[C×[HI‘yHżLR•<–bUQWÅ™ÂJùT®¤BYŒ@vMì*”âf§«M`/™yEàîjºMì+w>Rq¨5®ò€ÕÞš.Á|>L›íÅú±dÒÄZÖÞ®eF„Í0B7}œÄ¥µVvšÞö>ÿlŒëqN?¦nN§~x£òy¶ÔóRçÿ"Ì+|ÿu²çïËj—~\ËʺrëBL{²|úyçÓЋ°6"Ô–Ð~«Øº‚†ÚkMøÚ¶è²{ ©*ƒªª¥B×ʈu…®V†”Œ»"|èJ±:2O­›Öa_.M¹9dcòÑ{Å*\ÐÛÁel:Óºä3IW9hëÒ¡µšDÄM—$ÃÔ,[˜™I3©EŸí·´*L΋\7"_š¦³­›¥IÙt$\`C/hÂVÑLÓÂÆ軛דë}6Ù—¥•Ú«ô‘Jëei%<^j¦K¿¼¬}Ž9ç‹Òx[ Õ´ i{¦:9­i4×Â..(F‰4¶hsG3µE¶È´t•. “EVS Å&?G+Å2ÝqdK)TŸ¢I¢%íh­ÔBt´Vü*lN·ôxÕ[2ÕrΡÝl!«/™§±«Ô¶¦ÈÖyÛeÞ¥·=“Û°Íß²ž%)ó'4'T‡°ÆÈ €· ¡Hû -’Ôã|Z+-Iö–n+fz¨Ñœ\ÍaæéËi’¨^†> -endobj -491 0 obj -<< -/Filter /FlateDecode -/Length 4479 ->> -stream -xœí]K#Ç ¾ëWèÀåz°^€áC€$ˆ1°HFcy×F0`ç¿Ÿ¥zu7%µfÇ­í]ìJMÖƒÅ"?’%M9jüýÄà¿DF¥”c ãé‡Ã­¢×øSZ, -û+ü‹þh4EåMÉ`‚‹*foc8>ðßêqnþ|øÇïÿ^ö1G«rÖøãOo™ENÅ£ö+ƒ¥XÞ«­+…%æ,± †diËŠƒrò bµI`%ˆá(·eeˆa£!‰1LöQ` 9ŒÕZäAMä¬À3^(=H“„Àx…ˆj%,ðÀ]ã©%p×ج%,ðÀ]ä ^˜ƒ2H$,@|SFÃtE^V:§$aî–¬„ˆÂJ' ‰È‹ -†d$,+"?“™‰+Î$žh@¯Gl 4°Ñ*ŠgàË5’xh1QY¦ ž ¬‚i´xl ¿ÈÇhƒ çÓ§ùˆ*À"bfŠ¼È · d÷½æÍÜ…fç󱟾;|ú„à{üî?‡w¿+'eí¯A‚PZò+¸ÍØnìÛ`ù. 1.™AŠ%„€/éÃBÄ<„4€ÅzèÆB"üñŸãöÍBr΢£7ê¢Àg .¯ëü@¢2:¡(F}`9f‘ïîsSäˆ !û#Ë:T5Ï;t%ÉzwŸ×—%Jh$œËye!o4~ÝÍóÂo„yh6À!dYwöye‘]w—Ì[ÀÛI( €óÄÀ›¸+»³Ë+ -¬QÌ#; hã²åh -ˆD¤iÑø÷oÖ*Åù̾?Nâ#¿3”Ößüpøô/_üý¯_~û{óîðõgZSøüïïê멾¦ó«œùx~·£}ãûú:·ÉÓ8ï–í-ø|Zí¹ -Ç`úFŽ‰×Úõ~f’ç›­L‹>oßøÊ»´–|a¬¸\Së_ä¾KŸÿóøæ‹ÃÞ, ­TKg¨ql”9b^µÍ}]ÞÇ6“Ìy—IÖm6Ó6¯ÍM»av ól[”–[Õ·p½½z2‡¶uOÕÄN“¹=ÕyÞŽ±›‰vóÒ“‰ºå˜w™œ°ž›î9™¹?½¯;ÊfÊŸ*5£ãŠàOá–îìóh†ŠÊþª¥þ*Àê‚G®,íÿã‰,Ô XÔ¤Jľåwöy8 ¥ëXz§ÖX îøoiÁ{xÚë åî8¿³ÏÃYçÏ”|~¤™Á«z܇ˆôSz¹;Òïëóp–z#'ý(ñç—éí”W«²N–6¯ZèÎ>f¡öF.úBܹjm¾ýéwGz;å”üq`J壭ëÖ¹¯ÏÃYçõ<ôÅuï/0Òßíq Ò[M¿³ÏÃYêœô£ÄŸWò°GŽôéþš~gŸ‡³Ð¹hšl»Ø1²âDß¡º»%ß³•Vwà·¨~_Twúþú}gŸG³Dw#çü%Öï?‡w}€îÜýµúÎ>g•7ÎMV-}®µöÂ6Nó–qº|þ¾³ÏÃYéõ<³[ÊJƒ hƒµµö{v¼Í±–¡[Þºzñ[Yô·ø÷nE³Î0zßzhí÷[ài5ÞE 9ã~ Ý×çá,ôÎ3Ï ÓæH¸Á­K–x­^ÞKsŽ¹Îrhm­¢:½à³ö}Íi_®ù8Ö"åûXãÚºÛ7=zŸU>[¬‹6®ZQ:¿^g½&)_\å¯/ ¶KÙ/a%¹û±rgŸ‡³Î9ç:ûUÖËwŽõ^á‹œ?'ßyâ¾³ÏÃYäürµ]«W²ûa˜„…/ÈçoÍuÞ‡/TBkÌì¸8{×&ÿÛVK?Ÿ×^°ÖœiîìópÖz=×üh1í’5ï¨Å×'X Oü $[§y¤!ìvvÑë[ß•ß×çѬÓïÌ=/dïÒ Mߥ ¹cÉ&MÓxmOúñZ²*µw[Kœ~ºÆóå&Æ›ÊZ¾øãŸÿô·i-¿ù\rÊ… ÿ$0Ýöu,e1ƒe;·õ‘=³­ñü¼¡×¶Ýâã”Ͼ=óÛ\gëëÿ1ÎÀeÖã$ƒ«}|}ÕuÌX_ý¹÷kk)ýÌÊ+šìaȽ);°KåiV9kY³ìj5}6=4Æ3Ï~ª³…:M˜Ç|çNv|?NßÕðç8k…Ç3ßnÇ Žx”/(ÙŽ³Ðb(¸&ß©#Ë¡ÇZÊ.µõ±æíÙ3Ùø¢š É†,Œ],2Ÿû—]WÇzš-mXÅÚ¶ê¤[ƒ©m™t[»©ûàjÿÊïV÷TÇœ<€û5½7k+}úÞ^ÕeZ¯·ë0Ôu5¹NuoôùµÌ]õÒ-œª|“NúºOuLiOªܪŸ¶•q§=]zøÐÛ¹ã×Só¢Iyé‰lkeâ5ÝD½ÑM¨vÚôsšöæÂÚšžÖ¨12¸³\¦Ù·kùCC3íGí ¿"XË9Š=<-u_Úö5WÔz±·Ôt*N„:ÞÛêÛÕæZœ¾ 3»ÖY™££Ÿ¼'¼ÿ¾ù«>ëA»¥×ûÝå[¤=Ÿ¸V›I²ù 3¼òHs-#Ç5æˆ1úI‘Â^×mlmGT1æê˜1¯Æ´UÎÙ—n~ L{\ù I¾Ũ½™wíìó¢S}Å„ËwyG“÷0s1á*æ¿.æLs§)99oÂÅ s@ -Ê—½¬&üzuœÐº\é×ǵ.+ð…qý»Ïoô¦TnH -á’T7úû ²ÇÞIýK Z¥©~ǘåòAòÁ]ÑÔ‡ø¡·ë'Wná[^ }¾ Ê ñâJoôçÝ&8ûzÚ§dáq‰]·SŸ§Ý¸:׺pq*xº±T° vß,ï"iu—Ñm¢Ç7Ìe¾Ëi5iñöK@˜B5þJßÃÉ7§\Â}}¤íxÈ7§\ÁCý4‡Âeñ²8f0+O\˜º‘ò!—žôÖÜè‹/º¬Žg7‡qŽ9z±¼ß^3™köÚm1Žd½$³½ÖįØi“ôò ììS4« ¯Ùj±Ù×aßQÞÎ>g«É\³Õ[&u~åëý¦pçZ{…×NŸ–}^n’zóœÕ÷·¿ª÷E]õžï™KÞ¤éÚ¤nŸ7›Ü0Ç:¶W¿Íê²etÁ|Á¹KHË‘¡D¾ìRl±oÏ9‘©Å® çCWeØãûñj®mZLšz]Z¡[âS-ÔKñšÏtÛç¦\+èÍW™¯T•x*ÂûøW6ú|[Ãf+<„r¿)wœê”±| ú1â3¤ˆ´+ñÝxŽLÛ:S”mŽz–«ãì­êmòš/˜åËÏWÍOµýeÓ8˜LŠõ_NdËÍϺ‘Rû5ùùÀ7“@&Ǻ7ÈL¬ou y‚]ÑNݨòº%⨮oÇQ2×ó[ëÛj¸¿oÝøF6Ò­‘+w’'ˆèÌ–Ì«×ÊT2ßžž”«O¡‹ÂÅe'Žin;o’ÓÑo‰zšn-5y ߶ÙU±‹>«ÎLÛßÚÚ8mç5âé€iÝšú,RùÎæ6TÓ®Õæ&¡r§úÖ²oõ}H§ƒ@üD·¡ ›ÙùÓ®ñÍ—gbj†D½]níÒé ¶«£ù¾S±·J£knš¢ Sw©+^ ¦["ÿ:ˆÉG´ko—dþ¡ïµN“ÝØ ñt@ˆ¡ ùùà£Ðڬо™ÞLtÓ¸œô°—A©© -®Ùh|o ÿ† -ß©Œ<å¡nR|÷çx“°ovòRI3=tÔ!I†âh;©ËÄØmvÖn¡=ƒnoÝ5¶ N*›è17ñ¤:x,ɦ[]'3„5ýt¬œ‰º éÙwS~^‡œ¾»ª×}²`&s÷}ÜA;Ÿgrì;nø"×.ow²ùF<•ÀFk2›~j“ ²Õ=ÚÉ&â  0ÈFŸ ¹ykG§r+B};œLŠ¸§Ã÷‡æ¬ó–Oƒ3|/ùœy™ãÑæ üû׎_¶‹0ÏqÜꎶcë‚åL³õÇÈ¥"ÿ/ÇIoâ_?µ‘¿eÇG(ß,ŽOÊßÿƒ’…g -endstream -endobj -492 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 491 0 R -/Resources 4 0 R -/Annots [ 493 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -493 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 240.123057 101.433071 221.373057 ] -/BS << -/W 0 ->> -/Dest (cb64-1) ->> -endobj -494 0 obj -<< -/Filter /FlateDecode -/Length 4604 ->> -stream -xœí]]¯Ü¶}ß_±ÏÂðû(òP -j4EíCÑ{m'(n -$}èßï¡V$GÔhÅÝ{mËi|±ÞÕ IÈÃ3CŠÕYâï+…ÿ¢U"Ƽ=_~<ýt’"8‰SŠÅÁ¤þŸàÎJÚ œJ>ºóY`‚ÉéàÏO'ü×ÒäO§¿ÿæôïeuÖ"%¯•;ÿü>«¬!† £JPIe•s"í<£òJàSâT0ëíZ`†MÑq*˜aµŽŒ* cƒ2kU‚:(Ë©`†J.0*%a‡ÒR²:"­5šÑ)'<*Ýs:­„I'V SAs:c„V9Åé’ðÞ»Èé,lqI*Nç`‹SÖJN[¬‰ÓyØb¼‘¬¶è § °E£v£‹°芬¶H/§KF¸­eu :C\ë´tÂEc$§SJ8`Ó°:ô(4’ŒNÃ/]bu°Å©9-œ<áLˆ‘é­:÷n#ât¶h,«ƒ-h|Ž´‡-2xŽЃDæ%ŽtÂ&m9ÐÑmäX@Ç$l†£œ°>ŽŒTÐiÅ‘°ÅYÏ1Q°Å¢ç²:Øb’å¸ÀhØ‚[´5°­Z8.0 [+“â¸À€o­TžãÂ…™’ãÆ5Ñ[Ž (PJp®wr\`@ºèîãÖ5ÎkŽ h×Øè9.0à]c•ä¸À‚wANV[`Ž ÀŽÂ¨h8.°à]£dà¸À‚wÑ4ÇhUzŽ €¡c”Xð®ŽÒr\`Á»:À°º РǼ«.óÜà]í¤æ¸À‚wµÕžãE€$ €wA!Ž` –ãø{è´á¸… °„ãÞU îéÓ`+¡bò8ð®Šh>V—„ -¨q¦ß¢–…ò>q\àÀ»pT†ãÞ}FŽ ÀñUs\àÀ»ÊÀSs:ð®ÒIr\àÀ»ˆÇ€ƒP8.€Jº¬. ™bä¸ÀwAKšãxa!#˜„Õ )Ž @ÆB"å¸ÀƒwáÞǼ+1xð®´{Xl1Qs\€¸:t[¦O#XRƒ)8xW*´0§ïJǼ›Ý&Ç>dŽÀ@(Xs\à£)ÏqO:„|¬Î ;Ž ‚„À²Xl±Ár\€ÀZ$“"ÇAã5ÇAÄ  "I!úf‡°paǶ Rä¸L&b²–ã‚à<Æc¨UN絈tÍê"t*p\‚pŊ㌥DD§ç¸/r¸ÄqÌ€NYŽ B‚-è*À‰¨™s:[ds\€H:¥8.ˆ¶ ä¸ êˆQ¦—ÀCc,‰ªætVæqfä¸ Z/r¨Èqº Fš`JV[@ }ò`Ûq\€Á›æ°:Øbœå¸ F‡›‘ã‚a‹–šã`37ÇIÂD|$éE“9.C'%ÇIEŒ7µå¸ý27#ÇÉHŒ71Äcúm2>7Çɇ…ÕÁM‰é·à$Œ7ÁNœÎÃ,ÇÉû<ÞŒ ÌÀx=;%óx3°Óà]—ÀLœ¼‹ÈÔs\€Œ7Ùrc{ âuñ¯ŒyÄÙ êuð­ì”÷Â[vÎ@‚|ó‰4€™YFÏÎÀ­B©$;m Á¿ˆÇ슮³OtŠÊ>3†|‘ ÝÂ"º¯cŽ–Ìl$»Îýüýéë7p¾çïÿsúð›i¦¬ü)Sj‹ø -Ý@'4·Cô­pùÆ£¡•˜„v²>’'R3RçI·l$Ü_þw^ÿXXÿ›Noêé¼øõôèpÀxÊ­1|æ‰ÅwfyAƒóIàm=Ò˜¤3;rˆ+¥]$þÝë€:[q­‡Ä|øK †­vç×?ž¾þó«¿ýåÛï£×Nÿø­DøÍW -ßÖ^¿]˜ß¢ÿ ¤àwœûè£ùß6¨­Öy+/ÌåoqOEmÇ/îÍr §$tȧü\šëÎuh­=‰ÚÈã´…d6ò1Ï¿ïát,Ïápz;|[ùEÚLÍø•][v8æ|OÚ´ÆH’mú3³Äʈ¯«ý€†Lÿ³¤ïÔoÓ]ß»kȧôë‘€IZ¡•ûþl,ÏáÐt;ʺåόԣ¤G”"-J}[ßê–åä|•ÅRkyEQðaYFÏz«ÁÀ—²:DgFÝ„ìEk´ÇÔžÖ³ä;f uYÚ–ëwË?ëE #u0ÏѪoG^=§õhËÜ`Ôí4¹µ ZVçÏÜ*Ú3-Ý·"A÷s¢°)ö6W„rß+;¶†ÀÔ–UŽœë¡¡üiÔ—o¨Äiü6Çò‰;‘âgžè¨<Òyå…®ä+½¦xÈž§:däèay圛ˆíÑE¼û½/«ylD–·Q½Üfó¹·cÇ#OßÝBõ³QE®¥Gò -Á4µËzêÑÈù‚:îº,¯c5'3âý[ÌiCxï÷;–çpÈÝ™ 4:èH“xiêi÷¢ ¬rŽÌ¨'{YŽþtqòBI˜ÌÆEú½Y¡Á<‡Cèã÷Ó‡øäÞîäŸ_fïàëHL˜ÒQi··*|,ÏÑëvV4Þ‹¼¿µè®½g”ó©z\³¾ôýuGâC§…tÖgôÜFäXžÃ!ò˽¿~ØÞrsDµ8wÿÚ¢Á<‡CÜØ#1ý½v6„® zóøZÉÍûGoåzÆ EÏ[]ñÒÀ*ÉýëÑòÁ<‡CåÎ<äQ9íÆ(lÙwx÷ÒK:®ÜâGOï[®xÌs4$úñ0œñ ïxqÿÀºÌÁ<‡Cé`ÜXjÐÊÕ&«µãe«U½ÜÌÉÀS3«•RÞ|2‡ÎNWû.Œ­ÝšNõîù¨[ñíG¯Ã »ûÇãƒy‡â9ÎϺ‚öËåëG»‰Ææ3ó;ó™÷òã3V`|þ.2z°Cõ”îŽréSu7Ÿó½´sOëSgŽ^¬CíŸÜ¼GÈܤOhgeåÞÉÁ³=²Ö{¸õç·F.>E^Ö´§ë÷VË×QÆÆ{5è9'¤öú‚Ú«H¼¬éœåÖÓÜhm‹7ЗX9˜çhèKƒë!û>}È54ÇŠ3û(d{åÛ -xf{0ÏáP8'~ªU´Û|!o¿róY–/9Ý@§»ÿÙÃÁ<‡Cç3bÇÏÊ+/Øs6âÜÕ½’nÖ»ö¬8œ\¾M0αfS/Îc/Þ¿Êg0Ïá°w;:œê-Ìó¸¹.߶:ÔšÔg‰èÞu¿»zßÅS?B'#óÕzánU{ç¦_7¹SC£Å­»#ƒöå—Õ>imKG1wFߪDüõwóÎÁ¡Ë;óD§"Ùh¢Bq7ÉòÖÛR”ÍÎù¯‡–Ÿ1刼%¬‰g„z6…¼‹J†Ò«?üé%Pš^ùþzËøÚE¯¯ƒœ^·ì¯Ç¹J'Ȩ›ëë#m,Næê`ÜD=¹Ù®’ó`"__•«ùÚ|ÓmלÖ_?SYóï©œX`6Ÿ/OöäüùýpÕ/Êwó¹‰=SŽ\ƒ+×°jÊŸN~ÚHM»ÂI7¥ó¶±go…Ém“Îy¢(U¥éÔTÙ꼑sÚl÷§šjÞWæ-ùòvL×ÍyÉÁœþ§©Ñ<©dE®ÿL ×½2å$Žº4ñÓ)ï•j±ÅˆxPœ…óOY˲ª$¬² ø5ˆÔ§4NÈùgª…W~jW®&çw%[ÞÃÆÊ’ÈL»¸\OÌ‘Ó«µ8_½jçýf£0󑯦8_l†°hiÚV`˸+VF¡[ %9]k[ìQy²Zu¾ «é´êiþ’VÒœ·„—Nkzé+Í»\–¢JíjYe†•ªÔ•”µAlm'Ft91¯d)Ú¢1«ž´ZÞ+ì*ŒH¶¦K%#ºœØtsi®¶T¨©bËšJÍ7SÔM¬ÏȦ:š¥!o Múˆ4åçRìs ”¶–‘àF¯„—\Œ]‰ŸN.0©]ã -é -ô¨Ðr«8ʆ—&Íýõºf‘å–òÿWªpUš™gú¡l…TÞ-­µ“ä¾YÅËJ¢r_YÇr5 lhiIu©*fi}!šbÒgÒ­©k-¤¤Êˆ<¤b^&©JK±ª¨«âLa¥~*WR¡,FàtMì*”Ÿâf§«]`/'óŠÀÝÕr›ØWî|¢âP[\å­ïª½µ\‚ù"¼LŽÍöâ ýXNÒÄZVo×NF„Í0B7}šÄ¥·VvšÞ?ÿlŒó¸—Ó§ÉÍiãtÂoTÞÉ•F^êü_¤y…Ï¿NöümÙ:ìêǵ¬l¡+·.ÄÔ“å}¿ã 8ï^„µÛ¡¶„ö›XÅ–Ö4T?®5ákÛ²ËFì%¥ª ªª– -]«C"ÖºZR3î†ðÒÕb džÛ6Ía_M¹8œÆäMçŠU8 —ƒÃØt¦¹ä3)G9iséÐZM2 CrÂÔ,[˜™IOR«>ÛoiS˜|.r@ˆ|hšÎ67K‹.²é*H„À†Ђ­¢'M {£î^Ïn÷Ùd_z@–Vj¯Ò'*­–¥•ðx©™ýò°úsÎ¥ó¶ªeÒ÷L rZ×h¡…]PŒilÙ掞ÔÙâ¤ÅQTº€LY-1›üœ­TËtÅ‘­¥PcŠ&ýÖ´£­R+ÑÑVñ«´¹Üâñj´djä(œC»:ÙRÖX222OsW©m)M‘­Ïm—ç.ÞöL.Ã6C|‹LeËæV)â¿GúÎ5O7Á¥*Ó숊m³M8j«‚Ñæœr¸½‡Ø¼v°‘L—ÜçöüÉz–¤ÌŸÐ3¡9„5F¼m˜ðEÚW¢žæ}JùlI²—t_0ÓCæäjvÈ3O_N“Dõ0ä¡¢KÓ†Õ2Ƽa{Š.š¦P.‹é“éïÖݶf -endstream -endobj -495 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 494 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -496 0 obj -<< -/Filter /FlateDecode -/Length 4520 ->> -stream -xœí]KäȾç¯È³‘ãAÆ0æ°À®ámìÝÃ`Ýé.‹cü÷ýQR<$1•Êìšvv{ªP•)2 ù‘© Ù³Áï7ÿÙ!¥/?ž~:™!²ÁÏXbq1²¿Ç_ä³5¶9$>ÿ(‡˜ÙÅp~=áßê²/þzúß_þº¬cÏnÈ98Ëç¿}ù!¦ +¬ –±^a11: -+ØCÌYcA ŽähËŠƒrb1ȹ¤°Äð­ß²2ÄpÑ’Æ‚6sTXÖ@ëŒQyÄy§ð,JÏÙ!¤ì²Ê‹àÙè4ž÷CˆdÙj¼<„8i<‚,œÕx YØYȧ¨ñdñÁ•Y\Š^ãEÈâ ¬ðdu%•YL0Vãe?pND*/ƒgRL[ž3 ´lÊAÃîÚ„éSyy°WüZlYÃî"Py ¸ øLãDT§aw­G¤ÖxÀ]ë²Ñ°€»ÈXØÃ`‘hX€ø6XÓUyy09% ¸ Xr -&IT^`HVÀñ`‡jX€»ïYÂÜ5콆¸kiʃ,>9 ×€·U|Éê`BãwÅ k<à®11kX€»65,Q.iXdÁNÂhÈ1 B6à!åSyaÀ5kX  ÈRy…"iX€ÄzÈ>' ¢ƒ,Þ9 ¢ƒ,H4,@F0d‹ì[]@˜‹º> È‚LQà Ù2‘†‘ÖcÐªÆ nHp­òx6jX# ÅV쥆§×°?Hº¤aÄÏ’†1C¸Š†ECrÈÌ5ž…,H²5,@¦ žµ$Y jX\Â*3 ¡±–„ª5Yg& …ARE à&Xi)UdLhX€ù‘Å6kX€Å›Xæ¨<Èâ™4,HÉÉr3iXdqÆiXÛ”õfÔ° È‚ŒOÂl i²†€qðŒÑ° Û„õ¦# à—²ÞLdo°ÞÄOñÛ샬7£†™ #EQyISVü˜„õ&ÐIãÈâ2iXCõfÒ°iÖ›ÈèÕ-$ëͨnw9™4p™iаXo"³ÕÖöÀËù™ÎL²âLêŽô2b«ºe`€½ˆVQÝ30_Y#©›+ËÔ]„U0­Q· ðùm0aÚ}ê·¨Ì!"f¦(ƒÌp Bv_×­˜¿RlÚûÛŸO¿~à{þóßO/¿wÊʯE‚0–&äWp—1ÝŒìÛbøMCïfü%„€Ô!bnBZÀâ¼é&B"üÉÏyûf!9ÑQë¢ {)I6õ$[',Š±>p3›Èw×¹)rD†ÏõÕemªêûmºÒd½»Î›Ë*°€%4ξ_ˆ&ä­Âo;ù²Øœm/ËxD74º< qÀ]™ëUÞP`ƒ•1R­€2>; MÀ,* - -ÿÇ»Pj–bÚ¯—øH–,¢Žãó»O¿þýwÿóÇ?|É|÷rúá7+Æo¿±òz™^™§W‡Vd‹–㈖<¡Ó˲õ¼(›–t*×/ËkŽ­žôÅnY®´ÃfUÏëåè}7à‡é½™Ë[3ý•~k{¼ê§k£ŽU§ènlon¿ÊßñF™B¹þöÿÎï¾;ý绥‘ËŽÉg% Gª#d×.Uù»ü9Ì1ç=s¬*þЦ¤NQèx+3)êÍ}Zßþ6SïNýÎôÖ:}™N¾µË,Ìéý$g©[ÛJK¹Ör—6«Ë®ê¯õT^«NèX;馥¹?Õ8åC™bjˆ‰Ù$'¹Ø®u¬ól扅ñž}næâeùZí²ØÂèíÅná¢ç×6.ú|÷ó{·-ivÙCÖç°µ^ž°jwã_:l"7K ,)û¾e«ót–I»Èùsò:ÛÔYIriÛ^­ó±³fžy×f9_i«Œéeie·’ŒÞ¢*b[ÅKÖQdœpk¯F‡^ÅKÞoëì iK(Ûì±:Og³ûÉçÆû×I_™Ã+ÉÚ”\d‚>q¶Ç52¹¹\ÞA§äãµ|ïgÛYec?·lºØž_¶y—_]CÒ–NRæ%ÙßÙ·ÊcužÎ*÷sÐõl×™KmÆú¼ïvì/wí¬Pæ«Eè»ô¨[¥3÷cåÁ:Ïf•n?ó\g”¶›éµÅ}Ýøõ€‡v–ΗOõÈ+–Úe•r/\*Ü´ÔcužÎRod¢ÿxuÅ#W–ö¯ñÄ+Ú円1Xߊðë<…ÞØô|dƒòÜù%3P<íŠu¦ûWòëÚìZïò¼¯ºOâyž_¢ú}Qø$þ`§³Ä9ç׸~ÿ9¼ë3Dpâû×êëŽÑÂJ™—ÎÚk†0õ7es¹ŸxæÛ¹ýM¾’-èºOf­Ÿ±­Sýÿ¤íé»z•æ~»qqÆtr”1{ŠÓkûbóZ[êU/Óu-èÂÅ̤ã—:\Ïc•)4ߨóf›üÕ3u=¹µžê8Ëœw6ˮɭɴD°=ôZ#×Ê·¸ÓEZŽÏÚÝñZg•¥_ßÚºÍüx‰œc‰Ž»ËÖyèt•7 â\Ï[ʘa®úW0ÅlÖ [Ü¢ xÓ$\í0¤5rFáªÃVKÔš$”¯Yî·ë|8à"*íòË·7jSö ášT7ês2cî´úc¨]¥>| ÍñÌlâàw4õ9¾Hu`üäÇìä0¯´/ǸBy!^éú2{ÀïÞNû”<.Bê¾r÷5àý¾ÖɨŠS™–, -jú)œ?,ƒí"ò×’šmÒ #g9‚tÕéèíW€0G[@½;vóÆÁ:O²¨ix˜xÍûƒÍì}iáC»®¯~é¡¦Û Z{o¡/nœXm÷m6w®,›ûÅW©ëÝdMåú‹³n·;³ ÊY¢ìÙÞ:ÍëX•'±Úî49KôºÙÞmEßÏûEFßÌr°jb›ºs«o¹¡´’ÛãÙÎvuºÜGѤ<ÑÃ't`[”C05›v'4µsjì´ôñ%åÌÝb?Ïe -²vËŽšnÏˈ’îŽHº47OtW—ˆJ‡.¥µm‰æÞÏ~))ûªýePC9Â"»žÊŸNa<ÐÕŽ‡z›ëä©gäÊ^æ&ŸåÙd<Ù2uvT¶=_©9>+å§ZJþƒdäDu9MwœÚþb.ÿÓ8é?ž¬l¾˜É¦§G˜‘Œ`ÌkòëIuA -™¨m.Ü q~kj[dë^E¡]€ qÈë’ˆf~Û64$„Lo—ÑH}.ÕäR2¥áœ:Vˆ¨ì–,£7ƒÉò¸4øù*TQ$-­ÄÖ õe[ƒ­âM²õ¦#ò–hºîÙQ‘ÇÊñÒUu¡«è½êl7ý¥¬‹Ýtî/'të×ÔW•*)(Mí:Si¾*W*—’uB¨Î“Bºœâ7¦4M˜ÌÊïfMŽzžˆ©Õr¹”SH—“ZnnëLÅZ*µª¹h¾‰ÒLݧªx…vé6ý¢<ÿ¨óãËÛ%Yö²ê\›ÔÙÛ/'„Ú_O•ÒÜ°Âp1½žè»v+9™f/*§{Nïàš…&åÊÿ *¸RyÆ7–ªIÉa×íªu"¾YÉK%õôPQ‡4 XŠ­l§.cµÙ^_6¥¼€n-]5¶ v*ëè1ñ¤*x,ɶZ]% „ýT¬ì‰¦î™«)¿.ÈMN®®Ê¦vlgî\ÛmäP±óµ'Ç:ãVN.¯òÖv;›/ÄËØhMÓO¥“Fv¦F»ÖYGl‚¹ÁèëH.ÞZÑi<Íh~ÛœL‹¸—Ó_Nc˜sžì=¬ìãòZ{þÊ|‡¿ÿ?Ñùåäç)Ž;SÑÂUl]ûH&mJÉò§B¬nÓu°ßÈ6µ²\¬¡Æqç:¼¦VÝ4`/%mEP[¹=‘›;²«¦ë¬ï4Ã;ÄËJ‹5‘ùÔ¹i{ºôep²‹&g†©pÑ—©ñ| Éç®I\IÑÒÁ%×UÄEß(.»s“l!¦dßIU½ÈOýTxé«»èÒ¹ôG-ÌöMÚ8Š®R`ß_ô “í;Í y¡v¯Ož÷YäP<@¨Ú+õµ§Ö µžNõãeX^Ö˜ãÇ-§â¼MCµ-ßùž¯INs–ZÐ⢷юšZµ¹÷R¡-:-¢Âh¦Ðj‹±ÈæjE-㈓ª¥XsŠFýK¯iîg¥*‘ûY ›²Òn‰x5[ò5âÞœci%k.™ZèkW*µ’¾Ð¶}Ó²ïmÏÝ0¨ ZfjZ5Þ”|ÿñ©Îj'B+U~Çݛڳ¨ÉFïüøøK“B†<Á(Rê¶K¿²Ý%)û'}O˜Ž¼7ÑʃLu^ÁÈ·]Så!§zµlÔ!ݧe{¨ÁœÙìO²wÞÆM¢ze©(®ô’ô&yÞV4V¿çC>Åõ‹í“ñ÷Ÿp ð¿ -endstream -endobj -497 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 496 0 R -/Resources 4 0 R -/Annots [ 498 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -498 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 176.373057 101.433071 157.623057 ] -/BS << -/W 0 ->> -/Dest (cb67-1) ->> -endobj -499 0 obj -<< -/Filter /FlateDecode -/Length 4623 ->> -stream -xœí]ˮ丑ÝçWäÚ@Ë|_ÀÀ žã(Ø Ã‹ª¬®6·h{áß÷¡$R!*¤dæ½U¥öt]d¥AR!òð0¢’úªð÷Æ‘ôc -ž®·/?]Ԝ¿1ÅêdT‡OpW­( N'ÝõÇ,°aÉ™à¯/üלòä/—?ÿêòë<új†”¼Ñîú÷ﳊìbÊ ª•ÒVP97„`œT^¸Å”$Ìp mUfPŠNRÁ 2& -ª3,m·ª3LÐ$©`†N.*­`‡6J‰:¢ˆ¬tÚ •î%уÉ$Q ÓÁH:kH;-éÒà½wQÒlqIiIç`‹ÓDJÒÁ²1H:[¬·JÔÁƒ•t¶ÔNt¶]QÔÁå•–tÉ.E"Q— S1Ä­Î(7¸h­’tZØ´¢= -䃠3°Å+—DlqVIga áOÒ'œ 1 -½ÕäÞm•Õ’ÎÁc‰:Ø‚Æ—ÀxØ¢‚—(=hȼ$q€ a dH"í@‘¢Ä&¦B° ˜äò)H<`•†Îh‰¬‚-Ž¼ÄVÃBÏu°Å&’¸ÀØ‚X [ Y‰ ,Ø–€‰ ,è–TÒXð-)í%.° \˜©$.°`\=I\`A¹€R’¸À‚s-¸Sâ ÒEwX°®uÞH\`A»–¢—¸À‚w-i%qw­ENQ[`‰ ÀŽƒÕÑJ\@à]«U¸€À»èFFâ´êz‰ €•ÁĨ$. 𮉊$. ð® D]ЭÄÞ5· Üà]㔑¸€À»†Œ—¸@À?JôÀ» '»°+qÆ{茕¸… n‰Ä¼«†?¡Oƒ­“—¸ÀwuDó‰º4è€ú-jyÐÞ'‰ x••¸ÀwAŸQâpü€ÕH\àÀ»Úb¤–tà]m’’¸Àwá78‰ ‡AøãÛ  +êÒ RŒ8ð.hÉH\€QxPL"ê i‰ @ƃ‚*qïbxOxð®rÖJ\àÁ»Šàöˆ:Øb£‘¸~ tè¶BŸ†³:(¦tà]¥ÑÂ’¼«THxðn6%.ð! L”¸ð‚Ä>ÒBðø¤ ƒË'êü€s'qAP8P–¨ƒ-Hâ8ÖC²)J\ l±ÆH\ lË q<‚!ixßâô¶.âü€` ‰ ’òCv“%.C§”ÄIGÌ7 I\€~™ç›Qâ‚d曘â ý6YŸç›Aâ‚D°ÅÁEu°NSú-8 óM°“¤ó°Å$’¸ yŸç›Q⸘o£C1Ï7ƒ.ïºf’tà]x¦^âœ`¾ ÏVšÛ+¯ ðÏdeÌ3Î(F ¨×alC -Ü‹Ñ*ˆ1òÍs$1h31³Œ^Œ`X…R+1l À¿ðÇhà Sô‰‡¨<à0fÆo2¡[¼û:çX’ÙdS|ìï?\~ýƒïõ‡\>ýjŒ”•? aLMÀ3ºIhnï[ãö­XÝ0 -i´>“'Òb¤-ÎA·l$†¿üïº=XYÿîè·ï.èºSØÐç²1kò9RütD´Ð»/¿þö?ÿ_üUþîÓå/ÿ‘§èJQTà5|ò7Ξdh$ÈþŽ ŸOSŠ¿ùëõÝ·üzhH4¡Ãа¾^¾„þ8%ÿÝ»±Öl­µçcª5ð’јù£ÿÅ!_ -£«è³¼¦žçêÅ-À7Àýaþl2—¢ƒÀ V´©s*Ÿª¢žjëŠÕ¹10w'ãÆ&øïoÿô?`MàÜo¾ÑùÛ4ßaúVvúÆ<N%>ï§ã|þT95éòyÈí1çù°èŒaéìüù8Ó|œËOK:ú>Ãa>žïæs ™ï£¤¿Íç~¶ÞÚʪMª)³\74e‡’^Æ\†BAP°â¦2—‚®3ÏIP·˜ f­k’æVr·¹æÓ}Z·`O×Ö ë2²®´hmA½èéöåWy¾gÈr󵺑ðà½êé»–¯ÖyžGäRFµãýRiá:›‘AÉÜEj_žÓ!Õó£mÔäÜA[mZZB×!ò^ã¶q48Öcº‘¥å²¾Rƒy©}yN‡ÔxÌ©ªAÔ‡å8×àŠ/ý4º¾}+íØÑ ½"⥧öÑ—µ¯öžRÎǦ¾hñLÖ6í rñ f0Ê{×½ìÌs6TšcÿòÈOkGrqÔló|¶IÃQ@ R‚œ§  ràNËó8ßtæ9]ËÞñáJMÞØ(ÙÔfî;æ6nuäl[O³Vš‘óØÜ×0é3qî£ÏæÿÀf5~4ž·òB<öµ*j~qïw[8åÀ‡åü\šëÎ5h­=‰Û(ãtñÆ(‡fb~¢z§}yN‡Ócn3vhÖf³¿]Ú¾ÊKcOë RÚb¤õÊvdzf–Ú3ÖÕ~À=G¡ÿë;õÛ6÷÷qòú´Ùa=æ1)ê —tæ9šŽ½¬£ñlÅH-JZDiÖ¢|lk[ýÓºœq†XX,±Y.GÁ§u-ëmæ’_ÊjuorÏ[ã=¦ö´–%? -s­ÛÚ¶\¿»ã3Òõ"µ/ÏÙjïDöNkÑ6ÝôqšÜÚ9Hkògnã…–n[‘¡û5^Øè{Û ¡Ò÷ÆŽ½Y0·¥E•c×zj6/#Ñr¯/?"ãcÍC$væ9ïxŠ_9ÖQy¤•Wº’¯ôš&j·¹‡rÍ[òÊ5wÛ¢‹î+ô6¼Ü•Q½ƒÜ'¢yN‡Ücßñ̼#T¿Uì^Z$oÌýPZ×S‹Fi,¨ó®æ Í&&Ó1úÛÅç¤ Tz¹}yN‡Ü;Ñ@Û ƒÏ4Ù(ÍGÚ{ÞÀô¸¶i¥v$oŸjøp£wa·×³žùÄ~mÿÆ_dQˆUYOYÜ¢žE7žñGmz‚Kûòœ ‘tÇmâ"µöøèµ7CaÅk}5ò½ÿ™?‘i·‰fšÏ‹Tb¾'Z2©hò¡C¤væ9RýÕ¤#äGƃœ×öø¥y2M#ðó>ݹQ¾ïµì ’Å$“Ü89¿‡Ê¾<§Cå_ôŠm·òûzP½3+úy |™á ¾ìËs:dÞñ5ßræÒò‡f7oh†Žq¥Îi¼ƒÒÅ—ìžuæ9J]ßJÇÏ>÷þnP÷ r¹Ç·~~äÌãóòÎ<§Cá±o9®$)ëh¥¨6_ïêçtR‹ sø»sf…Ù‹o–.‘÷ÍuŸ\Ïq×(=€óiã´±Ú½™Œc±ÈÞ‘¹3ÏéÐvÇg|æ ‹¨œÇ{[Žþr~òBÃã+Á;óœ¡Ï?Oïâ“G#ÜoÈ?ÿž½c±Ì'Ì/~š¨»‡Ø¾Ë£!|MÐûç×Jî>?ú ¶«0ÞÈ+xÝꊷövPÉž_÷FÈ;óœ•wâgå´ƒYX²Ý?K/i¸r—ùsëÎoyΆÄpÇG< gü›÷Š'FñðĺÌÎ<§Ci§ßXjÔæ “ÍÚq†²Íª^)rÒñÖÌf¥ƒR‡oæðètµï&ØÚ¬éÔ_º ß~ö:ÜA1=>ïÌs:߉q~Õ´?_¾~¹»h|"žÙ™çth¼Ï|”_±ã‹ðw‘ñ§€ ªÇt”Ëߪ;|Ï÷¶\{\Ÿ:sôjjûæ^ç3¢Àb“>¡5©{O$;óœ ±ñØWm߯•Z÷« ï½0 -—tÌžg÷<š·Ã®?4²Xd/;óœ_ßmß…Ü ãÀßü(³qßÖMo|øùÿ"ÿ0ÿÐvÔDîÞsóÎ<§Cdg|óhuDþ½Ê0„w"}µö £ᮺv…ñž_»óþ̦'¹åÞbmO|bdgžÓ¡æ—wÃWÈlß ÿÚ= 3NY̱w¶Ò™çlˆM¿Ä)W=ë^Y{¨ìXƒùÚw~”Å{Ÿ4væ9B＋ó$´oŽ³ ­6O#eÞøÿØ3vH?ÓéÌs:$Þñ Oůѹ¯Èl‘Ùþn`^\V*Ï~ïf³™Ó¥ÏÌ‘Oü&QgžÓ!óÎso­vßÙîYëÝÝúó¯F®>E^Ö´§é{¯åë,cçw5ø5G¤¶ú‚Þ«˜¿lxÌrïmi¶¶Ç‹{è{b=dgž³¡O«Î‘m§>å"šs9š­²¿ô­Âð»yó€àÐbÎåÍ[¢Ó‘íEP±w7ɨmw.˜¯ž7\Ð; È¼k¨WD¥7ÚØÛÀ|?Å §_›~_jüýF?çêÇ]Æ”é÷¨ÆÆæžšÚ3Ç\ÍSU*[b×å%Ô¸‰@†âÇÍiýôËšÇrbñ(çëeï1çÏoü…I¿*ßÍ×föм¡A½WîaÓ”?]ü¸iŒ7S>ÚäE¯ž›Û&]óF5QYÒ¥éôXÙúº“sÜõ§šjÞ¢Uå]ÛòŽ=cÓò“9ýOc£ÿxщ†\ÿ™ ¦íÕ(Ž¦œ,â—KÞN“1aˆígá|¨jY¤KÂ*»]òO˧6¥uƒšS-¦ Bäôz+Îw¯=‹ó–¤q°ó™¯¦8_l†p)xÚ¥À%ã]±¶Š ÝV¨Ø屡bÎ[Xժ󋰚ΫN³æ/iM`Íy$¼]pYÛJ_DiÞ±Ujר*³Ì¨T¥®¤¬ BµÑí"¿Q¥hBcV=kµ¼Ô$ŒHTÓ¥’NÝ.bº¹4W[*ÔTqÉšJÍ/¦,P·±V¼ ëh–†¼Ç2ë#ʖõØç(m­"ÃÙo 1´¿\\R»…+”+ÐãBËʭ⨼,Òü^èt„®Ydy3žüÿD®J3óŒš*¤ò†ZËÙr‘Ü7«x]I\î+ëTyK½‘¢ì*fy}騄ô™tkêZc+)«2&©˜—Iª’ÇZ¬+êª8SX©ŸÊ•\¨Š¸Ü"vÊ/+ñb§«]`/óšÁÝÕr±¯ÜùÂÅ¡¶¸Î»£U{k¹ óEx6jÅú±\dUG»åbL¸RXÄ ¾ŒâÒ[+;åŸËáÒɤ÷vùÛeæŒu&áÀ[7ûäž—¾þi¾Åç/týCÙ]jǪla*·®Ä|$Ë[CÇNqÞ*ºk·aBCŒö±ŽKZWÐPÇñüKé¡‘åìj!ö’RWÕUË…n©C&6ºF[V3î@xkj±:2¯m›eÀžNm¹9\Ææ}ÉŠU8á·ƒÓ¸èì2$_Y‘8ËI—!Z2,#Nx¡8eL‹e+33 ùEjÕgû‰7…Í×b'ÌȧvÑÑ2Ìò¢‹l¼ –.°å'¼`Òü¢ie`ôÓÝëÕí>›ìKÈÒJíUúÂ¥õƲ´ž,µã©_ŸÖ1ÇŽ?í_:ïRCµ,Ëúž­NÎÒ5ׂV'£L—lsÇ/JE¶ºh(*]@¦Š¬–ŠM~ÎVªe¼ã(ÖR¨>Å"ý¯iÇ[¥V¢ã­â7iÇÝŠÌ,²âõp8‡åîÔ’²ú’Qyž»JiIi‹l{mZ_»Œ¶Wv´âÏT-ÙÜ&åSü÷Lßw”R•¿1:¢ã²#jÒÁ{MÙ݉ރC(ï’(²pÉÃyŽã'Û(I‰Ÿð+¡9²V ¼í˜ðEº¯`E½Ì[YÊÙ’oé± -ÂC Ím÷‡´ƒã•c¨ž†> -endobj -501 0 obj -<< -/Filter /FlateDecode -/Length 4435 ->> -stream -xœí]]¯Û¸}÷¯ðó«åÇð (ö¡@[4è tŠ>Ü8¹»(n -dûпßCJ$GÒX–›Ô7»¹plÍÔpxxfHË’>*ü}«ñ_$=Ę‚§ãéÃáãA Á)ü+%fEý¯àŽZQœN>ºã‡,°aÉ™àOü·8äÅŸ?~sø÷¼Ž>š!%o´;þò>«È!† œ JP)m•sCÆyAåõ€.¦$©`† dh­ -0ƒRt’ -f1QPE˜a)h»V%˜a‚&I3trAPi;´QJÔÁEd Ónðpº—tF>&“D]€N#é¬| í´¤Kƒ÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ é£ÄàøÕH\àÀ»Ú"RK:ð®6II\àÀ»ÈœÄ€Ã ‘H\€ø6h芺4¨£Ä¼ Z2 -*‚ID]$-qÈxPÈC%.ðà]„÷$qï*g­Ä¼«i¨ƒ-6‰ ×@‡i+Ìi$«ƒ2` -IÞU#,éÀ»J…$qïæ°)qY`¢Ä0p@l$.𑆂—¸À'R>Qç;‰ ‚‚À²Dl¡@ ±’MQâ‚``‹5Fâ‚`` R‰  I#û—°p×[)J\&b"’¸ 8õ¼*é¼b]‹º„@B±–¸k©!bÒK\‚rº$qÌ€N“Ä!ÁL‰ Š†h™K: [dK\€L:­%.ˆ¶ ”¸ šˆU¦W Bc- WK:Ry%.ˆä‡œ*J\€i‚•&˜RÔÁЄÄŸ¼Øv`ñƒÅ&–9¢¶XGÄhòr3J\#l1ÊH\læõf¸ )Ø‚ŒO₤üÓd‰ @ãÐ)%qAÒëMC`^æõf”¸ Y…õ&–x¼MÖçõf¸ lqHQDlAÒ”„y NÂzì$éF+NwŸø•bf ¹“ Ó‚Ý·5G/fÏ÷Ç~ùéðÝ‚ïñ§ÿ¿);eõO#A(¥ ù¦In‡ì[£ûM‡˜3Ie aà-u²!u#5hqÚtËF"üåÇõ‡™å0üu9½m§Oˆâãé1‰“B† `E,_—_Yå VX!Úz”±ÉdväW*šþý›€:Y1î¶Cf>â%ÃdÜñ͇Ãwyõ÷¿þð0zóxøÇïõý·ïÎŽïtšŽýt§c7½§µ ƒ¨È/Ê…ñ]Mí¢HyU9=ÎÏStvÞF³%1;ÃÜ®\Þ3›N“,õúõ\µŒÉ¶˜E»µ/†•¯õ™®ÙVë±¾Ó[Á7¼³S»¬ûþŸÇ7¯x3\ÉB ऩ1ｿ€Ñ}U>£ŸšXÒn@ó*š h™ mØP>tH¹8þäžkÚ, «SÀ™ÅûrZÅéåÆ×LŽaFŠ‰ábr?}—÷ß+Õåår®É6‘·³Î½Ak -ì¿eÿ½›|ù¶ûÐæO;½Þ->/ü~O~1κõ že¬*UMMŸ3Æ—u–4]èsÙþÛ©í´¶¥ö­—õ­Í‘EÙb›{ZÉt6»šwÖ¹;TÒ&#Re¸Ó|ô>% m!s…€Àõ -ìE@eϳIÃ’UÕ åË:Õw³DìuŦ–”œA¤»'÷Õ¹;Dn§ÍËoYšSG‰¥E+î - ¹Ä¸Ó -£owŽþÆ/ÓÒR†§m‹Y³Ì Cak+ÎíZq(ÍûJ‹úK?Õ÷æ“ÓÆ<¡ø†¿ÓfïéàîUÎÎ:w‡Ïír5‹ØÙpY±°±Ì( µ` )†7–]â…ïÕX’pÉYëK`Ûs.Ïm6ÉÌix¶˜‘@)ï²l"sg{C¦ÙÎ0?G,ÞÅéó®À^D,c¶ç’û1»¯ÎÝav;ÿ\ÍþeÞWÇðL¾¶‡%gžVaN`&#¬nŸÁ>·´ïaÂÎÿk—à“ö|’’œÑ”·ä·Q¹¯ÎÝ¡òÂæb´ÛÈÅ>b<ï»»Ô Ù>|f†¾ÊgPoàÊ}uî•Û™ç2£¼f“üëâ¯fè³nèËHµ,«Ì—cJùKHÝYçÞj/d¢¿ -¾:3#Ïì¿Ù™x¡,‡T4”`})Âï¬sw½°ïyËå-¼ó[f Ì´3ètׯäwÖ¹;t~¦üó…fÏ:ã¾D¤gùåîH¿¯ÎÝ!õBNú"ùçëô¤®¿*ig{C(]ÈEo䫯ïø-ÒïŽôÄ÷2w~Û¹³ÎÝ¡s;½yÝûFú[®¨úÜ‘žÜõkúuî©rÒÉ?Ï4Ãî9ÒÇë×ô;ëÜBwæ¢üZ úýœï£W¼Îò¼ÂWì›x7ÀoQýº¨înø&~g{C¢»s~ë÷Ï1»¾@wöúµúÎ:w‡Ê {ž/’kži6íŒàüZ‘ª7®5Y^Öòà ßrº¾{ßYçîPzáúÏåï+…åug¦rÉ:{ýÛ3^ÄmQïðzÜ¿¢Yf­îN?Ôòû8çãõu‡gÊ~´¡ûêÜB¯ÜódœÆ#኷Î!qk½¼ƒ—^rŽ¹ÌrV×ÖŸ‰êþ†ïÚwÖ¹74ú}¹æ³\å¨?箵?wÝüì꼌¢é·ggÛYöIÊ…kío‰—~3wŽ+½½ž+wÖ¹;t^È9—¹Ø¯r½|e[Ÿ´"<ƒÈ~_´³ÎÝ!òB~¹‰æÕìþ&“¸ð†|_5×tK>³ºÿŸ¿ŸAë {š;ëÜZ/übý¥rÚ94ïX‹/w°f3ñ‹Î ¡ç‘š0Úɧ. sg{CgØ™{žÉÞ¥š6Jgr±‹¿e«cÒn+“û’†²ö®}i‡ðà`Éç{¶†|Ë[mµ‰¥/¯þøç?ýmùûü¼/ÉraÝòBØÕú2··ÇlßXÖ…<;k?Çã•|*+¯G==Žï¹Þ˜L²Ó$¯¶p}m)ç:UÞžt“-õÜåX×1ãöŒÈßåÖÈݺ¾ââÆž¼Ÿä'f©Só}8µ®ÛïÍêÔQñÝóuDJ™e;½ã‡é¸ØÛ¼¸ßKQ-½¤ÀÞ†Xo;›šU›Ót6?ÆÏÚ§0ødóý£§öíÔsçó9Foï¾[·ãm¾¹Z¾ïº5ycôTñÖ–Ñž³Cõ¾Ì¼xÊý9B°-ßÈÙ+2> m—y™ÆúMS[|¾u˜÷“/ªMnŠ¨±ûÚù ajwò_GÛTV°¿Ï©>ŸœW3Ä•¶¬lŸÅ±A즓Zú¡Ø8ÙPûSd’}®Û㦲±ë—6ÕQÚáü’úg©ß´ð5g€ÜŽÖ½Ïõ|ņǩ>ÃJõ]ž/6¿Ÿ¾Ù³é;³ô]™Ùf>^ÎvžåÐ¥_k™GÆí-'mÔ§§Ñ/c¶Æ|ç™/¸~bÚÅåòô0Çc)ËúR²%ÅÚ®ý¨œPÇÁlú‹VX[Œ«®ç¸€‘<Þ®Î{5úAÙ¹—ØköW,3¼{ØFâι·ÄöF‹~¥²nÓ_^š›×Çäù<â‘°qqÅê6·óxÖ–ŸÏ{ΑuÎsÙrÔ^èvöÓ¨M®xþYìc~Ü>¿Fþ¼0` ÔsBªÁ -©èëév†Á¡5çòíd£Ó‘ݱ­ .¹°XßK±Þ‘ð˜ÿ–9~ï šÌÏ1±ñˆœžRÈ·þ”òà¯sœ4mŸýȹvÂRž×-_NS×}^y¬Í߉Ã*Ö -ï{6†i”›–c0žòëØ[Î÷0 Éiέý ^m}¨¿O«¡üxðå6¶ºÜÊ\ù8h“Ÿurô4äÒ1ß:7*Kº.ÎÖÇ35Ëb>¶RÓCcT¾|¾‡ðøDv0•ÿXýÒL|M,ËTGSºøéðA‚˜¨g§ÄY8}T­-,^ÍBvÂB7 iYÒºzN–[W?W{“ë»Z-ßx•T-dË­GÇ BÔôz-νWƒžÄù!)q°Ó‘o¦8_m†°7H¼lo°W¼(ÖV1¡[ ;]ªöè|Síæ:ß…Ítî:͆¿–5 ç–ðtÀiíRú$Jó£jSÕ»F5™eF¥&uµdjã$ˆNAø­ªM³éÙ¨å\ÂXD­\ªåÑé –›Zsm¤B+{ÕT=ßMéP·±9^ت1ä§>±9‚ôÞÔqàâ¼jc­"ÃY O„Z‰Ÿ.¥]ç -å*ô¸Ð²v›8ªŽ—.Í÷Æ?ajVY¾=pþ¤ -פ™yÊM Rùßý¨Ÿ$ÏÍ&ž;‰Ë}c’< )ô²Ì]:„†Yî/•P>“n+Ý<6“2—1yHÕ¼LR<æbÝP×ęªWr¡ªFàt]씟fân§kS`¯'óšÁݵv»Ø7î|ââÐF\çûµ7{[» óUx*–â ýXOÒÅFµh×OÆ„Ý0Bw}*â:[;•›~Mû$“"îéðó¡„9cIøà­Îá™—>þe^áõ¯¨÷»ã¸Q-LãÖ™˜G²ü°ª¸Sœ^U…mÚ0¡!Fû]¬c/ë*Z7†ñ5õêª{-©ƒê¦åB×}ÈĦA×hË<ã6„§…["ó©cÓöxhkçp›ï”^­Âïc×Ù’¬Iå¢=¤CK†UÄo‡ì„©[633’Ÿ¤¹>ÛO|(l>;`iD>´]G=Ìò¦«¬ô‚A -lùo˜4?išÙ#}óôúäqŸLöudi£ö&}âÒÖ±,m„'Km9ôóÃsì1ÔÉÛ=ÔÚ²lîÙ–äô©ÑS špŒ2iìÕ¦ŽŸ”ªlvÒ(]@¦ª¬µªM~ªVÝRzE/…–StéÏÜÓŽJs¢ã£âWes»5âµlɶÈq8‡Þ;ÕK¶\2 -2Ïk7)õ’¶ÊÖç¦ù¹k´=²nP7Ä÷ÌTõjnUò&þ»eîŒu;R©úWvGtìOˆ@ &¬±å¡Ÿ*z¡üܦ@‘m—\]g{ÿd½KR÷Oø™0Y«‚Îo•Mx‚"]V°¦ê£]åjI‰]ºÎÂöP§9µÚ*Ïï+ß#—M¢vòR1?®Óæ¤7槌¥å¯M}ùÊ”oŸ”¿ÿ²!&¹ -endstream -endobj -502 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 501 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -503 0 obj -<< -/Filter /FlateDecode -/Length 4760 ->> -stream -xœÝ]ÉŽäÈ‘½ÇWÄY@S¾˜o€Ð‡FÂ4Fƒi 0::TEuJ²´æ0¿?Ïô…Nã‘YUlU"+ƒf¾ÝŸ?3s2H}UøùNã¿Hzˆ1O×ÛÏ—_.jNáßXbv0ªÄopW­( N'ÝõgØ0„äLð×× þëÛ⯗?ýæòy}5CJÞhwýçO¬";„‚r‚*A¥´TÎ !ç•×N1%I3\ CKU€”¢“T0ƒŒ‰‚* KAÛ¥*Á 4I*˜¡“ ‚J+Ø¡R¢†("kvƒÇ {Igôàc2IÔèt0’ÎÚÁÒNKº4xï]”t[\RZÒ9Øâ4‘’t°…l ’ÎÃë­u°ÅÄ`%]€-£“]„-@Wu°Ey¥%]²ƒK‘HÔ%èT q©3Ê .Z«$Öƒ6­¨ÃŠÂ$ù è lñÊ%Q[œUFÒYØBø‘tà gCŒÂj5¼º­²ZÒ9ØbL Q[0ù[Tð` ÌK˜J†$0Ñ)J,`b(+Ñ€In Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!¬\Q[l"‰ ¬-( qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ],÷ qëZçÄ´k)z‰ ,x×’Vx×ZÔu°–¸ì8X­ÄÞµZ‰ ¼‹ed$.À¬À¡—¸XLŒJâHâïš ê€5h%. ð®q8ÉsƒwSFâï2^âeÿ(1ï‚BœÀ¬Äð÷Ð+q ‰ xW'¸?aMƒ­“—¸ÀwuÄô‰º4è€Ö-FyÐÞ'‰ xŽÊJ\àÀ» Ï(q8~€G58ð®¶ðÔ’¼«MR8ð.â'qà0hÀ¿ Zº¢. *Å(qï‚–ŒÄðƒŠ`QIK\2âP‰ ‰ ’ò‡É€Æ¡SJ₤#òMC`]r¾%.HV!ßDŠ'¬Ûd=ç›Aâ‚D°Å!Du°ASÖ-8 ù&ØIÒyØbI\¼ç|3J\€0ù&"zqK r¾Äíð®K`&IÞEdê%.ÀòMD¶Rn¯@¼. >“•‘3Î(î(P¯ƒo· ¸Þ*ˆ{ -äË9’¸i3‘YF/îÀ­B©•¸m À¿ˆÇhÁ ÷ݧv‹Ê>3>É„eAˆîKÎQ‹Ù•b÷ý±þõòÛp¾×¿þïåå7ãNYþÑ¿%ωµã%b¦t5ŒÍLÄÚ†ýûž¨Â&„TMÔ ÅiËM„#†³M×òAÏ †½l±F(3žµÝ"OИ(ëEK­òî–jL¼0"·¶_¬DÉƽ»ÖYþw]~Ø1y¹ÐoÀ2F Ž N4öh¥w6Úæþp )ãî9o…ÓFjw[C˵1ùÁ*ï…„–G)› {$Ð r E³Âÿöáršº¿ï{—Cm]¶~”0ÆF]?ü|ùíþð?ÿõÇÑ퇗˟·e"üï¿ÓøL·û_§ïrg§c¿¹~øa£?°¯JœšÌûã.ÔÔ ZU§®Ò$ßnÖØöÅAX6ë^¾ß© ÇÙ¼÷+6íTÇ¢GÖ§P>¢ÿ]jfb³«ÿPÝ#¯D?u鯇Ӽ™íàÝü¸ø~øýüá¿›Åg"ZüÄ­røE8Â÷Ï-á½àû±cË_¸Ì4µSÃÛ ‰7ºNÇEþùûlóŒÒžNK¨d4q(·Iƒë¼…¸¿ òå– Tïó?®°H/B³2}WæÖ•Õ+åûºú©ùœëPWvjƒÏC­0C–Zï±ÝÛÓ؛뚩_«§ãPuoÔú˜Ç£Œ³ÈÇöPz¬ÎIPZÍMm ôa„ýÔèn_ÇÙp¼|·Î†…éÂ霻÷2cC^ 4±`­Y2!!+r1è®Ã-&4”2^’ý‘Ôö˜ð`“`¬0¡ñv c……L÷·cÑט!ýñþy!Ÿ~‹œºr|xF¦:Ÿ–1M9;ý~žþÒô™Ûo½õ׊›~×°\n3÷Û1÷³™@A|ÛNŠw(¶Qw¬ÎIPWÍŽquvŽ¶ÃùÊbãÈ·>±ó' ž1­éüKncLm2Bò ê†]?-g~V§aÕ…æ$ÕÏ<‚3¾ôwïúþ³´bG‡ö‚ôÆ‹ç•6ÚG_×¾²zr;Ÿ»ñ¢™ÌmZAeñò&»_¬s:TnÇ—Ïf×ky |¶(Ó¢€:¤¹NF@áÀµ™ Oðͱ:§›Ù.ä­ñ’ÝhòÚ1·y¦º˜=ÝÌÒ„®cy­½4»fÏÖÿÔd5~Ž´¶ná…¼·²Â=µ¿¸+ÈÍœ²öüœÊcç:´–•ÔÚ(ã´FcÄ<#ߧ¸‡ÓcuΆSÚŽà¾C7s6ÅÛyñä{úHÒ#}T¶êϺ,õˆ¯kwf{‹Íú£f픿¶;¿Ï÷¨O™õ¨‰˜Û/9XçthÚŽ²¶üÙŒ‘z”ôˆÒÍŒ¶¾­Ÿõ—y;c†˜Y,5Yn‹‚—y=ë-ò)†ïvžKú²ž‡ìEkíŠ)+­gÉÏB®u›Û6^°\ñÏÔîÒEê±:§CêÎÎ^Çi=ÚÆM7½]†g›÷i«×ŒfZ¸¤üQØ{Û;B¥¿ ;v®±ŒezT¹¦¯§²ù$¶QßxÇ›·‘x¬Îé¸)~㽎Â#Wžér½¼jº]»Å9ä>oÇ×_wY öÑ«ˆÔÈìŽÊ¨^Aî»ëœ ¹n;v<óުߌªæ\z$/ÜÆ¡4§’/(yWw…f±'sÀû»sRˆƒ¶Ä·m#÷`Ó!wg7Ðvèh3ÍÆK·žv/¸_±íf©÷äýUnŒ.ì²?뛘ØÏí_Ä‹Í.Ĭ­«,›îQßìn<:zœKÖ9"wâÑn_¤Œ^ë½Ö2”†£ÚQŸy¾¿ò+2ò»™æ #µ‰=µ’Š†o¼ßFê±:§Cêv¼zi£‡üÜð`ËkküÒ]™¦ ü|Lwn”¯G-+¨lö$“;vÏâÁ:gC¥ß‰E÷Pôèl¼WÜwÕk÷<þ*P.#Ó›Çùò`Ó!s'Ö|ÏÌåÊÊnÞÑÝ=–çAð -Jk,y8#:Xçt(=v§ãϽ¿‚û;{Ÿ@î#çøÞ×|xVçlh ;1ã3Wàš•óÄ`ïËÑ_/N–Ìãw‚¬s:„>=ýìß¾ú×\+ˆmbB~œÊø…è=Ä«s:ÄîÜÑøÄ·²¾ô7UÊr¾ÖŠëbÖ÷¾¾šøЙA9òŒžmD«s:Dþz¯¯ŸvµlfT+ˆKß[t°ÎÙ}+¦¿–#÷}|þ^ÉÕëGŸÔò.ŒwŠ -ÞvwÅ{G2*csýúèùÁ:§CåÎ>äY9m# ;„ì¼ûY%W®ñcl¯[¼ãí`Ó!q'F< gü‹¯Š'¼x|â¾ÌƒuN‡ÒƒqcAR‹o˜,îoP¶¸«WÚ99ð­™ÅJm~3§Ý.öÝ[»{:õç·£nÁ·_| WPœÏÇÖ9ŠÓÎç7½ƒö×Ë×Ï w é‰ý̃uN‡ÆýÌGùñ w`|þβö*`‡ê±Üí¶ßªÛüžï­ö=ÞŸ:qôì>Ôþ›{¯¥foÒ'̳¦Ý§L¬s:ÄnǪý÷k¥Ùý&ÈkžÇ·ø^fûŒÉ'÷<šP÷€]GâÐÔìEFà±:§Cà·CûïB.±o~ ”Ù¸nëb5>|ý‘5>ä××DMäö®›¬s6Djupƒsëö~ |˜~…/Enký%Fa‹»èú[Œ×Û•/Ð,–’«çðäÍ=?N#ì¿–!:›§Œ¬ìÙF~ÌàòñÎWÝ=Nyþ$B4Éï´ñŠ@“RàGè¯=‡Ðüt÷ƒ÷o1ß¿ã:>CÂßyÊÆ;s´šžBwÿNìøüÂ1b›†rœ>â{üÎåîþ3«EÏ2äèfô%\ÖßËS_ýÔNÌS<õÇ~‡ëó]‡ÓScgí»©ïÆšž«XÎÁåsXLå/?¾B¯R>Úð;¯žËs“®ü -Š¨,éÅϬ{n'B*•ÆÝë›Öà¨Ikì•ß -¤¢÷àâ÷ŸŠÍvÉÃu¶÷O–»$yÿ¤í Ó1µ*hàmÅ„W(Ò¾¢iêuzI\-)ñ”a{¨ÒœZìïÁ÷ÇM¢r8Uä×Þ[z#¿­7(-n_Êò³í“ñçÿÚu› -endstream -endobj -504 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 503 0 R -/Resources 4 0 R -/Annots [ 505 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -505 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb70-1) ->> -endobj -506 0 obj -<< -/Filter /FlateDecode -/Length 4338 ->> -stream -xœí]Kܸ¾÷¯èó«å£ø‚=H‚Ù Éa‘ø½ÞE0àÍ!?%‘,I¥–ºgÆ‘´»UÅ¢ŠäǯŠlµ¤Ï -ßjüIw1¦àé|yúpR]p -ÿú“ƒ^ý#^Áµ¢Ð9|tç÷Y`C’3ÁŸOøovÈ‹?žþñÍéßS}6]JÞhwþíç¬"Û…‚r‚*A¥´TÎu!ç•×š˜’¤‚.¡¥*À JÑI*¸AÆDAᆥ íR•à† š$ÜÐÉA¥üÐF)QG‘5‚N»Î£Ó½¤3ºó1™$êt:Igmçi§%]ê¼÷.J:‚/.)-é|qšHI:øB6Içá‹õV‰:øbb°’.ÀƒÞI‚. +Š:ø¢¼Ò’.ÙÎ¥H$êt*†¸Ôå:­U’NëΛVÔaFa|t¾xå’¨ƒ/Î*#é,|!üI:ð„³!Fa¶š<»­²ZÒ9øbL Q_0ø_Tð`u™—$0!t” I$`¢í(R”XÀÄÔQV¢“\G>‰¬ÒÐ-UðÅ‘—˜ÀjøB˜¹¢¾ØDX_P@âká‹!+qÛÐ"qÝ’JZâ ¾%¥½Ä„ 7•ÄŒk£'‰ ,(PJXp®wJ\`Aº˜îAâ ֵΉ ,h×RôXð®%­$. 𮵰uð–¸ìØY­ÄÞµZ‰ ¼‹id$.À¨vÀ¡—¸XéLŒJâHâ êB‡9h%. ð®qh‚¹Á»Æ)#qw /q€Ò”˜ €wA!NNà VâÄ{茕¸•ui‰Ä¼«Ÿ0§ÁVŽÉK\àÀ»:bøD]êt@ ó½Üiï“ļ‹@e%.pà]Ðg”¸ß!¢‰ xW[DjIÞÕ&)‰ xyƒ“¸pè4‰ ß:­]Q—:•b”¸ÀwAKFâDáNE0‰¨ €¤%.w -y¨Ä¼‹ðž$.ðà]嬕¸Àƒw!íuðÅF#qòè0m…9dµSL!éÀ»Jc„%xW©$.ðàÝ6%.ð! L”¸vÈ‚Ä>R—Bðø¤ CÊ'ê|‡c'qAP8P–¨ƒ/Hâ$Ö]²)J\ |±ÆH\ |AÊ q2‚.idßâò¾.âú€à 2E‰ Àd]LDç±C¯J:oº@×¢.B§ƒÄ!P‡P¬%.ÀZª‹˜ô€à»œ.I\7 Ó$qAHðSEâ„¢.dæ’NÃ$Ù Ó…Nk‰ ¢/È%.ˆ&b•é•ÄˆÐXK¢«%©¼ÎŒDò]N%.À4ÁJL)êà hBâŒO^l;‰ °øÁbËQ_¬#‰ b4y¹%.ˆ¾e$.6óz3H\|AÆ'qAR¾Ëi²Ä qè”’¸ éˆõ¦!‰ 0/óz3J\¬ÂzK¨£Ãh=dî#^b1LÆ_¿?}÷—Wÿë?F¯ß~úRô³R.~ÿ­ÎŸÝø>»ñØi& ³2~x×¹ÌLG H¢±\‘½›Ö“íJ.—çõù™Íìœ _³-6f,Sê¢iÊŽ6jx•º}}»ÌêŠÍ¶Öë§ïåüÕwÍÚ®†þ¯çºdÙ÷ÿ<¿~uúÃë)ûÌtaÞìDÆœyí*n÷™<·/W,s¯Á•ûé0˜<„f*šA°òÅžéJ¹jÇá÷F€·aC¨Ý¨»#©®0mSV[u­AR/¡õÇBe¨w2Öz6US Ùb±™3uÏ óúߌu§¥/u¥–m«sdV¶÷ƒÍ½Õxï`Ä}6‡CåFÖXî2½§Ä´kÈ\ 4»[P°…=Wó†9«ªY0”Ïmˆ¯Ûfk;®ë}ÚXÇXu;Oî´9"íõ ²öò–éÌöTzÝœ»ØʳÅèÛ£e„ÅÕ;ÏÜf³fž†ÂZWœúµàPš¶•föó~*ïµOÊîÀ|¯Húõ8nÙ^âÞÎN›Ãáóz¹‹Yì\ûjNZilíÕ:.òxóñ½K.9k} ¬q6÷/V˜“g‹ ”ÌÖwˆ;m‡Ì/½_ –ygç“È€e̲/±wcvŸÍá0{=ÿ\Ìþ{¾EÙ`Iñ'0Ó•oLžâß­ß¾ø.Á -“RË')¹Îõ_Ël r§ÍÑPI»˜³Ñ®#·v¹Ë×½w™¡oêÇTÚÛ¹r§ÍáPy=óœg”·ì“^üuÇ }Ö=ý¤²¬rïÕl;m‡ÔLô‹à«•¹qÉÇ™‰+e9äÞk5vÚ¡ûž÷ìQÞÃ;_3ƒÝ׸9uûJ~§ÍÑÐé^(ÿüD3ƒgq!Ò;{ûuë;m‡Ôœô“äŸÏ?Ò»{~ôò? z„ÞÿS k¼sóõ_#ýþHo¿š}§ÍáÐy=½{ÝûFú{®¨zéHïÕíkú6GCªßÈI?Iþy¦vàHïííkú6‡CèÎ\”_ 4û½Bá þ{µž¯Ø7ñn¯Qý¶¨îïø&~§Íḑs~Žë÷—˜]#‚ßñó6‡CåÆžç'É5Ï4›vFp~­È‰ ÕW®5™_Vóào9Ãß½ï´9JÃÆõŸóß)ÌV -óëÎLá ’´zýÛ3^Ä}Qoñz·E3Ï0ªíÎ~(å÷#pÊÇËëWÊ~´¡ûl‡Ð÷<§ñH¸à­5$^[/ïà¥O9Çœg9‹këW¢z¸ã»ö6‡Cã¾\óY®rÔOGãÚµök×ÍO®ÎË({¶ZϼMR¾(\kOŒØúÍÜ*WÆ;¸rŸÍáйóWéÔzöË[/ßXדV„+7Úºã÷E;mŽ†È¸‘_ÎF¢öê•ìþ.»r÷[òA~ÕÜÍw_:ü/àWÐzÇžæN›Ã¡uãëŸ*§=åNL³Þd&~Ô´‚ΖGjÂh'œÚBç>›Ã¡sgî¹’½K;4u”Vr±Íß²•1©·tÍmI]¿ö.m©‡èÁÎ’ÏÏKIzmµ‰}[^ýñÏúÛü÷ùy_’åÂÃ/AàSmÇÔ×3²oCYòÌ,mŽò±¬¼ôônxÏvCF0»±®KáäQ7ž+—Ï÷ Ú¹[ l³Î]¤ïêFË»ñ§ÒJ§¦{djôV7r‹û3ú’·ðùÌÊдLlÇ—c-°­¼õÙFͬªš–§|ÞÒ~lºŸ´9„Î'›ŸŒ4¶ÙŽ£ä|>Ç0ZýH½]Öãm¾mx~4Ͳ5¶khsßî‚ïÇû‡ŠœË÷‡NGv»ãJ4›E6xeysär‹ásþ›GkªÌ&³ñŒ¤‹Ð<ëÄÉ•»Ëüœ'RYÜá3šk0tÖÝØ$,¯t³Aþ† Ÿ&N™HùÝz6yÒ 7µkÙyÑ=ó0çe€Ÿ¨}ýn<7ó§LÊÚ†òÓ²´Ê'ßß—^÷Ï&Q>vÚ䇗=u6M:ç{áGeI—¡Ó}gëóŠeÿÈ·µÔø8• “ -0<"ŽŒå?ôƒþ3ž:_æxÿÄ&Õ‹£)MüxÊOì"ALÔˆbCœ…ãGUëBD43ÙÑ3ti^ÒºrGmFNÖ•Æ•Öd{WÌòÔI•B¶¿—øpbAK¯—âÜzÕéQœŸz;;ùêŠóÅg[…Ä˶ -›á¦X[Å„n)TìtMl¨ø£óS2j×ù&¬®ó®ÓløKYØp^^N8­KEi~ÖR©ªô®QUf™S©J])Y„ê8 ¢ËI~«JÕ„Á¬z6jù‰ƒ0 Q-—J9At9‰åÆÚ\©PKÅfšJÏ7WÔm¬/È.,€‡üG6G”-§bŸG ŒµŠ 7f!¼œbh!~<¹ ”v+”+ÐãBËê­â¨^š4ßpgø„©Ydù~ÿùÿ*\•fæé?hªÊÏìhGí$ynVñ´“¸ÜWÖ!©4…V–u—¡b–÷—ŽJ(ŸI·–®=6‘².còŠ{™¤*yLź¢®Š3…•þ©\É…ª8Ó5±«P~œˆ›Ÿ®NU€½œÌkwWëmb_¹ó‘‹CqÀRý­õ2Ìá¥l4gèÇr’&6ªF»v2&lŽš¸Ñèc/.³µ²SÇÎñc›dRĽœ~=õaÎXg>x«óóÄxæ¥ÏÿE™WxýëDçÊ,†8nTe S¹u"æ‘,?}2îç§Qa6LhˆÑ~ëØʺ‚†Ça|MÍ\5b/%ueP]µ\èZ2±©Ð5Ú²žqW„—Y/ÖDæ©cÓöphKãp›}R¼ÂocÓÙ’ϬJå¢-¤CK†â€WŠCvÂÔ<›¸™ÉOR»>ûO|(l>;`iD>´MG-Ìòª‹¬o+‚Øò^1i~Ò4ñGpúîéõäq]öedi¥ö*}äÒÚ°,­„'Km觇5æØs>(“·õP­Ë²¹gk’Ó¦FK-hrÀ1ʤ±™?)Ùä¤%PTº€LY­1ŸühVº¥oq{)Ôœ¢Iå=íø¨ÔNt|Tü¢l®·D¼š-Ùš9çÐZ§ZÉšKFAæ¹u•R+i‹lynšž»DÛ3k5G|ËLU3s‹’wñß=sg°™íDH¥Ê_¿;¢c{ä5é`íŸâ­¢÷àÊb ÙvÉÍ6×÷O–»$eÿ„Ÿ ÃÑ‘µ*èü> -endobj -508 0 obj -<< -/Filter /FlateDecode -/Length 4801 ->> -stream -xœÝ]ËŽ%¹qÝ߯¸k“âû faÀ2<° а†ÕÕS„#/üû>ÁL’‘ÌÈGUW·î¨ Õ73‚ yxÁ¼ÅÔw…Ÿï4þKNO)åÜýù—Û¯75E¯ð¯¤XÝõOøþ®•‹“×9$ÿ…6N1{Ãýó ÿ ·<ùçÛŸ~wûŸu}7SÎÁhÿÛϤrvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS@§IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°Å w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔaFaBt¶峨ƒ-Þ*#é,lqø‘tà ocJÂl54»­²ZÒyØbLt¢¶`ð%0¶¨$ -À šˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq˜¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.¦{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»˜FFâŒê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãÑiå﯌ļkœ (øG‰Þxâew¶€`%.Àz± °ÉÀ-‘¸ÀƒwuÆò'Ìi°Õ¤Sxð®N>Q—'Ñã¼E/O:„,qïb¡²xð.è3I\ŽŸ°¢‰ ê.º\÷×Q;¨­eÈÙÐyÛû´ 6/Ÿá5ÍK·—¶îK}n®OWÈ>ÏýTôžõe`}Ãõ?Ï2]Ë@z÷´†fIËÚ¢ÕaÙM)fGmó25Úší8ëšï34þ¾2€šûAÙuŽãÝlªØæã¦{[WØÝ™†RùTíI?ùÍÜ;Àyé Þþ¨öñÃû.uÛ|óePŸUœVµ>LB¿,&ö§eõçAØ­’Ê´}8T8{s9eÈÓRW^äÇå›"á& -åú—Nr# í¹‡°gÕI~àEbì¤ü´ˆøÚsK«ü…2Ëãlçƒ=è©y¢-×CóÄaõñ‘ ƒ=KÞy1YË.´ßÙ²·DqözŸž° óBÜméI~=p5¢îwë}—ÖÆäàãÔg6‡uTšë¿ëñÓ“RïÁEAtù ‘àǵóT‰².È-,Xüëâ»Ç­ûOÏ,3=*-³}‡­ö•Ôl -ô ´vB„ó|I„õ5øÐ"¬>àCõ4.wò,t/"›{³0®gë¼4.×5ÒJ³~¨s^:×u5FXÒWè‰az`Œ*oœ?â}l“^ʾ>½Í˃­!Öls`  -öK0&àßM9ûõPá!þ±|-Xö -—Ú%çÎð-Ï£áßiu„ÿ†U3|Æ5Nt ©žæë|ùmr7¤£ûâš-y>v1,]~?-Ÿn¹¦ò9G«ó{ÆÃ|tÃüîœ £®ø ‚è›ehT8cÝ‹yuÝlðuv¶Æ®;– D Ì901§xµ#K.eÌÛjÆÀ·#¿Êó3CVÛT¸Š„W¶µþ‹L­ó¼‘½ŒfÇÓR]ç:KÈpÙœ"õZž‡Cj8æG; ‡­Áyó¶ÕA›‘–ÐõNˆ| ¯qÛ8<›1—‘¥å²¾R£~=R¯åy8¤¦cNU¢>öëy”ñe˜W×÷¥;´7¤³U¼Î´bŸû¶öµÙSËù4ô—ëžÉÚ¦Tv_ј0)í©y1Ï£¡Òû—o©öâ'ðÙ& Gå<wFÖ›×óÍÅ<7²'>‹4Û*9ô&ÍóÌ¢Gi…Òl”DPzxE¼Ú^É[óóh9¬‘Æó6^HǾVCíÀ/þi¹•S|XÎÏ¡Ôw~@k›IÜF§Ýsô”D_%?Ãéµ<‡Ócn³vh6f‹¿]ǾÉŸíƘ£ ½²ÝõlˆR¯¬u|gf³ÅæŸcs§}Ú¡}Ÿf¯O›Öc“r×öK.æy84{YGëÙŠ‘F”ŒˆÒlDùÚ6Žú˺œ!VË,Êå(xY—1²Þ&|øa²E /ûqÈ™·viÿò“k=¯m+Ï«öÖg¾Kw©×ò<RÃÉÎÞÀi#Úʦ›>NC£Mû´†~—Q1Aiá‰â{xaÅ÷¶3B¥Ï';ñ%͈*ÏêzS4/#1p¯þ6 •ïs"ñbž‡C≧øwÞëh<2¬Ê+]ÍWgÍ°k·iC­óùòÆç.Ď蟻|?¤wLvawTFõrß°ûw1ÏÃ!÷Øw|ä¼#T1ªX[F$oÌýP·î§ÒZÐâ®á ÍfOæÂêºÏébš´uô]ä^ËópÈ=Ù ´:x¤ÉVi¾ÒžyóÛa”Æ•||ªqàÃïÂnë³ùÄamÿÑóîUYOY<¢žín¼Å ù \z-Ï£!2žø£Ã¾Hë=¾zíE(Œ£x¯¯V¾§ßø™y›ÝLóu‘™ï©Í”U2ô·Q‡H½˜çázì¯^AZY!?1伶Ç/Óiw°¿Ý§{l”ï{-;¨d{’ÙO¾çg¨¼–çáPyâ‹ž¡èµ£ñ^~ßTï}3î7òdÆ7ðåµ<‡Ì_ó=#— (UtóÞˆfèðÏ„à”v_òrDt1Ï£¡4]û¦ãW½¿‚Ô½¹¯iã{??JæõqùÅ<‡Âcß²|“¤~VÚÕæßw K:iÄ…þ4ff»0{û›u„ëÎû¦Þ‡úŽüÚØ^äÕ•ùbž‡CÛ‰Ïø…Að8>Øûrô·ó“w_ÿMð‹y¡ož~‰O^»ÃýŽüó9;vË|B:ñªüìb¯åy4Äæ“o4¾yßà/U^å|«7ø¬ïý|=3ÿЛIy=‡ˆ¼˜çáùÛ}¾þ°³å0¢ÚAœ{ýw‹.æy8Ä]û«˜ñYŽ¸¿ôôöïJî>?ú¨¶ßÂx'¯à˾]ñÞÀ*Ùóë«;äó<*Oö!•Ó¢°KÈ~ÅêþUfÉÀ•»üÈŸ[_üÆÛÅ<†D­NœÄ‡!ðiqmÿi9i2zŒ¨÷tÒoò:±ƒ+6O“œ@±‹°=âð®‡×'' HzÅŒMwÄåH§²î›@çô™å/ïËaoaù›—ål>¾²“H;ŠyISÏ[(™»¹¶œV*g/,‡;•CŸò,/‡-Õ [®Ç³ÿJ}ô¥”Ÿž’°ƒ¨Zù‡¹µ6øÚ†ÍPþz å„a]N™W!MÚÐkhîÁMtn^Ìw:Õ8)ët:]:[ßwr–—÷üÚRÑÿ):⟎w.CËo–ô¿–Aÿ妳›¨ÿ‰)æwo¨"N¦Þtñç½{Å b'ñ¢˜„Ë¥je9]6Ù37NyL‰ B-—¹NGÌ—Æ×ÖP~_³Ñ™¸NÕD¶œ -;W,‘3è­˜Z¯&½ˆéý5i²Ë]h¦ÐaLMØ t S’kérM'ˆžobº¥4ßF*¶T©g͵ç»)ê6µŽd¥i¤r±9¢l½\‹é,Ö6ÖtPÝ2}êváó KŒÛˆ?ß|RûÎÊWèq¡eå6qR/]JÏÒæ+LÍ*£“›éÿ™*|“ó” í¤èôõ~×+¡¹ÙÄëNâòÐXÇI= ]ìiYwéfy餄ôDº-u뱕”u“Ç\Í#’jä±놺&& -«ýÓ¸’ U5Õu±oPþ¼w;}›ª^µÊ‚fp÷­Ü.;?sql#®é(ýfo+—a¾ -ŸËÂæF1A?ÕJºØ¨¶Úõʘ°RèâN£Ÿ‹¸ÎÖÆNôz°zÙ'™´â>ßþr+Ë -C'.«éÍ0ÜóÒ÷ÿCšñû×›»ÿ±E>¯ãF5¶0[Wb¾’Ñ{ÄÒE1½W¬ -Û´aBãíw±N=­¯hhë¸1Œ¯]Ï®:±×”º1¨nZ.ô½™Ø4èmYÏøáóЋ͑ùÒ±é ö|kkãèìH:ľZ…Þܦ®³}I¾³"qGIû’­3,#nx¡¸eænÙÊL$¯¤u=ÙïøPXª‹Ý07‚nm×¹¾Ìò¢«¬´‚% lù /Øi^i^Ù#ýæéõÅ㾘ê i£ö&ýÌ¥­a$m„'Km¹ ëÛ¶æØrÐb¼½‡ZY–Í=Ûœœ>5ºkáV7£Lšz¶%畺*[UZŠF©*k%ÆjSX²Õn)-Nb/ÅæSté_xO{>*­=•°IKåÖ¯yK¶9@žÃ9öÖ©ž²ù’Iž»I]Oi«l[·[×]WÛ;k†ë†„žÍoR¾‰ÿÞ2wÄ÷H©êOÙÑ©¿¼ µÓÑ[ÞǪRàG¯ÔŠ.±í’Wç9Þ?Ùî’Ôý^†crÖª¨éͺ² Ÿ¡Èç -VT}뮜-+±I¯ëa{¨ÓÜömåÕŠe?³lµÛH¡"½IÕ’Ó›èpQÉo—(_"K«í“òóÿ“ôvÑ -endstream -endobj -509 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 508 0 R -/Resources 4 0 R -/Annots [ 510 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -510 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 668.673057 101.433071 649.923057 ] -/BS << -/W 0 ->> -/Dest (cb73-1) ->> -endobj -511 0 obj -<< -/Filter /FlateDecode -/Length 4388 ->> -stream -xœí]K·¾Ï¯˜³Ó|_@àC€$ˆ $‡ ‡ÕZ²¬Ø9äïçcOóÑìêiÎìJjIÖb4ÓU,v5ùñ«"»g¨Î_+üH‰¢wt~üùôËI -o%þM%“ú^Þž•$/¬Š.ØóÏI`¼ðÑjïÎO'ü׶şNÿøêôŸ¥:k£ÓÊž}›Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ü°ž4­UnP –SÁ Ò:0ª7 yeÖª7´WÄ©à†ŠÖ3*%á‡ÒR²:8"‰ŒftÊ -‡FwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¾XE$9|!<§sðÅ8#Y|ÑÁNçá‹FëDFà ÐX|‘N*N°1±º >¬uZZaƒ1’Ó)%,°iXF:ÉyF§á‹“6²:øbÔœÎÀ§OXãC`F«N£ÛH£8…/Z{buðÏ1€vðEzÇQFH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHøbÉqL`|!Œ\V_L$Ž Œ†/(Àq1ðE“á¸À€m há¸À€nIFÅqß’TŽãÂ…›’ãÆ5ÁÇ” (EŽ 8×€;9.0 ] wÏqëë4Ç´k(8Ž x×’x×X²:øs\vFÃqw’žãïbiŽ Ы8t+B‡ 9. ð®’8. ð®ö¬Î ŒAÃqwµÅ%p‘¼«­ÔxW“v(ü#Ùl¼ -±|:_@° ÞC§ ǨLh¤%Xð®Š̘[ ¢ã¸À‚wU@÷±º(”G‹3ã­,”s‘ã ÞE 2Xð.è3p\Žˆ¨šã ÞU‘šÓw•Ž’ã ÞEÞ`9.„BÀqâ›PÐeuQÈǼ ZÒ - À$¬Î Iq\2y(Ǽ‹ð9.pà]iá¸Àw%!íauðÅÍqòè0l™1dUH ¦àtà]©ÐÃœ¼+¥8ðn -›8Ÿ:p\²`Íq $¢÷Žã%tHùX8¶x e±:øBž8.@b-¢‰ã¯á‹Ñšã¯á RŽ ˆ¨}³Óø¸°ó‚/È9.“‰‰8.ðÖa>†VåtN‹àA׬.@§<ÇÞ“@(V`.%=Ç x‘Ò%Ž àtŠ8.ð¾`¨p\€P$‚FfÎé|A’Íq2]è”⸠hø‚lã‚ f™Nr\€¹$ššÓ‘LóÌÀqA 'RªÈq† fš`JV_@ ÒdÛr\€É&›˜æ°:øb,q\‚NÓÍÀqAðEKÍq°™æ›žã‚(á 2>Ž ¢t"¥É€Æ¡“’エ曚8.À¸LóÍÀqA4óMLñ˜qKóMÏqA$øb‘¢°:ø‚¤)2㜄ù&؉Ó9ø¢#q\KóÍÀqÒ Ì7‘ѳK!Í7=»\ÞµÌÄéÀ»ÈLÇ8À|™-7·— ^ë‘ŸñÊfœ]1 ^‹ØÊ.Hp/¢•g× $È7Í‘ØE¸‰™epìªÂ*”J²Ëü‹|ŒVœpY}j—¨àà3ƒO1,Ù}™sÔbf£Øe}ì×Oß< øžüïéÝWÓJYþSH¦Ò„ü -Ã@Gt·Eö­pùÆ¡£•˜„4yï±INøXT ÅyÑ-9‰ð—þמÃñWÓéM9}D¿œ><°Jê«€éë´6Øx|£É :,19B´u(c¢NìÈ!¯”´(üû×'uöâ²Z÷/1&mϯ>}ó—ïþþ×ï_F¯ßþù;)­ýök…w -—w {:™›ßý,SuDó»ïlæz®ZæÝòÝêùý¡©ÏW;«ª­•¼OZ6þ=2¾†¥½ú¡©3¬¯k:¯Y^CñóÍåÒT§òï½ ¿ý×ùõw§?¼^sÊV'`RJnKmw°›æ]ÏåâûåH#oçÈA›£!Ó\Ï;'î˹3—Ü›Í ÷¾›{¸}ey⣇yVô°Ýóe–ÑùRxþ¡Cy¯ÏèhGU“/ëvÍÒw6ùz¹ÙÚ/n¡ÏÜ~÷eÐæpèÛÉ!·Æt›™qÑtŒëú,dkö¸‰B{ûÜ{Ðæp(Ë3×õ«!C=z˽—M¾ë{Í9iYï‚ë>Ùwí¾‹§~†ÞÌÌ{,ô±wnòݘ–©˜lqëîÈÄ }ýùQŸ¸ö¥Ì£˜»@eŒte'?š±·¯ÉÜΈƒ6‡CåNÖ˜îqÙ{ωi×¹B€¯v· `™=7ó†žUe×íýÈþ^@;oëæv­nòigCw<9hs8DîÜ…nî,¯îH7™ÑŠ»Ú{‚$³ãUï›ÁÞ¿ÒÃìì½ÍܺQÓçºAa©«»G¸âÐþŽwÿ¬H¿öäº6É«ýZ‘ºè¯Äñf-qt†3hs8|^Ï!W}±ñ8mwŽ›iì­•:ùþ^<~{+–8\¶¬õ!°Öú³»~Á3§m³Å„Šzï.â ÍÑiwî{¿‡X~ä•O"æ1ÛÜÅÆì˜Íá0{=ÿ\þ{î¢ì°${ÇÄ2ÌtåŽÉsü»õè{_%ØbÒæ©Æh…nËì¡rÌæp¨ÜYż÷» ¿­½/ú¦vÜ@e¸ƒ+Çl‡ÊÁoØÜñ…Ï‹¿î¡/º¦Ï#ÕÝñí›A›£!Õíd¢__mŒÈçL>ÌHÜ@h“CŽ>«1hs8„î¬{Þ³Fyïü– ?ãæìí3ùA›Ã¡ó=域hfð¢#îCDúpû“ëƒ6‡CêNNúIòÏçéýß´9BýýߺÆ;7?ßñ[¤ŽôÞÜþ4û ÍáÐy=½{ÞûFú{ž¨zß‘ÞÛÛçôƒ6‡CêNNúIòÏ °#Gúpûœ~ÐæpÌEÛgºï+džh¿¯6ñUs'ÞÎ=ð[T¿-ª‡;îÄÚ ‰a'çüçïïct}€îø–ù ÍáP¹³æùIrÍ ¦ÁÞ>+²@âCƒê+Ïš¬~T1–»œáŽ{ïƒ6‡Céد­¾Y¾ñ+:sñÚ|þíŸj}‘?àõn|FÓgÅv°rùq.ùxýÜáB›o #tÌæp½qͳá´6®xk ‰×æ˼ô)ç˜}–³z¶~#ªÇ;îµÚ q,×|‘§ÕóѸõ¬ýÕßðÊOç%Íß=Û¬§¿&._džµ¿'Fì}gn‹+£¹+m‡ÎÁo¥é¿òûÁÖy7yÇ÷‹m‡Èü²ë‰ý_i¼“îüúÆ-ù`ûÔÜÍ¿¾tøoÀ´¾šw7ðkmÚ]&XšÍ -Dw‹ì r½µBÞ àœþzȹk-Ò¶¦&œ’)ú´H‚ØwüóŸþÖ@,ýȨ~{ùIßK(Ãg‡šÒ¸Ëqjª 2i)$Îe¦'ÍÄu!-;ujÎK·ÈùÇ^Ò{ª+•§w—îIrʺËkªkþ<Õ2DæóM“ÚÔ-)áºèõÛùÜ?S¶¹†ü }\uå/'7íj£¦Í¤ Bé´õéÙ‘0©oâ9í¤¤!•»NM­Î–Ó†±¿”Ró²2m+—¶ºl0ÛÌå™:ýç“Š$Rû'¸ì÷('qÐù ŠŸNi¿ObÄDBŠ“pþ(K]¤rÁ"{ïzû’Æ -9Œ¥rcóGmóÕ${›ÍÒ>,$s!3íDr91#„¥Skqºz)Ô,N{¦aæ#W\±.û a­Ú²µÂj¸+VF6B»ÊætU¬)û£Ò[¥é\×Û¦SM÷ç²Ú7ÝyMøxÂiM/}b¥i§Æ\Un]-‹Ì4NÅ"µ¹dé*ýĈOŒðk™«&tfÑ7½–ö»ºC•r1—cD'¶Ü\›-=åK©PMcnùêJ…º ¥áÙÔF³Ô§M ›1"Mþ¸»Ô¹¯ehp£WÂÇB ­ÄO'ë™Ò¶r…´z­Ð4õq/Uš~^àò C3ËÒnAéÿ UØ"MÌ3}PT •vüªGõ$ilñ²‘Z¹+¬C\ (òµlÓ\Êû‚Ù¶½ 1åé–Ò¥ÅҦɹٽDR…<–bUPWĉÂrû®l…2;ÓU±-P~Zˆ«Ÿ¶ U€=ŸÌ©î¶Ô[Å®pçS+ö¥ÇUÚ¾­ø[êm0Ÿ…S`£^œ òIªXËíêÉau ¤PÅ•FŸ&q­…¦ßòž?ÖAÆEÜÇÓO§)ÌicuÄgTڴͼÔù(ó^ÿ>Ñùû¼ýÕ%ŽkYØBn]ˆÛH–ö®ƒâ´—u–aÓ55´_Å*Ô²6£¡Äq­¾¦j.+±ç’ª0¨*ÚVhk6b] «•iZÆ^>v­X™çöM Ø—C“/§1iã´ìÚËÁa¨:SCò¹©G©h éÐ’n qÐVŠÃ愱z¶p3²=Iiúä?µ]aÒ¹šƒ&H‡¦ê¨†Ù¶ê,›®¢)‚Ø´mŤړƅ?ŒÓw¯g÷ûì²Ë# I µéS+-–¤…ðx©™Ýò°ÄsNyðÖ*u™fì™’äÔ¡QS Z´m¤¡šÍl{RʲÅIs (t™Ì²R£Ï>¹Ù,7ËtÅm%_rŠ*ý©miÛöJiDÛöŠ[•MõæˆW²%S ÛÂÙ׫“µdÉ%#s­u‘R-i²l}nZž;GÛssTq53•ÕÌ®JÞÅ÷Œ‹M·Á•ÊÓêˆ -uÃHjRÞhsŽ)Ý ÎC(mãì)4Ë%7Û\_?Y¯’äõ“öLèAÆH¯€· ž ˆûŠ¦ª§y¯MÞ,Jö’nkfy¨Òœ\­aæeÍi‘¨ú4U´qÚtY†6÷R±ËEÓïö.—O¦¿ÿÌñvf -endstream -endobj -512 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 511 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -513 0 obj -<< -/Filter /FlateDecode -/Length 4851 ->> -stream -xœÕ]Ë®$7rÝ×WÔzåðý-<†4<‹ÝÕÝ30® h¼ðïû“HfTVÞÛWrWUÁG<<Œ`f²ôUáßwÿKN/)åÜõöóå—‹Z¢Wø¯¤Ø\õOø‹þª•‹‹×9$ý™6.1{Ãõå‚ÿM—<ùËåÏ¿»ü÷6¾š%ç`´¿þý ©œ]bŠQyA•¡RÚ -*ï—‚*èMÌYRÁ q{U„.'/©`†3& ª3¬‹ÚîUf˜¨¤‚:û(¨´‚Ú(%ê`ˆrÎA§ýÐéAÒ½„”Mu:¤³v Ñi¯%]^B>I:[|VZÒyØâµsJÒÁgS”t¶Ø`•¨ƒ-&E+é"l1è,èlº’¨ƒ-*(-é²]|NΉº J1íuFùÅ'k•¤ÓzñÀ¦u˜Q¤-Aù,ê`‹·ÊH: [þI:ð„·1%a¶šÝVY-éá/UyMG{Ë=Ï—¡×¾êZÞ)ŸÏwÊŠ5ýת LwTÖ­ê¦4Zoíò7 -cªN­>mëêyÕëT£ÿº®~zS?[yz´Y«þóúáÇË?lWâ¤8^!¢÷êFÏeùŒþÐÌùš½ ý¶»]œ†ˆui¢6¬ŒiûÐ&V^¾PSSÀ÷Š5¥_²UMÉ€S£M*mùñŸþåŸÿµÁH¦ö¦ú#A6õvlmíñdÛš+&¦ekãz½“×´ î%]+‹¥ëФò1MüçQf¹6[»ÊôPCî⨫ä£r>²ºÔªïíª¶–²k‹íz²'®ÓâT·ÞíÙLêmï´ÒK;BdYO2«š¾¤iV}ùÕ§5 ïÕžN±^Lk/©[mQ¨M ¼ ­à¼YºßUÛ`ëˆc™DÕ”£?ïË –‚Aºá°/§´½N(í;²Nò;Ôh Þ%ë l£OA9xJBÙ+òG™[$dQ?[ú¼U}¨6ù¶¨¬ß[[ÉGÚÒ~ª'TÛsý r; -B[š¯l6™Z_E:]=¥k‹Ÿ¯z]Ëÿ4ìÓæ°ïýÜ?¥¬/kþ¶¸RÙ4ÃÖYU1a¶ín³´ÛÑÚÜð×ÏRÞ—Š¯:Î-ú,•ûšØË7¨µ”Ýöá<ŽÝ¦0æF7=ì õSœû©·3Nø¸ƒ§-+½oã'2aÅxgÀ-ûy΀­O’Ðθæ-ß+–ÊÜNc|z?2»yþ"+m>ì§<÷Óà<Îw3×­z]ÇÐÖv÷v6>ªØVunùO£Ý¥/ؼ¡´¥ÜÊcmœ[Õ.¸\²çÛÆ¬ÞÍ¿iœË°AhüÚgæK-íÿìúßO|×8svmRK°%H¢›€&ióÐ<™çM¡ê;ú~¾Û›Ý’%:…žšãwŽÞJwÌQZán…9À¦õñ‡óHõ:!µ£0V×À×¥#uçr (uKÎ>E=Ux„RO7‰VÄyNn*žËól(õtÏù>J;¯›ésBšnAÍÇõûN^ÿºÜMéèº8P5ϧ¡3†¥³õïsýtõ;•Ï™ô·Z×¾çNì´ý4ma=Ú%ô!vѺhÝŒ;FݹðáZOÞØ*9õ&ͺ ´¹á;žf£TAyèÅÇ}Gã­ù?±¨&l‘Æóv^˜bè™{Žâc¹S|XÎÏ ¡o|7eœoÌѳ}‰^Éy„Ósyž §ñ؃ۭ|?¥úÛmìwÏ~„yí™=A—÷™½²»ëÙ¥žYëøÃóó-|þ96wú§Ú÷yõúÚ-ÏM‘yLgÂ:™çéÐtìe­gFšQ2#J«Ýn GŸÖHîowË,Êå(øº-cf½]< ùð­¬ ÑĨ÷âGÞŸ1ãQÁóšc­ÛÖ6~sp‡T¾Kw©çò<RììMœ6£­lº½uziá¾ß{xaÅ÷¶+B¥Ï÷¢`nËŒ*ÏêzS4‰Üë£w¬Ry/æ‰çò<xŠÏüÄểmÖL»v»6´:oç7Ÿ»ƒØ]âÓ§{^>»;*£úrß°ûw2ϳ!7ûŽÏ¼ƒw„êoFkˌ䂹ê¶ý4£QZ zÜ5Ý¡ÙíÉœXýÓð9]L‹¶ŽžØxð ö¹ñîÑê©<¶ ±)ëà.Ë!‚gԳݷø£É½žKOæy:D>ðG§}‘Þ{|õº¡0Žâ½¾Yù>þƒß‘yðòÄæç¯Tæ{j³d• ½czŒÔsyž©Çþꤕò3ãAÎk÷øeº3íVà·ûtÏòû^ËT²=Éì_‚óG¨<—çÙP™ø¢PôÚÑx/¿ï ªïDEÿ(—‘™õëùòdž§Cæ_ó=#—(UtóÞˆžÞT}ßAéð%OGD'ó<JÏ=éø«ÇÞ¿‚¼}¹¯iã{ß?ÊáõqùÉJ÷U–=aÕ_Ÿn¯–÷?ê«Áå5Ô¼ÊM}õ´¿6\¿Ã T•Ø”à ÔúJ5{ý·—ðúwoƒomØ å/—PN‹ÓåÄP°J:RüÜbilò•N¨KÊ:݆N—ÎÖ×;9ËAì¿ôTõlvEǵÒQ}ëÁí좦ÿ¥ úÏÝBý_Î\(ç(«"N¦] ñË…ÎÑv‚عqpÃ1 ëWÕËrºŸÑd7m\òœÒúEÕ¯ã°zyeýj|k å÷-oæTKdË _kÅ‚9ƒÞ‹©õjÑULg‘§ÅÖ«ÐM¡×6»pèxÚQàÈøP¬­bB¿*VÝ×ìÑtveïº0„ÝtÞuš Kk"Î#áí‚jí,}¥tr+ªõ®Q]f™Q¹K}KÙÄõqD·‹ üNµ¢³ëÙ¨Ñ9’«05 ¹ž.·t‚èvÓÕÒ|©ØS¥‘5·ž¦ ¨Ó÷e7v J¤W`sDÙöu+¦3<úX«ÄpcvÂÛKŒÛ‰_.> -©ýà -åô¸Ð²r»8©—!%~ý†©Ùdt -ý¥ -ߥÄ<å‹vRt’渕ÐÜìâm'qyè¬ã¤Ð.Ž´¬»tŒ³¼¿tRBz"Ýžº÷ØFʺŒÉcnæIuòØŠuG]…µþé\É…ªê†Øw(¿lÄÃNߧªW½² Ü}/wˆCçÎ.Ž}Äé( Öˆ±†ù&¼•…ÍÍb‚~j• 1«ÓàÓ+cÂaHaˆ¾q›­è§Ú×1ɤ÷vùÛ¥,sÆzCg3«é”oîyéëÿ"Íøû¯‹»þ©+¹®ãFu¶0[7b¾’ÑoB¤“búˆ&ìÓ† c´?Ä:´¾¡¡¯ãÆ0¾v#»ÄÞRêΠºk¹Ð>dbÓ¡k´e=ã„·©»#ó­c3ìõÒ¶ÆÑ)t i³ -¼9¸LCgÇ’|eE⊒Ž%ZgXF\ðBqÉ*Ìò™H^Iïz²ßñ¡°T»`n]Ú¡sc™åE7YiKØò ^°Ó¼Ò¼±G0úÍÓë›Ç½šÚ i§ö.}áÒÞ0’v“¥¶\†íe_sl9’¡MÞÑC½,ËæžíNΘõp› ŽQ&M#[Mày¥®É6•¶…¢ÓdªÉz‰±Ùj¶Ö-¥ÅIì¥Ø}Š!ýïiÏG¥w¢ç£vi©Ü¶âuoÉvÈs8ÇÑ:5Rv_2 ²Àsw©)m“íëvÛºÛj{eÍpÃ0> -endobj -515 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 558.873057 101.433071 540.123057 ] -/BS << -/W 0 ->> -/Dest (cb76-1) ->> -endobj -516 0 obj -<< -/Filter /FlateDecode -/Length 4351 ->> -stream -xœí]Mܸ½÷¯èóË%YÅ/ ØC€$ˆ‘ ²€‘‚Ƴö.‚qoùûyT‹E•Zê¶Ç–íõ`<­*U"_)©iÎ?ßüÙ¨Sð|~|{zwÒ*8C‰ÙÁ þ¿Áæ œI>ºóÛ,  Br6øóÓ ÿu‡mñ§Ó?¾9ýgncÎV¥ä­qç__g“ -1íU‚JTΩ¬ó‚Ê…KLIRÁ ØòRà§è$Ü`k£ Špƒ8ZªÜ°Á°¤‚&¹ ¨Œ†Æj-êàˆf&+èŒSî%5ÊÇd“¨ Й`%‘ò3’.)ｋ’Žá‹KÚH:_œaÖ’¾0Å é<|!OZÔÁIº_,Z' º_€®(êà‹öÚHºDÊ¥È,êt:†¸ÔY픋DZÒ£°I¢# -䃠³ðÅk—D|q¤­¤#øÂø‘tà G!Fa´Ú<ºI“‘t¾XXÔÁt¾ÄÖüDA*ó’Ä6ÅɲD6’âÈQb“âH¢›œbŸ‚Ĥ tÖHD@¾8ö/Œ‘+êà %–¸€,|A‰ ˆà‹e’¸€À¶ ´H\@ [ÖÉH\@à[ÖÆK\@ \¸©%. 0.EÏ(PJ8—ÀHÃ=H\@`]rÞJ\@ ]âè%. ð.±Ñ0x—–¢¾À€™H0x—Œ0xÃÈJ\€^UÀ¡—¸XQ6F-qƒwmÔ,qƒwm@uAa ’Ä Þµ— Enð®uÚJ\Àà]ËÖK\ (ð³ð.(ÄÉé|ÁJ\€x%‰ P™²HK$.pà]“þ„1 ¶R&&/qîuI™€Æ-ZYï“ļ‹@E8ð.è3J\ŽWˆ¨VâÞ5„H-éÀ»Æ&-qï"opÊ ¸ñM 芺¤tŠQâÞ-Y‰ …•Ž`Q€d$.+Æ N¸¬>µKTpˆ™1ä‹LŒì¾Î9¦b´Rì²>öëϧï|Ï?ÿ÷ôæ›a¥¬ü$CiF~…a`ºÛ!û6¸|òèh£!ÂÁ{l²!MNÐâ¸è–DøËÿÎË3ÏáøÃé©ž>!Š_NŸyd|DL_‡µÁÆãM> Ã“#D[2”lf'@y¥æYáß¿<¨£—5Ðzظx‰É0[w~ùöôÝ_^üý¯?ü½|súçï´æ×Z»øý·&vãßrüf~ìÂå/£Ùwe»²f¥|Ñ»yÕ>5Ÿ‹ weÇ:0?Öy%Ñ¥¦ÌXo–/|kt¥\µ3Íù^-ýœÙ¼žôƺµëK+u…yû{c¿ÿ×ùå‹Ó^ÎA8d¦9'2H9¬ÛÀí>“÷ÁísÀÓÜkp½vWà=èK÷Ó¼¾›º³NkMÓ¹¶üù Ã­¨{|Ÿ¡"Ã1¯Ôp!IÔzå‘Tý{|s{óÓû£nÁ·ÏÞ†+(¦Ûgã;m‡âë¹èÝ97²¯¯ïAî*ïXÓÜis84n,fÞÊ=oÉõ>Ù«©ŽÕC¹ê­(ø¶ÖÑŒÈ|î< -iährKn¯<Ýs±ÍÒ¤OègÃÚo!vŸÍá{=Wµq»w? ò„(\Ê5þ܃¼ûÑÛ~íÉC©Y‹Ü‹À6GC }ú<Ôuõ,q%ßü(£¸îëb4våjüèì¶8‘¦ü0?6 ³£-Dî³9"w®oÚ®gÃÔ³&?}Æ_¿Ý+³\­¿½(¬pWï|YËk»•pס ÷ÃŽ¨®¼_þÒÜ>Ïšr¾¸¶þHMg¬J:Z½‰š}6‡CÍý7²g<ÓÏ=;nrÀN×®˜×s¼™×“íj¯§ 9mNYmÖxUºWÒÍÙûœµè?ùعNIÍšãÞÙÊN›Ã!ö·uÊÙÈÚªk •›k÷¢]F(7ë{ï4î´9Bùznx/ÔÞ(-ÿ0¢°»)óÆ×82VH·ßÓÙis8$n䄇â÷ˆèm®Øø""ó¡C=ÍÐåºJÞ;|¦æ¯Ë¥gæHwGî³927î{›&7æ’[³™Ý½ïÇn‹<óÑÃ8+zXïù:Ëè|©<ÿС¼×t´£ªÉ—m»f:›r½Òlm×ÐwÇÓ;m‡¾ÏCöcúÏÐ+Ïì³õ'ßd:}ûÜ{§ÍÑPèöå‰ë)Úu¾ÐË{Í9W$ÿ¼óÐt6÷›CT†8ø­î6‡Cç{䎟”W>àÈYÉs÷JºUï:²âøë.¿3yrÊÅeì¹ÛŸòÙis8ì]χv ã:nnËWSZÛ´gÉè~ê>wí¾‰§~†ÞÌÌÏ wO‰wnÊݘ–©„lqíîÈÀ }ýåiŸ´ô¥Î£„»@uŒte?š±·¯ãŒ¸Ïæp¨ÜÈ»—®Ú»÷Æ´»Þl±·¡`/ -{®æ =«ê®=Úû‘ý½€vÞÖÍíZÝàÓÆ<Æßñ4äN›£!ÒoÜ…nî,/îH7™Ñ‚»Ú{‚¬g³ãµ§³7{ÿJ‹³÷6sëFôþÅ‚»{„ íïx÷ÏŠôkO¾k“²:Я™‹~=Žûf-qï g§Íáðy=‡\ôÅʵ[¯¬–§k¯­Õ:åþž={+–$\ -Ï…?+ÖZ6×/V˜³Í38Ù­»ˆ;m‡ÌûÞÏ˼²óYdÀ2fÛ·möbvŸÍá0{=ÿ\Œþ{î¢l°¤xÇÄ ÌtåŽÉûøwë=Ðg_%XaÒ oƒq§ÍÑP6V1¿è÷W?"CßÔŽ+¨¤Û¹r§ÍáP¹ó ›;ÞQø²øëŽúA×ôWzÇÛ7;m‡ÔLô«à«•¹ñœÉlj+·sÆN›Ã!tcÝó _võuf+_l¥oŸÉï´9:ã3域ifðœßwõ‘>ÒíO®ï´9R7rÒÏ’¾üHïxh§Íáú<_kyóó¿Eúý‘þŽo(Úis8t^ÏCïž÷~‘þž'ªž;Ò'}ûœ~§ÍÑš6rÒÏ’>Ð;p¤Ow|æN›Ã!tg.Ú> Ô½¯Px¢}_mà«æN¼{à·¨~[TOw܉ßis8$näœ_âüý9F×Ljàw¼e¾Óæp¨ÜXóü,¹æ¦¼}Vd†Ä‡ÕWž5Y|¯b-Ë»œ?Ž{i‡u.ïe‰ÍÖš›E6¸ÜÈ£l‡qÎ?=Ôüˆ1DAåMt)ž‘r -yß™ ­üóŸþÖ@+­Ž}}ù«ËKøìñ‹¦&9Î]?<^‘Ë _ÇSàvZ6ÏØvîÒmz|½1ÿÍuåòüæÒ=YnsYùê?õÄñ|C7ænÍ]rÑÏêw㹆:\s åÑ‘´èÊw'?ì¡d†}ô´ÊؼÑîÙ³¢Ü7éœ÷mŠšØ”®3Cc›óŠå°=ñ»ZjܱXçM óV—팛ƒ±ü»¡ÓßžLb•Û?ÅewQ=ˆ£-“øé”w—eAÌÈwŠ³pü¨k]lJÁ*{ß•ú’ä”?¦Z9¹òѺr5ÙÞ³¼ëëRˆ†}o.'„°ôf)ÎW¯•Åy‡Þ¨h<òÕç‹ÏNr[vªp2ÜÒÐ-…º9Ý$¶\ü1yG·Út~V×Û¦3M÷—²64ÝyMøxÂi©—>‰Ò¼/h©ª´®ÕUFS©J])Y;„k? ¢Ç“ üV—ªYõM¯åÝÕ.ÂX€Äµ\*åÑãI,7ÖæjO…Z*N¦©´üäÊuŠµáÙÐF£4ä-Ç›1¢©|œ‹}îÒ×:6¸± áã !†⧓ Bi7q…vz­šz«8ê /“4¿Psù„¡Ydyoªüÿ…*\•fæ>®ÊûËMGÓIòجây#µr_Y‡¥0¦²Ms™*fÛö2Q å3éÖÒµÅfÒ¦ÉyHŽLR•<æbSQWÅ™ÂJûT®l…º8ÓMbW¡ü4O~º:Tör2o¸»Zï$ö•;ŸZq¨=nòfÕßZoƒù"|÷â ýXN2‰­®Ñn:Y#œ)Lâ‰FŸq­•†oŸ?NƒLŠ¸§_NC˜³älÂO&ï}Ûf^æü?”yߟøüCÙlíÇ­®la+·ÎÄm$Ë;¥Çâ¼szÖaÓ-7´?‰MœÊº‚†Ç­møš's={)i*ƒšªm…njÃFl+t­¡¦eÜác׊5‘yß¾™öåÊÅá4”·é+^á ½ÆIGSH>7Uâ(B:´lC´•â°9aš<›¹™Ùž¤6}öŸÛ® |®æ I#ò!M:žÂl[u‘ WÑA -LíA[1›ö¤iæàôÝÃë½û}tÙ—¥•Ú«ô©•Ö ËÒJx²”†C??¬1‡Îù  Þ©…j]ÔŒ=ªIÎ44¦Ô‚g-FiœÌÆ®=)Ùì¤%PTº€LY­1ŸühVše¸â(¶R¨9Å$ý¥mi×öJmD×öŠ_”Íõ–ˆW³%ª kᦫÓSÉšKFAæ[ë*å©$ÙòÜ> -endobj -518 0 obj -<< -/Filter /FlateDecode -/Length 4836 ->> -stream -xœå]K$9¾×¯¨3Ò&~?¤Õ±ÄJ#8 35Ó Ô‹´pàïó…3mG:#³²{zFµbZ=UáGØþüEØéÌÖW…Ÿo4þKNO)åÜõöã始š¢WøWR¬.ŠúüFÕÊÅÉë’¿þH§˜½‰áú|ÁÃ%Oþ|ùË/.ÿZçÑW3åŒö×"•³SL1*/¨2TJ[Aåý£ñAP=¡‰9K*˜á£3n«Š0Ãåä%ÌpÆ$A•`†uQÛ­*à µ“T0Cg•V°C¥D QÎY#è´Ÿ:=H:£§²É¢.B§£‘tÖN!:íµ¤ËSÁ'Iç`‹ÏJK:[¼vNI:ØâlŠ’.À¬u°Å¤h%]„-½“]‚-@Wu°E¥%]¶“ÏÉ9Q—¡S)¦­Î(?ùd­’tZOØ´¢3 -ƒ¢ 3°%(ŸElñVIga‹Ã¤OxSf«¡Ùm•Õ’ÎÃc¢u°ƒ/1€ °EÅ QfÐD¼$q€‰qrÙ8‰L²“K.I,`Rž\ŒV¢“ýäBŽX¥¡3Z"«`‹wAb«a‹ÃÌu°Åf'q5° $.°¶g%.°`[´H\`A·Ne-qß:¥ƒÄ„ 3•ÄŒkSpXP. ”%.°à\ À‚t1ݣĬk}0XЮu)H\`Á»Öi%qïZ‹œ¢¶À€'«“•¸Àw­VQâÞÅ42`T'à0H\¬L&%%qœÄ¼k"\€¨‹æ •¸ÀwG$Ï Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\± °É ,‘¸Àƒwu†ûæ4ØjÒ)‰ ƒ™$x‘i¸Xo"²•Öö -Äë#â3Y™hÅ™Äêõð­â–÷Â[EqÏ@|i$nÀL¬,Sw àV¡ÔJÜ6Pà_Äcnà óîߢ -€C„ÏL‘™1-¢û¶æèÉìN²yìß¿üò=œïõïÿ¹<ý¢ì”Õ¡¤vˆ¯0 LÆp{DßÍ·@vŒÅ4Xö¢ÄTmÌÝ, "\¶ÙÈ,8<úwÝ~YÙ -SÉXäÆJ(ÐêßÁ)¨¥bpO)ÝaŒ!/Ùm}qž»&GÄùÚ¾hÙÖÞG¼ÞÞI’­/Îóæ¶zZ{s]ïÎà'~ÛÁïõÒtØÖ‹IˆÞÁ=›é¶­³2  ¨Ã¢ÜîˆlÓ-¹~fò ³¼¡Á - xD„il6äAA‹Xû(·Jü«wébżOß.™ùˆé4œ£ñ×w?^~ùûïÿüÇ?ü¾{ºüõ[¥¼ÿîMŸfùLËgœ?]½ó§AéîÙ¹Eÿ´Ö×ôÊΟ`ÀòëÂPîuŒ6Ô2ÛgÒ1[ÔGü>ÍuŒ6´ôdïmÑvÖ¼'û¡¦oå<Éù\ìí/m5ky-O«ïþv}÷ýå×ïÖ +«¥—áô\–ÏÁé—€gÎGðl¨Ã—{×5Hݶñ ÃOlˆü:­QÇ¡ó~†Ý`ñl -Tè|c/ÓÕt-ŸfvØÂv•çƒŒ_tGpÊjíÛ]¡jd(Ò£XžnÁŠû±x2Ï£«÷C4¾!‰iýùhÑíí§Ú;aba¬´]P”æÏÝrÆ6ñú¤ûÞ¿ÞAlجmß#Jm_Δ'ó<:Ý1WÖv½gÅK ?S.kny@׋ËRB¿±¶Œ3hÚDö€ÑÓÆ_Jeë‘çò<"ï—ÃH´^F¡C¯ä0‰ _ 4¸A7òp-OsnÚrfãE>»6Áßz6P$óåfíZ{Øè•› -ÞåÏsy­Ç±æÏ–ÓöЬ·èÚÌ’ay·š‰_uÉè4=ŽÔ£môê:Oæy4tš“±çNôî„^m£´‹—lâ×ÄÊ«cÒ6.©-y* ïÚ–vÉöø ªÒV›TÚòýo~÷Û?±¶þÖ4S:Rõ‡êaaWkËÚÞî7Ⱦ9­4;k;çë|IÛVŽ/ð{ºîs¨ïðù±—Y®ÍÚ®2K_Ü÷ºJ>?ÇÄ­.5ë[»âŒúS]šx—DÜzI.Ðè²Ñ[,©=GY-[ªÀmfè‘ÖRÅz ÍùÔm±:,æn§¥3ÙÒù½ÅNë«-TÇb'ÊÑ·åK7·èÕ¶œ2ªµgCiÛ‘tæO¶Cõ¶P®GxžA‚mt.(h eϨíe®QØûšúÙÒçmчÅ&_ýÂü½¶•ìq±§-íOËxßj¤°\ í(H¬ižØLhÄ\ß9,éªÿò‹^/åèöÕhb§ïÓØ?¥¬Osþê©lšóŒX0aÖí®3¬ÙQÛ\ñçÏRÞ§_Ë8·™n—>Ùékb_q æ~Pv݇ã86›BŸmÜt·,zÐOtnlÝO­qÀÇžÖŒÖõ¾ŽŸÈb Æ{­ùÀsöª}’„vÆ9oe»"[05sÑÈÒk†žù‹s׊·ŽúÍlæ¶^·Cë/Ó?¥¹C]´%LÜbü<¿Í±íXé­m7Žµý¶æÆ1rÉOÁ–Û't@‹Ds7:™çU7±Þ0òÍ^„éÉ{Li1*S}\déJ,`˜a·ÂÒᯡ™ÎY8[]j^äÇå›'p…rýÓwwr»TNL†°gÕü>LÙcì¤ü%ÂG¢Ìò0‚óÁôÔÑV&_Ôj#÷‚EÒ‰ö;[NY-Ùz·÷é|,:/ÄÝ–ÞÉO£ΰæízß%ƒ—ÂŽcœúÌFã°®1 yÊ;Ìt. -bOÁŽÿ°HVA¢Ý ü¶8Ït¶s¨´Ìö"ôtTf&5AÞfdºs#÷\žY6>ôåäÝ.ª÷ä’Ö ˜qQ¸vQËâ/Ìyf>°YØŒ;[ÇûïΣ+À «!'.nÛ/¡G×&Ô妜}Šz¨ðYÁÅŠ¯Â¹ ±“y YtøY÷nÉ4ö©AýûùûFî‡ÛLnHG×%èYò|è:cX:»ü~\>ÝòÊçì÷µ|Ñ·<À¶O†-˜{]t¬º"èìMÖ“yuÝl:-|€ºáÀfC›Ýö?»YÞF/®Ëø·²Î#á…mmËÔº5³ÎózDªÍ)Šv‘š;×YB†Ëæ.RÏåy4¤F}Ìv@Nì¨ù9ß\•ÐÀoFœF––ËúZHƼ©'ó<Rí1§ªQ,Ö›·à_†Ù»¾ý(íØ1 ½!yñ:ÓøÍ߯e_›=µœC՛ћvPÙcEc¤L´wãË“y•Çñåáñ§ñØÔÑ­v¶C³á¸½Ãn 1 )QÎÓn?UÜÙø -¾9—çáFöN W{òƼ¤p’Ø,[À›ÓÆuô4¥”‡n¡Ðš¶íB¼6ÿ¶ª k¤ñ¼öŽ•ulN¿ßA.?$²Ãr~®½{ã¶Ú(ã´GcŽžÕIôˆý=œžËóh8MÇÜÆw°[¤~‰·ëØoŽ/„ŽÑ÷Œ‘à«NÌï¬RÏø:~`<¢±:ÉÏæNû´Cû>ÎQßÞ¢Ä"¦³ˆNæy84GYGþlÅHwž±(qó ãòƒäñvc±ÌV¹Oë2FÖ)ÑÒp`²­@Ÿö×!÷¢5>cÆ£«Èk\kÝÖ¶Í7îöž©ˆ/Gê¹<‡Ô;;{§h›os§ÙÝSGZ¸W÷QX‰½íŒPésï ¤ÍŒä¶Œ¨ò¬®7ÑÖu¡ ›é¼ë4þšÖD6œGÂÛÕÚQú,Jé­Ôµ¨Ú»F5™eFå&õ5e×ÆIÝ.‚ðU‹v̦g£Fïöœ…©ɵt¹¦D·‹˜n)Í·‘Š-UêYsíùnJ‡ºM­ãÙ=øé^°9¢lýºÓsˆm¬Ub¸1áíã6âç‹Bjß¹Bù -=.´¬Ü&Nªã¥Ki¯dþ†©YeôfDú¦ -ߤÄ<å‹v RôvÓ~Õ+¡¹ÙÄëNâòÐXÇI= ]ìiYwéfy餄ôDº-u뱕”u“Ç\Í#’jä±놺&& -«ýÓ¸’ U5Õu±oP~^‰»¾MU¯ZeA3¸ûVn‡ÆÏ\ÛˆkzUm³·•Ë0_…·âØÜ(&è§ZIÕ¼]¯Œ »a ….î4ú\Äu¶6v*ï‡X¾öI&yÜÛå—âæŒõ†ž‰ VÓ›×y䥯ÿEšïñûÏ‹»þ¡¾êsöãF5¶0[WbîÉèït¤“bú»Uئ Çh¿‹uêi}ECóãÆ0¾v=»êÄ^SêÆ ºi¹Ð÷>dbÓ k´e=ã„·¡[ ó¹cÓö|ikãèé>zIlµ -¼9¸L]g»K¾²"qEI»K‡Ö–¼P\² -s·le&’WÒºžìw|(,ÕÅ.XA—¶ë\w³¼è*+­`I[~Á všWšWöF¿zz}ö¸/&‡:HÚ¨½IŸ¹´5Œ¤ðd©-—a}Ù|Ž-ÂÕÉÛ{¨•eÙܳ-ÈéS£‡nuÁ1ʤ©g[x^©«²U¥ÕQ4º€LUY+1V›Â’­vKiq{)¶˜¢KÿÁ{ÚóQièù¨„MZ*·z¼-ÙyçØ[§zÊK&Axî&u=¥­²mÝn]wõ¶WÖ × =2U=›ß¤|ÿ½fîÌy†)Uý)»#:õ—cÃQ;­±åï©8ÄÑŸ¬ˆ.±í’ç9Þ?Ùî’Ôý^†crÖª¨é/×É&> -endobj -520 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 480.123057 101.433071 461.373057 ] -/BS << -/W 0 ->> -/Dest (cb79-1) ->> -endobj -521 0 obj -<< -/Filter /FlateDecode -/Length 4387 ->> -stream -xœí]Mܸ½÷¯èóËåGñ ö bdƒ,`$‡ ‡ñ¬½‹`À›Cþ~Õ"UM•ZjÙcËöz0žVI•ÈÇÇb‘jš³ÆÏ·ÿ%2*¥ßžÞ´Š^ãßâêbPÿˆßèÏFSTÞäüùm¸¨bö6†óÓ ÿu—<ùÓéßœþsÇœ­Ê9XãÏ¿¾.*r*¦µT*mœ ò^Åh}TÁ(öëϧï0øžþïéÍ7C¤¬þ8Cj‚…n`3šÛÃû6x|ÐÐF B,„{ò#bžŒ4 Å1èVŒÄðWþç®,‡á?·wíö£øåöèÄYÃð¦¯ClY|g–h°Æä£m@—ma'@~¥¦«Ä¿yPG+.1ÐvÉÌÇx‰É0Y~ùöôÝ_^üý¯?ü½|súçï´öáûo þRºüõ~ü›ç²µóqLÿfÔ…I×Ò×4µìÈÒ„ëüôØÝßLùŽ–¾Ù5ê´ÓèËïê½Kš×,Ý#>gvÿ7×vX=>oICóz˜ÙÏëhüÜò±ç WR½~ÿ¯ó˧?¼¼ÞàÀ#':G a«Û²¼VŸ¢˜ÚÞ‚h­NÖ|ÆU}tøvÛÛ{ž±¦-ð-P«å¶¿®{îŸ.ϵÁ‘¿ƒó „˜ÝB!œõ ê.-k\÷—ÆÚ,i˜NjñG†”®eÙu­ÚP¯Y Z™ârÂ}_OåRWnO~ž“æú*bkàdZóP—¶=ÇÚÝ=:oÌs8´ÑMÎk5×óëyË7DÕ>þø±‡¯ÇÑw•¥çHÜîR, ”9ƒeÑYæ·º-ÏázÛq|o>Ù2‚>ÿ|™½c±Ì%,!0›ŒõkˆÝ–çpˆ½íGÞ¼ô®ãá{Zôž)ÎÇêqϺ¿·Èˆ´Ì?ôViO¡ ç&"7æ9"ímŸò¸\ràÞrsFµ€8æ#jRÖP"ZCܶ<‡CÜm¿²Íj-[aôìZ|@åÃ8§dУ¦¶JÏ[K÷ô¯.-ø^Ñ Ït ðŽüBÊ^ùbk¨Ü–çp¨\ B•ÓnÌÂ6!ûŽÑýYzIÇ•‹ü8ù{¾,§4,iÞFâ¶<‡CâŠxÎøÂ{ÅŽQÜM>àf”nÌs4”º~c­Ab¾WºnaÞ:m¶PGð(£ˆ·rCÅ›®5Xy®<ÿС¼×Wtð^ÅüeËc–KoCH³µ%^\Bߎýó}÷Cö}ú{hŽågö^ÈòÎ7…Aß?÷Þ˜çh( Ûüĵ‹v™/ô|Mã‘Ýsñ]–ÏÙ]@§»ÿÍÃy‡Î÷ð?)¯|Àž³àçÎÖJº¨wëYiüõ—ß+y|Ê:ŠËØó÷ïòÙ˜çpØ»íõÇ8n©ËWSZËê³zt?uŸ»z_ÅS?Cg3óÙ~ánW¸rSWc8S ÞâÒêÈÀ }ùu·OžÛÒæQÂ*Pë#]ÚÁÖ÷ÇëïboÌs8T®xÝ{W|UbëÍ{ -¶" ²ç¢ßгªîꃯGök|ÞÖÍí®¾¨àaêKˆŒ;vCnÌs4DÆ•Uhþnl¿zÃ<£wñ5AÒW³ã¥ÝÙ«­£…ÅÙ;÷ܺ^#½1ããnpÆ¡ýŠw¿W¤=…®NVÞx_ÇãŽw¹7æ9>oû³¶XØQ»þÖ¼^µ2åö¾Ú{/–$\ -ûŸkÜžÕøÅsro± ²][EܘçpÈ\Y÷~†±üÈ‘Ï–1Ë߶يÙmy‡ÙÛþç¬÷ïYEYaIqÅÄ ÌtcÅä}ì»w ôÙ£ Lšôýo0nÌs4T¦•(æýþêGdè»êq•î~®Ü˜çp¨Üø†ÍŽw¾,þÚÑC?hL©;Þ¾Ù˜çpH]ñD¿ -¾Zè‘kßøQzâBÓýßœ±1Ïáº÷<È÷]}žŒÎ¬ïŸÉoÌs4tægò??SÏà9¿ïê9Fúìîß¹¾1Ïáºâ“~–üóåôyÇÛ@ó¡ÏóÍ–wïïøm¤ß>Òïø†¢y‡Î•oCß;ïýGú=;ªža¤ÿq<#z4ª÷å|¢äMbÇm4x®&YAãüpŽzÄŹüôp #Îœ UÆué G’r,gÉx½øãŸÿô7¯òº³}}ùrËf.|øEu¹p¹.Õ1„½M }C?¼&]‰äB"~ß”*»T½·—¿¥¬’žÞ\š ÈmI.¿CYãç¡œT‡Øñ~N%9Ç!^ôWåûñÞÌž¡ Ïž¡†ôó¬)ßÂp.’ÎÆÓ!)cËá¹ç@Ê•¶ÉçrSÒŽLm:3T¶9/äŽ~×R§ër0a9”êrD1»Ó¿ýíÉdR¥þ Y\N Õƒ8Ùz1‰ŸNåÄXÄ„ùøFqŽu+‹LMØdàܨrŸÒy¥Ç¹î|ýh}}š’ß×lå$Ò5‘β¹ÜX"g0sqyz­Ì(.§î&åÆ«ÐLñ¡Ú áT ñ´SSÆU±qš ý\¨Ùí&±¥j)§´µª “°™Î«Î°æ¯imdÍyKøxÂm]/}¥å¬ÏZT­]«›Ì1£r“úš²5µvD'Aø­®E³éY«•Ó.ÂTD-]®éÑãIL7–æ[KÅ–*MYs­ùÉ” ê.µŠdCÒXŽg}D»úñZJ Ô¶Ö‰áÆ΄' 14?|Rû‰+´¯ÐãBÇÊmâ¤'¼LÒ²Ññò ]³ÊÊySåÿ Uø&-Ì3|0Ô UÎŒ›®¦›”¾ÙÄוÄ塱I5`(NiYu™fy}™¤…ô…t[êVcWRVeLs5¯T#k±i¨kâBaµ~Wr¡®Fàv“Ø7(?]‰';}ëª{½Y0 ;‰CãÎ'.Ž­ÅM9°ÙÛÊe˜¯ÂÇa`£^\ ŸêM&±Õm´›nÆ„“a …I<ÑèÓ ®½µ±ÓðÍñãÇ©“I#îãé—Ó0ÌYçmƇàL9Ï–{^æü?¤yߟèüC=@í2Ž[ÝØÂ6n½󑬜~ž6ŠËièUغ Zb´?‰MšÒúŠ†6Ž[Ëøš¦ìz"öšÒ45MË…~ªC&¶ ºÖ8V3þ†ð±«ÅæȼoÛLöåÒÕ‡Ãm\9z¯Z… þ8¸L“ÎMCò™‰«’tÒ¡%Ë2â‚ŠKvÃqi{°"m„'KÝp®/Û˜ãÎå¢vÞ©†ZYŽõ=לœ©kL®]]pŒ2iš² <¿)UÙÕMë@Ñè2]e­ÄXm -c¶Z-Ã'±–bó)&é/¼¦=o•V‰ž·J˜¥-åÖ¯yK®9@žÃ9NO§§”Í—L‚,ðÜMJSJWeó{Óõ½ëh{fA“!aòLõ”ÍÏRîâ¿=}ç’§‹DH©êÏ1i:r5™è¬;çâî¤À!T”X¸äî<·ã'ó(IŸð;¡99§£ÞLx‚"¯+XQOãi­r¶¬ÅGº¯„ðÐDszrÊ!Í!HÔ.c™*ú<Û­S*ÇÖGmÄpÑ°3Ò]…O†ŸÿÈÏîR -endstream -endobj -522 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 521 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -523 0 obj -<< -/Filter /FlateDecode -/Length 4804 ->> -stream -xœå]K$9¾×¯¨3Ò&~?$´$@¬±ÒˆÃLÍ4õ"-øû|áLÛ‘ÎȬ잞¥FL«§*#üÛŸ?G8ÙúªðóÆÉé)¥ƒ»Þ~¸üxQSô -ÿJŠÕEQßè¯Z¹8yCò×H`ã³71\Ÿ/øo¸äÉŸ/þÙåŸë<új¦œƒÑþú¯O¤rvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS@§IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°Å w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔaFaBt¶峨ƒ-Þ*#é,lqø‘tà ocJÂl54»­²ZÒyØbLt¢¶`ð%0¶¨$ -À šˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq˜¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.¦{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»˜FFâŒê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãÑiå﯌ļkœ (øG‰Þxâew¶€`%.Àz± °ÉÀ-‘¸ÀƒwuÆò'Ìi°Õ¤Sxð®N>Q—'Ñã¼E/O:„,qïb¡²xð.è3I\ŽŸ°¢‰ à7-r)ϧ®×~ÑÕ¼C>ŸwÊŠKúÅÆšÿÅe)f÷Ò­×6ú<=ý*O­?­íhö õ5ûj¿¾_úïÆúò=¥ýö¯×wß]~õn º-Í ƒ#l´KÎÝÁé¹,ŸƒÓ/ÏœOÁ3õn¬CX‡‡†®tyb]ûiþôf‘-Ý¿Ö:‘Á%³¡l0j`fSƒÁöëœR2 é®Q•¥wÙÜãË“y ˆˆÜ‘8A]†º‚$ Ã(-éÿ7Äó…f×@ªŸ7›vPiÝ‹Wñ“y•î?~U\óF³éäòÝPª$¾g¨öëúÅYXË©³¥Ù·ƒÒî8ºìdÒŠ|¥çò<J̆”¡7<:'8Æ#‚jú3#^ëmhÈø¨¥c¶¨ø}øUšY£5ïÉ~¨éÏ#pÍÇn(o¡Ýe<Ðsy¡'ýÌ:‚ŒÓøJ¸á­=$~b£4pË^úš}ÌÑËq#ZwVu£^›ŸÌóhh4ç|ͷ౺R~Gt{;äüÙ‚^4ZÛEiþÜ-gl“ä/þëk׈ ›µí{\iì˹òdž‡CçŸsôÅþ/ãå–õYá"ÙÆ$Ý`N©Ü,=Fä¹<‡È;þå0­W¼ûWq˜Ä…¯ð †8{ÃÃ;‘ÐÈ™ùìÚøÛhéËÍÚ´¾bGódž‡C뱯ùÕrÚšOÄâãÖj&þ¤3HF§í~¤víl£WwÐy2Ï£¡Óžô=w¼wi‡¦ÒŽ/F\²ñ_+¯ŽI»ANmÉS‰½k[Ú%»—léð¾¶Ú¤Ò–ï~ýÛßü‘µ¥ð7íK2_Xt¦֎µ­}Í Ûæ´>Ò̬mœ¯7ò%m‹ï{º¾ÞP¿áóc/³\›µ]e†(Û÷ºJ>¯Ö;YjÖ·vÅñ§º3ñî,h¸õ’\ ‘e#·XR{Ž,²¨ÞÐ/,3a–©ó5ïÖJÅZŸæ2Õm±8,¦n#}ÙÒó!‹ÖW;¨ŽÅF”£?nË –OÑým9eDk¯†Ò®#;è™ÙÕÛBý·Ýyæ¶ÑƒA9²PöŒØ^æÔÏ–>”S;ŠM¾®ó÷ÚV²ÇÅž¶´?-c}«Âr-´£ °¦yb³ ys}³Ç°¤«ë–_ôz)ÿC·¯z;}ŸÆþ)e}šó×u‘Ê.w4Re«¥^Öî:»šµÍOqþ,å}ZðµŒs›åv链&Öñjîe×}8Žc³)ô¹ÑÆMwûÁžýäÕØO­qÀÇžÖlÖõ¾ŽŸÈ`ªÝ š™kÍZž3Wí“$´3Îy+ÓÙ‚©™‡F†^³óÌ]œ·VœuÔoFšÛ+^{êد}¡–¹ã?ôv•¶.óBü2}ZºHýü4Ú|Ø^D…ëöÇúë¶æÓÑwòÉOÁ–#=ôÐ -Js×w:™çU«ÞÐiòý Pž’÷ Ñi*ô0dºÒ s0æAØ­0¸‘ô@ÂPá_†-æ”åE~\®±yòQ(×?}{'·Kå)žö¬º“߇){Œ”¿¸.ƒ«éO”Yu>؃ž:ÚöäD¡6r/¨N´ßÙrZNî¾¢÷é™-t^ˆ»-½“ŸFœaÍÛõ¾K3.9¸*Ç8õ™Æa]£ó/òTp˜é\Dwß,䢕ci÷œÅ­3FOAfzÞh¨´Ìö" t|{&5AÞfd:&“y$ˆl|ÊÓ »|¨ÞÓ’´xÆr½D-b˜ó6Ì|`³4°Wëó{Q‹Ï¢Zâ²TûÅ¥àˆÚ¸$šÜ”³OQ¡)ºX‘áU8·av2Ï£¡ +ÞšîݲiŒSÿ÷ó÷Ü·¡ÜŽ®ã쨕<ºÎ–Î.¿—O·|§ò9ãýTëÏ/¸S9l¯ [4÷6Â"=f² èìMØ“yuÝlzjíuà ‚͆÷p@îÌfz½¸.ãKÜê:„¶µ…³u gçõˆT›ƒ.G'¤cî\wöhêÉ<†Ô¤ùÑȉ5_óÍW «C„g‘¥å²~*¤Òc§/EêÉ<‡T{Ì©j@óïæ­:Æ—a^]ß~”vìÐÞÎVñ:ÓøÍáŸÊ¾ñ`wÙ"J[{¶6í=aҸИ0)í‰GLNåy8Tû—‡Ç£ÆcUG·âٮ̆ãöÃ1Ä4¤D9O»EU9podã+øæ\ž‡Ù;>\íÉ[%…ÃÆfÙ*Þ{°¢¬|ÃÍMÊC·Z(Žm;¯ÍÿE5ÃCÜ9ÎHnˈ*ÏêzÃC™™{}'ŸÌópH¼ã)>ò¡Ì‘ë¬Ù9Â<"£íPÞAÞx‡eƒØ×>¬Y=7|8¿b÷ïdžGC®VÇÎã#oá}ñg€Ï>QÏQ·î§ŽÒbЯáÍfSF^þ¿_Þò=FÙ{zË^ò:±—F5¼ÞMržõ–çö%8W=¼xh}WEÒëÝmº 0Gz#ÚÞ=QóiŽyõrì‰ÖÛÏ.G> íðm^ÒÔ{©ì¸_;æ¶ß«Ç£Ê}ÕåhZ9>•g¹iG3U¿‹;ôªÚñ/SŪùH;~ÖÊ?8~ØÚàk6Cùã%”·ûéò†WÒ¤ ½þÜdilò•Þ(˜”uº.­¯;9Ë‹ól©–wé+z½.½Z± -¿XÒÿXý‡‹În¢þ/gzË{¯U'S/ºøùBï=w‚ع~0øŽ˜„ËWÕÊrº3®²H8NyLiý¤–¯ý02Ýž¿_[Cù}ÍFï£sª&²ålsÅ‚9ƒÞŠ©õjÒ‹˜ÞŸ&»\…f -[jÂ^ ãi{=ã]±¶Š ýV¨Xu]l\µGÓ»F[×….l¦ó®ÓløkZÙp oTkGé³(¥7V×¢jïÕd–•›Ô×”m@\'At»ÂoT-Úa0›ž½÷s¦ -$×ÒåšNÝ.bº¥4ßF*¶T©g͵ç»)ê6µŽd7v`?ÒÃ`sDÙúu-¦3äm¬Ub¸1áí‚%ÆmÄÏ…Ô¾s…òz\hY¹MœTÇK—ÆT» -S³Êè­‰ôÿL¾I‰yÊí¤èͧýªWBs³‰×Ä塱Ž“z@»ØÓ²îÒ16ÌòþÒI é‰t[êÖc+)ë2&¹šG$ÕÈc-Ö uMLVû§q%ªjªëbß ü¼w;}›ª^µÊ‚fp÷­Ü.;Ÿ¹8¶×ôÛfo+—a¾ -oeas£˜ Ÿj%]lT[ízeLØ )tq§Ñç"®³µ±SyÄòµO2iŽ]þ~)Ëœ±ÞÐÙä`5½•{^úú¤ù¿ÿ¸¸ëïëk@çuܨƦqëJÌW2ú餘þ¦G¶iÄÆ1ÚïbzZ_ÑÐÖqc_»ž]ub¯)ucPÝ´\è{2±iÐ5Ú²žñÂÛЋ͑ùܱé ö|ikãè”5½@¶Z… Þ\¦®³}I¾²"qEIû’­3,#.x¡¸dænÙÊL$¯¤u=ÙïøPXª‹]07‚.m×¹¾Ìò¢«¬´‚% lù/Øi^i^Ù#ýêéõÙ㾘ê i£ö&}æÒÖ0’6“¥¶\†õe[sl9’\'oï¡V–esÏ6'§OîZ¸ÕÇ(“¦žmIày¥®ÊV•Ö…¢ÑdªÊZ‰±Ú–lµ[J‹“ØK±ù]úwÞÓžJëDÏG%lÒR¹uÅkÞ’mçpŽ½uª§l¾ddçnR×SÚ*ÛÖíÖu×ÕöÊšáº!¡{¦ªg󛔯â¿×Ì9Ï°!¥ª?ewD§þâl,ÔNGklù[h*…qôç,¢Kl»äÅyŽ÷O¶»$uÿ„ׄᘜµ*jú«v² ÏPäû -VTý‹wr¶¬Ä&½¬„í¡Nsj³;Tþ¬QÙã,›Dí2R¨HÅÌ’Ó›è¯D¥åg°é@µ[mŸ”Ÿÿ}XµÁ -endstream -endobj -524 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 523 0 R -/Resources 4 0 R -/Annots [ 525 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -525 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 405.123057 101.433071 386.373057 ] -/BS << -/W 0 ->> -/Dest (cb82-1) ->> -endobj -526 0 obj -<< -/Filter /FlateDecode -/Length 4482 ->> -stream -xœí]ˮܸÝ÷Wô:Àhø(¾€`’ F&ˆ#YYØwì×›!%o´;ÿú6«È!† œ JP)m•sCÆyAåõ€GLIRÁ ÈÐZ`¥è$Ì c¢ Š0ÃRÐv­J0ÃM’ -fèä‚ Ò -vh£”¨ƒ!ŠÈA§ÝàQè^Ò=ø˜Lu:Œ¤³vð´Ó’. Þ{%Á—”–t¶8M¤$l!ƒ¤ó°Åz«Dl11XI`‹Aé$Aa ÐElQ^iI—ìàR$u :C\ëŒrƒ‹Ö*I§õà€M+êТPI>:[¼rIÔÁg•‘t¶þ$xÂÙ£ÐZMnÝVY-él1&¨ƒ-¨|‰Œ‡-*x‰Ђ†ÌK˜J†$0Ñ)J,`b(+Ñ€In Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!´\Q[l"‰ ¬- qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ]4÷ qëZçÄ´k)z‰ ,x×’Vx×ZÄu°–¸ì8X­ÄÞµZ‰ ¼‹fd$.@­À¡—¸XLŒJâHâ.@Ô…mÐJ\@à]ãðRÏ Þ5N‰ ¼kÈx‰ ”ü£Do¼ -q²;[@° ¿‡ÎX‰ Ø`à–H\àÀ»:¡ûÚ4ØjÐ1y‰ xWGTŸ¨Kƒ(q¡Ý¢”í}’¸ÀwÑQY‰ xô%.ÇèQļ«-zjIÞÕ&)‰ x~ƒ“¸p4‰ п Zº¢. *Å(qï‚–ŒÄè…Á$¢. ’–¸d<(ø¡xð.º÷$qï*g­Ä¼«n¨ƒ-6‰ à×@‡f+´i8«ƒ2` -IÞU5,éÀ»J…$qïænSâ²ÀD‰ `à/ØH\à# )/qO -:¸|¢Î¸we‰:ØB$.€c=$›¢ÄÁÀkŒÄÁÀ¸ À#’†÷-` à"Ž¶ÀS”¸L6ÄD$qApã1”ª¤ófˆt-ê"t:H\ 芵ÄK ^âüÝ%‰ `tš$. ¶ ©H\€®hˆž¹¤Ó°N¶Äðt¡ÓZâ‚h` ¼A‰ ¢‰ez%qzhŒ%QÔ’ŽTgF‰ "ù!»Š ™`¤ ¦u°4!qê'¶Äü`°‰aŽ¨ƒ-Ö‘Ä1š<ÜŒÄ[Œ2›y¼$.H -¶À㓸 )?d7YâÐ8tJI\tÄxÓÄh—y¼%.HVa¼‰!žÐn“õy¼$.H[\Q[à4%¡Ý‚“0Þ;I:[L"‰ ’÷y¼%.€›ñ&¢Á -ƒ#ô¶al2™9ø•Š÷ê NV\æ@ë-3ý%ÃdÜùÕûÓ÷~ñ·¿üø0zõîôß*x?|§ñMï.ß.N÷¯ñy˜d€ˆó—k“}.=ÉÍ6LßS\Œ|êu‰ç¦0ÎMa§´©Ñ×<Íœ·z‡4í:?ëç|j:QΧæÿФõnÞ‡ü —ëlBþÔgÒ,œ›Ã—²¼ö,ZýðÏó«§ß¿Z‚lô¤¶Í7M¥™Ãø)œTãÂ~wÀJ š¦æã.+äûvN—Ú‘JÃîO ´Î§wâBûh›ý¿îž¹3Îáжã3Rƒ„R‚oÖ5/M§Çû¸ýéüä „2?0opÃCú½9¡Î8‡CèußñÉ|ÒÓƒ>ÿ|­c±Ì'ÌË­&jãöÛçpˆ½îGÞŒ¼+õv™ÞM5zË(çSµ¸Æg½¿µÈˆ´Ì?tfPŽ|FÏUDvÆ9"íuŸò¸\ràÖruDµ8æ#*ÆiŽ¹ÈÎ8‡CÜu¿rk-Gœ a#•²FCŒZÔ”ZiyksýèÍ¥ŸÃ+Ðjã™4ÃcÙ"vï ygœÃ¡rgò¨œveÖ…ìz÷gi% Wnò#_¶Î[1ã¸}î:ûâ‰;>âa8ã+owôâÄÖ¬{QÚçh(¥N¿±” 1ßkc“GYíÁ¯íÚhzùŠœR›¯Yz|¶Z3„(Ù&ÃfµÇÝ­­q?Ï«>u+¾}ö2Ü@±½}<Þçp(Þ™ã¼×ç#&ûùúän¢ñŽùÌÎ8‡CãÎ|æ­üø„Ÿ„¿‹Œ¯6¨ÃÝnE¡À·5 Ö"sÞãæÔ‰£›PUÃÓkDÄæ&}B=kR{+’q‡Ø뾪‰ûµûY÷Zè…K8fÏ=È»MˆÛaWêØ\d/;ã îóû¡®Ig…Œ+þæç@™Û¶®ZãÍëÿˆœýÃüz{ÔDnoݼ3ÎáÙ9¿ymwD~K,L¿_+ _­]af¸«®Ýa¼å×63á®AAkÇÇÚÛãîØÙçp¨¹-{Á3íسá¦Ñlt|Ƽæñn™Žf{F”ñôšQRˇ+[øZI3f_íU×ÇKÏÞ:ç)›sì­tÆ9bÿ?O¹hY{im¡²cæ}h—êÙ|cïJcgœ£!Ô＋s'ÔÚ`ïìŒ(lV#eÞø[Æíík:q‡ÄŸðP¼ñ„ûŠÌ™¯ÔçÝÉe§òä÷®v1›)\zfŽtwpd_œÃ!sgÝ[«Í¶{özw×¾Ÿj˜Š¼ìiO—ï­š¯£Œv÷qáù× Ê[}AoUÌ_6|Îrëmi´¶Å‹[è»c?dgœÃ¡¯s?dÛ¦¹‡æX~fë…lï|“Qîxg»3ÎÑPúüÄOµ‹v›/ÔzMãå¹ù.Ë—ì‡n ÓÞþîagœÃ¡ó ¾ãgå•Ør6üÜÕZI3ë][Vœ>îòYȃàS–^\Æž»}—OgœÃaïºw8–[˜æqsY¾™ËÐVžÅ£û©¹nÊ}OíÌWû…›]AâÊMYáL%x‹[«##ƒ¶é—Ý>imKG «@½?©´Ù_ßñ6vgœÃ¡rÇkl¡†­JÜÛ§Ýõf‹¹ ·þ¨Ö¦ßвªjʃ¯G¶k|ÜÖŒí¿Uðzn›?NuÇnÈÎ8GCdÜY…æïƶ«7Ì3Zq_$µoíÎÞ­ý+5,ŽÞ¹çÖ´éý‹7k„+mW¼Û½"íÜ“oÊdç÷í~<Þñ.wgœÃá󺹪‹µûoÍ«Ý£šÆƒ\ß‹¸·bIÂ¥°/üY±ÆíÙ¿Ø`Nî-öþ®__œÃ!sgÝûúò#Ïì|°ŒÙ{~‹òËü1ÊxÝÿ\µþ{VQvXR\1q3]Y1yŠ}·®>û,Á“&uûŒqŽ†ÊÔ÷Ë“_çû«Ÿ¡o*Ç TÚÛ¹²3ÎáPÙù†Í=¿ùUñ×-ô£Îéo õŽ·o:ã©;žè7ÁW-rï7?IKÜ@h¼ý—3:ã¡;óžù½«oÓ3¨è|9{*Ò¹|îPt:²c4*$wƒì p}èF9ºâœÿZˆù [Îļµñ §‘RÈgÄdH½øßþøW©üj‰y{y‘ë²p†kÏÃå…|Ÿ‹jbè2Ì€~|%¥TÏ¥jÜØUæâ¼T…š¶øäïË™ ¹X/ÐÉr“ÃúËgLkºÓ‰–S~™4rüü³¹á¢_¤ï¦¼™=cŽ=C>¥UU~8ùñ¼#=žy§|´É‡âž= 6×M:ç3–¢²¤KÕé±°õy#æx”ð‡j:]XåóaS—£‡ÙÍþÃXéïO:ÑË?Äå$P5Š£)7³øñ”O‚%ALà¾NqN—ª¦Eº¬²ðlRÒºAM—©&n]¹4®Ã³$UJר*³Ì¨T¥®„¬BµžÑÃI~§J҄ʬzVkù$´‹0 Q —J8AôpÃM©¹ZS¡†ŠsÔTJ~6e†ºµàÙXF“4äãÁYQ¶\.Å>×@©knÌJøpBC+ñãÉ!´›¹B¹=.´,Ý*ŽjÆË,Í‹Ê—+4Í"ËçHåÿ/Táª43Ïx¡©B*Ÿ7ßÍ™ä¶YÅËBâr_Y‡¤Ðæ°¬¸t³¼¼tTBøLº5t-±…”“‡TÌË$UÉc)ÖuUœ)¬”OåJ.TÅd7‹]…òãB<ÛéjSØKf^3¸»šî,ö•;¹8Ô×ù`¿joM—a¾ÆŽZq†~,™Ìb£jo7gÆ„³a …Y<Óèã(.­µ²ÓøkïÓåÜȤ÷áôËiìæŒu&áÂ[Ï©åž—>ÿa^àó¯,£]úq£*[˜Ê­ 1ïÉò©æ±SœO9/ÂÚl˜Ð£ýY¬ãÖ4Ô~ÜÆ×4GW3±—º2¨®Z.ts2±©Ð5Ú²’qW„M)VGæ©u3wØ—[[ÙØ|¤^± -7üqpg»ä3Kw9èÜ¥CK†EÄ O·,Ã4[¶03’gR‹>ÛO¼*l΋Ý07"ßÚYGs7Ë“.²ñ)X¸À–ßð„IóLÓÂÁ軛דë}2Ù—¥•Ú«ô‘Këƒei%Òm LÍ4§V³Cv°Ó4æ8IToC*º4Ç­bÌÇÑ¥Åé¢Ë*ôbúdüû˜ã -endstream -endobj -527 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 526 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -528 0 obj -<< -/Filter /FlateDecode -/Length 4446 ->> -stream -xœí]KÇ ¾Ï¯˜³·ëÁz†’ FÄ€Œä±d#XsÈßÏÇêzu7§§gµ²GN´ÐÎ4Y‹üHÖîÔê³Â×çß"é)ÆIXà€»TVÂÜ|F €ñ"ª‘°ÀwµE¤–xÀ]m’’°Àw‘78 `“F aâÛ¤LWä¥I¥%,pÀ]À’‘°QxRH"òÂCÒŒ'…‘ç'<; ‚Á²Dd¡@ ±ž’MQ‚` ‹5F‚` R LI#ûËÈsë‚,È%,’M1IXœG=­JûùÇÓ¯|Ï?þûôö³|RV¿4„Üš_Á LÂv;dßË·,KÈ¢A²»ó´!u±4€°³±Xxüï¼}³¢²°èJÈsõñxÍ{òè„2á(Ùe½»ÏM‘r‚tno´,k×Ñ8oW’$ëÝ}^HÖ®#`#@Þ!Å<®×ƒ}^\¯ã¼Gõz°ÏKÉj›Ÿ$nš·!(œ‡â.þAÔ;»¼ ƒñ$È=ÚØd8~Qù(Z4þÝ« ´H1ŸÒ·ÇA|dt¡Ñ¸ó«w§/þüõßþòÍ·ÐÓ«·§ï¾TŠüWŸk~}[^/å5ίæÂüo{{*4ÝiΕ×Ò^ÙÞoÑ·Ìåê~Ù¯ÍízÿÚ¦É÷z–­>ç÷¯ËUO»b¶C!À ÊåÚaß:õy8ë¤]ü¼KÓ¿ñ0·Çýa^IæÑ8°ÏÃYê„ô“ÄŸò°GŽôCZ©h2š"Ñ- =Öçá,ô`.»&ë.6Œ,8Ñv¨ìnÎ÷L¡•øT¿/ªu °Ï£Y¢¹‘sþ‹÷á]¿@7öþJý`Ÿ‡³Êý\óÓÄšò¦ƒ¼Y©^YâëÁªW9­è…uœê-M¾+VÚsFJnr9$ß²Òc}ÎJ÷óÌf)+ npÌwL ÖTÛÙñ:ÇZ†fyëêÅmeQ?àÿÛãÍ:Ãh}꡶?nK<¦ÕxW-´çŒÇ-ôXŸ‡³Ð;Ï<L#á·®Yâ^½|—>åsåÐÚZ¯Du«î¯Ëöy4k´ÇrÍ—À±)?Ä×ÖíìªÏ*ŸÍÖ‹Ek[¬(ίWÇY¯IÊWùëscăÍRökXiíýXy°ÏÃYçœs‹ýOÖËwŽõAá‹X~ðÄý`Ÿ‡³Èùåj'šVw²ûga˜„…Ïȳ5¬êì _©„Ö˜Ùpqô®Mþ·­–>ž×^±ÖgœiìópÖºŸk~²˜vÍšÔâ묅'þ¢$['õ¦†ZW•Óà2öµõÕ¶oçùu¡ÛA×¹mñÏqÏ·:(û‚¹,¿^V:sƒÿ¹îïy_žþ¼Zë/ûA•§è°­Å_/ÓzN8Ë¥«ý]fÛš³•Áü ›‘ÿ¦è°ŽA¿;ËmÛšK¶ †±ë:ª¯—}Ïã­ì½Fþ+:3›£¢³Ëõ=áýwÕŸUÇåã~PÚW{^ûpË sŒþêÊzË~µÓǢìS7ØkÑÝ2. ~U±h_W´±¯‡Ôƒæqs¡ûö ÇØrG\y»k\ó¡u-}¿ÇÕYþ5Ć^/u}š}=…´Òûº[aBÅýuF”›¼Í¿´ÏNG™nnf¤û<ëý_0uM^ä#Ñ9¸«˜Šf7^—¹ºÂÂNÍ›puÂä‘œóWÎat((jÚ‘ -}\cÓä<‚0®{ûÕÞó§õ½¿&ÕþÎOÉaï¤þ9˜­xw`Ì|!ÙØÑÔÞaòX–Õj;wG™z`ýdó§RùzÏÐ>ßÍåùpu¥7úóîk¬y9íS4𸈚憺4ìÆî\Ï(©‚‡{ ÝWR•Ôê7[NÕ”»”$îõ ÷ YËYSµ#ª£ê¿ûr¹Ò,a]é+Ù+®æ€3¬ºöSjls¢²[dE$HÖ¡½ÿ°"k;Î"ÑÉA{W—®É¡úZžWdmÇž-Z}¤$¾·}œä|W÷a­Ÿ_'‘W”œ:\ïc“É«E’=û^—¿€i­§uA÷ú²œ¿Í3س3}M’¼/—ð«Ý$þh1¢F»•/ì­Iot¶ò7s,â«7™×:"J;Ð9ê~.¬ªOÔ1ÃÒÇgäQ_B|¶½Ýµò]‹µÞS$¾’)E«èxap°ÏÉZ®CÔþ* –¾\a°÷žÂàŠT‡ ƒmÿ/ ®kêñ -ƒgh( ž¥ý¡0x1í…Á¾ÞU|[î³9ÇwE§ãpµFC’›MnG-A¶—œõꈚ’/Áµ^1Q -|oŒT•pÈܦý¢Þû9³ïÓP½¤Ò¦ÆÚ!j9@ÉmjœÍ½%–åøšfºiyë¿xµ94Ïó•Cæœï ±¥¿“›µ5¸º†¯Ö[ùþäóH:߃§|œ´á‹rÏž&>£éÌ÷.EeI×­ÓYÙú|¥g¾^ø}kÅßAR| !_@•·v|(íßçM‡²‡&_ |;¨ÊdX´[“ŸN|;, d¢^-Ý 3±¼Um,Ò­øª´ Âc˜Òº%B*o{…ÆqIl­«áþ®vã[{HÕF6ß[3O,ÑÓë-™W¯&]È|ÃnœlyòMÆöFìÒضØ;Þ$k«¢ÛÕ0]'ªòh¾‘­©Îwb}T¶¿¶5aØÎ=âå„iíšú$Rù^Ï:TÕ®Qf¡R£ºÚ²mµ}H—“@ü\Õ¡ ›Ùøîñíh31VC¢Ö.ÕvérÛ•Ñ\Û©ÐZÅÞ5UÍwQº©ÛØ/Ð.Ã)Fà+ÃQ¶¾]’¹Àn{­â`7fC¼œbhC~:¹ ´v+”«¦7í0n#GÕí¥SC¬ª‚kVß-Åßg¨pÊÈ“ßhj&Å÷Ãõ§> ûf#/•4Ò}C’4 )ô¶ƒºtÍfG}騄ö º­uÓØ‚:¨l £ìWmhßÀcIÖÍê™!¬ê§aåHTUL×É®™òÓ‚ÜåtÍUj“y=˜»kãv²oØù4’CÛqÍ—ý5yÛ¸ƒÍWâ%6Z“Ùôc¤“jÑ®O6»`…Nî0ú”ÉÕ[:åÏΖ·Ýɤˆ{9ýtÊaÎXg¸€óHÃò>$}þÚ|ÿÿ<Ñù›zYÚÇjha¶.Èc$ã›ÎãA2ß|^‰Ím¢¡ö;YÇÞÖUkhqܘ¯©wWØkKÝT7îHt]‡Ù4Ó5Úšq;ÄËJ‹-‘ùнé{~´uq\Šò5{U*<ŒËÁcì<ÛCòyOÜ´‡tpÉ ñ0ŠÇaÂÔ%[ˆÉ9NÒTÏòÓ¸–ç†4‚mçQ³ãЕ–W14A -lLJq`Òã¤i! ô³Ýëƒ÷½ˆì«0µA{£>Ô¶0¦6À“©6?úåc‹9öÌÕy»†ÚXvð=Û’œî=µ ÅÃh£5ön¥'¥J[LZEƒ ÐT¥µC•É—nU-yÅQÔRh9E§þ4jÚ»Ò”èÆ]ñ›¶> -endobj -530 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 315.123057 101.433071 296.373057 ] -/BS << -/W 0 ->> -/Dest (cb85-1) ->> -endobj -531 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 108.376036 101.433071 89.626036 ] -/BS << -/W 0 ->> -/Dest (cb86-1) ->> -endobj -532 0 obj -<< -/Filter /FlateDecode -/Length 4629 ->> -stream -xœí]M丑½ç¯È³‘ùü  Ø‹¬;@c}X졦zƆQ³Àxû÷÷QÉH*”bfWwkîBu¥"ø"ƒ!¦¨¯ -?ßhüIO1¦àéúúÓåç‹š‚Sø7§¸¹˜Õßá7¸«V&§“îúSØ0…äLð×· þë.yò·Ë_~sùŸÛ<új¦”¼Ñîú²ŠìbÊ ª•ÒVP97…`œT^O¸Å”$Ìp mUfPŠNRÁ 2& -ª3,m·ª3LÐ$©`†N.*­`‡6J‰:¢ˆ¬tÚMî%Ñ“É$Q ÓÁH:k'H;-éÒä½wQÒlqIiIç`‹ÓDJÒÁ²1H:[¬·JÔÁƒ•t¶´Nt¶]QÔÁå•–tÉN.E"Q— S1Ä­Î(7¹h­’tZOØ´¢# -䃠3°Å+—DlqVIga áGÒ'œ 1 -£ÕäÑm•Õ’ÎÁc‰:؂ΗÀxØ¢‚—(#hʼ$q€ a¢dH"íD‘¢Ä&¦‰B° ˜ä&ò)H<`•†Îh‰¬‚-Ž¼ÄVÃÂÈu°Å&’¸ÀØ‚X [ Y‰ ,Ø–€‰ ,è–TÒXð-)í%.° \˜©$.°`\=I\`A¹€R’¸À‚s-¸Sâ ÒÅpX°®uÞH\`A»–¢—¸À‚w-i%qw­ENQ[`‰ ÀŽ“ÕÑJ\@à]«U¸€À»FFâôêz‰ €•ÉĨ$. 𮉊$. ð® ˜D]˜0­ÄÞ5· ÍÜà]㔑¸€À»†Œ—¸@™À?JôÀ» '»°+qæ{茕¸…Mn‰Ä¼«¦?aLƒ­&“—¸ÀwuD÷‰º4é€Æ-ZyÒÞ'‰ x••¸ÀwAŸQâpü„ÕH\àÀ»Úb¦–tà]m’’¸Àwá78‰ ‡IøóÛ¤ +êÒ¤RŒ8ð.hÉH\€YxRL"ê i‰ @Æ“‚*qïbzOxð®rÖJ\àÁ»Šàöˆ:Øb£‘¸~ t¶Â˜†³:)¦tà]¥ÑÃ’¼«THxðnž6%.ð! L”¸Nð‚Ä>Ò”Bðø¤ ƒË'êü„k'qAP8P–¨ƒ-Hâ8ÖS²)J\ l±ÆH\ lË q<‚)ixßâò¶.âú€` ‰ ’òSv“%.C§”ÄIG¬7 I\€q™×›Qâ‚dÖ›Xâ ã6YŸ×›Aâ‚D°ÅÁEu°NSÆ-8 ëM°“¤ó°Å$’¸ yŸ×›Qâ¸Xo£C1¯7ƒ.ïºf’tà]x¦^â\`½ ÏVZÛ+¯ ðÏdeÌ+Î(F ¨×anC -Ü‹Ù*ˆ1òÍk$1h3±²Œ^Œ`Z…R+1l À¿ðÇhà Kô‰‡¨<à0gÆo2aX¼ûºæhÉìN²%>ö¿^~û‚É÷ú×ÿ½üø›9RV~4„95Ï&¡»¼oÛ·Ž\ž—3GeaßY² !55Hq ¹e1ùå×퇻aöw·µc -ªpgg!‰&fzG£·ð‡°Íéô¹l,ô|n`Èp@õá§Ëo¿ýÓ¿þË|”|øñò_¿ÃˆJ¹ïñ Â%|&L˜Z–Ï!ûO9ò°\»¬Ëòsšßÿ÷õ÷¼N“Ý)»··uæjôÇ%ù?ÌMgkoøLKËa -BÖyªŒ´@Ìò)m½61n. îË~“§ŒkÜ¢M»S©|iŠz©­«A‡hлqs7üÛ·ÿùïfÝ ^ÐÌú÷ßh|vfùKaý—¿K7¬iüúwMãÜšöuýÛ鋼”í0¨ºÑÚm}Ö·zj9Q®§ÖÿÚ•õãŽ=¯Ë½*Ûì¨6­e–D«.5›Š>—cè¶>÷Âò¼¶vªéŠ½J¾n›5K›Ï×"z3¨V,‚ïá±a*µðÌsü6³1¸ð›!•+Fuë r.Ö4sú£¾ñ·%,çrœí°P0üÂòèVïë¾®|–úê˜èÆ&o‡9oÁP%ï]ÎÖð…îv%ä°²skksÒÎ#†V²Ž³5[Âƪ-9,Aº -ï1¶Q¶ò/<`£)`~0ÏI0_9Nì=Ì—~¯øØÁ‰Fëkô~Y>oäëo•S—._‡Ü#kžï›Î–ή¿׿´~Îå'†õØØè°ËÇ£ÛÔÍœ›‹¬Ú¤º2K½ý¼JúÔaa[”ŸåᦲÛ~ucyN‚ºf6<ï{¨³·h»7ÓÎ-Ÿ˜®cß žü¤µö^¸-#ë*»•ÔM?ÏÐ]Ïßäù!Ë­u #áÁ{ÕËßZ¾ºÍó<"ÙŒRìx¹ƒT׸ÎfdP2‡HËs:¤úûüh;䄆š‚¼™;h‹ MOKèz'D>ÂkÜ6ŽÇFÌ0²´\ÖCjˆ#u,ÏéšîsªêÅV³÷ÈùÒ/³ëû÷ÒŽÚ+ÒÙ,^FÚl}Yû6^ùÇ®½¨y&·6ɨ´ÍW4ÆOÊ{è_æ9*í}ÿòžŸÖÏäâ¬Ùçøl“†£ [—Qkèc…÷zÖ<Î7ƒyN׳>‹šÔY²kÍ»a¤%=¢´ÚÄÆ9‚\7Gr»²Xb«\Ž‚.vسÞf= ùð¥¬Ñ™Q÷Ö!GÞ1u¤õ,ùQXk‰±R©Ä£tƒHÌs6¤ÒAd¯ã´msÐíàiÍüt=k\{ú`¼ÐÓ}/2tŠ6ûÞvA¨ôwcÇÞ*˜ÛңʱºžZÍï ‘{}qì±à`žÓ!ñÀSüʱŽÊ#ݬ|£+ùʨé¢v›{(u¾Ž!¯&³Al®þ¹ËïºôÄdÑQÕ;È}"ú7˜çtȽï;ž9‚wÕŸŒ*v/=’7þ*OJwÛ|ÎüQ[ -Þ!w,Ïé{ |ð9òˆ7ð«Ù»qÁ=êYtãԩǹt0ÏÙéüÑ..R[Ï^{+ÆQ¼Õof¾—_ø™y›h¦ùÌHe¾§6SRѨ£}@ƒyN‡ÔûþêÒæò#ãAÎk{üÒ=™¦;3ðó>ݹQ¾ïµì ’Å$“›Ü¼8?BåXžÓ¡òÀ=BÑ£½ñ^~ߪwVE¿ ”ï 3<Á—cyN‡Ì_ó=W.(huóÞˆfè˜wêœÁ2J}ó%‡WDƒyΆR?¶Óñ³¯½?‚;Ô=ƒÜGîñ½Ÿyóøº|0ÏéPxß·œw’”}´RT›ïwõk:©Ç…5üáš™Eaö⛥‡Kä}Sï“û9=28ŸvÞI«Ý[Éx‹™óœm>ã3OàXDå<>Øûrô—ó“wß >˜çt}þyúŸ<á~GþùuŽ±ù„ù&jã;˜çlˆ ;EÞø¦ÊC«œ/5â:Ÿõ½Ÿ¯æ:3)G>£ç>"Çòœ‘¿Üçë§-wWT;ˆsï-Ìs:Ä}+¦–#FCøž —ç÷Jî>?ú^mwa¼“Wði»+ÞÛØA%{~=!Ìs:TÄ!ÏÊiwVaCÈ~`vÿ,£¤ãÊ=~Œü¹õàŽ·Á":Ù Í+0“ÀpûúóòñkþÙ'7ŠÌGÚx5@[ -ùmý{ow5?,«‹åÝË›æ7óøå:7˼ßQ«õݞ˛æ·ÂÎpYg¨™rs.]Ó-«’ò]A5¿!6CyöÐsZ¿üÖW~ûµœXxc­/{ó9Þ˽¾2ü¦|·ÖÍì¡õmµõ\¹‡MWþ|ñóÉz>}He¯Ãäã ¯ž&›û&]óiQYÒ¥ëôÜØúº“s>Ôñçšj=çQ壟ò±Ë!ìbMÿóÜé?]t¢)·f‰åL65‹£)MüvÉgò‘ &šÌ 8 ת–Eº$¬²×K~=sêSZWÞš¯S-<¿Þvùh\¹›œß•lù¬R%‘O X*„ÈéõVœï^Mzçs ãd×+_Mq¾Ø a+xÚV`Ëx(ÖV1¡Û -«®‰ {t>§6oÂj:o:ͺ¿¤5uç=áëÕÚ^ú&Jóij¥¨ÒºFU™eF¥*u%eíªý$ˆ^/‚ðUŠ&tfÕ³^ËgÒ,ÂX€D5]*éÑëEL·–æjO…š*¶¬©´|3¥AÝÆÚð‚ln£UòA­lŒÀ]1¥¸Øç(}­"ÃÙ_/˜bh#~»¸ ¤v+”+ÐãBËÊ­â¨^š4ïø_>ahY>Ñ#ÿ¿P…«ÒÌ<óMRùTžvÕ*Éc³Šo‰Ë}e’Z@ShiYsé*fy{騄ô™tkêÚb7RÖdLR1/“T%[±®¨«âLa¥}*Wr¡*F º&vÊo7âf§«C`/•yÍàîj¹Mì+w¾qq¨=®óKÕÞZ.Ã|¾Îõâ ýX*ib£êl×*cÂfH¡‰¾Íâ2Z+;åccËÇ6Ȥ÷õò·Ë<ÍëLÂou>1{^úúHó-~ÿ~¡ëŸË5Ëj5Pdá’‡óÜŸl£$%~ÂkBwLd­ -xÛ1á Št¬`E½­çáÉÙ’oé±ÂCæ¶'¶ÍGnϱÌ9HT/C^*º4ŒªbÌ%´> -endobj -534 0 obj -<< -/Filter /FlateDecode -/Length 4510 ->> -stream -xœí]Mܸ½÷¯èó«åGñ ö bdƒ0²‡ ‡q¯½‹`À›Cþ~%‘,I¥–ºgìh¼ö Ý­*’*_ÙjIŸþ¾Õø/’îbLÁÓùòáôñ¤ºàþõ%&½ú5^Áµ¢Ð9|tçY`C’3ÁŸOøovÈ‹?ž~üæôïi}6]JÞhwþõ]V‘íB A9A• RÚ -*續ó‚Êë]LIRÁ ÈÐR`¥è$Ì c¢ Š0ÃRÐv©J0ÃM’ -fèä‚ Ò -vh£”¨ƒ!ŠÈA§]çát/éŒî|L&‰ºFÒYÛù@ÚiI—:ｋ’Ž`‹KJK:[œ&R’¶AÒyØb½U¢¶˜¬¤ °ÅÀ;IÐEØtEQ[”WZÒ%Û¹‰D]‚NÅ—:£\碵JÒiÝ9`ÓŠ:Ì( ’‚ÎÀ¯\u°ÅYe$…-„?Ižp6Ä(ÌV“g·UVK:[Œ $ê` _bãa‹ -^¢Ì .ó’Ä&„Ž’!‰L´EŠ ˜˜: -ÁJ4`’ëȧ ñ€U:£%"° -¶8òX [3WÔÁ›Hâk` -H\`-l1d%.°`[Z$.° [RIK\`Á·¤´—¸À‚pa¦’¸À‚qmô$qåJIâ εàN‰ ,HÓ=H\`ÁºÖy#qíZŠ^â Þµ¤•ÄÞµ5El€%.;vVG+qw­VAâïb‰ 0ªpè%.V:£’¸€À»&*’¸€À»& ˆºÐaZ‰ ¼kº Enð®qÊH\@à]CÆK\ tà%fà]Pˆ“ÓØ‚•¸ñ:c%.@cAZ"qïê„ð'Ìi°U§cò8ð®Ž>Q—:àqaÞÂËö>I\àÀ»TVâÞ}F‰ Àñ"ª‘¸ÀwµE¤–tà]m’’¸Àw‘78‰ ‡N#¸ñ­Ó -Ðu©S)F‰ x´d$.@îT“ˆºÐHZâq§‡J\àÁ»ïIâÞUÎZ‰ y±í$.Àâ‹M,sDl±Ž$.ˆÑäåf”¸ FØb”‘¸ØÌëÍ qAR°ŸÄIù.§É€Æ¡SJ₤#Ö›†$.À¼ÌëÍ(qA² -ëM,ñ„y›¬ÏëÍ qA"Ø⢈:Ø‚¤) óœ„õ&ØIÒyØbI\¼ÏëÍ(qÒ ¬7‘Ñ‹[1¯7ƒ¸]Þu Ì$éÀ»ÈL½Ä8Àz™­´¶W ^ŸÉʘWœQÜ1P ^‡Ø*n(p/¢U÷ È7¯‘ÄM˜‰•eôâ®Â*”Z‰Û -ü‹|Œœ0ì>ñ-*8ÄÌr'¦!»¯kŽVÌ®öÇ~ýùôÝ‚ïùçÿœÞÓ?¡/Mȯ0 LÂp;dßÝ·ÝæLRÙBxOlDHÍH Z7ݲ‘ùßyùab9 ÝŸÞÖÓ'Dñáô o£±„#–¯s‹o¬òŒ+,Žm=ÊØd2;rÈ+M -ÿþÍ @­ö@ë!3ñ‹a2îüæÃ黿¼úû_x ½yúÇïõý·:¿ûé»3ã{߆Ïø¨\)߆2å¸ÿü0”¥wx•v.£,±ºïÇ÷± Ö½*ïºÔìsn<·aåK}¦+åj=Íúö–Ù!Õavj7êüÔ¶R¶·Mj+LûTêkóý?Ïo^þðf -®>ãÀ•0D¹ÌWñ¸¯ÊSðø)`ˆåë^usæY­—ÐR¶AtÓ[ÚULV†1N‡³óŠMf‹ˇäá3m‡~!÷Ev1~¶ìÝŒåÒsõU†eÞ‰¿•'wÖ90±ºŠLÝÈÂ)e”+aº)Bv¾G˜¿Š<“ÑÃ0êù}mäË9ç¶T’˜¡|®/èà³J·~g;«<Ìê”þzÁ¾5R\CŸ­GyÙ‚3n }ûê}t•çóUB×o/”îãºy -R8¼¢~‹Yâ‡_RÑäEÈuî«s8îK ×Uß2¢ =sïç Æ·nf G¸ÀÓ/7 ]AgK KkÐ_ð~ ûêOÈÿ¯¼òŒ3g%Ï­õÌì}>³âørÃk"BNY¢¸ˆ=Ã2½½«–uŽ†=s=;ìý–ý÷Óè˷͇Æ0–Œî§Ùç™ß7ñ4_ž³eù •¡ÞËXëÙT L%d‹¥Îœ©{·ÿvl;-m©ë(µì[#³²½lî­ÅkcogÄu‡Ê¬±0Üe:zO‰i×¹@@hõnAÁ^ö\Í欪fþ`(Ÿ×!¾n›­í¸®·iccÜ<¹¯Îáy=ƒ¬^~Ë2ÙžJ¯›s[yÖý‘ñµ}»sô¯Œ°¸zç™ÛlÖÌsÃPXÛŠS»JÓ¾Ò¬þÜOå½ú¤ìÌ÷Šô ¿ÇÙVâÞÎÎ:‡Ãçõr1³ØYqY°pe¥±µcTÛ¸ÈãÍÇ÷f,I¸ä¬õ9°ÆíÙÜ¿™Óòl1#Rþ6î*2wÖ92íõ óSÄò#ï켈 XƬ¥Û1»¯Îá0{=ÿ\Ìþ{¾EÙ`Iñ'0Ó•oLžbß­_€~ò]‚5&mù$%×¹þk™-Tî«s8TnìbÎF»ŽÜÊWÜ_÷ÞWú&?® 2ÞÁ•ûê•×3ÏyFyË>ù—Å_wÌÐgÝÓ—‘J,«Ì?3Ôò[HÝYçhH¥Lô7ÁW+3rã:“Ï3WÊrȽ×jì¬s8„nì{Þ³Gyï|Í v_àFîö•üÎ:‡Cç'Ê?_hfð¬3îsDz–_îŽôûê©9é‹äŸ/?Ò;uûI;ë ¡n#½“wn¾¾ãk¤ßé½ýZöu‡ÎëyèÝëÞ/0ÒßsEÕ§ŽôÎݾ¦ßYçpHÝÈI_$ÿ<Ó ;r¤·¯éwÖ9Bwæ¢üZ Ùï -Oð«õ|ž‰wã|ê·EuÇ7ñ;ë ‰~#çü×ïŸbv}†îííkõu‡Ê=ÏÉ5Ï4›vFp~­È‰ ÕW®5™_Vóào9ýß½ï¬s8”n\ÿ9ÿÂl¥0¿îÌÎ A«×¿=ãÕAÜõ^ï÷¯hæF­»Ó¥ü~NùxyÝá -BÙ/‚v#t_Ã!ôÆ=OÆi<.xk ‰×ÖË;xé%ç˜ó,gqmýJTw|×¾³ÎÑÐöåšÏr•£~:×®µ_»n~ru^FÑøÛ³Õvæ}’òEáZû{bÄÖoæÖ¸2ØÛ¹rgásç¯Ò©yö··^¾±­'­WyÇï‹vÖ9"7òËÙHT¯^Éîïâ°+w߸%äWÍÝ|ë¥Ãÿ~­wìiî¬s8´nübý¥rÚSîÄ4[áMfâgA+7âjy¤&Œv²Á©­;qí«s4tƹçJö.íÐÔQZÉÅ6ËVƤÞ~0÷%uýÚ»ô¥ƒ%Ÿïíó£´Õ&ö}yõÇ?ÿéoóßçç}I– ¿c+Q¶ÕþLmn±#Û8”u!ÏÐÒ×áx!Ëf=AžÓ^º°vëþ,Ϲ›=ä—òÜ~¶£åüãyíðyúKé±^ïÓ]NŒÜ‰Ùo†ÆvX_Y¬eç|?¼Ìeì+vÄV¾ï×ezÜf}ó£z›ßØ9õ +£]ê2ÌbíÇnyÞŸ”Ÿù‘l~>ÇØëŠ=¹­±oý}–íx›o^›°l§·ûa´Íõö]³#?ÓC¶C ïÙ/K&†¹%Ø–”ោ¶,·6§Øl¸Ìc›ÇÏ\Ê8Œ6¹1†Ï_Ù -­l¹8à´·=ï^îG?ö¥ÌûfGË-†ó 9ÅX®D6Wp0¶ÿ¶ÙWòŒßǹú¶Þ õKäœ`U˜0Ó~÷J1;JŸ žÂðÞ~½8Øߟ§Ô«ø—}yÉ(6¿™çãXmm˜Œ›nöƒ_¯ø 玪 3€¬ªnyNìêÚ`'LÉpl—^qBãd6”­„G ªÙ6q@Ú­ÄSTÚÞá3wLcEΈ… ·˜påÏé°>ƒ×í•w•ŸÚ‡~gº¶Ys©×ã=‚ƒƒ'Ë÷hNGvËáš@mÙÈ—–7(.·ù=ç¿yBÔM懃ÙxFD)äûiKIC&ión S=âÉøÁ%¶à0±ä"eÒ‘¬ê$ɧ ~·ã¼ê]ž¹!6Ô±}v .eš‡qÈ.ϳö¯gíCùÉlZ åÇ“ïï ¯ûçƒ(;mòÄΞ:›Ç&óý裲¤ËÐéÞÙú¼R³ìÚÇZj|›ÊgÉ7æÓÆÆòûAÿ€\†:_²—þ©IªGSšøñ”ŸšE‚˜¨¥@â,?ªÚ2}3“]°*]š—´®ÜÕš¥]Ö•Æ•Þäú®TËw3'U -Ùþ~ÞÉ!jz½çÞ«Nâüä±ØÙñÈWSœ/6CØ$^¶5Ø*nŠµULè–BÅN×ĆŠ=:?©¢ºÎ7a5»N³á/e‘º™]ÂË §µsé£(ÍÏ;*MïUe–•ªÔ•’u@¨Ž“ ºœá·ª4M̪g£–Ÿ1cÕr©”D—“XnlÍÕ‘ -µTlUSñ|3¥AÝÆêxAvaK“¥ÈæRSÆ‹s\ÇZE†³^N1´?ž\J»ÆÊèq¡eíVqT /Mšo$6|ÂÔ,²|Ïýüÿ@®J3óô4UHåçf´£v’<7«xê$.÷•uHò€¦ÐÊ2wé*f¹¿tTBùLºµtõØDÊ\Æä!ó2IUò˜ŠuE]g -+þ©\É…ªÓ5±«P~œˆ›®NU€½œÌkwWÛmb_¹ó‘‹Cq‚Rí­í2Ìá¥l4gèÇr’&6ªF»v2&l†š¸Ñèc/.³µ²S—Íñc›dRĽœ~9õaÎXg>x«ó3½xæ¥ÏÿE™WxýëDçÊC$†8nTe S¹u"æ‘,?2îç'Ba6LhˆÑ~ëØʺ‚†Ça|M­ºjÄ^JêÊ ºj¹Ð52±©Ð5Ú2ϸ+ÂËÌ‹5‘yêØ´€=ÚÒ9œÆæÇ«pÀ»ƒÃØt¶…ä3kG¹h éÐ’aqÀÅ!;aj–MÌÌ€ä'©®Ïö -›ÏÅX‘mÓQ ³¼é"ë{ÁŠ ¶ü€7LšŸ4M쌾{z=yÜG“}™YZ©½J¹´v,K+áÉRÛúéa9öœÊämªmY6÷lMrÚÔh©M8F™4¶jcÇOJE69i •. SEV[ Å&?V+né{E/…šS4é/ÜÓŽJu¢ã£âes»%âÕlÉÖÈq8‡Ö;ÕJÖ\2 -2ÏkW)µ’¶È–ç¦é¹K´=³nP3Ä·ÌTµjnQò.þ»gî uf;R©ò×ïŽèØ»„@M:Xcû'i«è=8„òÃE¶]rsëû'Ë]’²ÂÏ„áèÈZt~&ºlÂ#i[Áš*ÏK—«%%vé6ÛCæÔbw¨(nÿ¥[¿ITC^*æg`ÛœôÆüèΠ´üSÞ#Ž“í“þïz7«i -endstream -endobj -535 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 534 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -536 0 obj -<< -/Filter /FlateDecode -/Length 4427 ->> -stream -xœå\K$· ¾÷¯ès—õ ^€áC€$ˆ1°HA³½;6‚q;‡üý|T•$V»ºgv¼ÀÏN©EQIU•ìÙàç ‹2Ù)ç’"/?ž~:™)ƒÿj‰ÕMe‡ßÎÖPš‚-1‡óLðiJ%¸ÏO'ü³¹•ÅŸNÿøÝé?ë:öì¦R¢³áüóGf‘ŸRNÉ…UÀ2Ö+¬¦”\ˆ -+Ú C,EcAŒÈÑž• •4Ä ç²ÂÊÃS²~Ï*Ã%K bØ’²rXgŒÊƒ †È;…gáô¨ñœb.®¨¼žMNãy?ÅD6XW¦cÈ K(Æj¼Y‚%2²ÏIãEÈâ£7*²¸œ¼ÆKÅA;EáeÈëÊ*²˜h¬Æ+~ -%©¼žÉ)ïy΄)dïƳv -°M¯ò°¢0I1)<Y¢ EåA–àÓx²~4p"ø”³²Z¯no¼Õx²8—HåAL¾†.B“¢XAã’†.¥‰Š# \öeÊ -¸\&JÉk0àJ˜(–¤á€7•'Ü ’!²Td¡D °žŠ/YÃ‚ä ‹wNÂä B LÅ"úVÓÈsQó‚,ˆ5,’M¹iXBD>­j¼è¦œ×*/ƒg“†)ÑWl5,@.5e,z ð‡K@ ð,iX -dÁRÑ°®hÊ‘¹Æ³A¶†ˆtÁ³VÃ‚ì ¢A ²ËÈ2£Ñ°¹$T­ñÈpž™5,È'5,À2A¦ ¤Ty0¡a懓í a’$›HsTdñ4,ÈÙqº™5,Ȳ8ã4,€mr¾™4,(² âÓ° ˜8q˜¬a`r¾™4,(YB•Y4eÝ“o4^„,®†%FÎ7³†3o"¢W·2ç›IÝ.î†dÒxÀ]D¦QÃÜ ßDd«åöÀâ3™9ãÌêŽôøVuËÀ{á­’ºg`¾œ#©›™eŽê®Ü*˜Ö¨Ûø‹xŒv˜0ï>É-ªsHð™9ñ –!ºï9Ç(毛÷Ç~þþôåœïùûÿžWwÊÚ…ñ{ŠœX^®`ºWSmŽ`"ÖvìX@È÷‚*,B*CD P\¶ÜXD8b8Ûrîv-0äe‰-B™:.’Ý"O°˜(UIŸ[å•$ -"X&rQDn÷+õÎ:¯®UÙï½j½³Î«ëŽ83{C÷ëõÎ:¯®WÙï½z½³Î«ËšMÍÉKYÍ'<‡&ä­Â7¥óüßyqkù# Þ÷kí¼]BY€;+½¢Ð{ðýý»¢Œù w.lsrˆàLÞýxúò›?þùOû³õîñôϯàúȘË0tÁ5þÚ_ÿëüî›ÓÞÕqú>ÎÌ›¼ y?Á¬ ð3y—#M¡šgVy‘­-ŠÀàp`ä“/Ž4x]¤Ö°î­v¨õ:+©ßZš¸¬6Â:S•õ—oþþ×o…²øi…¯¿°_±²æ¿ÁÎôà—ûˆ¿U}×;D4b -§ê›¹³´ƒfa:K_e¡·ë|A8‚›¤´¿¾Q1 ïoÅxMªõ‘Õ€ªZ}z€Ms˨ÂmÖGG¢?Ð}d^®7}T-’èOÎ\ÜÈ³Ô eO»cüHU8«1íóµÏ»™P^LWGz£>Ïž 5Â}-í2)DãË ; EÌÆa_€”]¼&áuŒèºß -üâgaéò ÀÛð»ôY¯™ÆÙ/²G×d°ëY}†Yι,ƒ½_d§ù~G_Ê2ŸA“ÉTàŒ«bš[÷]ëÅ=Ûg9—~ý|Ý­ûai×ö¹»GI*uæãK•GêbqÝY¹^x?_»vßø—eœB'u,¢Ï¦W.3cþ÷büé~Wõ—6ãMN7ÆSéy3Õ)~}¿–ËVËæ=7,¬É®-¯ZÏôeéEußüx²Hûì-ââº×n[¶=ï¯ð3¼};uÔ‹l¡Êw$G²×ä0M[‹ö—•3¯€ÅCîeãg¹ÑbN¥íyå®Ã’±Ç*äð…-À]š•-2…†ãóu[M,¥Q¶®°Åš56 ÒÆQ-ª•yrÔ  ]ÖH¡Yãr_-—ævjûï‡|Öê¾lõSÛú8×·­?Z"Ï}T›pëqW´6BŽ6æfOiþ[Ûû¸Ø×2϶Õë«J×5#phv`š nç±Ë´y³C~x”=y»ÕSgÚØÇ{bñ¬:¬: c®›ÖÈ¿´+íÝHô–È=—íèNÂ.Ìm5þ4·ÛѬÙOkû¶^üníF‰¬×Ø‘Žø ʶùm:{ö%º7d?î»—½ŠæÂ?šîÁû¼\Öº’ž´–Yú·VÎù¡þÂή~aûà鮑ÌòË:~í9íŽ=§ÍØŸ“2’õS.u³áîœñÎ:o&i$—‘ó§lãgJ×¾^Ò¸o÷9Iã©îN÷õ?=i¼®©·—4¾@û"i|‘öEÒøjÚIã±þ¢I#%ÏP€ÏKS =ëI#¿a4¸M{È×Bå<»…z-eÝêQ$~·’CNŸfW#ÆÛÚ5C×-õ8N£‚ç7\3÷iiÔ¾U(W]ý¡1]“ã“Ó¨}ÛÕ–‹§—¶ôð—–P³‡"®e¯¥D›0»ÖaY›§ -nÓ†«64BÊuš·ã®càþ?ˆ)­CÇU.Ãí‹è{¡u,òÎën¡mtÔÂJ/tì“i:½^Z{¤#~;l££7•þš_)¥=Ô™Ûêì×O¯¬·¦™äM_;ß$æÏ,QOcÛ¥6‡º"MWŸ3M–©¡–æ÷šÚb¯½ï}u\Ì¢e^V>íÙ©yÜûƒáã­4.¿éç9i\âï'b}Âywwg7“Æ¥úùÔi?S·îðõÒ¸}»ÏIã®Huw·¯ÿéiÜuM½½4îÚiÜ‹´/Ò¸WÓ¾HãŽíôåiœŽS™¦œ-–ˆþºBÛÓË* ð×û}àÌß~ Ói]íW€_Ö]@-ð{×&;~ßðï¬ó)o‡üx˜á¡yaÕÕE›•ùx}…¶6‚ÑÛ)òæù]#Ö}¬ÓßQ¶§Ân7}5úìâ[ú¹áµ¿[{ß"‹Ý×õn¶Òvÿ:º¼b±üyãl}.g˜ùüv÷±ÅÞWçXì{þJúšÅþf,í~´ÍÅ¡mGÒ4ÒŠâJ´Ý…Ñ -Òõ -²t»éði‹5Mœœ¥Ltëm³ûê¼»íHËoôØmMÜæïÆNlKœæë}ùítÚ”[6@퇥ÎûÁsN”óËï‡å/-×ܾŒ>Wlö•@ÏÖfëw‹¦é- ð½XŸ€AñgÇVw_7buCl>8âÀêüÚÚº¿Y4I -/‹æ‹àm|S}šéÄì¥uóöÏÚÏÍ©ôB{¿ŸùU²úÖѽ–ð̱öíyüT‹¥Éñp`©q`gË ânZê}uÞœ¥æc|ôËIÃjšåÍ›={ ÚÍ´f]¯d‘ÏÁ5)›´† VÌÝ–eõ¶>›¥û|K½¯Î[³TƆCS5“z/ÂÒ‡ `ÆÙ½¾þ4]‘ccîÝÔ…oK­ÊGŸW¾]Xþa£/¡ÉZ¦n–ß-ߧ¥€ ¿ÎÁfñ¹[·Å›En˜^ ½÷›œíæ[™ut^øå—Ä'^ ÿ¦’ø[Îk±¹û8ïˆØe œßâGF¾mQñ¨{yÏÖµ˜^<†é–G0í‘€|\W”™îú£N³zÓkû(¬ö÷°ä³z„ÑÛ?x,ÔÇÚvSùÓ)Öï’m=›ÂÄ×& »q;âåC;òÓ)$¥tX8£ì‰^´ÛÉÙ {Ô”›ª°4¿÷æg¨ÊÈS/,u“â3ÆÝè„×f'¯•$é±£i°”FY¡.þ˜Åïèh;¥<ƒn/Ý5¶¢ -• z*M<©k²íV×É aM?+%Ñ4!ÐÝ ‡nÊO+ò3ô¥Lï,Zaî¡·;ȱcç“$§>ã–àèòöv…Í7â¥:6Ú’ÙôsëdéÞnt&ˆC0€Â }ªä¶Z;:ñ¡‚ír,2Íã^N?œª›s>8~~½åó¤däeÏÿC™oðûï¿mÌ~Ü™Ž®cëŠ,=Ÿ>˜ï$ói„Ø— :°?È6²¡YC÷ãÎ ¼¦QÝ `o%mGPÛ¹’†ÙuÓuÖ Í„âe£ÅÈ|êÜ ‡=ßú68~ÎG_4©p#‡ƒÛ> -endobj -538 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 770.673057 101.433071 751.923057 ] -/BS << -/W 0 ->> -/Dest (cb89-1) ->> -endobj -539 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 533.926036 101.433071 515.176036 ] -/BS << -/W 0 ->> -/Dest (cb90-1) ->> -endobj -540 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 297.179014 101.433071 278.429014 ] -/BS << -/W 0 ->> -/Dest (cb91-1) ->> -endobj -541 0 obj -<< -/Filter /FlateDecode -/Length 4620 ->> -stream -xœí]]¯ä¸q}ï_ÑÏ–æ÷ìC€Äð"²À ~òp§gÇFp×ÀÚùû9T‹d‰*Iì¾wf´Žç¢§[U$U"O)JTW‰¿ïþ‹V‰SðözûùòËEŠà$þM)“úG|‚»*iƒp*ùè®?g "$§ƒ¿¾^ð_wH“¿^þø›Ë_–yÔU‹”¼Vîúן²ÊbÒ1ª•T†Q9'BÐÎ3*¯.1%N3\°Ú®Ufا‚VëȨ"Ì06(³V%˜¡ƒ²œ -f¨ä£Rv(-%«ƒ!ÒZ£r£Ò=§ÓJø˜tbu:4§3Fø`•Sœ. ｋœÎ—¤ât¶8e­ät°Åš8‡-ÆÉê`‹ŽÁpº[4j'1º[€®Èê`‹ôRqºd„KÑZV— “1ĵNK'\4Fr:¥„6 «CB#ùÀè4lñÒ%V[œ‘šÓØbñÇéÀ΄™Þªsï6Ò(Nç`‹ÖÁ²:Ø‚Æç@{Ø"ƒç(=Hd^â8@‡ lÒ–#°ÑFŽtL†`8ÐÉ ëSàxÀHV [œõ[,z.«ƒ-&YŽ Œ†-HÀq1°E[ÃqÛZ …㺵2)Ž øÖJå9.0 \˜)9.0`\½å¸À€r¥Äqçp'Ǥ‹î8.0`]ã¼æ¸À€vžãÞ5VIŽ ,x×ädu°æ¸ì(ŒŠ†ã Þ5JŽ ,xÝHs\€VÀ¡ç¸X:FÉqïê(-Ǽ«\« }Ðp\`Á»Úá8Ï ÞÕNjŽ ,xW[í9.PøG²Ñxâøp¶€`9.€¿‡NŽ P˜ÐK8.pà]•àþ˜> ¶*&Ïq愈æcuI¨€gú-jY(ïǼ Ge8.pà]Ðgä¸/àQ5Ǽ« <5§ï*$Ǽ‹¸Áq\8…€ãø7¡$ Ëê’)FŽ x´¤9.€2‚IX]’â¸d,$âPŽ Z‘Bðø$¡CÈÇê¼À±ã¸ H(‹ÕÁ,ǬE2)r\4l1Zs\4lAÈÀq"‘¢ovx[v|`a "EŽ Àd"&k9.Îc<†Zåt^‹@׬.B§Ç!XW¬8.ÀXJDtzŽ @ð"‡KÀ è”å¸ $Ø‚®Âq\‘ˆ‘9§S°A6Ljt¡SŠã‚¨a ¢AŽ ¢ŽezÉq<4Æ’¨jNgegFŽ ¢õ"‡Š ›`¤ ¦du°4ÁqÚ'¶Çü`°‰a«ƒ-ÆYŽ bÔy¸9.ˆ¶h©9.6óx3p\$lAÄÇqA’^ä0™ãÐ8tRr\TÄxS[Ž Ð/óx3r\ŒÄxC<¦ß&ãóx3p\,lqQXlAД˜~ NÂxìÄéûD§¨<àà3cÈ™Ð-,¢û:æhÉÌF²ûüØ_ÿtùí œïõO»|þÍ4SVþ„)µE|…n šÛ!úV¸|ãÑÐJLB;YŸÉ“©©@‹ó¤[6î/ÿ»®,,‡á?N§7õô ^|:=Ü'‚’`,€1|æ‰ÅfyGƒ%Gð¶iLÒ™9Ä•Ò.ÿó‡ €:[qŸ­‡Ä|øK †­v×?_~ûo?üç¿ÿáGÀèÃçËý“”ö')]üþ;•»ù»^»pÿb=β>O"éÝFRŽµKYùîó8¿üVòûÿ¾~øáò/–5Epwx™\6å^¼Û¾cYÞÒ¾_¢Y1ÜiÖÒTîÖšª¯JuÖ«–~ÕtŠ4Ñ ‡œÇÀËÏø‘æãò缺kâ°Îëä²|i„0ú¼ü®e¿lÀö6§ö»‡½}YC7×ë Z»µ‘ižçž!g³#Šyþ襃yÎSŒ5öpÚ·ß„EM~ßZÛWy‡ãEþŽªìÇ{[M´Ôa¤ä?ÂTí?·íóUúº-Ëœ0܇ö?KúNý6Ýõ}ÂGçOyðš•À0 ÑÊÆCŸ6˜çth²»¬·ç̌ԣ¤G”"-J[ßꟗåä|•ÅRkyEQðyYFÏz½½SÞŽÍjY¢3£Vfû©•¥Üº™S{ZÏ’ŸH¾ñ´×n9gÕB©q¤Žå9R÷îžÓz´en0j?Mnmƒ–Õù3·ŠöLK÷­HÐý–,̡ۨÜ÷ÊŽžÝISšUŽœKϽÊ.uY^}váߪÛ@" úò„`œ&qö‘8–çtH<ˆK+\[ê#ÃGz›c&ÝV+3ƒ)}iñÎ+/t%_é5ÅCö<Õ!#G#È+çÜDl.âÝèíxY•Èc#²ÜG5\ÝâÀáÎ`ž³!WïÇŽÛ}þܨ~3ªÈµôH^!˜Æ¡vYO=9_PÇ]·åuÔúxÀûësÚBÐàýrÇòœ¹ûqjQt±à4Ò$^šzÚ£h G+OÝ{ò‚´>ædZqŠ.Ìú|Æ“˜Ø/í_Å‹dbQV|ßÒí"¸G=™Ýx&Õî .Ës:DģݼH­=꽶F(„£h­/<ßË[b¸oÏç=òVS™ú #•ÄžJ‹$£Î7Dö‘:–çtHÝWG6yÈO„)¯mñKißµ,ãŸéÎòí¨…G¥!s’É 7 ÎP9˜çl¨4±èŠm÷ŠûFP½1*úu |™æq¾Ìs:dÄšï9r@ùC£›÷F4AGö¸çAðJ[,9<"Ìs:”ÄŸ_kìý%Ü¡îä>rï}ÿÈÄÇÇåƒyN‡ÂýØRÙu/³Úv®ÍœÆÏé¸gÆð‡cf2 ³5¿YZ¸Ì¼¯ÎûäbŽÃH ôʧ]tÒÏÕnd,™‹õ̃yΆ6{3>sŽÌ¨œ'{_ŽþzqòBI˜,ÄEú£Y¡Á<§Cèó÷Ó‡øäÑîw䟿ÏÞ±Xæeî:*íŽ;–çtˆ=XÎø(òv¾·è¡}d”óµz\³¾÷ýuKâC§…tÖgôì#r,Ïéù뽿~ÚÞ²;¢âçäãk‹óœ qn?®Üº—ÃΆÐ5A/ϯ•Ü¼ôQ®Wa¼STð¶Õïl ’Ü¿!Ìs:TÌCž•ÓvFaCÈ~À»‘^Òqå&?ÒûÖƒ+Þóœ‰1âi8ãï¼W<ãÅŸX—9˜çt(ŒK Z¹zÂdµvœ lµª—›9xjfµÒAÊÝ'sèìtµïÆØÚ­éTŸÞŽºß~ñ:äQìåããñÁóQ~|à -Œ¯ÂßEFïv¨žÒ=P.}ªn÷!ß[;÷´>uæèÅ:ÔþɽÁ{DžÌMú„vVVÝ‘Ìs:ÄîǪýóµ\ë~ä½0^¸¤#ö<ƒ¼çÑ„¼vÄ¡žÌE#p,ÏéøíãÐþYÈ2vâÍo2·m]õƇïÿóˆ ->̯ŒÊZwtß|0ÏÙç7÷VGä·ó„ùÃ<¹«õw™îªëWoŵÏϬz’k×ðk{Âë óœ5ÿx6|ÌþÙðoÝç)™s­ æ9bÿ1O¹èYGem¡r` æshß@h|ü}ƒyN‡Ðƒgqžä‚þéÑi4¡äên$Ïÿ{ÆÆË®äã÷tóœ ‰ñ &<o¼Á£ÓX‘ØÂ"ó¥C}^\V*Ïqïj³žÓ¥/Ë‘ñ‰w æ92î{+¹ùÌöÈZïáÖ÷s ÓO‘—5íéþ½Õòu”±ñ^ zÎ ©½¾ ƒö*/k:g¹õ47ZÛâÅ-ô=±r0ÏéÐ7¸²ïÓ§\Cs®8³B¶W¾m ð‰g¶óœ…cqâ×ZE»Írÿ ›Ï²üšãPI>þìá`ž³¡3½!vü¦¼òŽ=g#Î]Ý+éf½kÏŠóÇÉåÛãkö1eñâ<öÌã«|óœ{ûÑáToažÇÍuù±Õ¡Ö¤>KD÷©ûÝÕû!žú:™¯Ö w«‚Ø;7ån e*&Zܺ;21h_~Yí“Ö¶Ôqshô­J[þ:=ñ4ö`žÓ¡ò j|÷·0î#sóÉý -}¯ÖfÜгjÿ4z?²¿@ÇmÝØnñ®‚—Ö7ùÄjÈÁ<§CäØû̧{býÝ­¸‹Þ´r1:ÞZ}Øú;-ÌŽÞiäÖõîù‹¡÷ŠS}Ëû[žx_øñç½ ‚CS:—÷â‰NE²µDåa’ ®7¢(Û9\ó_2?£Ë#TyX¯ül -yß” ªþõ÷¿ûªéå¹?ÝÙ܃šû t§Ôûûq¦Ÿ©’Tq´÷îÚXÂòxSCäJ¿Sœ§_ò÷ý•y”w‡7-TÉiýý3•5ÿžÊ‰Å1ÏçËÓã9~¥I¸ëå»ùÜÄž© G®Á•kø¾oÊ_.~ÚHMûÀI7¦óF±Wo…Ém“®yß¡(U¥éÔTÙ꺑sÚ^÷—šjÞqWæMøòL÷íxÉÁœþ—©Ñ¾¨dE®ÿL÷Ý1å$Žº4ñë%ïŽj±µBŠ³pþ)kYV•„UvÓ‘ú”Æ 9ÿLµpãÊOíÊÕäü®dË»ÖXY™iß–û‰!rzµç«—BÍâ¼Ãlf>òÕç‹Í¶-MÛ -lÅÊH"tk¡$§kbm‹=*ïHV«Î7a5V"Í_Òê@šsOx»à´¦—¾²Ò¼¯e)ªÔ®–UfˆQ©J]IYÄÖvbD· #üN–¢-³êI«åÝÁîÂX€dkºTÒ1¢Û…M7—æjK…š*¶¬©Ô|3¥AÝÄZñŒlª£Yò–Ù¤HS~.Å>·@ik nôJx»ÀÅØ•øõâ“Ú5®®@ - )·Š£lxiÒðß¡kYÞ[)ÿ§ -W¥™y¦ÊVHåýÑÚQ;Iî›U¼¬$*÷•u,Wʆ––T— -¡b–ÖÆŸLúLº5u­±…”T‘‡TÌË$UÉc)VuUœ)¬ÔOåJ*”Åœ®‰]…òëBÜìtµ«ìåd^¸»ZnûʯTj‹«¼Ù]µ·–K0_„·É±Ù^œ¡ËIšXËêíÚɈ°RhâF£¯“¸ôÖÊNÓûà短“q÷vùóersÚ8ðÕ÷n¥‘—ºþ/Òü€Ïÿ\ìõe³°»ײ²…®ÜºSO–wúŽƒâ¼ówÖnC„ÚÚob[ZWÐPý¸Ö„¯mË.±—”ª2¨ªZ*t­‰XWèjeH͸á­«ÅȼµmšÃ¾šrq8ÉÛÌ«p@/‡±éLsÉWR$ŽrÒæÒ¡µšdÄ-‡ä„©Y¶03’ž¤V}¶ßÒ¦0ù\䀄ùÐ4mn–]dÓU$ = [EOšö0F?ݽÞÜî³É¾ô€,­Ô^¥¯TZ/,K+áñR3úåaõ9æšJçm5TË2¤ï™ä´®ÑB »8 %ÒØ²Í =©-²ÅI‹£¨t™,²Zb(6ù9[©–éŠ#[K¡ÆMúgZÓŽ¶J­DG[ůÒær‹Ç«Ñ’©£píêdKYcÉÈÈ<Í]¥¶¥4E¶>·]ž»xÛ+¹ Û ñ-2•-›[¥|Šÿžé;÷<ÝL—ªüM³#*¶í5ᨭ -F›kÊáNôbó¦×ÁF2]òpžýù“õ,I™?¡gBskŒ -xÛ0áŠt¬ E½Î;“òÙ’d/é± -`¦‡ÍÉÕìfžÈœ&‰êaÈCE—¦-ªeŒy‹ö ;]4ݧyYLŸLÿl²Æ -endstream -endobj -542 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 541 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -543 0 obj -<< -/Filter /FlateDecode -/Length 4520 ->> -stream -xœí]K#Ç ¾ëWèÀíz°^@àC€$È"b`‘‚fåÁ8À:‡üý|ìîªb·ØRK;Þhmï`vÔdU5‹E~$K­’=ü|añ_&;ä\R¤ãé‡Ã‡ƒR0ø7¶X\Œìoð›ÂÑJC°%æpü > ©—âñå€ÿV—²ùËáï¿9ü{ÙÇÝPJt6|Ï,òCÊ)™ ° -XÆz…Â’ QaE;`Š¥h,ˆ9:g%ˆA%1ȹ¬°2Äð”¬?gˆá’%1l IaY9¬3FåACä³aˆPzÔxÎ1WT^Ï&§ñ¼b"¬Æ+CŒ1dG%c5^€,ÁYÈç¤ñ"dñÑ•Y\N^ã%Èâ ¢ð2due•YL4Vã?„’‰T^Ïä”Ïy΄!dïƳv°M¯òàQX¤˜žƒ,Ñ„¢ò KðÆi<Y?8|ÊYñVÇÞí·/@ç©<È‚Å×ÀEÈbRÔ 40.iàR¨8Ò@Àe?P¦¬¡€Ëe ”¼®„bIxcÁsVo K ¨!·…à¹*²øBxYÐ@Ãï!‹#¯aÚ¬Eø%S¬†xKÆF <b <×çHx@.L©hXà¹Ø©aèÂÝ“†¨ëCtxÀ®§5,ðÀ]OÖhX@À]ïÑSåA°†@ÇÁÛì5, à®·&iX@À]¸‘Ó°«:À£†°•Áål4, à®Ë†4, à®K*/ ðA¯aw]À´È ÜuÁ8 ¸ëÈE `(ðǨÙpôt²`5,@¼Ïy 0Øà–hX€»¶ ü)> ´l.QÂܵ˧òÊ`4®ø-´<Ø‹†¸‹@å5,À]ÀgÖ°? ¢: p×zDjܵ® pyCаæ0X$ ¾ ÖÀtU^LÉYÂÜ,9 …“$*/ 0$«aÀx0ÈC5,ˆÀ]„÷¢aAîšà½†¸kiʃ,>; ×€·U|Éê`BãwÅ -k<à®1©hX»65,ˆ‰ .kXdÁN˜i()E b1à!åSyqÀuа  KåAJ¤aë¡ø’5,H²xç4,H² eаÁP,²oµ<€,0µ> È‚LQà ٠‘†)DÔcЪƋnÈ p­ò2x6iX ÅVÃÔRC†ÓkX€8]Ò°b€gIÂT \EÄ¢!;dæÏB$Ù ÓÏZ ²ƒ,È5,È.£ÊŒFÃDhÔ’PµÆ#ÃufÖ° S8UÔ°n‚JH©ò `BìÛAÃ?(6Qæ¨<ÈâiX³ãr3kX3dqÆiXÛäz3iXP dAƧaA1qà4YÃÀ8xÆhXPlF½éHÃø%×›YÂâ êM”xŠß¹ÞL‚,)ŠÊƒ,HšŠâ·À$Ô›@'!‹+¤aA‰‘ëͬaÒ Ô›ÈèÕ-ÌõfR· €»¡™4p™iÔ°¨7‘Ùjµ½ð†„üLgf®8³ºc`½±UÝ20À^D«¤î€/×Hê¦ÄDe™£ºk€° -¦5ê¶þ"£3L˜vŸäU„9$ÄÌœx’nAÈî[ÍÑ›ùfÓþØß¾|Bð=~÷ŸÃóoƲúc‘ Œ­ ùÜÀ,w@öm1}ñÒq`fb !à=}XˆTº°8oº±üïxþb!9gÑÑuQä½€ÌéÆ| Ñ8:¡(F}à8fv‘oîsUä„ ¡Û «ËÚU%ïÛu¥ÉzsŸW—•! -%4Îź’*äµÆ¯»ø\lζWx>£n°ºÅ ¼ªäÜ•¹ÞØå6¨Œ‘jE´ñÅqhÞ ¨0´hü»· Ô,Å´Þ.…øH–,¢Ž Ç·?¾üó›¿ýåëo°˜oŸÿø-â—™~‰¾úÂâšž—ƒ›¯ãüwnÒ|§¿×lºÚž_ùú-~µ£Ö7P¤9[âjå²UîëópVI—‘tµÚmår_± Ü \à1Î -e~¶}“7¬2Ü•ûú<œU^N;×é¤+½¶¸Ÿ7~Ýá¡ÂÒÃéc=rÃRERÉOVÀ¥âUKÝ×çá,õJ&ú‹À« \YÚÿÇu u"‡44ŒÁúZ„ßÙçÑ,Ô]Î;/áÔY  ­ø¯™ÁGxÚ†uúÛëø}Î:¢üó3Í ^Õã>A¤w"¿Üéwöy8K½’“~–øó ˆô"¯Ü»g¿³ÏÃYè•\ôNܹhm¾ýéwGz/÷2ù¹¢<> rÑ:wöy4ëô—óлëÞŸa¤¿Ùã>A¤÷þöš~gŸ‡³Ô+9ég‰?¯äaé}¸½¦ßÙçá,tg.š»&Ûûs±¯Þ¨u‘çx%Þ†ó -üÕoŒêw¼¿³ÏÃYâ•œóçX¿ÿÞõ "8™Ûkõ}Í*éÊžçg‰5¯äM;#¸|Vda‰Oª/gûrÍWyÊÑ~¼5®­»>éÑú¬òÙÅÓylEyú»9ÎzNZ¾¸Ê_ïgì–²oae0·cåÎ>fáJιÎÅ~‘õòc}TE¸a‘ò}ò;î;û<œE^É/W+Ñ´z!»¿ Ã4,¼#”OÍ5Þ‡7*¡5f6\”Þ¥}èäUëòK^»a­wìiîìópÖz9×ül1mËšwÔâ묅'~RڰΞGZÂjŸ‚¹fûú<œuîÌ=7²wm‡¦­ÒF.võƒluMÚ'ny.ekï:—v)>Ž‰øT/ëò8—7øÓÿ*?‰B“uZ‘ ´–B¶6Ÿ¥Ì=v°ŒSÛØCë\§ë3úÜ–ù:§½tã¶ýY™swy(žÓy|–£çüó}ýôºéòi×VîRb”Jd½y;ÏÏLói²×yʼnûMÕò,ûiæ? ]ˆùrÇ®«ªCäs$ôž„L×÷xîsš<ÙÆyjQΉ‰Åó±tuN¡Î…ï1ë?5ôíù8Ñó™ |.Øù8Mï4/Ê$kCÓç2ê°Îo´‹É¿Ùø|¸hÈÅ¢Œ=ÙssiŸ}=XÏžÿžêzÌ2…5¦×u®,¥Þvœÿ¼Þmýëº+óm ¶vÑó‹é~S^1·«Ñ-Ì|;ÿ®ËWs ݇µ~ƱÞOýkôíùiÓÎ6á–ó£”r›õ‘¦¿ýŒ“üã}j¿æº®›Bµ#|\èp½ŽM¦Ø}£­›íòc/é)­õÔæ™Vö±aOm×+‰9Ò¬ƒç¥–˜8·•6o$®IL›Ú.ü/˜%N­u¦që;û¿Äué+4÷™qï’ÞÊ™}Í:oc„ÝÖù¤~ßsœ½c­½$'‡³”sÂÙ%NT¬9û 6€âÇ -øŒ;”‹îjf´³Ï]'/¼bJš¼|Rp_ý­lërËV˜a}Z„Í–ˆ$‘Ï/[Ýp‚n‘ØÖp^?´zy\çË ™¤Œž¿ºÒ›òxè_Œ[R]éâPÖNë?¾Å¶J$ÃŽ1Çót)DASŸâci;æO~<ÜŠú¹Cû|Ä#”ÓæL¯ôçÕ~x÷zÚ§ìàq™b\¶Ó >T}ù^ëÔ^Å©b, XÕdž›ðn™|,B¿•ä'Q|hjáã W7½} j¼ÔH·çñë}¤Dlx…\ÂCó$Cþ†wÑÊ3Ÿ·=´}¸ßèc­i‘oUÈ-±õã2Sê ÊÕZ‚ˆm¼õ½*}ñxËjSöl ncsC–ȵ¯w“•Öë×Ñå†Åòùd“õ¹œ‡<{wÙb÷õy‹íbÇnZì/ÆÒö£­5ÈÌ.ÀmƒÒÔóå1—•p;×n-·=¯3Æó•“]ßq…µßÌ'«¥€ž!ðÉ–9Ø,jkæzµÉ묺9?ëhWÇ{-Õ‡!ù+|FÖ„’øÂ-ݹ÷SȲs-ââToûZñ?Uæ6Uç¢Öm5Þ\»ÖzkÔÿ\#Œu@™è®íKˆPEa{}âžæu;-ë’6þ…ڻ͡žºRΖòÃ!Ž'jÚñTeó`íÂ1Òàymcø4NO¶.•m=Ç/«øÐZÍß_aøHk>Ît\Zy1·ÿ0.ú[P -™ <¦³æÍHFÆÖä—×)d¢¾‹v…ÌÄù¥ic!)p+Ú œ†²n‰læ—}çŽãôôÒ…:îj7>’LmäÇS§+DôŒöœÌ³7ƒÉü} yðóUl¢pî߈}@’mû€½ãU²õFÃ9шÛu²£*åó}›êb'6Ñ¥ê¬XþÚÖ%±œ—ˆ§në×ԕʧÄסªvi4/„*j˶ ÔÖI! -ñ S‡&,fã‹Uã³v'b®†D­]©íÒé ¶›G m¥Rk•{×R5ßEé¦ÎœÛ´“ØÝNü4ÂGŒ¯/—dÞ@mkm²°wF<bèŒürIi:V˜PMO½·‘³éöÒ©)WUÁ5+O*åÿ'¨ÊÈ3¾°ÔLŠOîWý&웼T’¤Ç†:¤iÀRêm…ºlJÍf¥¾l6J{ÝÖºilA*ôTªx R <–dÛ¬®‘ª~VJ¢©Bàvš)¿,È]ÎÐ\5˜v³h…¹‡6n'dž/’œÚŠ[>:ºÉÛÆ6_‰§1°ÑšÌ¦ŸëM:Ù™íúͱ Pèä£/#¹zkC§ñ™ùew2-âžßÆ0ç|p¼Á½åoB™—=þmÞà÷_:~]Þâ¸3 -\ÃÖYF2þÞœ¼“ÌߣS‰ÍmÑ‘€ýN¶¹· ÕZwNà5õî¦{mi‚ÚÆ•ÄÐu(È®™®³^h&\ žVZl‰ÌÇ®MØÓ¥¯“ã­J>´¹J… 9\æÎó=$Ÿâ¦=¤ƒKNtÄ…—↥K¶“ RÞ¤©žå'¹¼Ñ&/DÁ—¾ó¨‡Y9t¥³M{y!&+oZò(Bßí^½î³È±zS´7ꋤ¶‰1µžNõãe\^¶˜ãÇ}½ê¼]Cm,/|Ï·$§»FO-hq!mTPsï67ò¦Ti‹›Ö@Ñà4SimÄTeŠs·ª–qÆYÕRj9E§~/5äª4%¹*ñ¬-[#^Ë–|K€‚4çÔggzË–Kf…eïF¥ÞÒWÚù½iyïmbÔ‰=35½[8kyþÝã;SŸÕN„ÖªþŒ»#6÷Ãê¨É&ïüøýƒ&Ç !þ -™DYl—ÜÜçòþÉù.IÝ?‘wÂr ä½I–¿IRáŒr!†ªß2©w+FÒm -P¶‡:Ì™³Ý¡ñ«ÄÆ-Îq“¨]&.ù›='½™¿ð(«?¦Äo¿¾[lŸŒ?ÿô¤o” -endstream -endobj -544 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 543 0 R -/Resources 4 0 R -/Annots [ 545 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -545 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 198.873057 101.433071 180.123057 ] -/BS << -/W 0 ->> -/Dest (cb94-1) ->> -endobj -546 0 obj -<< -/Filter /FlateDecode -/Length 4598 ->> -stream -xœí]]¯Ü¸‘}ï_Ñφá÷°ÈC€l°ƒ$ÈFò°Ø»=N°¸`²ùû9T‹d‰*Iì¾×¶œ/Úݪ"©yxX,Q¢ºJü}§ð_´JĘ‚·×ÛO—Ÿ/R'ñoJ±8˜Ô?àÜUI„SÉGwý) L!9üõå‚ÿºCšüåòç_\þ¶Ì£®Z¤äµr׿ÿ˜UÖˆCŽQ%¨¤2ŒÊ9‚vžQy%p‰)q*˜á‚Õv­ -0æè8Ì°ZGFa†±A™µ*Á ”åT0C%•’°Ci)Y ‘ÖÍ蔕î9VÂǤ« Щ 91«œâtIxï]ät¶¸$§s°Å)k%§ƒ-ÖÄÀéÇÚÃIèàò±:/pì8.Êbu°ÅËqk‘LŠ [ŒÖ [à2p\@$ï›ÀÀ…XØO‘ã0™ˆÉZŽ ‚ó˜¡V9×"Ð5«‹Ð©ÀqAV`(V`.%":=Ç x‘Ý%Ž `tÊr\lAWá¸C‘ˆž9§S°N6Çðt¡SŠã‚¨a ¼AŽ ¢Ž˜ezÉqFhÌ%QÕœÎÊ<ÏŒDëEv9.@7ÁLLÉê` h‚ã´Ožl;Ž 0ùÁdÓV[Œ³Ĩót3r\#lÑRs\læùfภIØã‚$½Èn2Ç qè¤ä¸ ©ˆù¦¶ _æùfä¸ ‰ù&¦xL¿MÆçùfภYØâࢰ:ا)1ýœ„ù&؉ÓyØ¢“å¸ yŸç›‘㸘o£gC1Ï7.ïºfâtà]x¦žã`¾ Ï–›ÛK¯ ðÏxeÌ3ÎÈF $¨×aleCÜ‹Ñ*°1 òÍs$6h31³Œž`X…RI6l Á¿ðÇìŠîÑ'¢ò€CÀ˜C¾È„naáÝ×9GKf6’ÝãcÿËå—ï1ø^ÿò—O¿˜"eåOÁA˜R[øWè:¡¹¼o…Ë7 ­Ä$´“…0ð™<Ùˆš‘ -´8ݲ‘þò¿ëúÇÂrþÃtzSN(N®¦ÐrÄôuŠ ‹Ìò†KLŽ0Úz¤1IgväàWJ»Hüëwu¶â­‡Ê¸b>8“a«ÝõÝO—_þîû?ýá÷?Fï>]þû?¤tîWß©ü­»ïpÿ–æþ Ç^>ïï¿WòùSå¶K—Q7êãœçCÓiMÒ™ùóqþ¶óï\~jéì°1οçk°ó13_GI›ý2m½þ´–U›dWf9oèÊ%ý¯þçúîûËoÞ-¤),qM™›v±7–å5Ø{CÈU«Á »˜3K¬ÙOËz´s¹Û\ï‰è>-Û/C'G“kÛ…eYWÚ³¶ŸjzûaÝÊQÚï\ƒ ¾ô÷±õí[iÃŽíéd /=m²Ï~Yûjï)å|ìêË6¿diÓ*›Ç¨Á/Rsèdæ9*÷½Ë=/­ÉÙQ³ÏÃðÙ* Eíø<•·Z6>Á7cyÎÖ²úÀ‡+5y#£dW›¹ïèÛ}t«#gßzŠ´ÒŒˆœÇä¾ö ¿ãÜGŸÍÿÌiüi4oå…¸ïkUÔvüâÞo ·pÊŽKù¹ 4×ëÐZ{µ‘Å©nޘ͑Ž˜oPàt0ÏépºïÁ­ÆEÚlö·KÛWy‡cnìé=A›Öé½²Íñ¬›£ŽŒuµPÏ‘é–ôúmºëûx÷ú”æYOIÚ± É`žÓ¡ißËÚόԣ¤G”"-JǶ¾Õ?-Ë™fˆ…Å™åR|Z–ѳÞj>Àùð¥¬Ñ™Q·æ!GÞí1µ§õ,ù‘™kÝ–¶åúÝŸ5Õ"u,Ïéz×ë8­GÛrSûirk´¬ÎŸ¹U´gZºoE‚î×xa“ïmîå¾WvlÍ‚©-=ª9×S³ù $R¯/ßqŽÓ]Â}$Žå9ͧø•c•GºQy¡+ùJ¯é¢v«k(ç¼!¯œs±=ºÈè¾@oÇË£ÑQÕã‰Oì—ö¯üE…X”µs—eÁ=êItãÔø'¸t,Ïéyàvq‘Z{tôÚš¡Ž¢µ¾ùÞãwd:ä­¢™ú3#•øžJ‹$£Î+nö‘:–çlHµûþêÒ¦ò#áAÊk[üÒÝ™¶;#ðó>ݹQ¾íµð¨´$&™œpÓäü•ƒyN‡Ê_ôE¶Æ[ù}#¨Þ˜}(ß@¦yœ/󜙾æ[Î\PþÐìæ­MÐ1­Ô9 ‚7PÚ|ÉáÑ`žÓ¡tlãgŸ{w¨{¹\ã[ß?²ññyù`ž³¡Ðíû–ÓJ’²Š–‹jÓÕ®~Nǵ83‡?œ3“(ÌV|³´p‰¼¯ÎûäzŽCO ôʧwÒÇj·f2ŽÄ"GGæÁ<§CÛÏøÌ8Q9ö¶ýåüä „šÇ‚æ9BŸ¿Ÿ>Ä'F¸ßþ5{Çb‰O˜Ÿ£ÔQiw„ر<§CìÁŠÆG‘÷žSyh–ó¥z\ç³¾õýuGüC§…tÖgôì#r,ÏÙé¿Ýûë§í-»3*q^=¾¶h0Ïé7öTL/‡†Ð5AïŸ_+¹yÿèƒ\¯Âx#¯àu«+ÞÚØ@%¹=!Ìs:TÄ!ÏÊi;³°!d?0º–^Òqå&?ÒûÖƒ+Þóœ‰>âi8ã_¼W<3Š?±.s0ÏÙPýÆRƒV®ž0Y­'([­êå"'OͬV:H¹ûdNWûnŒ­ÝšNõñõ¨[ñíg¯CÅA=>Ìs:Ä8¿ê -Úo—¯ŸAî&Ÿˆgæ9â™òã+V`|þ.2z°Cõ”îréSu»ÏùÞÚ¹§õ©3G/Ö¡öOî Þ# -$6éÚYYytGr0Ïé»ï«öÏ×r­ûU÷ž…K:bÏ3È{MÈ;`׈H,rcyΆÀøõýÐþYÈ2vüͯ2·m]õƇïÿo¼ªù‡ù½ÕQYëŽî›æ9"ã›{«#òëÃüaž‰ÜõÕú;ŒL„»êúÆ[~íÆó3«žäÚ5¼ÅÚžøÄ:ÈÁ<§CÍ¿Ÿ _ ³6ük÷€Á8e$1Çñ×ð å9bÿ§\ô¬£²¶P9°ó9´o 4>þ¾ÁiÊ•ò¾“Ü\÷æžî2ä´þþ™ÊšOåÄ2ߙϗç69~5Üõ‹òÝ|nbÏT†#×àÊ5¬šòç‹ŸvRÓ.qÒG¡tÞFöê­0¹mÒ5ïJ¥±ª4š*[]7rN›ïþ\SÍûñʼE_Þžé¾Y/9˜Óÿ<5úO•¬ÈõŸâ¾w¦œÄQ—ƒ&~¹ä½S-#¶pÅY8ÿ”µ,«JÂ*»hƒH}Jã„œ¦ZxÞŸãþS»r59¿+Ùòž6V–DfÚÕå~bFˆœ^­Åùê¥P³8ï?…™|5Åùb3„­@KÓ¶[ÆC±2’ÝZ(ÉéšXÛbÊû•ÕªóMXM§U§Hó—´:æÜÞ.8­é¥/¬4ïzYŠ*µ«e•bTªRWRÖ±µÑí¿“¥h‹Æ¬zÒjyï°»0 Ùš.•tŒèvaÓÍ¥¹ÚR¡¦Š-k*5ßLiP7±V<#›êh–†¼¡6é#Ò”ŸK±Ï-PÚZF‚½Þ.bìJürqIíWHW G…†”[ÅQ6¼4i~jùþ ]³ÈòÎKùÿ;U¸*ÍÌ3ýP¶B*ïžÖŽÚIr߬âe%Q¹¯¬c¹P6´´¤ºT³´¾T”LúLº5u­±…”T‘‡TÌË$UÉc)VuUœ)¬ÔOåJ*”Åœ®‰]…òËBÜìtµ«ìåd^¸»ZnûÊ/Tj‹«¼^µ·–K0_„·i`³½8C?–“4±–u´k'#ÂfH¡‰¾LâÒ[+;åí½ËÏÖɸ÷vùëeæ´q:á‡7*ïìJ=/uýÒ|Ïÿ^ìõ÷e+±û8®ee ]¹u!¦#YÞ<Šó¾àEX» jKh¿‰Uli]ACǵ&|m[vÙˆ½¤T•AUÕR¡kuHĺBW+CjÆío]-VGæµmÓìû¡)‡Ó˜¼ ]± -ôrp›Î´!ùJŠÄQNÚ†th­&q@ Å!9aj–-ÌÌ€¤'©UŸí·´)L>9 nD>4MgÛ0K‹.²é*H¸À†Ђ­¢'M {£Ÿî^¯n÷Ùd_z@–Vj¯Ò*­–¥•ðx©™ýò°Ž9æšJçm5TË2¤ï™êä´®Ñ\ »8 %ÒØ²Í =©-²ÅIË@Qé2YdµÄPlòs¶R-ÓG¶–Bõ)šô¯´¦m•Z‰Ž¶Š_¥Íå–¯zK¦:@ŽÂ9´«“-eõ%##ó4w•Ú–ÒÙúÜvyî2Ú^ÉeØfˆož©lÙÜ*åSü÷Lß¹çé"\ªò7EGTl›ob ¶*m®)»;Ñ{pˆÍ[bI¸äá<ûñ“u”¤ÄOè™ÐÂ#ƒÞ6Lx"+HQ/ó¾¥|¶$ÙKz¬˜ðP£9¹Šaæ8æ$ª‡!O]š6°–1æ ܃Tl¸hº!v[„O¦¿úظK -endstream -endobj -547 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 546 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -548 0 obj -<< -/Filter /FlateDecode -/Length 4449 ->> -stream -xœí]K$· ¾÷¯ès—õ ^@àC€$ˆY`‘‚ƽÁ8€Cþ~>©J«ŠU]Ý;»é]{³ÓEJ*Š¤>’êjµ>+ü|¡ñ_$=Ę‚§óåÇÓO'5§ð¯´˜]öüwÖŠÂàtòÑ̆œ þür‹KÞüåô÷ßœþ=ï£ÏfHÉíÎ?—Yd‡CPN`%°”¶˹!ã¼ÀòzÀS’XÃ2´fˆA):‰1Ș(°"Ä°´]³Ä0A“Ä‚:¹ °´‚Ú(%ò ˆ"²Fài7x(ÝK<£“I"/€§ƒ‘xÖ>vZâ¥Á{ï¢Ä#Èâ’ÒÏA§‰”ă,dcx²Xo•Èƒ,&+ñd1ÐNx²À»¢Èƒ,Ê+-ñ’\ŠD"/§bˆkžQnpÑZ%ñ´|ÓŠ<¬(Ég ‹W.‰<Èâ¬2ÏBÂÄN8bV«É«Û*«%žƒ,ÆyÆ—ÀxÈ¢‚— +hȸ$a€ a dHí@‘¢„&¦B° ˜äò)H8`•Ïh ¬‚,Ž¼„VCÂÊyÅ&’°ÀÈ‚X Y Y ,Жà-XÀ-©¤%,°À[RÚKX`¸SIX`¸6z’°ÀráJI ̵ÀN ,@Ë=HX`ºÖy#aìZŠ^ ܵ¤•„ܵ=EdKXt¬ŽVÂîZ­‚„ÜÅ22ÀªüÐKX_LŒJÂHÂ ò€5h%, à®q˜‚¹»Æ)#aw /aeþ(1îBœœ@¬„ˆ÷à+a Ò pW'„?aM­“—°Àwu„ùD^t€Æ…u -Úû$aî"PY pð%,ƈ¨FÂÜÕ‘ZâwµIJÂÜEÞà$,€;  €„ˆoƒVp]‘—•b”°ÀwKFÂDáAE ‰È IKX0òP ÒBðø¤ÀCÊ'òü€k'aAP 8@–ȃ,HÂ$ÖC²)JX d±ÆHX dAÊ a2‚!idßbyYà.b}@™¢„@²!&" ‚ó¨Ç U‰çÍàZäEðt° Šµ„¨¥†ˆE/a~Èé’„ø!ëŽã¥eå½›ùmW 1L™vú}·x½PúUgò #ënè¥#Tçn—N…ñœšxÔÇ«¯³ƒ/û´ù¨Iž$Œÿí4vZËRçÖîËæÖÈ¢m‘ƒ-<­¾]2ï»ßŠŠû<šS¢öÙóJªðv™[/;d¸Ä,Î`±Yò2÷ÀÂÛñÌ•§7xÁQ¨Ð¹ôÆëKHU }0/_ö©ºãÙäg¼"S [ioGɃ}Î#i'›–¿íViVòŒ·Ä®À<—vZÁúö õw,Üúð6L¾åªY&†ya+ÎåZa(ÍçJ‹þK=Õ¿M'9 ?IBÑ ÿK{A\÷¤Ð¡L*š\ ìûç±>çŸû äÊ‹ØÙü²úÂzÑkÄbxCÙ¥¿0ûÞìK’_rÔú¾ÆåÙJr›LÈÉ“Åì ”r»ï™Çú<œgîg˜"–7k󬣜T2Õ>¬ )Þp­dº±üú$2`ÑgMÏ%ûìÁ>æ³f?ÿ\­þeÞWm¸‘¯AÉYF §*Ì Èd„ÒöäsKùž&ßùml ©éù$%78£)ozî{å±>ç•û9èÒÚÍr±[Œç}×c×Tÿ^ãÆÏ¡oÒã†Wº;°òXŸ‡óÊýÌs™Qjfé¥Ç}ÞøuÇ -]l‰¾ßŠÜðT–Uæ4±¤üUO=Öçá<õJ&ú‹À«¹±ùþqW¢ì¡–劆¬¯Eøƒ}ÍCí•}Ï{ö(ïÁ_3a¥mx§½½’?Øçá¼ó域hfðª+î#DzËòË£‘þ`Ÿ‡óÔ+9é'‰?¿€HÏòÊ£ûõû<œ‡^ÉEïÄ›îø5ÒŽôÄ÷2¾Ûy°Ï£y'íç¡w×½Ÿa¤¿çqªéÉÞ^Óìópžz%'ý$ñç•VØGzr·×ôû<œ‡ÌEù³@õý9ß­W´Îò¼‚Wìx7Yàר~cT¿ãøƒ}ί䜟cýþ!V×GˆàNÝ^«ìóh^é®ìy~’XóJ«é`çÏŠÌ<ñ‰yõγ&˧ÀZ|å]NwÇ{ïû<œ—^yþsù!…E¥°|îÌTÌ Ùƒ6Ÿ{ŧƒ¸,ê~ŸW4Ë £õ=¨‡Úþ¸ÎñxýÜᆇ²öÐc}ÎCoÜód˜Æ#á -·¶€KŸrŽ¹ÌrVÏÖoEõ;Þk?Øçá¼ñX®ù*O9ê÷÷Æ­gí·ž›Ÿ=—½húàÙæ8Ë9Iù¢ð¬ý=1âÚ涰ҫ۱ò`ŸGóN%ç\æb¿ÈzùƱޫ"ÜðÈ;>_t°ÏÃyä•üra‰¦Õìþ. “°ðŽ|?5×xKÞ¨„–˜Ùp‘¯.és'¯Z—ï­Ú o½cOó`Ÿ‡óÖ+WÿT1mË›ÔâˬÙJü¨+hÃ;{© ÖN68uÍ;õy8ï<˜{ndïÒM³ÒF.võ³lÕ&íàŽ<—4”ڻΥ]Bƒƒ%ŸOÅ̇:ymµ‰e._ÿáOüëòóùy_’åÂýÓ «Íe.oY¾±­ yuÖyŽ×+úÔ6ó ôœòÒ…Ûöfy¾]#~ÖýšžÇÏrô|º¯_Ï?%=õ+ú<¤@Ϙuf-ßGÀµïs+òqÝ\&ù.‹~Ï#¯´¿Lscz(ò³q«.ÐÏ»G`úP]ïE–Üç2®fí§)z>·¨ò G6Ÿp[ç6ÙÓ•yLú+ç7¬Çñ6ÿ”]ÓôOÓX~W$Zr¨>—¢¯:¿âãdËGÍzEÆ'aìâ×iì_ìð<õÄý•ùj˜ÚN:©2ë[–©úøøùRæ»Ó¼¸2oôÞÖzîOk_šõ™ùÒ®žÝR¥û»_m¦˜ýš='YÊu/£5½¤I^×u²Ô›žôd™¾‹îžûXÕîs,ézËk!ëÁ\êšé2ŽÑÉÛt¼«£°Ò‘ïsÏú)ºN]ç›ö¯mž»¼=_åÒÜ~5[qÌw<Ó ç7Òj†Sðôi¡_ÃçWgøl²løSÛœôXôêº µ’b×4.Ǥ]}•Óãæ>ÖbS‹µGÌ7TŸÇLVÕ¹Úäomü¸˜;‹Õõ¾Åïjûz¿Æªk8%c”*gût}ïêj…ßïo›}}—ºN÷ߌG¯1çòžWÂ>ÛcDóñÉî×1pW+ì·›ërwœD‹qÆ|dŽÕ5&#c}3+s.ŸëŽì˜ºV:\mr¥RXjW†;çŸe)Ðç‡!óJØx6(RÈg0JérNKÌw9-®ÛµxíÇðc}_n-­®i´cn;Azƒ² Îër˜…ÿç¢3ÝsçØ_/Ãj¹ßÓd’ËÛø;!¦Í¡~X<­LùÓÉ—óDu9SZù8h“¿tâŒ\9{tHç|†iT–t5.ÊÖçžå«:~j­¦oïPù@ï|˜ëøÕìbjÿS1úÈäá•5w/'í«BŽ¦^tòË)Ó dÔJæ 9§—ª…×,hÔÃaHË–ÖÕ“YÑa]}i\Mîïj·|&©ÚÈ–3 Ç DôôzMγWƒžÈùÛ*â`§+ßDq¾Ê bxÛ>`ïx•¬­bD·&*v»N6TåÑùtã¦:߉Mt®:ÍÌ_ÛšÀ̹G¼œp[»¤¾ˆÔ|F~ªjרF³L¨Ô¨®¶l¡f't9 Ä/Tš`ÌÆgVË' ÄX‰Z»TÛ ¤ËIl7暥Bk{×T5ßE鮞cú6í -ó¿~‡­eëË99×|ÍÖ*2¿1+âå„C+òËÉ¡µëX¡\u=N´lÜFŽªûK§æ#ôÆWXš•–ÏiÍÿPá5#Oy¡©¹T>k¹_õ›äµÙÈs%qºo¨C’4…Þ–©K‡Ð|–ëKG%´Ï ÛZ7ͨLeŒR/ƒT9Y7¯kä aU? +9QU!p»NvÍ•_fä.§kKÎ^oæ5sw×Æídß°ó…“C³¸Îg7yÛ¸Ìç+ñR-ÉÙõc½I'Õ¢]¿#vÁ -Üaô¥ëjmèTN`š^öE&EÜËé‡S sÆ:“ðÂ[¿‚g^úü_´ù¿ÿ:Ñù›zððÇjha¶ÎÈ<’åo ŠÉù[„*±-F4Ä`¿“uìm]õ†ÇaxM½»êÀ^[ꆠºq9Ñu2²i®k´ešq;ÄËB‹-‘y_Ûô€=^Ú:9ÜÆæ#««T¸àÓÁeì<ÛCò™ ‰«Ü´‡tpÉ°Ž¸àƒâ’Ý0uÉfbf‡ä7iªÏò7…Í÷b,È—¶ó¨‡Y>t¥•Y°&H-¿à“æ7M3y¡ï^^ïm÷Id_W@¦6hoÔNmËÔx2Õ–K?¿l1ÇžóE]¼]Cm,ËÖžmIN_=µ Ù÷QF½ÛÔÀñ›R¥ÍnZEƒ ÐT¥µC•ÉOݪZÊŒ£¨¥ÐrŠNýkÚq«4%:n¿j›Ç­¯eK¶%@Ž»sè³S½eË%£@ó¼w£Roi+m}ošß»FÛ3›uA|ÏLUïæV-ï¿{ÖÎØg±!µª?ewDÇ~T?5é`-ß¾¨¢÷ÀÊ_ (²í’›ûìwIêþ ¿Ì1µ*èü=š²/`¤ë 6TýŽM¹[Râ”nS€°=ÔaN­v‡Ê©•·›Ë&Q» ¹TÌß›hsÒó×=¥åwWó6‘mŸ”Ÿÿ_ø¥¤ -endstream -endobj -549 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 548 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -550 0 obj -<< -/Filter /FlateDecode -/Length 4730 ->> -stream -xœí]KäÈq¾×¯¨³€¥òùŒ=°/,à ìƒáÃLÏŽ¡WÀÊÿ}A2LUÓ3Õ<ž.Fä#˜ùåI©ï -?ßiüI1¦àéþòóí—›‚Sø7–XŒêñÜ]+ -ƒÓÉGwÿ™6 !9üýõ†ÿºÃ¶øëí?sû벎¾›!%o´»ÿí'V‘B A9A• RÚ -*熌ó‚Ê맘’¤‚.¡µ*À JÑI*˜AÆDAa†¥ íZ•`† š$ÌÐÉA¥ìÐF)QC‘5‚N»Ácн¤3zð1™$êt:Igíài§%]¼÷.J:‚-.)-élqšHI:ØB6Iça‹õV‰:Øbb°’.ÀƒÑI‚. +Š:Ø¢¼Ò’.ÙÁ¥H$êt*†¸Öå­U’NëÁ›VÔaEa’|t¶xå’¨ƒ-Î*#é,l!üH:ð„³!Faµ^ÝVY-él1&¨ƒ-˜|‰Œ‡-*x‰°‚æ%‰L%C ˜hŠ%01 ‚•hÀ$7OAâ«4tFKD`lqä%&°¶V®¨ƒ-6‘ÄÖÀ¸ÀZØbÈJ\`Á¶´H\`A·¤’–¸À‚oIi/qáÂL%qãÚèIâ Ê”’ÄœkÁX.–{¸À‚u­óFâ Úµ½Ä¼kI+‰ ¼k-jŠ:ØK\v¬ŽVâïZ­‚ÄÞÅ22`VàÐK\¬ &F%qwMT$qwM€ uaÀ´x×8œ‚ä¹Á»Æ)#qw /q€2€” €wA!N` Vâø{茕¸ a‰Ä¼«ÜŸ°¦ÁVƒŽÉK\àÀ»:búD]tÀˆ ë£)èò‰:?àØI\”%ê` ’¸õlŠ[¬1[2H\€ˆ`HÑ·˜ÀÀE̶ R”¸L6ÄD$qApùFUÒy3ĺu:$.¸b-qr©!bÑK\‚8\’¸f@§Iâ‚` –ŠÄpEC4ˆÌ%†-²%.@¤ ÖD[ J\MD–é•ÄðÐÈ%1Ô’Žç™Qâ‚H~àPQâ,dš`JQ[@`~8Ùv ùA²‰4GÔÁëHâ‚ §›Qâ‚a‹QFâ`“óÍ qAR°ŸÄIùÃd‰ @ãÐ)%qAÒù¦!‰ °.9ߌ$«o"ÅÖm²žóÍ qA"Ø⢈:Ø‚ ) 뜄|ì$é>]jfb·«~WÝ#¯D?wéï‡Ó¼™íàÝü¸ø~øý¿üáß›Åg"ZüÀ­røE8ÂÓçÀ–ð^ðtìXÇòO\fž€Ú©ámÐÄ]§ã"ÿø}¶yAiÏ2§9¤!IEáÕ. ž¬ó9Äý%X/·ìРÂ\[=ϱ™ç<,ç~š‰åjsa¹²òj¤N_V©©«0“Ö®û³¾áÉÜN”û)ý¿tm}Ú°çe:ׂñ £ø†ò˜|û¾`…!%ßYaeõ„iõ87ýb…1CÒ¼²âxnëÕEˆ´2ø®Ã½Õeáå•‚ÒhŠD«ëd«­.ƒŒegu_dº¿a‰8Ñט!ý~ú¼’Ï¿EN]9><#sUgLSÎοç¿4æö[ðµ|ñÜÞ¢ÍÜoÏ !—ß@¥‚ ¾Ž“â¬wuçê\uÕlowQg—hÛãœqäS£û´œAÏ*Çå,ä6Æp9#$Ï ®ú‘g»™_Ôù©A–›û:„ÏUOKûjYçyDÖ6Šïw*×YF%sˆÔsu.‡Ô¸Ï¶CN¨¨ÉȹƒÖZÍ´„®7Bä#¼ÖÚÖ¢Á5+æ4²´ÜÖWCjJ#õ\«!u¼}c©ªCT?ò.øÒOÞõígiÃŽíéÏ+m´¾®}eõäv>vãE52YÚ$£ÒÖXÑ?(ìa|y²ÎåP¹_îÅi½'½f_Gà³U™Ô!¥Ï -û¬1sàÖÌÒã|s²Îåfö †kòÇâ%»Ñäµc^&ï溜½ÌžnfiF„™sRÎÃËN̳õ?4YM¿7ÐÔ-¼÷c­‚ÚŽ_Üû äfNÙ‰a[~Îå±ë÷0ÊJjm”qZ£1â‹h‘ï};Âé¹:—Ãé~·òz¹×3âWusÙáXò=}$Hi‘>*Ûôg]–zÆוuÐFŽÂú£f픿¶;¿SÔ§Íë5“¢sû%'ë\ M´eíù³#õ(é¥Õj³Eë|doKM–Û¢àÓ²žõVù€Ãç¶:D3£nå!GÑZ»bÊJëYò£k ;´[þ™Ú]º“H=YçrH=ØÙë8­GÛ¸év°¯>îƒcf ÿγb¼0ÓÂeÊ·ˆÂÆØÛN•þ®ìØÊ‚[[zT¹¦¯§²ù $¶QßÌÇÐö‘x®Îåx)~㽎Â#W^èr½¼jº]»Õ9ä>_Î!¯¿‚³Bl®Æ»/ÐÛñòÙÝQÕÈ}b÷ïdË!w?v¼òÞª?U͹ôH^!¸Ci9N=%_Pò®î -ÍjOæŒ÷¯1'…8hK|‹ÉrÏÕ¹rÝÁn íÐÑfš—n=í?ÌUö=÷¨ov7ž‰GyœKOÖ¹"âÑn_¤Œ^뽶2”†£ÚQ_x¾÷¿ò+2òV»™æ #µ‰=µ9wÇÑÉ:—Cê~¼zi£‡üØð`Ëk[üÒ]™¦ü|Lwm”oG-¨lö$“ܘœ¡ò\Ë¡ò =BÑ£³ñVqßTodE¿”o 3=Á—çê\ ™þ Ö|ËÌåÊÊnÞÑ :Æ;u.ƒ`¥¾Æ’§3¢“u.‡Òsw:~ñÜûK ¸CÝ3È}äßúú‘§Çóò“u.‡ÂýØr¼“$ßG+íj·÷»ú¹œ4ãB˜37»0[û›y†óÎûªß'ïç8Œò -hù´‹Nú½Ú­LÆ7{‘g=óÉ:—CÛAÌø̸fGå:1ØÛrô׋“7š¿üd«!4<=ýŸ<ºÃý†üó÷¹:dĆ&&äGtŒ_²=@ìÉ:—CìÁ"ï+|Så¡,çk­¸.f}ëë롉”#ÏèÙGä¹:—Cä¯÷úúeWËnFµ¸ðø½E'ë\qç¾Ó_ËwCÚ{‚Þ?¯äæõ£j}ÆEŸwwÅ[G¨l®_ŸÝ!?Yçj¨ŒûWå´,ì²ðî_d•t\¹Å±½n}òŽ·“u.‡Äƒñ2œñw¾*žðâñ‰û2OÖ¹JOÆyI­¾a²ºw¼AÙê®^içäÄ·fVw:(µûÍœvwºØ÷"ØÚÝÓ©?~>êV|ûÅÇpÅáñ|üdË¡ø`ó›ÞAûëåëg»‰Æ'ö3OÖ¹ÓÁ~æ£üøw`|þβö*`‡ê±Üí¶ßªÛýžïKí{¼?uæèÅ}¨ý7÷N^#JÍÞ¤O˜gMêèŠäÉ:—Cì~¬Ú¿VšÝo‚¼æo«ïe¶Ï-|yÏ£ uOØu&MÍ^äiž«s9~û8´ÿ.ä -;ñæ·@™Û¶®VãÃ×ÿ7YãC~%JÔDîèºùÉ:—CäÉýͽ»#øÉâaþ¾¹«õW…î¢ëï0ÞŠk7¾?³ZI®žÃ[ÜÛ“ž¸òd«¡F«ÿÿrøšý—ÿõØÞ¨üq~8zp˜]çøåÑéØ}“á7F?\ÖO¿åÙ·~n'æ)™ûãH‰ëó}²ó³sí»¹ïÆšŸZÎÁåsXMå/7?¾C/FR>Úð›ïžËs“îü"Ž¨,é{5èY̯\Œƒ|1…ó]„µAjËÖkÅC±¶ªºµP5ÝU±¡læWô”¡óUXLo‡N7ÓŸËšÐLçžðå†nm/}¥ü¢·ÜT]£ŠÌ6F¥"u¹d™*ó$ˆ^n‚ð;•›&LfÑ7³Æ¯Ë™„1‰J¹”Ë ¢—›XnnÍ•™ -¥T¬USùjJ…ºeàÙ8F³4ð;d›5¢lþ¸{ž<×*6¸1+áË .†Vâ×› BiW¹B¹ ½Vh›v‹8ªŠ—*廩§OXšYÆ/áÿ'ªpEÊÌ3~ÐT Å/ ªGµ^›E¼¤Vî ë4šB-Û —¡`¶/•PžI·”.#¶6CÖÈCÊæ1IòXŠuA]3…åñ)\Ù -U6ÝU±+P~]ˆ«®,U§Jg^7pw¥Ý*ö…;_[q(3®ùíOÅÞÒnƒù,|õb†~ÌT±QÅÛÕÎa5 ¤PÅ•F_Gq^­…ø¶ùc]d’Ç}¹ýù6º9¤†_èá­æ—¶‘—¾ÿ/Êü€ß¿ÜèþÇüöœÉUØÂn]ˆ[OƯ¾'Åü*Ü,,˦jh¿Šu¬e]FCñãÆ4|MµºªÄžKê ºh[¡«c؈M®Ñ¶·#|éF±2Ÿ;7ÕaO‡6Ÿ¿“„ß»”­ÂA{:8ŒUg«K¾7M∋V—-™¦"ÚFqØt˜ªe 3m'eèÙ~j§Âr_ÍAFð¡­:ªn¶m:ËƳhŠ ¶íAÛ0é¶Ó´°G0úéåõÙó>›ìó -`i¡ö"}m¥åÄXZO–ÚñÐ/‹Ï±ã‹<òâ­#TÚ²ÍÚ³%È©K£†´8h1ÚHc­6pm§”e‹N³£(t™Ê²ÒbÈ6ù¹Z–ñŒ£8J¡ÄUúçv¤];+e];+~U–ÛͯDK¶@®…s¨g§jÉKFAæÛÚEJµ¤Í²uß´ì;{Û{sT ñ52Uµš[•|ŠÿžY;Sn'B*•ÆÝëûæà¨Ikìߤ¢÷àâ·ÀŠÍvÉÃuö÷OÖ»$yÿ¤í Ó1µ*hàmÄW(Ò±¢iêu~UŸ\-)ñ”a{¨ÒœZío÷6ÇM¢r8Uti|g«Š‘ßY”·‹Æ×mÐbûdüù?ê¬' -endstream -endobj -551 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 550 0 R -/Resources 4 0 R -/Annots [ 552 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -552 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb97-1) ->> -endobj -553 0 obj -<< -/Filter /FlateDecode -/Length 4426 ->> -stream -xœí]Mܸ½÷¯èó«åGñ ö bdƒ0²‡ ‡qïzÁ8€7‡üýd‰ÀÀY°‘¸ÀGêR^âŸtHùDïpì$. -Êu°…I\€ÄºK6E‰ ‚-Ö‰ ‚-H$.@FÐ%ì[\ÀÀE\lA¦(q˜¬‹‰Hâ‚à<Öcðª¤ó¦‹t-ê"t:H\uÅZ⬥ºˆI/q¾Ëé’Ä0:M„[0U$.@(ê¢Af.é4lA’-q2]è´–¸ Ø‚lPâ‚h"V™^I\€µ$\-éHåuf”¸ ’ïrª(q¦ Vš`JQ[@`|òbÛI\€Å›Xæˆ:ØbI\£ÉËÍ(qAŒ°Å(#q°™×›A₤` 2>‰ ’ò]N“%.C§”ÄIG¬7 I\€y™×›Qâ‚dÖ›Xâ ó6YŸ×›Aâ‚D°Å!Eu°ISæ-8 ëM°“¤ó°Å$’¸ yŸ×›Qâ¤Xo"£·b^oq»¼ë˜IÒw‘™z‰ p€õ&2[im¯@¼. ?“•1¯8£¸c @½±UÜ2Pà^D« î(o^#‰›0+ËèÅ]„U(µ· øù-8aØ}â[Tpˆ™1äN&L Bv_×­˜])6ìýöËé»ßó/ÿ9½û¦ß)+ B_š_a˜„ávȾ5ºo=HÑäÀœI*[ï©“©©A‹ã¦[6á/ÿ;/?L,‡á¯ûÓÛzú„(>œ>o!óÈøˆX¾Î-¾±Ê3¬°8B´õ(c“ÉìÈ!¯T4)üû7'u´bØ­‡Ì|ÄK,†É¸ó›÷§ïþòêïýá5`ôæÝé¿SXKáuùþ[?¿ßãðŽõ§Ê;u.—¡AæÜðžåµ|©Ït¥\­˜‘eoÛ9œTçç¦×nÔù©m¥lo›ÔV˜ö©Ôßl«ôeVFë©]î’“ÏQ§†×]íªïÿy~óêô‡7SÐõ™è:$FS$ÚÀé¾*OÁéÇ€'–µ×àI3·ïÎŒï±Á« ùd(ŠÛF^†²óaíe_Ü´a˜wä ¨òYXŽmWq¸³ÎÑ€ˆUÑ5$‹4˜¬ŒdœŽhé9 -›Ì™3ÔÃiÚýÂê ùïøÙ²w3–K— µ½!wÖ92é*GöÜ7ò!…%RÊ(WÎtS„ì}?Ž0y棇aÔóûÚÈ—sÎm©<ÿ0Cù\_ÐÁg•nýÎvVy˜Õ)ýõ‚}k¼¸†¾–RÞX÷…¾}u‡¾rmN3t}yÑt×ͳÂáõ[ÈR>u¡Š&/“¯£p_áp_žX¸®zø–e虣x?_0¾u3[8ž~¹y¨ŒNÓò@ -±Cð Þo sg£¡Óëžþ -RYV¹÷š¶u‡ÔLô‹à«•¹qɧ™‰+e9äÞk5vÖ9B7ö=ïÙ£¼‡w¾f»¯q£xûJ~gáó#åŸ/43xÖ÷ "½Sw\½¾¯ÎÑê6rÒÉ?Ÿ¤wöö+’vÖ9B7rÑ;yçæë;¾FúÝ‘Þ¹Û¯fßYçp輞‡Þ½îý #ý=WT}ôHo_Óï¬s8¤nä¤/’ži†8Ò{uûš~g£!ÔïÌEùµ@³ß+žà¿WëùŠ}ïÆøÕo‹êþŽoâwÖ97rÎÏqýþ1f×'ˆàþŽ_šï¬s8Tnìy¾H®y¦Ù´3‚ókE&H|`¨¾r­Éü*°šo|Ëéïøî}gátãúÏùïf+…ùug¦pÉZ½þí¯ⶨŸðz·E3Ï0jÝ~(å÷#pÊÇËëe„ö‹ ½ÝYçh 7îy2Nã‘pÁ[kH¼¶^ÞÁK/9Çœg9‹këW¢z¸ã»öu‡Æ}¹æ³\娟ŽÆµkí×®›Ÿ\—Q4þölµyŸ¤|Q¸Öþž±õ›¹U®twpå¾:‡CçÎ_¥Sóì—·^¾±­'­WyÇï‹vÖ9"7òËÙHT¯^Éîïâ°+w߸%äWÍÝ|÷¥Ãÿ~å¦[wìiî¬s4´Æ_¬¿TN{ʘf+¼ÉLü¤3h-Ô„ÑN68µ…Î}u‡Î¹çJö.íÐÔQZÉÅ6ËVÆ¤Þ 3÷%uýÚ»ô¥ƒ%ŸŸ>‘o@ëµÕ&ö}yõÇ?ÿéoóßçç}I– ÷²žÇaWíËÔÞ7²}CYòì,ýŽò±lÖä9å¥ k·îÍò|»Düìû¥<·Ÿíhùþx^;|žþJz¬×ûs“æÌ>³“}„¡OvôCÛ}smWúÄúßÛ훯ŠXÏó{`m©æï\'Û¤.Ã,Ö~욟ôÉå;Ûü™Ò§j>Çè·þ¾ Ëv¼Í·WÎðX¶SýNc[þª1®Ù¡Z_z÷á0·Ûò£\¼"ã“Ðvç4ÔÏýëû˜Ûzà8m5?¾(6¹1ÅækçÇ1 c»£ÿŠýÈö—y0ü•ã[±5¦waË\»æOo,Û‡¾×öz¼™ppðžsùfîÑéÈîM\ãØf‘°µ¼“q¹ð9ÿÍãRP4™Ÿ"fãY¥o¼-qwÊŒQS÷ðÙ®±#.³K*ǧ±Œk®ÏÃÞßW pˆ†Qw×ë‡Ë³áLƒÜÔùÍàä—¸ïÏ7â·‡YhCYÛwlx ÇúP~¹˜Cùáäû›ÈëþA"ÊÇN›ü¤±³§.#-¤s¾q}T–t:Ý;[ŸWjöÏgûPKlSù).ùþÃóÜØÁXþC?èïV2J 鯤zq4å ‰OùñZ$ˆ‰Z4ÚgáøQÕ¶p™™ì‚ä,ti^Òºrûk­++½Éõ]©–o{Nª²ý¿‡ BÔôz)νWÅùe±³ã‘¯¦8_l†°5H¼lk°UÜk«˜Ð-…Š®‰ {t~¤EuoÂj:wfÃ_ÊšÀ†óšðrÂií\ú(Jóƒ‘JSÅ»FU™eF¥*u¥dªã$ˆ.'Aø­*M³êÙ¨åÇK ÂX€Dµ\*åÑå$–u¤B-[ÕT<ßLiP·±:^]X–ò3ÙQ¶|œŠs"RÇ!¹áÆ,„—B -Ä'„Ò®q…rz\hY»UUÃK“æû9 Ÿ05‹,ßœ?ÿ?P…«ÒÌ<ýMRùí¨$ÏÍ*ž:‰Ë}e’< )´²Ì]:„ŠYî/•P>“n-]=6‘2—1yHżLR•<¦b]QWřŠ*Wr¡*FàtMì*”'âf§«S`/'óšÁÝÕv›ØWî|äâPG\秥T{k» óExéÍÅú±œ¤‰ªÑ®Œ ›a …&n4úØ‹Ël­ìÔߊsüØ&™q/§_O}˜3Ö™„Þêüð/žyéóQæ^ÿ:Ñù‡ò´‰!ŽUÙÂTnˆy$ËŠŒ;ÅùÑ‘EX§ b´ßÄ:¶²® ¡Æqc_S«®±—’º2¨®Z.t͇Ll*t¶Ì3îŠð2óbMdž:6-`‡¶t§±ù9%Å*ðîà06m!ùÌšÄQ.ÚB:´dXEðFqÈN˜še33 ùIªë³ýćÂæs±–FäCÛtÔÂ,oºÈú^°"H-?à “æ'M{£ïž^O÷Ñd_f@–Vj¯ÒG.­ËÒJx²Ôö‡~zXcŽ=çƒ2y›‡j[–Í=[“œ65ZjA“ŽQ&­ÚXÀñ“R‘MNZE¥ ÈT‘ÕC±ÉÕŠ[úGÑK¡æMú+÷´ã£Rèø¨øEÙÜn‰x5[²5rΡõNµ’5—Œ‚ÌóÚUJ­¤-²å¹izîmϬÔ ñ-3U­š[”¼‹ÿî™;CÙN„Tªüõ»#:¶ç3!P“ÖØþ‘Û*z¡üÔÄ@‘m—Ü\çúþÉr—¤ìŸð3a8:²Vž.›ðEÚV°¦ÊƒÕåjI‰]ºÍÂöP£9µØ꟞Û÷ÑoÕ׊ùaÙ6'½1?ã3(-oõ÷ÛD“í“þï;#³K -endstream -endobj -554 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 553 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -555 0 obj -<< -/Filter /FlateDecode -/Length 4783 ->> -stream -xœå]M丑½ç¯È³‘ùý æ°ÀÚðÀ6v€Æîa±‡êì)F±þû~A‰dˆŠT*³«Û9Þ.TW*‚Aòñ1‚RRú¬ðóÆÉé)¥ƒ;_~:ý|RSô -ÿJŠÕEQÿ€ßèÏZ¹8yCòçŸH`ã³71œßNøo¸äÉßNÿó«Ó_×yôÙL9£ýùo?’ÊÙ)¦•T*¥­ ò~ŠÑø ¨‚žÐÄœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚO$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ƒÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…A -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ³ÕÐì¶ÊjIça‹1щ:Ø‚Á—ÀØ¢b(3h"^’8ÀÄ8¹lœD&ÙÉ%—$0)O.F+Ñ€É~r!G‰¬ÒÐ-U°Å» 1Õ°ÅaæŠ:Øb³“¸ÀØ‚X [Œ³X°­Z$.° [§²–¸À‚oÒAâ Â…™Jâ Ƶ)8‰ ,(PÊXp®wJ\`Aº˜îQâ Öµ>‰ ,h׺$.°à]ë´’¸Àw­ENQ[`‰ ÀŽ“ÕÉJ\àÀ»V«(qïb‰ 0ªp$.V&“’’¸ÀwMRNâÞ5K€¨‹æ •¸ÀwG¤•¼k¼28ð®q&H\ Là%zà]Pˆ—ÝØ‚•¸ë=tÆJ\€Â&·DâÞÕËŸ0§ÁV“N9H\àÁ»:aøD]žtD ó½<é²Ä¼‹…ÊJ\àÁ» Ï$q8~Šj$.ðà]m±RK:ð®6YI\àÁ»ð¼Ä€Ã¤áH\€õmÒ -ÐuyR9%‰ Â?“•‰"Î$î(P¯ÇÚ*n(p/V«(î(/ÅHâ¦ÌDd™‚¸k€eJ­Ämþ…?æ6œ0ï>ñ-ª8D¬™)R#3¦…ƒwßbŽžÌ^I6ïýíO§_¿`ñ=ÿéï§×_•²ú£~ëB ¬1ïB6ã ¾šJy&œmC YÉCFÄÜÔ ÅeÓŒÄRŒå6ŸÛ½6“ÍÎLi™[Õ‹PAc¬lm½;ϻۊÂá3xxoëzE#o%¾i¥çí‡F"¾ê páŒ#Š=šéÞú?>œÀÜó®q83l‚¾ xôÃO§_ÿ›ßýö¿~Àh}x=ýï·JÁj8ÍJ¹„_|vüæå/];èã|í»{Mþ)Kó:ç%m€ú¼äñóuÑSºåšäE¯—ò?Îù=×ÿ8Ët-éÝË’NÏö”´v¶ÉÑ5L §VvmGZÚç¿¥<”ïÓlS©G}÷çß_é¿Ìûº¬Ta—. Ý|ŸYSÈÌË’VÍÝ ìº K·~ìÝ×Ì_Ì­eîM­é[Sã’¦Úåò©Zú­ÝXºÕ÷!ÔKýT^±eiŸëáßï.ú¸î¯ÒW¯K—¿,eé¹Übgm‹gý•„>ˆ³ µíE¶À­•Ÿ†¶»ÞµÞ»š¾Ö±Øb‡~¶~€ïScœZíçÝþ³ÞnÉ~?S·iÝÕë絕ò÷òvÛƒ°gÝãXß_–éüi.ã??jµm±‚£kl¡VÚ—CPb<ü…4(NÇ÷æyh[Ø-BäˆöN6ò´á>©ŒÈiCÉ®Ö:wM»ÔÖ·µn›ÃÂaTaèßÿßücèÂXþ»o4Aá2ÿ-C^p¹ø;ÂÕ -áVªL{.C…T‡ZÊ™a»Ô•ù~¹Æfø•¸ˆB¹þõ»¹áÌÓFe׬º‘Áxö;)?M_{ni•?Pf¹è|°;=5¯!Ëç¡Ž™HY}|äÂ`Ï’w^<Ö²íGÌI9'ô>mK£ó =ÖûŽF¼„PåÝzß!$FXåB¾SŸÙhìÖRiþÒU7É8ºí. -¢Ÿdˆ?®}¥º@ÕxE i!ã¸!GC7z2m©•–Ù~… íÌ/¤F7+v¬îáÁ<Ÿã–~>¤}×ùP½ÐÒµŒ±YÆ<®Ç~‰õŒóq=»êŒtƒ¾ÍTÓ¹¶,—v[Ÿ Œ/k9I®§ÕÊz½bÏenkÃøGÆ*1Ä¿ªO^¾;>»Ðà½ÙÕfNœgNq§õ0»6®ž0³Ü”³OQîÍ,L:K¼ÂGš$·fÖÁ<Ï6³lT{3«­Efø×hÓ56{™?oäËo“»!]§oÉó±ëŒaéìòûiùë–ÏT>gÿ¯µËœûZf­wœ)±¦¿‚ºùnjA=èƒFÑžÞ>êŽåyÔu³éáŒÔÙ5Úöø°ô|fº×õ–0Ç°Ñ‹ë2æ†EVGPwý.¯G~•çG†¬¶;q w¶µm!,2µÎó8"{ÍŽ—ëHuªs%d¸ln!õ`žgCª3ûühäÄŽšŠ¼yCb‹ ÍHKèz'DÞÃkÜ6ŽÏfÌadi¹¬¯†T«ïGê±åy:$ÞðÿÅ{G†Uy¥«ùê¬ví6m¨u^Ž!o¼{³Aìˆ.¶º¯Ð;ðòÑÝQÕ2rûó<rþïøÌ;x{¨þlT±¶ŒHÞ ˜û¡nÝO#¥µ Å]Ú͞ÌÕ?tŸÓÅ4iëè)“È=–çé{c7Ðèà‘&[¥ùJûÿæû‚GÔ³ÝGüÑààÒcyž‘7üÑa_¤õ_½®E(Œ£x¯¯V¾—_ø™y›ÝLó…‘Ê|Om¦¬’¡¯ªì#õXž§C꾿zie…üÄxóÚ5~îL»øqŸî¹Q~Ýk‘QÙž$FíÐ3pó<*ã _ôŠî÷òûŽ úJTôË@ùdÚûùò`ž§Cæ _ó=#—(¿+ºyoD3tøË3!ø -J»/y8":˜çéPzìIÇ/{ ¨{¹÷´ñ½ïÅt\~0ÏÓ¡pß·,O’Ôçh¥]mþ¼kXÒI#.Äð7cf¶ sm³ŽpÝyßÔûàó7=:8ŸÞɸW{-’Il/òèÊ|0ϳ¡-Ýð¹ÇvTžÇ{_Žþz~ò„ÚûŸ?˜çéúøýôC|rï÷;òÏ¿ç츂XæÒD嶷{,ÏÓ!öÆ÷"ï+|Så®(çk͸Ág}ïûë‰ù‡ÞLÊ»@èÙGä±ö­˜ñ^Ž¸Ÿ zyüYÉ«÷>ªíSïä|ÞÓïí\A%»}t‡ü`ž§Cå}Ègå´(ì²ïXÝ¿È,¸ò*?òûÖŸx;˜çéxÃG|Îø7Ÿ¬â<—y0ÏÓ¡ô ßX{ЩÍ7L6ÏŽ3”mžê•vN|kfó¤ƒR»ßÌá»Ó;‹`ëðL§þôù¨ÛðíïÃ+‡d)u@~4ӳḜUúž!ù»>DûË¥ìGÀËùÃrœjô9ïé8ëäub§³6ÞLrrõ°™í9žg=Cº>EÒ{”,»4¹éèák§Ñ˜çoêåðAú¦Cù&a=´0/÷gè>M^ÒÔSlÊ°ÎCÚu\ε¬–m–ËÁ€y–—Ãñê©n‡"ø.õÑ÷ô)?Ý{fC¶òwÎÚlmðµ ›¡üùÊ1Úº¼JA…4iCïZ:7Y›|¦£»“²Nסӥ³õùJÎò†ªŸ[*ú"Eï± 3ÌËÐò‹%ýÏeÐ:ÑÉ~ÔÿÄó fT'S/ºøíD/r‚Ø!ô>(&áòQµ²œ® ›ìfSSZ?©åcn…Óq<óGãkk(¿¯Ùèàg§j"[Ž>ž+„ÈôVL­W“^Äô’¦4Ùå*4Sèð¼&ì:ž¶Ø3Þk«˜Ðo…ŠU×ÅÆU{èÌú1·1§£1«é¼ë4þšÖD6œ{ÂË ÕÚQú&JéÕ0µ¨Ú»XŽªÌ2£r“úš² ˆkã$ˆ.'AøªE; fÓ³Q£ögaª@r-]®éÑå$¦[Jóm¤bK•zÖ\{¾›Ò¡nSëxAVúh‘Fzë›#ÊÖkq ¨c­ÃÙ/',1n#~;ù(¤ö+”¯ÐãBËÊmâ¤:^º”žP˜?ajVONÿÏTá›”˜§|ЮAŠ^1Яz%47›xÝI\ë8©´‹=-ë.cÃ,ï/”žH·¥n=¶’².cò˜«yDR<ÖbÝP×ÄDaµWr¡ªF º.ö Êo+q·Ó·©êU«,hwßÊíâиó‹cqMï‹hö¶ræ«ðR67Š ú©VÒÅFµÕ®WÆ„Ý0Bw}+â:[;Ñ;ðêÇ>ɤ÷rúó©,s ¬¦×qÏKŸÿ4ßã÷/'wþC=o^Çjla·®Ä|%£—奃bzy^¶iÄÆ1ÚïbzZ_ÑÐÖqc_»ž]ub¯)ucPÝ´\è{2±iÐ5Ú²žñ;ÂËЋ͑ùܱé ö|ikãè¬_zSCµ -¼9¸L]gû’|fE⊒ö%ZgXF\ðBqÉ*Ìݲ•™H^Iëz²ßñ¡°T»`n]Ú®s}™åEWYiKØò ^°Ó¼Ò¼²G0úáéõÙ㾘ê i£ö&}ãÒÖ0’6“¥¶\†õe[sl9·NÞÞC­,ËæžmNNŸݵp« ŽQ&M=Û’ÀóJ]•­*­ E£ ÈT•µcµ),Ùj·”'±—bó)ºôϼ§=•Ö‰žJؤ¥rëŠ×¼%Û Ïá{ëTOÙ|É$ÈÏݤ®§´U¶­Û­ë®«í™5ÃuCB÷LUÏæ7)â¿GæŽø)Uý)»#:õ7Ô`¡v:ZcËK‡U -âè½qÑ%¶]rwžýý“í.IÝ?á5a8&g­Šš^-›ðE¾­`EÕWKËÙ²›t_ÛC涯L)ï-û–e“¨]F -éuÁ–œÞDo9ŒJ~…J9Â6¬¶OÊÏ?h  -endstream -endobj -556 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 555 0 R -/Resources 4 0 R -/Annots [ 557 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -557 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 698.673057 101.433071 679.923057 ] -/BS << -/W 0 ->> -/Dest (cb100-1) ->> -endobj -558 0 obj -<< -/Filter /FlateDecode -/Length 4384 ->> -stream -xœí]Mܸ½÷¯èó«åGñ ö bdƒ0’CÃxÖÞE0àÍ!?j‘,±K-uÏŒ­±íA»[U$U"_UQê¦>*ü}¯ñ_$=Ę‚§ãý‡Ãǃ‚Sø7–˜Œê×xwÔŠÂàtòÑ?d CHÎ|8à¿î8üã»ÃæuôÑ )y£Ýñ·wYEv1åU‚Ji+¨œB0Î *¯\bJ’ -f¸@†ÎUfPŠNRÁ 2& -ª3,mÏU f˜ IRÁ \TZÁm”u0DY#è´<:ÝK:£“I¢.@§ƒ‘tÖ>vZÒ¥Á{#Øâ’Ò’ÎÁ§‰”¤ƒ-dct¶Xo•¨ƒ-&+él1è$è"lº¢¨ƒ-Ê+-é’\ŠD¢.A§bˆç:£ÜࢵJÒi=8`ÓŠ:Ì( ’‚ÎÀ¯\u°ÅYe$…-„?Ižp6Ä(ÌV“g·UVK:[Œ $ê` _bãa‹ -^¢Ì !ó’Ä&„’!‰L´EŠ ˜˜ -ÁJ4`’ȧ ñ€U:£%"° -¶8òX [3WÔÁ›Hâk` -H\`-l1d%.°`[Z$.° [RIK\`Á·¤´—¸À‚pa¦’¸À‚qmô$qåJIâ εàN‰ ,HÓ=H\`ÁºÖy#qíZŠ^â Þµ¤•ÄÞµ5El€%.;VG+qw­VAâïb‰ 0ªpè%.V£’¸€À»&*’¸€À»&Àˆº0`Z‰ ¼k.AòÜà]㔑¸€À»†Œ—¸@À?JŒÀ» '‡°+qü=tÆJ\€Æƒ°DâÞÕ îO˜Ó`«AÇä%.pà]1|¢. : Ç…y‹^´÷IâÞ…£²8ð.è3J\ŽàQļ«-<µ¤ïj“”ļ‹¸ÁI\8 €ÄðoƒV€®¨KƒJ1J\àÀ» %#q¼ð "˜DÔ…@Ò€Œ…8TâÞ…{Oxð®rÖJ\àÁ»Šöˆ:Øb£‘¸q t˜¶ÂœF°:(¦tà]¥1Â’¼«THxðnv›ø&J\DÁFâiH!x‰ |RÐ!äu~À±“¸ ((KÔÁ -$që!Ù%.¶Xc$.¶ d¸Á4¢o1=€-€‹˜lA¤(q˜lˆ‰Hâ‚à<ò1ôª¤ófˆt-ê"t:H\ pÅZâäRCĤ—¸?äpIâ˜&‰ B‚-˜*À Ñ 2—t¶ È–¸‘.tZK\ lA4(qA4Y¦WÀC#—DWK:R9ÏŒDòC%.À4A¦ ¦u°4!qÆ''ÛNâ$?H6‘æˆ:ØbI\£Ééf”¸ FØb”‘¸ØÌùf¸ )Ø‚ˆO₤üÃd‰ @ãÐ)%qAÒù¦!‰ 0/s¾%.HV!ßDŠ'ÌÛd}Î7ƒÄ‰`‹Cˆ"ê` ‚¦$Ì[pòM°“¤ó°Å$’¸ yŸóÍ(q 䛈èÅ%˜óÍ .€w]3I:ð."S/qo"²•r{âuñ™¬Œ9ãŒâŠõ:øVqÉ@{á­‚¸f @¾9G `&2ËèÅU¸U(µ— øñqÂiõ‰/QyÀ!ÀgÆ/2aZ¢ûšs´bv¡Øi}ì·_?ÜÁùùïáýwãJYùÓÆÒ„ø -ÓÀ$ ·Cô­qùÖä£cÎ$•-„·ÔÉF„ԌԠÅiÑ- ÷—ÿÏ?Ì,‡á¯ÇÓÛzú/~:}^4Bä‘ñ‘¾ö_Yå VHŽàm=ÊØd2;rˆ+Í -ÿþÍ@¬8­ÖCf>ü%’a2îøæÃᇿ¼úû_z ½yøç·xÅ¿×ù3MïazŸäÎÞE~^Xe¥œ›ê+ÛêåWÑ×va«‹ÌÏÛ¸Ú¾"{ÛÚ¨ç%VîŠv‹Mã5Ø®ÍÒÜÝ·s›|ùoOu ¶6ÕônºëŒå?þëøæÕáoæ #Ó„9)E¸Eʯàv[•Çàö9àŠ4÷\‘ý¯íg݃KÚRŽÙs ìn‡ên°kÞ_2üòÊüµøÛXgoDvt ŸM®kç ºµSPÀGýS£ÌÆe[ÏfcW®:®Þ!j[é-/³"!g×¹­ÎîI9±º$Ólh#«s¶¦—_•Úskä¤Q§ó-¥=ÝìëWé»÷~&¹v Äy¿¼Ûy}ý3^&¿PÂ9$qIE£VQ³­ÎîP³ø½c½Ýsç™8ïñžãÆ°ÓÁu#ú~ÞN®WG=5äð€²ÖYâÕž;5«c:dÒ¼ÍÏ>Þ±sÝ_à¹ÆmÎX6ÖÙb/Ç~<Ä.£Xzpä83u¨0¬|©Ït} é8ß -(ãuØ(j7é.!Ij+̯©Î¬µ¶–P©ÏÑõ4h—jZœç FS$ZAèÆ:{C¨¹ÞÊu4JÏßM(¼oå³Læ¯qf, ±Åw.ßΈq\š¿ŒÄmuv‡Ä•˜pW¼ñÎcEf‹ˆÌ»õè4mO×UâÞñ³eïf*—ž™#Ý ¹­Îîy9ÄfB.¹–Íl}?0y棻)+º[ùšet¶Tž¿ëPÞë :ø¬bñ²á –¡«S®WÊÖ–xq }l)0ß÷†¾muv‡¾•riNóÈü«ó¦Û¸®B–²Ç%Zu}î½±ÎÞPh·Å‰…ëúÕM#zÍ—E¾Pç74îÙ9iÞîŒë^lº€ÎRˆƒ¶üÚ -÷Æ:»Cç#bÇÏÊ+O8sâܳ{%ݪwYqz¹Ók&BLY¼¸Œ=émÍ[6ÖÙö.G‡c¿…i7÷åÛևưþ,ÝÏÝç®ßWñÔgè,3ï±P꽌µ‘MËÝÎTB´¸twddоýé®LÆroKÍ£„»@uŽteG;ØÜ[ô×ñFÜVgw¨\‰ ÃÝÏGï1>í2ÏZ½kP°…=㆞UU×ü~d/€çm]nÇu£M+y ©ëyrc½!’VîB³;Ëgw¤YdtÆ]üž ©Yv|6úvãè_a1{ç‘[7kú˜À0Ö¶º{„gÚßñîŸéמ|×'eu _+Ò'ý²'¶–¸5ÃÙXgwø¼CžEç;—îÎI™ÆÚŠQmã^o>¾WcIÂ%g­O5nÏêúÅsòh1#’Y»‹¸±Îî¹rßû|ùžWv^D,c–ÝÅÞŒÙmuv‡ÙËñçÙì¿å.Ê -KŠwLœÀLî˜<ƾkï>û*Á“:öTcrƒoˬ=A¾­ÎÞPéVV1»Ñ®#·ôÄË·µw™¡¯êÇTÚë¹rcÝ¡òräù˜/(|Yüuà }Ò5ý¤Þò œçÿ -γ u%ý*øjaF®“ßXgoèôϾÐÈàIgÜ'ðôÞ^ÿäúÆ:»CêJLú"ùçË÷ôþ†om¬³;„Þþm K¼sõóß<ývO¯š}cÝ¡órzsÞûzú[ž¨znOÔõ9ýÆ:{CjX‰I_$ÿ<Ñ Û±§öúœ~cÝ!tc,ÊŸ꾯Px‚_mä+v'ÞM#ðÍ«_çÕà wâ7ÖÙWbÎ/1ŽÙõ)<ø ß2ßXgw¨\Yó|‘\óD³i£çÏŠÌxÇP}áY“þ)°¯ÜåŒ7Ü{ßXgo(Û~…èì›å ¿Òa -gŒ Åçßžðé n‹ú¯÷Û3š>¨u7öC)¿s>>îp¡ìA›º­Îîzåš'ã4î Ïxk ‰—òå ¼ô’cÌ>Ê9{¶~Á«Çîµo¬³;4n‹5Ÿä)Gýx4.=kñ7¼ÊÓyEÓwÏÛé¯IŠ…gíoñkß™[äÊxWn«³;tnüV:ÿÒ¯._¾²­Ge„2"Ó ß/ÚXgoˆL+ñe7ë¿Òx#‡]øõkâAþÔÜÕ¿¾´ûoÀ/ õ†5Íuv‡Ö•o¬¿TN{Ì/1uÞl&~Ò´€ÎGjÂh'œZCç¶:»CçÆØs!z—Vhê(-Äb«ße+còzúíþà`¾syï”ètd[ÔX-²Òï生ß?濾cýÔ£¤4äM;m<Â)Q -yŸ‹Ü‘¯þøç?ýudþYbóîô#à§àŸ=^˜ÖŸŽ3ÄG'“OÓTfü9ãB 'Jp#Üs禚š~*¿ç¶ryz"ô,7¹¬?½Æ¶¦Ïc;± Þt¾q,bä“~Ö¾›ÎÍìÛpìÊWoÒýP~<øqÏ=îÛ¥|´É{= 6M:æ}b¢²¤ËÐé±³õq¡æ¸êÇZjÚ!UåMÓò†9§íSÙÁTþã8è:Ñû?O‹Ón†jGSšøáw³$ALðGÅY8}Tµ-0†éd÷`—0¤¾¤ue· jãÖ•Æ•«Éõ]©–w!U -ÙqŸÓ‰!jz}.ÎW¯=‰óŽ q°Ó‘¯¦8_l†°5H¼lk°U\k«˜Ð ;]*ö較Tí:ß„ÕtÞuš )kÎKÂûNk{éƒ(Íû–¦JïUe–•ªÔ•’u@¨Ž“ º?ÂïUiš0˜UÏF-ïætÆ$ªåR)'ˆîb¹©5WG*ÔR±UM¥ç›) ê6ÖŽdcMÒ·8fsDÙòq.öyÊX«Èpc΄÷¸:?\J»ÆÊèq¡eíVqT /Mšäô S³Èò^8ùÿU¸*ÍÌ3~ÐT!•÷³jGí$ynVñ¼“¸ÜWÖ!©4…V–u—¡b–÷ò'¡|&ÝZºöØLʺŒÉC*æe’ªä1늺*ÎVú§r%ªbN×Ä®Bùa&nvº:Uör2¯Ü]m·‰}åÎ.uÄuÞœ¬Ú[Ûe˜/ÂûѱQ/ÎÐå$MlTõvídLØ )4q£Ñ‡Q\fke§ñW±§m’I÷þðëatsÆ:“ðÁ[÷Úä‘—>þe^áõï*›;ü¸Q•-LåÖ™˜{²¼3sÜ(Î;5a6LhˆÑ~ëØʺ‚†êÇa|M­ºjÄ^JêÊ ºj¹Ðµ>dbS¡k´e=ã.ï»^¬ÌcǦ9ìÓ¡-‡Óؼ-X± -ürp›Î6—|dMâ(m.Z2¬"x£8d'LͲ™™ü$µë³ýćÂæs±FäCÛtÔÜ,oºÈÆ«`E[~À&ÍOšföFß<½=î“ɾ̀,­Ô^¥\Z/,K+áÉR;úùaõ9ö˜Êäm=TÛ²lîÙä´©ÑB špŒ2ilÕ¦ŽŸ”ŠlvÒâ(*]@¦Š¬¶ŠM~ªVºe¼â(öR¨1E“þÊ{ÚñQ©èø¨ø³²¹Ýâñj´dkä8œC»:ÕJÖX2 -2ÏkW)µ’¶ÈÎÏMóso{d—AÍß"SÕª¹³’7ñß-sçT§[‰J•¿quDǶ"5é`=¦îDïÁ!”7)ÙrÉÕu.¯Ÿœ¯’”õ~& Ç@Öª · Hë -ÖÔô“¤\-)ñ’®ëay¨Ñœ:[7«ïÆE¢zrªèÒ¸¥°Š1o©”—‹N¿Å9[>ÿþ69‘ -endstream -endobj -559 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 558 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -560 0 obj -<< -/Filter /FlateDecode -/Length 4776 ->> -stream -xœÝ]K#9r¾ëWè¼Àäò|ƒ9° ¼†h؇…Uê®]5f}ðß÷Ìä#™¡TJ]ÝÖ¸ j)#ø’¿2S”>+üý ñ_$=Ř‚§óå×Óo'5§ð/§X]dõ/xwÖŠÂätòÑe SHÎ~?á¿á²Oþ~ú÷?œþkGŸÍ”’7Úÿö…Ud§CPNP%¨”¶‚ʹ)ã¼ òzBS’T0Ã2´U˜A):I3Ș(¨"Ì°´ÝªÌ0A“¤‚:¹ ¨´‚Ú(%ê`ˆ"²FÐi7ytº—tFO>&“D]€N#é¬| í´¤K“÷ÞEIG°Å%¥%ƒ-N)I[ÈÆ éI\àÀ»pTVâÞ}F‰ Àñ<ª‘¸Àwµ…§–tà]m’’¸Àw78‰ ‡I#¸þmÒ -ÐuiR)F‰ x´d$.€žT“ˆº0HZâñ¤‡J\àÁ»pïIâÞUÎZ‰ ½ý!? ð[ò¼°6ˆyÛã ¾šry„&‚mÈ-„äa#BjFjÐâ²éÆFÂÃݦsý ×&Ãb¶Y#˜É-£U½X*hŒ•õ¢­wçùp[-Ö9‰½­ë¼•ø¦u–ÿ·n‰µP¯Ç¬#xÉÆÍôFoýwŸNŽª»Á?´Ë©X¼#ÌÐ&ž?ýzúãÏÿðOÿø¯¿`ì>½þü#¸ŸðÂÜÑî§ôËg–½Î׈…•‰óg§—w¿¼¹SŠâœ“AÑ’}•¯7ò%-ªÊ/ºlËæ4ä·uäôn„2Ëiþ̯’¾Úê[{²]¬éÊWKúbÇbw®‡óþÇùÓχú;õýýç¾Û̺辩E¦^ÑÝÔ™º|ªuiîÎsùi6Ì/ùÞF,ã¼Á»Øbk·pøü6—§?oËk úÉ;l›r²ý¥+}nËž>\³Cµ¶pW×öq·î;Ñ6Þiõ -³0 eÏme®!ØàÇýlùýRÆc± F¹Ô>—¶²=ZÚÜþ¦Ùö´¼{¹N%Í[7 ÌRßK¾ÎúË õ¬w‹^/å¿6û´Ùíû8öO.ëË2J}4O‡y -,˜0ëvs*u×悧0¿çò¾,øê§--}v¹Þ×L?®à@Íý ìºÇq¬6ù67ê¸éf?Ž~2jì§ÚÎ2æfivK6­©­µ—–y'ÓÙ-*›_«¹çº¾Šëök½Û^Þ`^µwæõ¼)sïï?eh[HÁÛáÙòî)–ŽÆãÄÆ€;§yož‡ÂÅGN†×÷hïd“áõ‚\•°¾Ý8N*µÎ]S/µuÕÞh±$q€söœÿüó¿ýËŸzÏÉ°Z¼&]Š‡,Ó¦ó:ó \­Á¿J¼36T8SÙâ•óð.u¥E¾_®± Ñ?.‚P®{ûéFn,¹x;ÙûkVÝÈïü”ÆNÊŸýné¹âè”™ïÔ’óv§§fâY>uÌ««¯9?سä'ùZv ýdó¶ /!è}¾y€ÎÃ2ú±Þ'=p”Öû±b ‘àr÷qêR7»uTjTËsRä)kx\äÅø•½{];ãU€d¯=Û ‚oÇ%Þø*ͳý -¢ìBj+`ÉòRw—æùšÅ÷àCëiÕKïöŽ3‹6«a– -¼Ja;‹‹¬¼o°6Fÿ/6‡™_äsÈPÂïAg÷ë©×zÉ{ç¤ÜÎ+†C r¯ô8_‚ÈŒï(<ÆÒ”’‹Aîaœ8üŸñꔟŒ¦Htãó<Æ)?sãÕ+˜á}À‰.¡õËüy#_^UNC:¾Îá×’çµéŒéÒÙåõyy§å3—ßóð÷òŠ?vPÊ,õ†¡ì:Ÿ¯ !DA?…Fñè>êŽåyÔ5³ƒÚE]£ÞÖ=Yõ²ô|êtoëdðäÈ5®G¡”1/6ËþMǾ ¯Û‘_åùÒ!«.."áζÖÅbÙ Yçy‘­ŒjÇËRcã:ËÈ dn"õXž§CjÚçG; '4ÔäÍ[[mFZB×!ò^ëmëÑàºsYZ.ë{!•]ñ½H=˜çÙêÌ>§ªQ¯]Tù2𥟽ëÇÒ;´W¤w^¼Ì´l}_ûêì)å|ú‹Zd²¶é -*[¬hŒŸ”ÁŠèV|y0ÏÓ¡r?¾Ü‹ÓFO.zÍ1Àg›4°®º:²î¾9–çéFöF WzòÒyÉ¡7ya†4eôt7J "8ßÈPoÝ~È£ù_»U_#­Ï[y!îÇZµ¿¸—+È-œ²Ãöü\Ê}ç´Ö™ÔÛ(ã´EcÄTD~úNåy:œîGpßÑï†,ñvû*p,ùž1¤´ÅÈ•]õgÃ*õˆ¯ëwfhŒþºùGÝÜ©ïvhßç9ê+7ÞF4ù.bRtl¿ä`žgC“ß²öüÙŠ‘F”ŒˆêöÿV¾mõ·u9ºÛ̌җç‡<£o»Â b _ÊÍŒzmr+ZëgLi#K~ÖZ—µmùžÔÿìû]º£H=–çézcgoà´myÓMï§áÑæ}ZïeTŒFúínçØÛΕÞ7v\[÷¶Œ¨r]]­æ¯ ±úøÑö˜GÞGâ±Ñ:Üå™|¥-–<¼":˜çéPzìIÇo¾öþP÷rïiãGß?ŠîþuùÁ4:»3í*o&¹·ò•óíégg=Þ¶þVzâãâkm€ªøÀÆkßI7_æïèåÀ~Þ1Ÿ T“T;c,-iÊwÙó0ÍÃZñY'*‡èäïµ—ÃsÞf~ay>¬f9§?§ã¥êÁO&Ÿó¥æ‹–³!Våï®TÛàJ6CùÛÉçÃGu>€Zù8iÿPqö4Y>1ƒ.µ¤ËÐéÜÙú|%gþ]ßj*þ"ŧóɯyhû‹%ýoyÐ=éD÷>˜,˯²8šrÑÄï'þYÄDít³b.U-‹t=,­È.`Õ0¥1¥u“Z>¶ÕøKùóGãJk8¿+Ùø¸LR%‘ÍFÎ Bäôz+æÖ«I/bþi‹8ÙåÊWSø0›*lRŸ¶Ø2Þk«:¡Û -UW]*öh> -¹voÂjzßuºþ’Ö„n8÷„—ªµ£ô]”òú¥¨Ò»pEEf;£R•º’²ÕqD—“ üA•¢ ƒYõݨñ±Ä³0 QM—J:At9‰é–Ò\©PSÅ–5•žo¦4¨ÛX;^]ºSÿVO7G”-×b>!¯ŽµŠnÌFx9ÁÅÐFü~rAHíW(W × mWnGÕðÒ¤|Ÿbþ„©Yd|¨+ÿ?S…«RfžüAS…ÌÜ®Z%<7«xÝI½ÜWÖ!©4…–¶ë.BÅlß_:*!=“nM]{l%íº¬“‡TÌc’ªä±늺*f -+ýS¹²ªbªkbW¡ü¾7;]ªNÕʼîàîj¹Mì+w¾÷âPG\ó)ÛÕÞZn‡ù"¼dÇF£˜¡K%MlTõv­²NØ )4q£Ñ÷,.³µ²ÿrPùØ&™äq/§¿ž²›3Ö>±Î[Í?ÑG^úü?Hó3^ÿy¢óŸÊ)ų7ª²…©Üº÷žŒb(óOa6ÐPGûM¬cKë -ª7¦ãkjÙU#ö’RWÕUÛ ]ëÃNl*t¶]ϸáeèÅÈ|íØ4‡=_ÚÒ8>{Ï·.Vá¢o.cÓÙæ’Ï]‘¸â¤Í¥CK¦Ëˆ‹¾P\v¦fÙÊLd_Iíz¶Ÿú¡°\WwÑ…|i›Žš›í‹.²ÜŠ. B`Û_ô“î+M+{£ž^_=î‹É¾Ì–Vj¯Ò÷^ZÆÒJx²ÔæK¿¾¬>ÇæƒêÊäm=T˲Ýܳ5ÈiS£…´ºè1ÚIc˶$p}¥Td«J‹£¨t™*²Zb(6ù%[é–Üâ(öR¨1E“þµïi×JíD׊ߤår‹Ç«Ñ’­ëáZëTKYcÉ(È|Ÿ»J©¥´E¶­›Öuo{îšAÍß"SÕ²¹Mʇø#].¥*ywDÇv®?5é`Í?Õ¨¢÷àâ_Û »í’»óìïŸlwIÊþI_†c"kUÐü£›² ïP¤ÛŠ®¨òƒœr¶¤Ä&Ý×ÂöP£¹íAóùW×òžeÞ$ª——Šü#‹–ƒÞÈ¿ ”–šçm¢¸Ú>Éÿ 뎧S -endstream -endobj -561 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 560 0 R -/Resources 4 0 R -/Annots [ 562 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -562 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 642.273057 101.433071 623.523057 ] -/BS << -/W 0 ->> -/Dest (cb103-1) ->> -endobj -563 0 obj -<< -/Filter /FlateDecode -/Length 4418 ->> -stream -xœí]Kܸ¾÷¯èóËå£ø‚=H‚Ù É!Èa¶×ÞE0àÍ!?ÕâCR©ÅÖÌØòÃv·ªXT‰üøU‘R7ÕYâï[…ÿ)BôŽÎ—w§÷')¼•ø7”˜ êñòö¬$yaUtÁžß%ñÂG«½;?žðßì°-þxúÇ7§ÿLmÔY‹VöüÛ›¤"#|ð^ZF¡’Ê0*k…÷Ú:Få”À%ÆÈ©à†õ¤i©òpƒb°œ -nÖQ¸aÈ+³TE¸¡½"N7T´žQ) ?”–’ÕÁId4£SV84ºãtZ ¢Ž¬ÎC§¼ætÆçIYÅé¢pÎÙÀé¾Ø(§³ðÅ*"Ééà ™à9ƒ/ÆÉêà‹Þp:_4Z'2º_€®Àêà‹tRqºh„ˆÕEèdða©ÓÒ -Œ‘œN)aMÃê0¢ÐIÎ3: _œ´‘ÕÁk¤æt¾þ8xÂ3ZuÝFÅé,|ÑÚ«ƒ/è|Ž´ƒ/Ò;Ž0‚Dâ%Ž´÷‚¢&Žt0‚Žtˆ‚¼7 èh¹è90RA§GFÂKŽc£à aä²:øb"q\`4|AŽ Œ/š ÇlK@ ÇtK2*Ž ø–¤r.Ü”0® Ž8.0 \@)r\`À¹ÜÉqéb¸{Ž X×X§9.0 ]CÁq\`À»†”一À»ÆÀ’ÕÁ˜ã°£0*Ž ¼k”ôxÃHs\€^À¡ã¸X:ÉqwuÄqwµG`u^` Ž ¼«-.‹Üà]m¥æ¸€À»š´ã¸@àÉfà]PˆåÓø‚å¸ñ:m8.@eB#-á¸À‚wUDøcÆ4ØJ¨Ç¼«ºÕE¡¨£×5Ðrظx‰É0i{~ýîôÝ_^ýý¯?ü½~{úçï$æRx]¾ÿV¥ÏoÇ÷p}ÇüS¦•:›ÊÐUfíõ=ÉKùlßèr¹b˜‘e?ÕsXÎæMÕ+;êÜÔ·\vð«ËO¯)Û~»Ùõ^fu«jõ²Þ×ëHzkf>éñz{A5½¦$“¦Ö¯ä÷ÿ:¿~uúÃë)ð†lô>¬ö™<«/QLmo@´À"7Õ®(2·ìš¬ËÝGž‡PÛÅog]ùÐÔ×@c€u†‡ä}Jèøwa| S{õóÓ!7…ׇhCÂiE$¥pÔvÃ6G1fU7‰ö^ÒqÓ–d_ YïAî*M¥Çt˧ìð6ûl‡FºÉ©wóã BJïŽöž{ÙOµŽ9ª‡rwÔ[PÈðm©£‘éÜiš‘£]r{áéÙ9W[“Ï´M¤Hº-ÄöÙ±·U¶{÷£ ï‰Â¹\ãÏäíGl;üêIBUM)ûØgs8~ü<ÔÎêY ãF¾ù1Pfº¯‹Ñ8+WâÇÌn‹uÍÓ Ö ˆ¬Ù@d§ÍÑ©oç”%*éYÏúÚ³*­Súñå¶{e’«]¦=5AÍtnæËZ^›£¥›½ÏG’­×@-ïçw3µO³¦”/*½‚š&SZD´ÜDMŸÍáP³‘û½iZ{Îi-ÏÌçž3nrÀ™ŽÚÙG–½Ö“ìJ¯ÇŠœ6§,6k¼:çNµœ³ÏsÖ¬ÿè#`¶´ÊsÍÂcïl¥ÓæpˆýºH9Y[u­¡rs¡q/ÚWÚ,7JZQ ÚBhŸÍáz;7ÜË¥7rË?Œ(¼ÔòIÆóÆ—82x$yÿ}N›£!Ñl䄇â'Dô6Wl|a‘ù0C=M™ëuå¼wølšw=–‹/Ë‘ÆÜÏ‘6‡Cæí¼sྜ›1sÉ­ÙLwï»±‡ÛW–'>zgEë=_f3_ -Ï?ÌP>×gt´£ªÉ—u»fég6ùz¹ÙÚ/®¡ÏÞÿ¥ÓæpèÛÈ!×Æt›™qÑ´ëæYÈÚìq…áþ¹w§ÍáPØ—'f®›¯†tõè=÷^VùB.ïi\šsÒ´Þ ×}²y(Njî7û ”!ï¶V¸;mŽ†NzBîøQyåGÎJž»¸W2[õ.#+Œ/{}MäžÉ)sç±gîƧÓæpØ»íæÇuÜÔ–?Õ6ÔºiÏœÑý<û›Ã¡r#kÌ w™öÞSbÚ-d.à«Ý=(èE@fÏÕ¼aΪrÖíýÈù½€vÞ6›ÛµºÁ§y íx²ÓæpˆÜ¸ ÝÜY^Ü‘n2£wµ÷INfÇ‹Þ7½£‡ÙÙ{›¹ÍFÍ<'Ð -K]³{„ ßñž?+2_{r³6É«óµ"uÕ¯ÇqÛ¬%öÎp:mŽ†O{;‡\ôÅʵó»sÜLckŨÔqáû{òî½XâpÉ<þ¢XkýÙ\¿à™Ó¶ÙbBE½u±ÓæpÈܸïý±üÈ+;ŸDÌc¶ýÊM/fûl‡ÙÛùçbô﹋²Á’ìË0Ó;&OñïÞ{ /¾J°Æ¤ÍSÑ -;Ü–ÙBeŸÍáP¹±Š¹÷» _×ÞŸðE4•NÞÏ•6GC¥ëü†ÍŽï(|^üµc„>ëšþ -Rw|û¦ÓæpHÝÈD¿¾Z‘Ï™|˜‘¸‚Ð&‡ì}V£ÓæpÝX÷ܳF¹‡w¾fÝϸ¹pÿL¾Óæpè|¡üóÍ žuÄ}€HïåýO®wÚ ©~#'ý$ùçóô~Ç·:m‡ÐýߺÅ;w?ßñ5ÒwGz¿ãWŠ:m‡ÎÛyèîyïgé÷Ü?§ï´9R7rÒO’ži„8Òyÿœ¾Óæh ¹hû,Ðìû -™'Úï« |Õ܉·c|ê÷Eõ°ãN|§Íḑs~Žó÷—] ‚‡ß2ï´9*7Öåsžå,ž­_‰êqǽöN›Ã¡±/×|–§ÕÓѸö¬ýÍßðÊOç%ß=[­g~M\¾ÈíW“ öêþÓ߈¥Õo®?é{ eøìðBSw=NM5@&-…ıÌð㤙¸®¤e‡îOÍyí9þØKzOu¥òôöÚ=I®SYw} uŸ‡zB†Èx¾aR›º%%\Wý¤~;ž»ñg¨Ã6פ‹®|rÃÞKjØOº ”Nôž “ú&žÓ~OAR¹ëÔÐØê¼b9lkü¾”w:–ióôñÕuäæ`,ÿ~èôw'I¤öO„qÝ•Tâ óA?žÒ®´Äˆ‰„î'áøQ–ºHå‚Evïzç%rüKåÆæÚæ«Iö6›¥Ý‚HæBfØ/çzbFK§–âtõR¨Qœvö ÂŒG®¸b]öÂZ!µek…ÕpS¬Œl„v)”ÍéªXSöG¥àJÓ¹*,®·M§šîÏeµoºó–ðrÂiÍ\úÈJÓ~¢¹ªÜºZ™iœŠEjsÉÒ!Tú‰]NŒð[™«&tfÑ7½–ve» -C•r1—cD—[n¬Í–žò¥T¨¦1·|u¥BÝ„ÒðŒlh£QêÓVåÍ‘&œŠ]êÜ×24¸Ñ áå„C ñãÉz¦´­\!m†^+4M½EdÅK•¦Ÿ¸~ÂÐ̲´§UúÿJ¶Hó H¥}éêQ=I›E…+[¡ÌNàtUl ”'âê§-C`Ï'sª»-õV±+ÜùØŠ}éq•6,þ–zÌgáel4'è‡|’*Ö²D»z²FX)Tq¥ÑÇAœGka§á×åÇuq÷rúõ4„9m¬ŽøàŒJ{涙—:ÿe^áõïÈ›´]㸖…-táÖ‰¸di‡õÐ)N;®ga6PSCûU¬B-k3J׺ákªæ²{.© -ƒª¢m…¶¶a#ÖºZ™¦eì áeÖŠ%‘yjßÔ€}=4ùâp“¶÷Ë^á ½†ª35$Ÿ›*q”ŠÖ-éÆm¥8lN«g7 Û“”¦OþSÛ&«9hÒˆthªŽj˜m«Î²á*š"HM{ÐVLª=iœøÃ8½{x=¹ßG—]IZ¨½H[i¹°$-„ÇKÍp覇%æ˜s:ȃ·¶P©Ë4cÏ”$§šZÐä Åh# Õl,`Û“R–MNšE¡ Èd–•}öÉf¹Y†+l+ù’STé¯mKÛ¶WJ#Ú¶WÜ¢lª7G¼’-™’Ùξ^¬%K.™k­‹”jI“eËsÓôÜ9Úž›Ë êˆ«™©¬fvQrÿí;W›ÙJW*ÿ «#*ÔmM¨Iy£Í9¦t'8¡´Ù¸§Ð,—Üms{ýd¹J’×OÚ3¡;#½ÞV\x„"n+šªÇay³(ÙKº¯˜å¡Jsr±:d„—5‡E¢rèÓTÑÆakp0È£òR±ËEÃjátùdøû?ÿ,„ -endstream -endobj -564 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 563 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -565 0 obj -<< -/Filter /FlateDecode -/Length 4795 ->> -stream -xœÝ]M$¹q½×¯¨³€Mñûö`À¼° /0°‚=5ÓŒ^+ü÷ý‚™$#™Q™Y½½ã’wÐ[•ü’/‚ÌL–¾*üûNãÉé)¥ƒ»Þ~ºü|QSô -ÿ•«‹¢þÑ_µrqò:‡ä¯?‘ÀÆ)fob¸¾]ð¿á’'»üñ7—¿­óè«™rFûëß¿’ÊÙ)¦•T*¥­ ò~ŠÑø ¨‚žÐÄœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚO$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ƒÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…A -QÐؔϢ¶x«Œ¤³°Å៤OxSf«¡Ùm•Õ’ÎÃc¢u°ƒ/1€ °EÅ QfÐD¼$q€‰qrÙ8‰L²“K.I,`Rž\ŒV¢“ýäBŽX¥¡3Z"«`‹wAb«a‹ÃÌu°Åf'q5° $.°¶g%.°`[´H\`A·Ne-qß:¥ƒÄ„ 3•ÄŒkSpXP. ”%.°à\ À‚t1ݣĬk}0XЮu)H\`Á»Öi%qïZ‹œ¢¶À€'«“•¸Àw­VQâÞÅ42`T'à0H\¬L&%%qœÄ¼k"\€¨‹æ •¸ÀwG$Ï Þ5^‰ x×8$.P&ð£ð.(ÄËálÁJ\± °É ,‘¸Àƒwu†ûæ4ØjÒ)‰ ƒ™$x‘i¸Xo"²•Öö -Äë#â3Y™hÅ™Äêõð­â–÷Â[EqÏ@|i$nÀL¬,Sw àV¡ÔJÜ6Pà_Äcnà óîߢ -€C„ÏL‘™1-¢û¶æèÉìdóþØßÿrùí œïõ/ÿ}yýMÙ)«ÿ4„’Ú!¾Â40Ãí}k4߇Å2öHZª4æn” .›ldÜýwÝ~YY -CÉTäÆ:(ÐÚßZ -»æzÁ<¥t‡E0Ö†|d7õá<‡&GDùÚ¾hÙÖÞE¼ÞÞG’­çùp[±üÆÕ#À\×+y”øcŸÕKëáM½žÌ€;ÆžÌôÁFÛ6Q2 BP„F»ä@µi‚–?3ùÁ,h°Âòñ`@› ùO"V>Ê­ÿÓ§ ¨t±bÞ¥o—Ì|Dt®Ñø맟.¿ý·þóßÿð#øéõò§ß)åý÷ßi|:7z– ‹ì3þÒ"_ÒÑÞrËóµëµ_t5ïÏç;eÅ%ýë¢ L·WÖmÑ i´^Ûåo´ŒYtjþói]WË«ÞY§êý×t˧7Ëg-O÷6kõýŸ¯Ÿ~¸üó§5àÊ:©NcI¯°¢÷ê£ç²üŒþÐÌyš­ ýº»]†ˆui¢:¬ŒêiÛÐ&V^権)à{ÅšÒ.™WÓ"Ôh“J[~ø—ýý°¶`1R ©}‡i‘x®֖µ½ 6žì›ÓÂkbjÖvÎ×ù’¶BÞݶeS¶u”i`t}¯£ÔGé^X>5çkå×´·^W±ÕËm®õ{mƒSx§S?+P–qÌ6V~±sé¯Òv²á6OA¬5æj/‹„U–îD-åÛ¥|é7Â×\žþ²-'XZ¦Ñ­€m9¥íµ?Cé›=;¾Þ±Cõ¶P·öQß›yn¶Ñ-¡ b¡ì½Ì5¾:¶¨Ÿ-}Þêø.6ùJ÷ó÷ÚV²ÇÅž¶´Á`±=/ŸAnGÁTMóÊ0n–úlÒuÑSºê–ü¢×KùŸ»}Úìö½û§”õu™+µ>7ωy,˜0ëv—y¥˜µÍOqþ,å}]ðÅædÉ×æ•Ü×Ä+¾â@Íý ìºÇql6…>7Ú¸én?øq¯ŸâØO­qÀÇ<Õ¶–9Eö¾ óijv¥µ­ZK|×ëtË|Ýr\ç7âðÏN-¼Øº3׬çJo£[·ë~[B_ºµc’6‡~ýdžw-@>Уûf¯wSB`o”èÒ ´ýÚUŠ*S…¹§yîV˜bÚ¶*œé‹EeÕµçE¾_®±yòQ(׿~Û¥r¯+„{VäÇ">{Œ”¿8Ü!ò'Ê,‘8ìNOÍd³|êà±m¡6rÄú'ÚïlÙÓ¥ý­wô>ÝÙDç…x·¥ùiôÀ-Ö|\ï»d0ã’ƒ›ÝÇ©Ïl4vëCS™§²’ÀEA FɹûÏk¼ -Šì½@gHг™îÊ •–Ù~‡‰ÉR£got´ Ü>žÌó$+œÆ‡_wøP½Ë™?ÕÙÕä ,¼—95m[☵¼×÷ýy4¹öÐÔ»‹-nŸ£i Ï -Š’J‹%lö)ê¡Â=$y -¬gTxNnçœËólHòtWë>’÷šá3® kÐú2ßÈ—¿&wC:º.AÎ’çs×ÃÒÙåïËòé–ïT>g»oå{~Ç‚ÃZ渡p[÷Ù½ýO=."ZB£è6È>êÎåyÔu³é™ßÔÙ5Ú*;e´$)=ÏwÑ^×#XÂoÃF/®ËXí<~Ðnåy$<ØÖ¶ «[2O?ŽÈ^F³ãe©¾s%d¸l‘z.ÏÓ!5ìó£;j*òæM„-‚6#-¡ëÿhÿ\BßC?,-—õÍããH=—çéš÷9U ˆúÌâ¼—/ÃÏ}ø(ݱc@{C:óâu¦ûÜ·µ¯ÍžZΗ¡¿\LÖ6ɨ =V4&LÊD{_žÌól¨ ûñå^œ6zrÑkŽy>»w£gu-®?7+å°þ¼;²æq¾9™çéFö †«=yc^rèMš;¦n©Ž·ßêèéíz”òÐ-õÊvÞ›ÿ3[Õ„5ÒxÞÆ i?Öj¨øÅ¿ÜAnå”–ósEèá-Çj£ŒÓ9zª*ÑËG8=—çépºÁm|‡fc¶ÄÛuì7wÝCÇÀè{ÆHÐå-Fƨì®?V©g|¿=>YÀçŸcs§}Ú¡}_樯ÞÒÚ ‰ELg9™çéдeíù³#(¥ÕæŽ ?øHo7Ël•ËQðº.cd½Íz@ŠákYãNáëýuÈQ´ÆgLH@ˆ¼ÆµÖmm[¹ósÇ?G¾Kw©'ó<RãÁÎÞÀi#Úʦ›ÞOC£Mû´†þ–Q1AiáÞÜGDaó­Õ¡ÒçÆŽ{«`nˈ*Ïêz×jþyÔGo·¤òFÂ>Ïåy:$DŠÏü¬àȉuÖ »v›6Ô:oç7Þ•Ù vD—øÜß–—ÏîŽÊ¨¾ƒÜwìþÌótÈÝŸyoÕ¿U¬-#’7æq¨[÷ÓˆFÉ´u×p‡f³'sÆû÷˜ÓÅ4iëè©ŠäžËótÈ=Ø ´:øJ“yiîi¢ùŽí0J£'ïjìÄp%º°Ûúl`1ñæÖ¡<¶ ±*kç.Ë.‚GÔ³Ý÷Ä£I=Î¥'ó<"ÓA<:ì‹´ÞãÞëÞ -…qïõ•ç{ù¿#sðØúêç¯T{j3e• ½Ý·Ôsyž©ûñê¤ù…ñ çµ{ü2Ü™v;øý1Ýs£ü~Ôr•lO2ûÉ—Åù*Ïåy:TÄ¢G(zt4>*î;ƒê;«¢ ”ßAf|_žËótÈ<ˆ5?rårå­n>ÑÃ;‚σ`¥¹Ç’§WD'ó<Jó¹'õµ÷¯àƒ7SÏ ÷‘6~ôý£l_—ŸÌót(Ü-Ë“$õ9ZiW›?ï–tÒˆ køÃ53Û…¹·¿YG¸î¼oê}çó‡‘@ÒûÒãý ÖŽ;hc{‘g=óÉS'oï¡V–es϶ §OZ¸ÕÇ(“¦žmIày¥®ÊV•VGÑè2Ue­ÄXm -K¶Ú-¥ÅIì¥ØbŠ.ý+ïiÏG¥u¢ç£6i©ÜêñZ´d[ä9œcoê)[,™Y๛Ôõ”¶Ê¶u»uÝÕÛ^Y3\7$ôÈTõl~“ò]ü÷ž¹3çv"¤Tõ_ÙÑ©$Gít´Æ–߆S)pˆ£Ÿ÷ˆ.±í’‡óìïŸlwIêþ ¯ Ã19kUÔô+² oPäc+ªþ œ-+±Iu€°=ÔiNmv‡ÊÏ<•½Ë²IÔ.éC¿êf)èMôc4Qiù,XÚ&zYmŸ”ÿ çÖë¸ -endstream -endobj -566 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 565 0 R -/Resources 4 0 R -/Annots [ 567 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -567 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 588.873057 101.433071 570.123057 ] -/BS << -/W 0 ->> -/Dest (cb106-1) ->> -endobj -568 0 obj -<< -/Filter /FlateDecode -/Length 4402 ->> -stream -xœí]Kܸ¾÷¯èóËå£ø‚=H‚Ù Œää0î]ï"ðæ¿Ÿjñ!©Ôbk<¶Æk7Ú#U±¨ùñc‘”šê,ñùVá¿@J„½£óåýéÃI -o%þ )&'ƒú5¾Þž•$/¬Š.Øóû$0^øhµwçÇþ›¶ÉOÿøæôŸ©:k£ÓÊžý)©È¼—–QE¨¤2ŒÊZὶŽQ9%p‹1r*¸a=iZª<Ü ,§‚¤u`TnòÊ,Unh¯ˆSÁ ­gTJÂ¥¥dupDÍè”…î8VÂ…¨#«óÐ)¯91ÂyRVqº(œs6p:‚/6JÅé,|±ŠHr:øB&xNçà‹qF²:ø¢ƒ7œÎÃÒ‰Œ.À +°:ø"Tœ.ac bu:|Xê´´Âc$§SJX`Ó°:´(T’óŒNÃ'mduðÅ©9/„§OXãC`Z«N­ÛH£8…/Z{buð•Ï1€vðEzÇQZH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHøbÉqL`|!´\V_L$Ž Œ†/HÀq1ðE“á¸À€m há¸À€nIFÅqß’TŽãÂ…›’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]4wÏqëë4Ç´k(8Ž x×’x×X²:øs\vFÃqw’žãï¢iŽ P«8t+B‡ 9. ð®’8. ð®öèXhƒ†ãïj‹[àznð®¶Rs\@à]MÚq\ ðd£ð.(Äòá|Ár\€þ:m8.@fB#,á¸À‚wUD÷Ç´i°•P!:Ž ,xWT«‹By”8ÓnQÊB99.°à]tT†ã Þ}Ž Àñ=ªæ¸À‚w•AOÍéÀ»JGÉqï"n°B!à¸ý›PÐeuQÈǼ ZÒ 2€IX’â¸d,$âPŽ xÝ{ä¸Àw¥5†ãÞ•„°‡ÕÁ4Ljk C³eÚ4‚U!5˜‚Ów¥B s:ð®”>r\àÀ»©Ûä¸Àù$Ðã8(kŽ \ ½w¸(¡CÈÇêœÀ¹å¸ÀK,(‹ÕÁòÄqkM x _ŒÖx _2p\€ˆ@D…è›ÀÀ…|A¤Èq˜L„HÄq·ã1”*§sZºfu:å9.ðžºbÅqÆR" Ñs\‚)\â¸n@§ˆãá š -ÇèŠDЈÌ9‚/²9.@¤ R _ r\tÀ(ÓIŽ ÐCc,‰¢æt$Ó83p\ȉ*r\€f‚‘&˜’ÕÁÐǨŸ4ض`ðƒÁ&†9¬¾K„ Óp3p\|ÑRs\l¦ñ¦ç¸ Jø‚ˆã‚(Ha2Ç qè¤ä¸ ª€ñ¦&Ž Ð.Óx3p\ÄxC<¦ÝFãÒxÓs\ ¾X„(¬¾ hŠL»'a¼ vât¾èHDçÒx3p\€0ãMDôì”@HãMÏN€wm3q:ð."SÇqN0ÞDdËí%ˆ×zÄg¼2¤g`g $¨×¢oe§ $¸½•gç $È7‘ØI¸‰‘ep쬺U(•d§ $øñ-8á:ûÔNQ9ÀÁ£Ï >ÝdD³ D÷eÌQ“™•d×ù±_>}÷€Î÷üóOï¾fÊòG!@Râ+4QÝÑ·Â퇊VbÒà!Üc“œð±:©@‹ã¤[rÝ_úw^L<‡ã¯‡Ë›rùˆ^|¸<Ü$*+å0|æï4ùˆK ŽÐÛ:¤1Q'väWJš$þý›€:zq-§ûè/1&mÏoÞŸ¾ûË«¿ÿõ‡×€Ñ›w§þNJk¿ÿVá/Ñõ¯Ȳ·ø†Q>¦K3wÅ槪WvÔeÛ™+yù1ý»Q窮ø1êè2Ë[U{þØQGvšvÐç{4ÓüîòYMïÛ^RZ¯¡ä÷ÿ:¿yuúÛ)ˆ†Èò -{ ZQ ÚÀ]ŸÉSp÷pÃ0õÜ̬ˆõXô±©ÞYu|Ë1ñÉU2­ŽõkÚ·×ê q/ÔÖ Ó¦áîiLŸîe€s?m³XøÁ5¿î&ËC2ͶgbÃàÔÛÀd§ÍÑ@‰O Ðr ‡)ºR-w!»AÆ¡Ÿ¤•ÌˆrÑïªKÃPÄú)‚ºÄ>›Ã!‘nòãq8ã o;ºpUÁ~”öÙ¥Ac.Aj¯0­á¶v²®ôàžGQ[ËïfµùÐä× c@vFˆä}J-©øwa| S{õãÓQ·àÛg/Ã×°’Ò”ð¨íŠûl‡âÛ±èî˜Ùo¯÷ w ºÆ“6=ćÓ|ÍM4vÚ úv z7?ÎÑxO¬÷)ø;ËÞÖ<æ¨ÒÝ‘oA!÷%¦E¦k§VhFŽ6vÉí…§g×\El;Óò0‘"é¶Ûgs8ÄÞŽUuØ®ÝÏ‚¼¦Îéö o?š`ÛáWOª› ÉnöÙŸ?µ³|ȸo~”™°îë¢5ÎÒ•þcf·É‰5>L<EdÍ"ûl‡ÈÎùM=«Y_kV¥•C?~Ýv­LbµË´¦¸éí¢s3_ÖâÚÙ4¸¡`î‡Q]x?ÿ5Sû4jJñâÚü£iâ8¥E”AË-ÔtÚ 5f#ö»±p1á™ùØsÆMC 8Óµ3æåï¦ù$»Rë±"§)‹Í¯r %³1ûRkêìÁÛgE&H|hP}ãY“Åï*æÖ²±Êw¬½wÚ¥}¿B´x³|åW:tæŒ;Çúc>Ôú"Ä÷]ÿˆfaÛÎrÈéû8åãås‡+mÞêFhŸÍázçœgÃimO¸à­5$Þ/wðÒKŽ1çQÎâÙúÚ«¿÷ÍðgmÚ·(Xšm8 -7“l n¹iGÞúâœ>sH¹KƒHæšpF€Hѧ=f„^ýñÏú[¡ô3dú§ëþ]_²Â±Ã°1îzžŠlx-KqL3ü|Y®¦k%ó„ak¯U"Ç×ÁÓß”WJOï®°IrÒºëwÈk<ò ™Çë Ý^‚Nª’«~’¿¯Ýø3äa›{ÈÚÅEU~8¹a¿$5ì™']J§MuÏŽ„IuÏi¦ ©\uj(lu^±¶"þPR»Ë´aaÚ¬êºuqs2¦ÿ0Túû“Š$Rù'B¸î$*qÐù¤ŠOi'YbÄ„1u§8 ÇCYò"•Ù¼êEœ§4VÈñ0–Ì͇Úæ»Iö6›¥~HæDfØãæzaFK§–ât÷R¨Qœvã ÂŒg®¸b]öš!µik†ÕpS¬Œl„v)”ÍåªXSöG¥ÝÛJѹ*,®·E§šêÏiµoªó–ðrÂeÍ\úÈJÓ 9«\ºZ™iœŠEjsÊR!Tê‰]NŒð[™³&TfÑ7µ–vR» -C•t1§cD—›nÌÍ–šò%U¨¦1—|u¥BÝ„RðŒl(£QêÓöâM‘&NÅ.Õ@®kÜè…ðrBC ñãÉz&µ­\!m†^+4M¾EdÅK•¦¯GhšY–ö¡Jÿ_©Âibžá@QTÚK®žÕ‹¤¶YÄÓBjå®°q% È×´Mq)ï fÛòRA2éé–Ô¥Ä&ҦȹٽDR…<¦bUPWĉÂrù®l…2;ËU±-P~œˆ«Ÿ¶4U€=_Ì©î¶ä[Å®pçc+ö¥ÆUÚ°ø[òm0Ÿ…—¡c£¹8A?ä‹T±–¥·«k„Õ1BW}ŵv~A~<¬Œëq/§_NC7§ÕΨ´Ïmy©óÿæ¾ÿ>Ñù‡¼±Úµײ°….Ü:·=YÚ=tŠÓ.éYXšM#ÔÔÐ~«PÓÚŒ†ÒkÝð5UsY‰=§T…AUѶB[Ë°ë]­LS2ö†ð2+ÅÈ<µnj‡}=5ùæp“¶äË^᤽œ†ª3µK>7Yâ,%­]:´¤Cœ´™â´¹`¬žMÜL€l/RŠ>ùOmU˜t­æ¤ #Ò©©:ªÝl›u– wÑ$AlÚ“6cRíEãÄÆéÝÍëÉõ>ºìr HÒBíEúØJË%i!<^j†S7=-}Ž9§“Üxk •¼LÓöL rjÓ¨¡MNZŒ6ÒPÍƶ½(eÙ䢹£(t™Ì²’£Ï>¹Ñ,ËpÇ-%_bŠ*ý¥-iÛÖJ)DÛÖŠ[¤Mùæ¯DK¦@¶…³¯w'kÊKFæZë"¥šÒdÙòÚ4½vîmÏÍmPuÄÕÈTV3»H¹‹ÿö´«Íl&‚K•?Ãìˆ -u+RtÔ¤¼ÑæS¸œ‡PÚ ÜSh¦K=²œ%Éó'í•P‚Œ‘^o+.>ÿß õT -endstream -endobj -569 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 568 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -570 0 obj -<< -/Filter /FlateDecode -/Length 4837 ->> -stream -xœå]K䶾÷¯ès+|?€À‡I# b`‘Œv{wbãvùûùŠÉURkƳ‹6²ƒÙnUñQ$¿úX¤(¾*ü|¥ñ_rzJ)Çà®·.?^Խ¿’buQÔßâ7ú«V.N^çüõØ8ÅìM ×ç þ.yòçËßuù÷:¾š)ç`´¿þô‰TÎN1Ũ¼ ÊP)m•÷SŒÆAô„&æ,©`†Î¸­* —“—T0ÓU‚ÖEm·ª 3LÔNRÁ }TZÁm”u0D9g Ó~ -èô 錞BÊ&‹ºŽFÒY;…è´×’.O!Ÿ$ƒ->+-é'çD]†N¥˜¶:£ü䓵JÒi=y`ÓŠ:x)DAg`KP>‹:Øâ­2’·Ižð6¦$x«!ï¶ÊjIça‹1щ:Ø‚Á—ÀØ¢b(4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ๢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.Ü=J\`ÁºÖ#qíZ—‚ļkV8ð®µÈ)ê` ,qØq²:Y‰ x×j%.pà]¸‘‘¸£:‡Aâ`e2))‰ x×$å$.pà]1ˆº8Á­Ä¼k<š ÍÜà]ã•‘¸Àw3Aâeÿ(1ï‚B¼À¬Ä˜ï¡3Vâ6„%xð®Î˜þŸ[M:å qïê„áuyÒ=.ø-zyÒ!d‰ 04gv“_œç®ÉB¾¶/Z¶µw¯·÷•dë‹ó¼¹­´ÌÀçº^w¿íà³z1Ïoëu`Wà;ÆžÌôÆFÛ^? BPÚæD¬LŒ–&h{a–74Xa9ø0 ͆æS$VBÊ­ÿöÝÔºX1ïÚ·Kf>"<©Òøë».¿þÓ7ûËŸ¿ß=]¾ûR.|ý•Æ§7Ë'ÌÇå»_ëÜÓð™Öé0˜Ê}Âõ"w~NªËaâw·Eÿž– KYjþõvÈSmZl4”mÖˆ´Çoš?wËÛÄë¯íº1ûÞÏu”tn·uû6uuµÏXÓ}ýë»o.¿{·\Y7À9,s:GáÁ!FÏeù9ýÐÌù 4k·kµ3\‰Aÿy6T šf;¼Žéjº–O³ú?Pçy>u} ÙB£A!ï”eh½¸,%ôkËè>kÈÊp¤ûH•iY‹µEd‡x<™çщµü"Ç‘h½:ŒBCÃk L"Â#ÜÖöðúi…Áf3Ø®91m ³‘"÷®(ÔǼÁß>§×î Õ6*ôÊM… ï±çÉ<‡VwÈŸ¿XNÛC³Þ¢kã%i]×Ê¿¨í ³“Úa´3–¾ê:Ïåy8tž <Ç qàÞ«m”v1â’MðšXyuLÚ²œÚ‚Õœbmi—lÍj XŘTÚòÍïÿø‡¿²¶þÖä)©í»­3-ìkmZÛÝç²sN‹µ1¼´¶w¾ÞÈ—´Û9‚úw[îÌë|.êå–:üð¶|jÎ×ì­io½®bSÕ›u:n·¿¤+cqªó-ïüï†>U`2ã˜Í‘Ù¡zß•>!n³gê°TVuÅ8…lé,ÊR—]úΗþ$ÌÍåéÛr‚¥Z: °-§´½ös(}s`رCõ¶Ð8´öј˜Ù_ÛèPHP΄,”=c³—¹ÆZÇõ³¥Ï[ßÅ&_gù{m+ÙãbO[Ú¿`³Øž—Ï ·£`­¦ybxoñÂ\ß',éêlå½^ÊÿÐí«±ÃNßÛ±JYŸªõ¹ÙWfÿX0aÖí.þ¦˜µÍOqþ,å}ZðÅ|µäkþ&÷5q¯8Ps?(»îÃq›M¡ûF7Ýígõ“û©µ³òDêxâý_êaxö¦·I²·óç6‰×Öœæ9¯ÕþIB› ûÔŠ¯F ´•/ËgõÃÌƶ¶mž»Žú0n|ñCƒâËÔ¶lì©þ«{ÁR±Ó3ž³Û>ÑúÈ:·²¶eæÕ5/Tn#gýlÙØ£ƒ,Xî™»‘ÍÉ<¯Ú^}ÃÆ7{p'ïá®bHSÜx\.éJ lÊŸa·ÂäÑ!…¡Â™ªY`ZC›¼ÈË¥yÔ\D¡\ÿôõÜ.•“=!ìYu'¿Sö;) :†@П(³šu>؃ž:Ú‘äá}¡6r/Xîœh?ÝJH:ÑݼWô>ãBç…¸ÛÒ;ùiôÀÖ¼]ï»dàqÉ!¤8Æ©Ïl4ëCs™§èìˆ1§@ÆX«ÐîuÛ ‰NFf:ƒ4TZ¼}‡½Ô)V»w‹á\žYâ5>ô„é>¤›úqù ƒ‡aco«iåy\ÿA­6<mÿnÍŒ€z­Þïo³½ÅŸz¿íó”?䫺q+ng“£-•ÏûÛ;ð¥æ'±\%Àã¾´âŇ’4Ú_Ë>E=TxèG9VŸð*œÛÈ;™çÑü(h}äG÷î#5Œ×åÉûùûFî‡{cnHç_ý¸äùÐuƬ}©ü~\>ÝòÝÏ>ÿÅgÞßtÿmeŽÛI·uŸímÐ@¡"èì â“yuÝlQ7°Úf#¾2ã 6ùÛèÅuŸãÜy$¼°­mÁ½ÈÔ:ÏëÙËhv¼?@ªë\g .›»H=—çáŽùÑÈa±À/ù¦°„~å4²´\ÖCj4/Gê¹<‡ÔtÌ©j@‹VçÍDÆ—aµ¾Ý(íØ1 ½!ÍâÕÓøMë/e_óžZÎÇ¡¿êMôM;¨ì±¢1aR&Ú»ñåÉ<†Êx_žÙÏz`ûQŽÛ¹Í·ºÁן{ëÆ;#ÍËùædž‡Ù;1\íÉ›%‡Þ$ß¡:«­ãèi6J "(Ý ROlÏåµù?°UMX#çm¼°sân¬cäÿ~¹üpËN Ëù¹"ôî çj£ŒÓ9:AŸèÁ×{8=—çápzÁmæ¾²ÄÛuì7Ç.BÇÀ8÷Œ‘àkNqî­RÏÌu|gf[1Òˆ’QZmŽ£pùaŽäñvc±ÌV¹Oë2FÖÏVÑÒpг­@Ÿö×!÷¢5î1ã~æ*ò×Z·µmó­Ë¤ò]º³H=—çÑšîìì œ6¢­lºéã44Ú´Okèw„‘îL¾EVbo;#TúÜر· -涌¨ò¬®7<,šxÔwòhóÉ<‡Ä;‘â#9±zÍÎ}—m‡òòÆ{2ÄŽèÚ9:ý¶.ì=#òòÝ¿“y¹Ç±ã#ïà¡úg£êôcCêÖý4¢Qš Úºk¸C³Ù“91û§sº˜&m)¹ƒÜsy¹wv퀾Òd³4ŸiïEóÛa”Æ™|¼«qÕèÂnë³ÅÄ{÷ȇ?Ê:¸Ërˆàõlwã5ñhʯàÒsy ‘ùN<ºó”äj_do…Â8êè Ï_ô™;-¬îq~¤f{j3e• ½Éá©'ó<RãÕ3H+3äGƃœ×öøe¸3ífàÿ¿‡QwPÉö$Ï>°|2ÏáòN,zE_ôqÞ¢zgUôË@ù2ã+øò\ž‡CæXó-W.'Pþ¢ÕÍ[#zxHôq¼ƒÒKž^Ìóh(ÕêÜQÇϾøþ¾ólò辤opéÛå]TÑcļ§w&¯{µUÃÞÝ$w V"o_ÎsÕà ‘Ö§•Q$½„Þ¦«¢r¤÷¶íU6Ÿæ{Ñzy˜‹öÁË}æ0_S7¶‡uó’†=¬UlÈ-þÕ‡ÐÊyçúÚÓÌ,$7í¡NÕŸ+Š=@«ÚCd¦<`«æ‡Æ–çVå<¸ØÚàk6Cùã%”wêòZÀ †^T n²46ùJï=LÊ:]‡N—ÎÖלåõþ?¶TËÿ½˜^Y†–_,é,ƒþÃEg7Qÿ—§zËÛ¹U'S/ºøùBogw‚عþhð1 —¯ª•åt{Ò¸Ên Ô8å1¥õõíiìqd:¬=5¾¶†òûšÞšçTMdË{ãæŠ!r½SëÕ¤1½á>Mv¹ -Ízª {Ž§íöŒwÅÚ*&ô[¡bÕu±qÕMoDm]º°™Î»N³á¯iMdÃy$¼]P­¥Ï¢”Þ«]‹ª½kT“YfTnR_S¶qmœÑí"¿Rµh‡Álz6jôvÒY˜*\K—k:At»ˆé–Ò|©ØR¥ž5מï¦t¨ÛÔ:^ÝØ#û‘þdóeë×µ˜ž>oc­ÃÙoL1n#~¾ø(¤ö+”¯ÐãBËÊmâ¤:^º”¢¨ù\³ÊèÝŽôÿL¾I‰yÊí¤èý¬ýªWB¾ÙÄëNâòÐXÇI= ]ìiYwéfy餄ôDº-u뱕”u“Ç\Í#’jä±놺&& -«ýÓ¸’ U5Õu±oP~^‰»¾¹ªW­² Ü}+·‹CãÎg.ŽmÄ5½l·ÙÛÊe˜¯Â[™ØÜ(&è§ZIÕf»^vÃ@ -]Üiô¹ˆ«·6v¢? R¿v'“fÜÛåûK™æŒõ†ž–VÓ»ãy䥯ÿEšoðû¯‹»þ¹¾¬tžÇjla·®Ä|&£¿4’NŠé/Tas&4ŽÑ~ëÔÓúŠ†6ÃøÚõìª{M©ƒê¦åBßû‰Mƒ®Ñ–õŒ?Þ†^lÌÏ›>aÏ—¶6Žžû¦×ÜV«pÁ›ƒËÔu¶OÉWV$®(iŸÒ¡u†eÄ/—¬ÂÜ-[™I€ä•´®'û -Ku± FÐ¥í:קY^t••V°$-¿à;Í+Í+{£_í^?{Ü“Cõ’6joÒg.m #i#> -endobj -572 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 517.623057 101.433071 498.873057 ] -/BS << -/W 0 ->> -/Dest (cb109-1) ->> -endobj -573 0 obj -<< -/Filter /FlateDecode -/Length 4380 ->> -stream -xœí]Kܸ¾÷¯èóæòQ|Á$AŒlFrr÷ڻƼ9äïç£$RUj±{<¶l¯ãiU±¨ùñcñ¡¦:Kü¼Pø/!Dïè|yúp’Â[‰CŠÅÅ ~…_oÏJ’VEìù}/|´Ú»óã ÿ5—uòÇÓ?¾;ýgi£ÎZÄè´²ç_ß&áƒ÷Ò2ª•T†QY+¼×Ö1*§1FN7¬'Mk•‡ƒåTpƒ´Œ*À C^™µ* íq*¸¡¢õŒJIø¡´”¬ŽH"£²Â¡Ð§ÓJ¸udu:å5§3F8OÊ*N…sÎNGðÅF©8…/VIN_ÈÏé|1ÎHV_tð†Óyø¢Q:‘ÑøtV_¤“ŠÓE#l D¬.B'ƒk–VØ`ŒätJ lV‡…JržÑiø⤬¾X#5§3ð…ðÃéÀÖø˜ÖªSë6Ò(Ngá‹ÖžX|Aås  |‘Þq€$/q ½5q$ ƒ(p, Cä½áh@G+ÈEÏñ€‘ -:­8"0¾Xr_-—ÕÁ‰ã£á p\` |Ñd8.0`[Z8.0 [’Qq\`À·$•ã¸À€pá¦ä¸À€qMpÄqåJ‘ãÎ5àNŽ HÍÝs\`ÀºÆ:Íqí -ŽãÞ5¤$ÇÞ5–¬¾À€…QÁp\@à]£¤ç¸€À»hFšãÔªÇÀŠÐ!HŽ ¼«ƒ$Ž ¼«=ºVçڠḀÀ»Ú⸞¼«­ÔxW“v(ü#Ùh¼ -±|8_@° ¿‡NŽ ™ÐK8.°à]Ñý1ml%TˆŽã ÞUÕÇê¢P%δ[”²PÎEŽ ,x•á¸À‚wAŸãp¼@ª9.°à]eÐSs:ð®ÒQr\`Á»ˆ,Ç€ƒP8.@ÿ&”tY]2†Àqï‚–4Çè…… `V瀤8. ‰8”ãÞE÷9.pà]iá¸Àw%!ìauðÅÍqâèÐl™6`UH ¦àtà]©PÃœ¼+¥8ðnê69.p> tภ-DÁšãHDïÇ.Jèò±:'pm9.ð Êbuð…gjÒ–çøá_ç×/Ox½ÐUŽGÇ%FUfs}&OÁÜs@ CÔ+P+ÅÖT½YW{Ó”Æ^&à?«¼¦ôI^ªû²„Ã`c›ªSUu¾YÃ`aó¶ªb;é¶à7òÊÏ:ù˜íoÎK®a¨ªgia¼l.<<Ó¬{[šHÇC¦>ó*>;mŽPŒ|®"ô©dÒ"0§UÏO>_gëØ@¬)ôHiX‡˜¶{ˆí³9bé:§ÞŠ¼+ô¦áá[j´›>a‹«Pú´¾d‘UˆA³Ä ¡ç:"ûl‡Èëåq¹äÀ­¥AgW¯]…ˆ’„Vˆö×gs8Ä]+ËÐ!—²fzϦÆT>Œ<@´¨ÉµÒòÖÖ=í›±Ÿ#*Prã™>KÀ£RÏq!E+ì±TvÚ •úz,yXN»2 -ëBö ½û³´’†+·øQÏñžMK! ÓôבØgs8$îĈ‡áŒ¯¼UÜÑ‹ë9ìGiŸÍáPÚ7æ¤*ö -Ë®k§ŒrîyÕµ\Pñ®©Í‡*¿ -²3B$ïSjIÅ¿ ãkXÚ§IÕ§¢nÅ·Ï^†(·Ç;m‡â9Î{c>ªdß _߃Ü-4š;æ3;mŽ†F³3Ÿy+?Þ=³ü‰ø;ËÞÌy´¨ÒÝoA!÷%ªE¦{§Vh&Ž6vÍí…§;ˆL57é"êY‘Ü[•ì´9b¯Çª:ì×îgAÞÓ çt•?÷ ï~4Á¶Ã¯ž8ÔTs‘Ýì³9?j›|Vȸo~”™°íëª5Þ¼ø¿È9>LÛèƒ"²{«æ6‡Cdçüæµ­i7šŸ~Ý~­,bµv…‘™á.:×ø²×63á¶AA뇞P]x?ÿ5Kûa+ŠÞž¤*ŽëÝkÑis4ÔÐýkÙ žiÇž 7 1`£«gÌË=Þ-óQÕF eu~Í(©åÕ/õZI3focÖ¬ÿì- sž’ª9ÇÞÑJ§ÍáûÛ<å¢eíåµ…ÊݹÆ{ѾÐj¾±w¥±Óæp½ÞË¥6rÉ?L(lV#yÞø[ÆÃík:6‡CâNLx(ÞxB^ÇŠ•/,2Ô§­Éy›ò÷®¶0ë)]|^Ž´òvŽì´92íκ·ªb3f,¹7šé®}7Õpý›åyC{ÿnÕ|e´»3Ï?4(oõu«ªâe]ÏYúÆ&?/7ZÛâÅ-ôݱ²ÓæpèëÜÙ¶éCî¡9VœÙF!Û;ß6Pho{wÚ…}qâ§ÚE»Ír½¦q©î¹ù"Ë—‡n ³Zoî~ó«Ïæpè|BìøYyå#¶œ8wµVÒÌz—–¦_;þ.䞉)s/ÎbÏÉÛwùtÚ {îzt8”›ŸæqSY¾™ËPëªÏ7[Þ¼¿ã·ž¾»§w|CQ§ÍáÐy=ýt߀{üžþžUÏÝÓG{û˜¾ÓæpH݉I¿HþùH-ìÈ=ý߆Ùis8„vÆ¢õ^ æ}…Ìõûj_U+ñvªßzõÝ^ýÕt>†·¨4kÓùDÁªP·Qà·›dmëÃ9òçôÓÂÉM8rD:ׄ3EŠ>%“àóòþÓß*ø¤¯†ÐoÇ/b7¾â³Ã/ cÜxŠjX"Ty™úá+%rõŒUc‡©îTœcUÈéô7å•ÒÓ»:I®SZ7þyMŸ‡|BŽL÷KðLöð‹ü¨_äo§{Wþ yØêòòg\U凓ÎERÃÙxÒ¡t:<÷ìH˜T7ñœÎb -ÒÊU§†ÂVç ËáÈá%Õt -±L¦C©Æ#Š«‹)ý‡¡ÒߟT$‘Ê?‘Áxb¨ÄAç‹YüxJ'Æ#&ð\§8 §²äE*',² 8Ջئ4VÈéc,™›?j›Ÿ&ÙÛl–Nò!™™á,›ñÆŒ–N­Åéé¥P“8º„™®\qźì3„s†T§3œ wÅÊÈJh×BYÝnkÊþ¨tJ[):7 ‹ëuÑ©ªúsZí«ê¼&¼œp[ÓJYi:ë3g•KWË"3•S±HmNY*„J=1¢Ë‰¾9kBe}UkéÄ´Q2¨¤‹9#ºœØtSn¶Ô”/©ÂlsÉÏ®ÌP7¡<#Êh’útŒxÕF¤É—b—j ×µ nôJx9¡‹¡•øñd=“ÚÎ\!m†^-4U¾E䌗Yš6…ŸÐ4³,7•þ©Âibžáƒ¢©tfÜ|5ß$µÍ"^R-w…uˆ+E~N[—ò¾`¶./$“>‘nI]Jl!­Š¬’û˜ÝK$UÈc)VuEœ(,—OáÊZ(³¸Ý,¶Ê ñì§-M`Ï7sª‚»-ùÎbW¸ó±ûRã*Xü-ùV˜ÏÂËбQ+NÐù&³XËÒÛÍ7«„³c …Y<Óèã έµ°Óð óÓǹ‘q=îåôËièæ´±:âƒ3*g[G^êü?¤y‰ßŸèüc>@mìǵ,l¡ ·.ÄuO–N?âtz–fS 5U´?‹U˜ÓÚŒ†Òk]ñ5Íær&öœRUE[ í\†•Xèjeª’±W„—¦K óÔº™;ìñÒä‡ÃmL:z/{…‹úqpf™»äs•%®RÒ¹K‡–teˆ‹:S\V7Œ³g 7 ë›”¢OþS]&Ý«º¨ÂˆtifÍÝlu– OQ%Alê‹:cRõMãÂÆ黛דë}rÙ夅ڋô±––KÒBx¼Ô —nyYúsN¹ñÎ%Tò2UÛ3%È™›ÆZÐâ¢Æh% ³Ù”ÀÖ7¥,[Ü4w…. “YVrôÙ'7™åbž8°¥äKL1K©KÚÖµR -ÑÖµâViS¾¹Ç+Ñ’)­áì秓sÊKFæjë"¥9¥É²õ½iyïÜÛž«Ç Ù7G¦r6³«”wñß=mg´if"¸Tùg˜Qa>r5)o´9ÇîçÀ!”÷ªé’›m®ÏŸ¬gIòüI}'T‡ c¤WÀÛ† PÄ}E•ÕãtZ+o%ûH·3=4Óœ\Ía¦)Ëa’¨\ú4T´q8¶[†Ž­÷R±ÓEÃ7¬˜ÅôÉðó6´îê -endstream -endobj -574 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 573 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -575 0 obj -<< -/Filter /FlateDecode -/Length 4842 ->> -stream -xœí][¯ä8~ï_ÑÏH|¿Hh±ÄJ#xXñp¦gfWè,ÒŸ¯œØ®8•tΙ3«F0£™îTùR¶?Uvœ´¾*üýJã¿äô”RŽÁ]o?^~º¨)z…?%Åꢨ¿Å¿è¯Z¹8yCò×I`ã³71\Ÿ/øo¸äÉŸ/ýÅåë<új¦œƒÑþúϤrvŠ)FåU†Ji+¨¼Ÿb4>ª '41gI3|tÆmUf¸œ¼¤‚Θ$¨Ì°.j»Ue˜a¢v’ -fèì£ Ò -vh£”¨ƒ!Ê9köS@§IgôR6YÔEèt4’ÎÚ)D§½–ty -!ø$élñYiIça‹×Î)I[œMQÒØbƒU¢¶˜­¤‹°Å w² K°èJ¢¶¨ ´¤Ëvò99'ê2t*Å´Õå'Ÿ¬U’NëÉ›VÔaFaBt¶峨ƒ-Þ*#é,lqø+éÀÞÆ”„Ùjhv[eµ¤ó°Å˜èDlÁàK `lQ1H€4/I`bœ\6N"“ìä’K ˜”'£•hÀd?¹£ÄVi茖ˆÀ*Øâ]˜ÀjØâ0sEl±ÙI\` lA‰ ¬…-ÆY‰ ,ØÖ-XЭSYK\`Á·Né qáÂL%qãڜĔ (e‰ ,8ׂ;%.° ]L÷(qëZŒÄ´k] -Xð®uZI\àÀ»Ö"§¨ƒ-°Ä`ÇÉêd%.pà]«U”¸Àw1ŒÄÕ 8 +“III\àÀ»&)'qïš êâ„9h%.pà]ãÑÉsƒwWFâÞ5Ή ” ü£Äh¼ -ñr8[@°ÀßCg¬Ä(l2K$.ðà]áþ„9 ¶štÊAâÞÕ Ã'êò¤#z\˜·èåI‡%.ðà]8*+qï‚>“Äàø ÕH\àÁ»ÚÂSK:ð®6YI\àÁ»ˆ¼Ä€Ã¤H\ÿ6i芺<©œ’ļ Z2À O*ID]œ$-qÈxRˆC%.à]¸÷,qAï*o­Ä¼«ÂQ[l2 ®ÓV˜ÓV'eÀ’¼«4FXÒw•ŠYâ‚Þ%·)qAˆ$0Iâ8! -6„ä¦c¸ dB>Q&\{‰ ¢‚Àƒ²DlqÑI\€ÀzÊ6'‰ ¢-Ö‰ ¢-$.@D0eè[\ÀÀE\8Ø‚HQâ0Ù”²sD°C¯Jº`¦A×¢.A§£Ä1º ®XK\€µÔ”0é%.ÁO.I\3 ÓNₘa ¦ŠÄpES2ˆÌ%†-²%.@¤ Ö$[ J\LÂ*3(‰ ࡱ–DWK:§h™$.H.L*J\€i‚•&˜RÔÁЄÄZl{‰ °øÁbËQ[¬w¤dh¹™$.H ¶e$.6i½%.È -¶ ⓸ «0Q˜,qh:¥$.È:a½iœÄ˜—´ÞLd«°ÞÄO˜·ÙZoF‰ ²ƒ-!Š¨ƒ-š²0oÁIXo‚$]€-&;‰ r´ÞL ÌÀz½¸%h½Åíð®Ï`&IÞEd$.ÀÖ›ˆl¥µ½ñúˆøLV&Zq&qÇ@z=|«¸e À½ðVQÜ3P _Z#‰›0+ËÄ]¸U(µ· øñ˜Ûp¼ûÄ·¨àá3S¤FfL ‡è¾­9z2»“lÞûç÷—_>Áù^¿ÿ×åÓ/ÊNYý« ”Ôñ¦Énè[£ù6`Q‹i°ìE‰©Ú˜»YD¸l³‘Ypxôçºý²²¦’±È•P Õ¿«¥bpO)ÝaŒ!/Ùm}qž»&GÄùÚ¾hÙVÖG¬^ÖI‚­/Îóö¶ÒBÔ{„˜ëze#ï$~ÛÁïõR$¸­kkôæ€lìÙLol´íEƒPN<œ‰‰Ò-¹~fò ³¼¡ÁT "€46ò  E¬}”[%þõ» Èt±bÞ§o—Ì|ÄtÎÑøë»/¿üÃ7ùÓ¿ß}º|÷+¥\øú+MŸŸ–ÏÛò™æOÌÄów|íéÝ"Ó]æýò¹¤W¶ç[å]êòµŽ°Î×êö=MÓì{šm«×åûÓRϧu9$¯ö6[oK¹¬îãÒ^³È–:J™™]K^—™=C†ÚŒÿ|îu·ö˜¯ÿv}÷Íå7ïÖ@++¤h´éŽ•[¸‡ÍsY>›_’9Br„bë¶Þ…­KüÜ{:<Bí]!W†M*+®‡»æ'Ý›L¥f{S¨AT0|böëúÅ)XË©S¥Ù'C”î"-€sÙ#pÒŽ‚ÕCŒžÌóh ÅJþ¥ )CnH,tBpŒ FÕôgF¼Ö1ÚÐ7QKÇlQðïÓ@®Ò,¨Èí¬yOöCMk2vCy»µîå=—çáê^Æ£ŒÓ¸ÜðÖ?²Q¸å /»ÄÇæý1Äq#Zw\ºfÁãYŸ~2Ïáñ\ ù±8ÎHnˈ*ÏêzÃÆ™G}'ÆžÌóhHÌw"ÅG>l8rb5;GsGd´Ê;ÈïÚlûÚ‡käñ†ÏµæWìþÌópÈ=Žyï‹?Úzö)q‡ºu?h”|A[w wh6{2'¼î1§‹iÒÖÑ©Œ;È=—çá{g7Ðèà+M楹§½ Ìwl‡Q=ùxWã †+Ñ…ÝÖg‹‰÷£vüüm(ëà.Ë!‚GÔ³Ý×Ä£9¾‚KÏåy8DÞ‰Gw´[틼Qâÿ¬~Y¤jÅ‚Om¦¬’¹{<çl¦GêVÇ!ë°'ùQ!§¶=ŠnN»'ü¿÷ÎûØz9^Mkè²Gækêªö H^ÒÔóQìèz;²½E¯GŸËY©å˜u9îœg¹i¨~ª/(ö0‡jDzMyØCÍG¦—S«òŽÒ·6øÚ†ÍPþt å튺¼aWDZ†^Á n²46ùJotLÊ:]‡N—ÎÖ×œå‡ ~j©–ß2PôzczµeZ~±¤ÿ© úÝDý_ž-)ïWEœL½èâç ½wÞ bçú*wÄ$\¾ªV fÝÀ°qÊcJë'µ|íÅÐA¯ù«ñµ5”ß×lô>@§j"[Þˆ7W,‘3è­˜Z¯&½ˆéÝýi²ËUh¦Ð1æ&ì:ž¶Ø3Þk«˜Ðo…ŠU×ÅÆU{4½ëµu]èÂf:ï:͆¿¦ÅêÖœÞ.¨ÖŽÒgQJo ¯EÕÞ5ªÉ,3*7©¯)Û€¸6N‚èv„_©Z´Ã`6=5zïê,LH®¥Ë5 º]ÄtKi¾Tl©RÏškÏwS:Ômj/ÈnìÁ±H?FÂ戲õëZLÏCµ±V‰áÆl„· \ŒÛˆŸ/> -©}ç -å+ô¸Ð²r›8©Ž—.¥5éü S³Êè­•ôÿL¾I‰yÊí¤èͳýªWBs³‰×Ä塱Ž“z@»ØÓ²îÒ16ÌòþÒI é‰t[êÖc+)ë2&¹šG$ÕÈc-Ö uMLVû§q%ªjªëbß ü¼w;}›ª^µÊ‚fp÷­Ü.;Ÿ¹8¶×ôáfo+—a¾ -oű¹QLÐOµ’.6ªy»^vÃ@ -]Üiô¹ˆëlmìTÞß±|í“Lò¸·Ë—âæŒõ†žU -VÓ[ñy䥯ÿFšoðïïwýc} ëìÇjla·®ÄÜ“Ño¨¤“búM•*lÓ† c´ßÅ:õ´¾¢¡ùqc_»ž]ub¯)ucPÝ´\è{2±iÐ5Ú²žñÂÛЋ-ùܱé{¾´µqôÔ½À·Z… Þ\¦®³Ý%_Y‘¸¢¤Ý¥Cë ˈ ^(.Y…¹[¶2“É+i]Oö;>–êb,Œ KÛu®»Y^t••V°$-¿à;Í+Í+{£_=½>{Ü“C$mÔÞ¤Ï\ÚFÒFx²Ô–Ë°¾l>Ç–G”êäí=ÔʲlîÙäô©ÑC ·ºàeÒÔ³- <¯ÔUÙªÒê(]@¦ª¬•«MaÉV»¥´8‰½[LÑ¥?ðžö|TZ'z>*a“–Ê­¯EK¶@žÃ9öÖ©ž²Å’Iž»I]Oi«l[·[×]½í•5ÃuCBLUÏæ7)_ů™;sža'BJUÿ–Ýú‹ËᨎÖØò[t*…qôs"Ñ%¶]òâ<Çû'Û]’ºÂkÂpLÎZ5ýª lÂ3ù¾‚UqPΖ•Ø¤—u€°=ÔiNmv‡ÊÏJ•ý˲IÔ.éÙC¿"g)èMôã7Qiù}!e+hµ}Rþþ¬‚y -endstream -endobj -576 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 575 0 R -/Resources 4 0 R -/Annots [ 577 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -577 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 457.623057 101.433071 438.873057 ] -/BS << -/W 0 ->> -/Dest (cb112-1) ->> -endobj -578 0 obj -<< -/Filter /FlateDecode -/Length 4395 ->> -stream -xœí]K¹¾ëWè¼€¹|_@°‡I#Ä€‘‚ÆZ{Á8€7‡üý|l5bW«)ÇnÛëÁxÔU,v5ùñcñÑ¢:Jü¼Pø/!DïèxzøpÂ[‰SŠ‹‹Iý -¿Þ•$/¬Š.Øãû$0^øhµwÇÇþë.Ûä‡|wøÏ¥:j£ÓÊ}›Td„ÞK˨"TRFe­ð^[ǨœxÄ9Ü°ž4-UnP –SÁ Ò:0ª7 ye–ª7´WÄ©à†ŠÖ3*%á‡ÒR²:8"‰ŒftÊ -‡BwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¾XE$9|!<§sðÅ8#Y|ÑÁNçá‹FéDFà ÐX|‘N*N°1±º >,uZZaƒ1’Ó)%,°iXZ*ÉyF§á‹“6²:øbÔœÎÀ§OXãC`Z«N­ÛH£8…/Z{buð•Ï1€vðEzÇQZH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHøbÉqL`|!´\V_L$Ž Œ†/HÀq1ðE“á¸À€m há¸À€nIFÅqß’TŽãÂ…›’ãÆ5ÁÇ” (EŽ 8×€;9.0 ]4wÏqëë4Ç´k(8Ž x×’x×X²:øs\vFÃqw’žãï¢iŽ P«8t+B‡ 9. ð®’8. ð®öèXhƒ†ãïj‹Gàznð®¶Rs\@à]MÚq\ ðd£ð.(Äòá|Ár\€þ:m8.@fB#,á¸À‚wUD÷Ç´i°•P!:Ž ,xWT«‹By”8ÓnQÊB99.°à]tT†ã Þ}Ž Àñ=ªæ¸À‚w•AOÍéÀ»JGÉqï"n°B!à¸ý›PÐeuQÈǼ ZÒ 2€IX’â¸d,$âPŽ xÝ{ä¸Àw¥5†ãÞ•„°‡ÕÁ4Ljk C³eÚ4‚U!5˜‚Ów¥B s:ð®”>r\àÀ»©Ûä¸Àù$Ðã8(kŽ \ ½w¸(¡CÈÇêœÀµå¸ÀK,(‹ÕÁòÄqkM x _ŒÖx _2p\€ˆ@D…è›ÀÀ…|A¤Èq˜L„HÄq·ã1”*§sZºfu:å9.ðžºbÅqÆR" Ñs\‚)\â¸n@§ˆãá š -ÇèŠDЈÌ9‚/²9.@¤ R _ r\tÀ(ÓIŽ ÐCc,‰¢æt$Ó83p\ȉ*r\€f‚‘&˜’ÕÁÐǨŸ4ض`ðƒÁ&†9¬¾K„ Óp3p\|ÑRs\l¦ñ¦ç¸ Jø‚ˆã‚(Ha2Ç qè¤ä¸ ª€ñ¦&Ž Ð.Óx3p\ÄxC<¦ÝFãÒxÓs\ ¾X„(¬¾ hŠL»'a¼ vât¾èHDçÒx3p\€0ãMDôì”@HãMÏN€wm3q:ð."SÇq.0ÞDdËí%ˆ×zÄg¼2¤g`g $¨×¢oe§ $¸½•gç $È7‘ØI¸‰‘ep쬺U(•d§ $øñ-8á<ûÔNQ9ÀÁ£Ï >=dD³ D÷eÌQ“™•dçù±_>|ÿ€Î÷øóï¾›fÊòB€0¥&ÄWh:¢º-¢o…Ç7­Ä$¤ÉC8xMrÂÇê¤-ΓnÉItéßqùáÂs8þjº½)·èŧÛ2´J@¾NsƒÇ7š|D‡%GèmÒ˜¨;rˆ+%]$þýë€:{qž-—ûè/1&m¯ß¾ÿËË¿ÿõÇW€Ñëw‡þNJ -?¼Pøkýù/¹ùï|fêl–å´vþ—2 ©æA³LUY±ó—¦ÚM¶[þ´ù÷þd›ä×iþüî2­–ó3Åê_ñ]7é³}£ËéŠ]ó\ô†)‹ÖæmÕ+›t?üëøúåá¯/Á6E çæN&JŒÀÌ>ÇLž‚Ïç€%†³W`yätSõsõeû©J ^d}õ‡ZÕÙþ£Ã¹†=í ¾.Gº y¡M˜–Ãñiä{¡c6»CèõØñÉ|2Òƒ>ÿ|­ƒG¬nbÂ49«ƒÒv±ƒ6{C¬¾GÞŒ¼+Ÿô¦ãá[jô–QΧjq]ÌzkYAdZ-¤%—Ðs‘c6»Cäõ˜r¿\²ãÖruDµ‚¸&F”$¦¹Å­ùÈA›Ý!îz\YF¹”5Ó{v5>¡òaS6У&×JÏ[k÷´oÎ5øQ’+Ï´£]ãÂáYòA›Ý¡rcr¯œve6„ìz÷gi%W®ñ£©ñžMB˜Û¯"qÐfoH41ân8ã+owôâ¦Æ€ã(³ÙJãÆ\‚ÔÄ^ᲆÛÚ)£…܃{Em-T¼ëjó¡É¯­V B$ï“nfµSí/| —öi^õ©¨[ðí³—á -ŠííãñA›Ý¡xcŽóÞ˜Ù7È×÷ wwÌgÚìó™·òã¶_|þβv°Cõ”î†| -¾-y4-2Ý;µB3s´±Kn/<=¸FDÍܤ‹¨gErkErÐfoˆ¥ë±ªÛµûY÷ÀôÂ9]ãÏ=È»M°ðk$¥f.rc6»CàçCm—ÏWâÍÏ2Ö}]´Æ›×ÿWYãÃô2\PDvkÝ|Ðfwˆœß¼¶;"í)÷ó¯Û®•‹X­_adf¸‹Îu¾¬ÅµÝL¸íPÐûñ±ööл mv‡šûײ/x¦{vÜ4Å€®1/÷xw™jöM(kóëFI=.|i×Jº1{³fýgoƒó”¶™s­ Úì ±ö·yÊ‹–µ•×*ö`Þ‡ö„6ó£+ƒ6»CèõØð^.(µ‘KþaFa·ÉóÆ·Ø2Vho_Ó´Ù7bÂ]ñÆzô6Vl|a‘ùС>íNÎ;•ç¸w±‹YÏéâ3sd¸ƒ#Çlv‡ÌuoÕÄfÌXrk43\ûn®áö7Ëóžöxþ»Vóe”Ñï>Î<ÿС¼×gt´­ª‰—u;g¹ö67Z[ãÅô¹;öCÚì }np?dߦw¹‡f_qf…¬ï|[A¡¹}ì=h³;ŽÅ‰Ÿjí:_ÈåšÆ©¹çê»,_rº‚N{û»‡ƒ6»CçbÇÏÊ+±å¬Ä¹‹µ’nÖ»´¬0ÿÚóï…Ü31eîÅyì…Ûwù Úì{ףéÜü<›ÊòM-C­›òÌÝOÝç®Ü7ñÔЛ‘ùb¿p·+ˆ]¹É«1-S1ÑâÚêÈÄ }þy·O\úRÆQÌ*Pi#]Úɦí­õ×þŽ·±mö†J¿5vï]µ«÷öiw½Ù¢oCÁ(2{®Æ =«Ê®<ÚõÈ~- ·uc»‹ï*x¨­q‘w솴Ù"7V¡ÛwcûÕ›&2ZpW»&Hòbt¼¶;{³ö¯Ô0;zo#·®Õpï_,ø¸[#\ph¿âÝïéçž\W&o¼¯÷ãþŽw¹mv‡Ïë1ä¢.VvÔn¿5/7gŒJ'¾¾/vàÞŠ%—̾ðgÅZëÏæüÅ -s¶ÑbBE½µŠ8h³;dn¬{?C_¾ç™/"æ¿°ª}Ûf³ƒ6{Ãl¸.Zÿ=«(,É®˜X†™®¬˜<Å¿[×@Ÿ}–`…Iƒ¹ý ÆA›Ý¡rcó«~õ2ôM市J{WŽÙ앃oØÜó‘_ÝÑB?êœþ -RïxûfÐfwH݈D¿ ¾Zi‘[ßøIZ"Ð(oÿæŒA›½!4nÌ{îäû®¾ÍÈ`æö‘ü ÍîÐùLñç<ç÷]=GOíí;×mv‡Ô˜ô‹äŸo §¿ãm A›Ý!ôy¾Ùòæý¿õô×zúWóyÞ¢"­Mç«Bs¼Fäf’ .ãÈGZÓO17cË!˜é \Ž)útvL‚ÔË?þùOk •^"ÕoϯlŸ·Èà³Ã/HÀ¸óu*ªi2Qå E觗Osõœ«ÆNƒâTœçªófÞô7å•ÒÓ»3t’\§´îü;å5žò ™¸æû%ÒHöé òýY‘¿ïÝø3åa›gÈ¥qQ•n:IMgáI„Òé°Ü£#aRÝÄc:{)HC*Wš -[W,§#†?”Tó©Ã2D˜¡:IÜ\Ìé?L•þþ "‰Tþ‰ Î'„ÊIt¾¨âÇC:!–1a”3(NÂù£,y‘Ê ‹ìžõ"ö)rþKæÆæÚæ§Iö6›¥“{HæDf:»æ|cFK§–âôôR¨YœNÙ ÂÌW®¸b]öš!µik†ÕpS¬Œl„v)”ÍíªXSöG¥SÙJѹ*,®·E§šêÏiµoªóšðtÀmM/}d¥élÏœU.]-‹Ì4NÅ"µ9e©*õĈNFøBæ¬ •YôM­¥ÒÎÂD%]ÌéÑéÀ¦›s³¥¦|IªiÌ%_]©P7¡<#›Êh–útlxÓF¤É/Å.Õ@®kÜè…ðt@C ñãÁz&µ­\!m†^+4M¾EdÅK•¦ícçOhšY–ΗJÿŸ©Âibžéƒ¢©tF\½ª7Im³ˆ/ ©•»Â:Ä•€"_Ó6Å¥¼/˜mËKɤO¤[R—»6EÖÈ}Ìî%’*äq)VuEœ(,—OáÊV(³¸]ÛåÇ qõÓ–¦ -°ç›9ÕÀÝ–|«Øî|lžԸJþK¾ æ³ð4ulÔ‹ôC¾IkYz»z³FX)Tq¥ÑÇIœ[ka§éä絑q=îéðËaêæ´±:âƒ3*_ÛF^êø?¤y‰ßèøc>0íÜkYØBn½·=Y:í< ŠÓéçYXšM#ÔÔÐ~«PÓÚŒ†ÒkÝð5UsY‰=§T…AUѶB[Ë°ë]­LS2öŠðÔ•b džZ7µÃ>_šüp¸IGíe¯pÑ>.CÕ™Ú%›,q•’Ö.ZÒ!.ÚLqÙÜ0VÏ.ÜL€loRŠ>ùOmU˜t¯æ¢ #Ò¥©:ªÝl›u–MOÑ$AlÚ‹6cRíMã…?ŒÓw7¯'×ûì²Ë- I µéc+-–¤…ðx©™.ÝåeésÌ1]äÆ[K¨äeš¶gJS›F -èâ¢Åh# ÕlN`Û›R–]Ü4w…. “YVrôÙ'7›åb™ž8°¥äKLQ¥¿´%mÛZ)…hÛZq‹´)ßÜã•hɔȶpöõédMYbÉÀÈ\k]¤TSš,[Þ›.ï{ÛcóTq52•ÕÌ.RÞÅ÷´³M7Á¥Ê?Óìˆ -õˆQtÔ¤¼ÑæS¸œ‡P:øÛSh¦Kn¶¹>²œ%Éó'íP‚Œ‘^o+.> -endobj -580 0 obj -<< -/Filter /FlateDecode -/Length 4763 ->> -stream -xœå]KäHn¾ç¯Èó£ã,æ°ÀÚðÀkx€†}XøPݽ £ÆÀ¬þûþR<¢”ªìšv6Ü…êL‘ñ`Œ/ÈPH¥¯ -??hüIO1¦àézûåòëEMÁ)üË%V™ý3~ƒ»jEar:ù访0Á†)$g‚¿¾^ðßpÙ½üûï.ÿµ®£¯fJÉí®ÿÌ,²Sˆ!('°XJ[åÜ‚q^`y=aˆ)I,ˆáڲĠĂdLXbX -ÚnY b˜ IbA \XZAm”yDY#ð´›<”î%žÑ“É$‘ÀÓÁH ¬Òà-UÅ‘—ÀjÈB˜¹"²ØDXYP@Âk!‹!+aÚ¼E ¸%•´„xKJ{ ,b* ,×FOX@.\)IX`¹Ø)aèbº ,P×:o$,°€]KÑKX`»–´’°€€»Ö¢¦Èƒ,p` €Ž“ÕÑJX@À]«U°€€»˜FFÂXu‚z à+“‰QIX@À]IX@À]°ˆ¼0aZ ¸k† ­ÜÀ]㔑°€€»†Œ—°Ž2” w!N V¬÷à+a›  pW',ÂœZM:&/aîêó‰¼4é óZž´÷IÂÜÅBe%,pÀ]Àg”°?aE58ஶX©%pW›¤$,pÀ]Ä N¸äHX€õmÒ -®+òÒ¤RŒ8à.`ÉHX€UxRH"òÂGÒŒ'…8TÂÜÅòž$,ðÀ]嬕°Àw!ìyÅF#aâð0m…9`uRH!ñ€»Jø«THxà./›øÀ%,€€¢`#a4¥¼„>)ðò‰õ[Tî°fÆÀƒL˜„è¾æ­˜Ý)6ïýý¯—ß¿`ñ½þõ¿/_~—wÊÊF€Kâ+L“`n‡è[cø²(“Eƒdo*Ì݆ÔÄÒÂe›Å‚Çÿ®Û/+Y!* ‹ÚÈ„Æ“8ËK'ò«¼£À - <"B26^A‹È}­ -ÿñÃ`ºH1ïÓ×ËN|Ät‹£q׿\~ÿÏ?ýÛ¿üùgxà‡/—¿üA)çüAã“âüéÜò™¶4 ™¢Ržšn´Z7̟ʶz«º_–r¥}¿®'õ[å¼-Ÿ/ év¿¿,ý|nm“[·Yú®}¡I;ýÔ²·…Ö•û2¬³´GÃÍÿqýðÓåOÖΗ³¦Ùùx#Ù¯¹‡þz®Ê×øëoá¦)¹iUåmmÖ¬ÎbbêLTLùQp§¾NgBíÞ[¦„éܶ¸µïxï1½7û¿™V²{ò]¥âlHØŒ¦HtÇ?OÖy6EfÊCcÓd±bÈ$ª…ëò§3 m±Àʲ£÷t õ8à|¯³jÇmƒ=Ë–§dî!åÉ:Oç‰tŒ•Tëv^·ò ïaIÿ-f×7X¾u<ž]¿OÖy:¯<4¿O¬y§Ùtr¯^ªO|é¼zhÅYXÚ)³¥Ê·ã¥-d¤ä&——ä{^z®ÎÓyéqœY=eÐàÇ|Ãêð`ô RþŒÅK£ ÕóÆÔÅmeQŸðûå|:3FµîI=”òç=pÇ4´·ç¡¦ÅŒ§=ôdgóPs2Î,ì0­_ 7¸µç‰GÉò \úžcÌ1Ê¡Ñ[wVucßž•Ÿ¬ótÞx.Ö|++å×xãèÝÎu†x6{/­íâEqþÜmg“/ñë£kăÍZö]¬t`å¹:OçwbÎ1û™/¿±­¯Êw<²Û’<»ë~²ÎÓyäør°DÕêAtÿ†IXø@<˜½aȳ78¼“ ˜Yq±Ÿ]›øo›-ýv³VöVûÀžæÉ:Ïæ­ö8Öün1mÏ›OäâãÖj&~Ó´ã-ŽÔk'œºççê™fùɤ¥}»hÛyîcÑkëÓ¶oùØ?²m'ºhÍg É㞪…µZÇÇ6óLdãG„¼"ã“Ðöìukoh^Ô<ˆõlùóV¬¸Èä -¾ÏßËXY -­l?÷ãÙÓòéåqdÏ)e¾tž\#¹¿9XÊ•uÈ-|½´ÿ±ÉW¢Y÷NúÉm}žë—uŽÛÎw(bAŸ¥ßnÜyö¨NŽ2æâOaþÌí}^ük±s©uöȺfqÅ–¬ìZ‡£«L¾Íj7ÝäéÉŒzªã ƒìøÓ‘öÐh‰†9å:Da\an« WõÉØúÌ6uk_“úǹöÑCÑÆ·^Ö¾Yû-ó \¿´ëÜOé»øýçVWÒg)[ôÉcßè¥ïÿe‘g©_õɆøÒÆíLÓqælvp¶éRzÄ懺ô]¶Zg k¬¨}˜“óÌìȬûöŽäüò©½OrLèù|³Í‡êø±1$ÊænLx²ÎCGß1tU^¢):U‹Á`6Á˜hê»]°4a·Ãäó#AC‡¶:j°™úq»Æ¦É¡E„vÝ—ïÔ2ðstÞïIu§¾óSr°T?Oø!„v'Ų́“óö@SGÛ¹}bT,T-÷†DñÄøÉæçEøìüÚç§&¡<vGz§>[˜gÍûiŸ¢ÁŒ‹„íØO]ê¬qØטÔÈ8< XäÅ4Æ, ßs«ÛîÍÛ ”ŸCNüÄßÐiží;@´. Æ>¯U »‡€NÖy’ä¸â!àöÕK¿œ‰ì ¯Ž/ 7p[x5l•6>Î}©\è›ÍÀm–š¬Ÿ÷IÀâ‘OV ³¿åÅ[>¹Ù£¨åûwÉÅ ‡ý1™â[Nùs[‰'ë<›?FÈzà÷nfUÌ*iÔËü}Cwà :Êñu˜CÊ\çcãÓ•³Ëï§å“–ïÜ~™ßjûÃ#óuçÌ8çó‹>4~®Î“x]ÛêC¯nln GÏÜfŸ ~Sú7Ìß‚ÜokÝ(›aë:{äÞ -²÷tCú³‡vOÖy:OuÇøx°¾~Ï·¥%oX¯<ëYZnë›yªo÷ÔsužÎSã1¦ªÁ£>¶ïó¦g‡—~^]ßßJ;r Þ^=½[ÅËLëo›+ùÆ#ïîÓ ¯r#ÓŽW¶XÑ?)ìÝøòdgóÊt_>üÌßN^Bžíì<¦zJëÔvw,›ôÛñæd§³ì®hòÖ­’Â1l¾ñ´ºÕ;ZOwVZ<‚ëðM+Þ´®{ÖÿØe5Ãã/}ÝŠ {r‡>6Gª_v<·?^³Ãöø\<ôî-ï"£ì§-#~ïCä×µÝóÓsužÎO#¸ÍÚÑ?v´ÄÛÅö›ƒ¾ùÀ¸öŒ‘àCìd©gÖº~gfó@bÿD7wê§Æ÷iŽúöŽ^¥.b:{ôêd§ó¦ã(ëh=[!ÒTrÜ<ðzrÃÙÇÛÅR—åö^ðÖ‡þ¤~8jZ3Ð/ûyȽh­Ÿ1ã¡ÉUä5æZ·µlóƒ‚;žÚïÒõÔsužÍS¡…ãÔuµÑÝò®›>.ÃææZÿ‹YŒL-Üâ{0,ßvvQés÷¹×qJö²Œn庾¾î¼êÏË[ƒ‚ƒÕœã·¶E§c÷¢êw‹Üq·²ý¾}©ÊU/²YïУI~]¸W¯Jß°µ·?o>Ïñ—^ °éslU"$ÕŽÈ¥¥LÙ×ïñÔÃ+Ë¡œr¨ ïñ/7ïó¡ƒ4ÓM=p¥Ú=)¯º£jª0ù(›šT,÷´Ví*ªcpe Sþzñùmq:¿1Tù8iï¿zš,ÛéZä7ÍYÒÅt:+[_wjæ±ÿZK-ïfWüºV~Ußüâöîb)ÿk6ú/ÍGÕŒó{”U&GS.ùõÂïÑ&LÔŽêÝ!3qùªj[üf v¨†)%­›ÔòµäóWãÊh¸¾+Õøýf¤J!›ßð5w,QÓë-™G¯&½ù]äq²Ë•¯¢ðMøJl R_¶5Ø*Þ%k«:¢ÛU×]#*òh~weUoÄ*z¯:Ý™¿”5¡3çñvA·v¤¾ŠT~riªhרJ³P©R])Y BÕNévˆ?¨Ò4Á˜•ßYß#9cq$ªåR)'n±ÜÒš«– -µTlUSÑ|¥¹ºUñíÖ¡ üǺ9¢lùº&óÉÐjk;¿1âí‚%†6ä׋ Bi×°B¹âz=ÑvíVrTÍ_5Ä¢*LÍBãƒ.üÿ ®RyòMÕ¥øMšíªuÂs³’×Jêé¾¢IÐZÙN]:„ê³½¾tTByÝZºjlEíTÖÑC*â1HUðX“uõºJf+ú©XÙUÝ5²«®üº"79]ªNÕμîÜÝÕvÙWì|íÉ¡Z\ókQ«¼µÝÎç ñ–6Éìú±tÒÈFÕÕ®uÖ›`…Fn0úšÉe¶VtÊï!X¾¶I&­¸·Ëß.y™3Ö>iç­æ·|÷‘—¾þÊü„ßÿ¼ÐõÏåµ’ó:nTE S±uEîW2þ›ñ$™ÿFD!ÖiÓ u°ßÈ:¶²®xC]ÇéðšZuÕ€½”ÔAuåöD×tØ‘Mu]£m§w@¼ Z¬Ì×Ú¦-Øó¥-ƒã3ƒüBÒ".úáà26žmKòµkW\´-éà’é*â¢o—]‡©I¶“²ï¤ªžå§Þ–ûê.º0‚/mãQ[fû¦ -¢+‚Øö}äûNÓJA臧×WÛ}Ù—ÀÔ -í•úÚSëÀ˜ZO¦Ú|é×—uͱù€]™¼MCµ-ÛÍ=[ƒœ65ZhA«‹ÞG;jlÕ–®ï” -mÕiY(*\€¦ -­¶ŠL~©VÔ’GE-…S4êßzM»Þ*U‰®·Šß”åvËŠW£%[ ×»sh£S­d%£@ó}íJ¥VÒÚ¶oZ÷]VÛk7 j‚ø™ªVÍmJ>„̹ΰ!•*?ywDÇö"f,Ô¤ƒ56ÿm-½†ÿy„@±Û.ysãý“í.IÙ?é{‚9&²VÍ%MáŒtŸÑ5Uþ‚š\-)qHoS€°=Ô`Nmv‡òŸÉÉ{–y“¨^Nù¯bYz#ÿ1 ´ü¤d~7üjû$ÿü/< ^Š -endstream -endobj -581 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 580 0 R -/Resources 4 0 R -/Annots [ 582 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -582 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 371.373057 101.433071 352.623057 ] -/BS << -/W 0 ->> -/Dest (cb115-1) ->> -endobj -583 0 obj -<< -/Filter /FlateDecode -/Length 4538 ->> -stream -xœí]Mܸ½÷¯èó«åGñ ö bdƒ,`$‡ {ÖÞE0àÍ!?j‘*Q¥»gÆ–x0žVI•ÈÇÇb‘jê³ÂÏ·ÿEÒCŒ)x:?|8}<©!8…cŠÅŨþ¿Áµ¢08|tçY`Ã’3ÁŸOø¯¹äÉOûæô¯e}6CJÞhwþõ]V‘B A9A• RÚ -*熌ó‚Ê똒¤‚.¡µ*À JÑI*˜AÆDAa†¥ íZ•`† š$ÌÐÉA¥ìÐF)QC‘5‚N»Á£Ò½¤3zð1™$êt:Igíài§%]¼÷.J:‚-.)-élqšHI:ØB6Iça‹õV‰:Øbb°’.ÀƒÚI‚. +Š:Ø¢¼Ò’.ÙÁ¥H$êt*†¸Öå­U’NëÁ›VÔ¡G¡‘|t¶xå’¨ƒ-Î*#é,l!üH:ð„³!F¡·šÜ»­²ZÒ9ØbL Q[Ðø[Tð  ™—$0! ” I$`¢(R”XÀÄ4PV¢“Ü@>‰¬ÒÐ-U°Å‘—˜ÀjØBè¹¢¶ØDX[@âka‹!+qÛÐ"qÝ’JZâ ¾%¥½Ä„ 3•ÄŒk£'‰ ,(PJXp®wJ\`AºèîAâ ֵΉ ,h×RôXð®%­$. ð®µÈ)ê` ,qØq°:Z‰ ¼kµ -xÝÈH\€V€C/q°2˜•ÄÞ5Q‘ÄÞ5C€¨ ú •¸€À»Æᤑ¼kœ2x×ñ(øG‰Þxâdw¶€`%.Àx± °ÁÀ-‘¸ÀwuÂð'ôi°Õ cò8ð®Žh>Q—PãB¿E-Úû$qïb ²8ð.è3J\Ž0¢‰ xW[ŒÔ’¼«MR8ð.ü'qà0h8`|´tE]TŠQâÞ-‰ 0 -*‚ID]$-qÈxPðC%.ðà] ïIâÞUÎZ‰ d‰ÀÀ^°‘¸ÀGR^âŸtpùDpí$. -Êu°…I\ÇzH6E‰ ‚-Ö‰ ‚-p$.€G0$ ï[œÀÀEœl§(q˜lˆ‰Hâ‚à<æc¨UIçÍèZÔEèt¸ 0k‰ 0—":½Ä ø!»KÀ è4I\lAW‘¸CÑ öëϧïÞ`ð=ÿüïÓûoÆHYùÑpÆÔÿ -ÝÀ$4·ƒ÷­ñøÖ£¡õ0 -i´Þ“'Òl¤-NA·l$†¿üï¼þ°°†ÿ8ÞÞÖÛ'Œâ—Û笒Û*bú:Æ™Å7fyFƒ&Gm=ÒØd2;rð+-ÿöõ @¬¸Ä@ë%3ã%&ÃdÜùõ‡Ówzõ×?ÿð#`ôúýéï¿Qʹï¿ÕøKtùëò“ì-~ã$ŸÒåÈ]ÍónÖk7éJÞ&ŸKe…)ýûIç]ɧ¦¿vúk–åÕg(÷|@9Š=OkSXÞSMåæ<‹|“môД£ç2é‰ÉË÷~™ß¨é9ÓÚvm¾ÿÇùõ«Óï^/Á8z¨3N(e–ºŠß¾,OÁïKÀÓÝ+°]5‰ÏBúÉbÏÒÂx_VfÉ_ꩅ☾¤)ÝB-m,ÏQë£ÈÍ|­dØæÈþB‚#¢Þïà¶3ÏÑ€‹ÙÕUµ :¦ 7¬Fõ\Ë™$¬^Ö45Ähkm¿DEEvAZ£—ZQ½G™v}?ëçûÔr¢|Ÿzÿ‡¦¬ù~NwÁ-êØ@påY6iogÒÎ<‡C$]åÒZ‹®©=>tµC±›[ª¶ «õÅ°÷fo¨;6Ÿ·È«= °4/‰Tæ€bâ™T4y2t©}y‡ÔëÎjÒÆò'ƃœ×¶ø¥´ŠoZVïwèŽòm¯e•³[IÉazª)‡®£²/ÏáP¹ã‹î¡èÖÖx.¿¯ÕS¢/å22º/;ó ™fÇ×|ΙKÊošÝ<7¢:òˆ{o tö%»gDy‡ÒÿóSͽ_Á êîAî-ÏÈg…mu–UþÚ湺<×& -ÝíóòÎ<‡CáußRÓ„ºÉ‡Ô¶ùKSmæ4~J'µ¸0‡ß3³(ÌVp³´ðÈ]V¸ï»¹\jg* ÿ‰¦-O ôΧwÒj·f2†…"»Gæ¾<‡CÛŽÏH J ¾]·¼Q9Žö¼ýéüd¡–ùyS1ÒïE…:ó ¡öºïød>¹5ÂýŒüóuöŽ Ä2Ÿ0oq1Q·‡Ø¾<‡Cìu?òfä]A8_©ûf¤«Eo™å|ª×ø¬÷÷– D2ÿЙA9ò=×Ù—çpˆür×Û[®Î¨6Ç|DEÃVÜ‹Evæ9â®û•[k9b4„ÍTÊ 1hQSZ¥å­Íõ£·j½㙼‚§m­xn@F%±õëÞygž£¡’vâGå´+³°.dß0º¿H/i¸r‹‰¯[wîzëÌs8$îøˆ‡áŒ¯¼WÜ1ŠÓ{3;ó¥~c©Ab¾×Æ>Ž²v'—9iFùŠœÒšoXyaÆ'áï"ã«€ ªÇt7”[Q(ðm-ƒõÈ|ïqêÄÑ‹}¨e³¾ižsgȱؤOhgMjoE²3Ïá{ÝW5q¿u? òÞ£pIÇì¹y÷£ y;ìêñC‹Ev#°/ÏáøùýP×”³BÆós ÌÆm[W½ñæõÿ DÎþaþJ‘¨‰ÜÞºygžÃ!²3¾ymwD~37L¿~¿U¾Z»Â(D¸«®Ýa¼å×n¼?³êIn~†çØÛãïØÙ™çh¨ñ÷¯e/x¦{6Ü4ú€ŽGÌë=Þ/ËÑl/Ј2^^3Kjùpe _+iæ쫽êïûxéÅ{@gœÒ³˜cïl¥3Ïáûÿ8å¢g핵…ÊŽ=˜÷¡}¡,ÞØ»ÒØ™çpÝyçN.hßgZ­V#eÞø_ìHŒ·¯étæ9w|ÂCñÆFtî+2[Dd¾iPŸw'—Ê“ß»ÚÅl¦tée92¨Û9²3ÏÑvÖ½µÚ|g»g¯wwëû©…ùo‘—=íéòw«åë,cãK5ø=G¤¶ú‚Þ«˜¿lxÌrëmi¶¶Å‹[è»c?dgžÃ¡¯s?dÛ§¹‡æX~fë…lï|Û@áïlwæ9 -ûüÄOµ‹v›/ÔzMãÝsó]–/ÙÝ@g¼ýÝÃÎ<‡Cç|ÇÏÊ+ÏØs6üÜÕZIõ®=+N¿îò»Á§,£¸üVêö]>yŽ†½xÝ;ë-LqÜ\—oç:4†Õgñè~j>7õ¾‹§v†Îfæ«ýÂÍ® q妬Æp¦¼Å­Õ‘‘AÛòËnŸ´¶¥Î£„U ÞoUÚ¯ãocwæ9*w¼ÆöjتĽcÚ]o¶˜ÛPpë÷jmú -«¶ß‚Æ×#Ûµ>okæv‹ï*x3÷ÆMDÞ±²3Ïá¹³ -ÍßmWo˜g´â.¾&Hj1;ÞÚ½ÛúWZXœ½sÏ­é5Òû+>nÖWÚ®x·{EÚØ“oêdç÷+ãøïrwæ9>¯û«¶ØØQ»ÿÖ¼ÚÕ2äö^ìÀ½K.…}á/Š5nÏnüBfÎĽÅÎoöëÌs4d¦uïËÙù"<`³w|egžÃaöºÿ¹êý÷¬¢ì°¤¸bâfº²bòûn]}ñ(Á“ºÛß`ìÌs8Tö}óä×ùþê'dè›êq•w|zgžÃ¡²ó ›{¾%ò«â¯;zè³Æô+RœÎÊê\>«(:ÙÑž»Ivи>¨£wqÎ?-Üü„3ÇaȇäÚx†ûH)äse2¼^ýþø ƒWÞmÞ]^D¸~ñÙã÷áòUàù:WÇ8Dê2LB?n©.Äs!76u®²KÕ«i‰:ÿ½|­x®òKd¹Éiýåw,kú<–KsN÷ËðËùó×>†‹~Q¾›îÍìËpìÊðŸVMùñäÇ3’ôxNžòqÐ&¤{ö4ØÜ6éœÏeŠÊ’.M§ÇÊÖçœãñÃkªéDb•)ÌT]Ž+fSúc£8éDC®ÿL—ÓCÕ(Ž¦\ÌâÇS>=–1Ñ`:ÅY8}Tµ,Ò%a•=€sÃÚ”Ö jú˜jáÖ•Æ•§Éù]É–Oõ!UÙñ\›Ë!rz½ç§WƒžÄùÞ8ØéÊWSœ/6C8H<í\àœqW¬­bB·*v»Yl¨Ø£ó‰mµêü,¬¦óªÓ¬ùKZXs^>œp[ÛJEi>÷³Ujר*³Ì¨T¥®¤¬ BµÑÃI~«JфƬzÖjùô´‹0 QM—J:AôpÓM¥¹ÚR¡¦ŠsÖTj~6e†ºµâÙXG“4ä#ÅYQ¶|\Š}nÒÖ*2ܘ•ðá„!†VâÇ“ Bj7s…rz\hY¹UÕŒ—YšE.ŸÐ5‹,Ÿ=•ÿ¿P…«ÒÌ<ãMRùü¸ùj¾Iî›U¼¬$.÷•uHªMaN˪K‡P1ËëKG%¤Ï¤[S×[HY•1yHżLR•<–b]QWÅ™ÂJýT®äBUŒÀíf±«P~\ˆg;]íª{¹™× î®–;‹}åÎG.µÅu> °Ú[Ëe˜/‡q`£Vœ¡ËMf±Qu´›oÆ„³a …Y<Óèã(.½µ²ÓømïÓǹ“I#îÃé—Ó8ÌëLÂou>Û–{^úü¤y…ßžèüC9Lí2ŽUÙÂTn]ˆùH–OBâ|2zÖnĆíÏbç´® ¡ŽãÆ0¾¦9»š‰½¤Ô•AuÕr¡›ë‰M…®Ñ–ÕŒ»"|hj±:2Om›yÀ¾\Úòp¸ÍÇð«pÁ—qÖÙyH>³"q•“ÎC:´dXF\ðBqÉn˜fËff@ò›ÔªÏöo -›ïÅ.˜‘/í¬£y˜åEÙø, \`Ë/xÁ¤ùMÓÂÁ軻דÛ}2Ù—¥•Ú«ô‘Këƒei%Â>(-†‹.ï]/Â'ãÏ¡í> -endstream -endobj -584 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 583 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -585 0 obj -<< -/Filter /FlateDecode -/Length 4553 ->> -stream -xœí][¯Ç ~ׯÐs€læ¹A -´Eƒ¦h£}ú`Ëv‚â¤@Ò‡þý~œÛîR«Õñ‰+§ñ¬]r.ç#9+ôYáïsÿ"é)Æ›)%o´;ÿüŽYd§CPN`%°”¶˹)ã¼ÀòzÂS’XÃ2´eˆA):‰1Ș(°"Ä°´Ý²Ä0A“Ä‚:¹ °´‚Ú(%ò ˆ"²Fài7y(ÝK<£'“I"/€§ƒ‘xÖN>vZâ¥É{ï¢Ä#Èâ’ÒÏA§‰”ă,dcx²Xo•Èƒ,&+ñd1ÐNx²Àº¢Èƒ,Ê+-ñ’\ŠD"/§bˆ[žQnrÑZ%ñ´žlÓŠ<¬(L’Ï@¯\yÅYe$ž…,„?‰œp6Ä(¬VëÛ*«%žƒ,Æy“/!€ñE/AVÐĸ$a€ a¢dHíD‘¢„&¦‰B° ˜ä&ò)H8`•Ïh ¬‚,Ž¼„VCÂÊyÅ&’°ÀÈ‚X Y Y ,Ж`-XÀ-©¤%,°À[RÚKX`¸SIX`¸6z’°ÀraJI ̵ÀN ,@Ë=HX`ºÖy#aìZŠ^ ܵ¤•„ܵ5EdKXtœ¬ŽVÂîZ­‚„ÜÅ22`V'Ø¡—°¶2™•„Ü5Q‘„Ü5.@ä… kÐJX@À]ã0ÉswSFÂî2^ÂÊüQb4Ü„89€,X àïÁ3VÂ46„%8à®NpšZM:&/aîêˆéyiÒÖ-´Š…÷ê0-RÌûôív1†s4îüêÇÓþúoùæ[Xà«÷§ï¾TŠÞõ¹æ÷Kywó;ï"»rM4¿;ÀùB{ƒW,t©Î»Î×®ðjÝU=—®´Jù"c­Ï¼&ÇZþØe­õqÙË—±h½”Ñ]8áéåujÿq)G“o-»ÆZåz]ôwtùšË~õó«¯O¿µ4ºœ-ÍF‡@ØhŠD7ìôX•±Ó_ÂâŠ[°+–jéno°ÎÃY*íãè'‰?¿~7¯‡à)RRÑp2¾o¡Çê<œ…ÞDŸ‰;»Ö&áÛožþ¸§BJÞÂŽ1oÇî[ç±:gûqè]šþ•{ú»WÜGðôFݟ׬óh–jnĤŸ$þ¼Ð -{`OoìýýÁ:g¡cÑØ5Yg±adÁ‰6Cevs¼g -­ÌÀo^ý>¯nÜýùûÁ:g‰7bÎ_cþþK¬®áÁãý¹úÁ:g•7ö]æ]½…}éyüYf·’×Ì6“û¥búíËê1Gö3fïÈ).å7R¿oåx*X7y›¿ºÃ‡S É47㩃užõª ¤\ÿ²Lš¢sXÖb •—û:IÓ>†`cž„«&Ð’Xu8Cú× #ú~»~ÝyÜ¡]÷þ«µ)æÓ:¼¿&ÕúÎOÉaî¤ú9¼Y…Ÿî@›ù ,rÞîhjo+tL*ê µ™»#É:0~²ù[éü ÝghŸÏfò1ÏÓ>ñì¬y9íS4Xq‘zìÛ©KÃlìöµNdœâó °È‹)< €cP²íµào\ñiG‰ÏYušWû ä# -¨ñ‰V„”äæCƒu$±lxÙ¦wð°¹ayeíÙĵ­ÅŠSÿ½•“±U²ÚÚ˶ší.óeÆ ÷,³Y](a+aÕh™%üÍÅ#î/9t¶êp×*S¨æ”?ø•ÁcuÍ*“Ö{VyëqP›ýš¼ž¯7t·zÄE«r|æ`.×yÓyÆ åly½-ïT®¹ý9?–ûr n wŽµ¥¹ukGÆèû-Rm>D³÷ìDëŽ~ìõ`‡³T¿ve9¡[ͧü`W²†ÅZ––Ûúh–Ìý–z¬ÎÃYjÜÇTµ²¨7CŒ÷z…—«XôåféŠ+ko–>xñºÒÆÏK¾õ‡ÆÝÛ•¾êƒðLW¬²ÇŠÆøI™`oÆ—ë<šUjµ`>û›sëçüÃöÎä®}Òn0™f*A®Óž{UìSûm9w*8hÁ9>÷/:‡c¬Ú|Þ,rcújRµ=–ç¬WG!-ó.4ÉÎÛˆ”Yzà3Ú®e]æݼ/ Ëæ«ñóÃ[6ƒÙg´G‡eSÖÔlmxÐÐ6X˃ƒºI›3·²)žX¤™nÚC¡a¿Á«ážj›èæuÉø.ªlÒ¯ÚßyðÑÆàê6SùÓÉçóu>sVù8iÇҟ=M–ç‹0òY…–t:•­ÏWjæ£üj¥ÊéþŠüåÃóÔŽ7¥üOyÒ<éDë??}Ì'q«LŽ¦ÞtòÓ‰Ob'LÔaÞ 3±\ªÖéöD´Ò.©0¥uId˜ª\öǦœvΗÆÕÑp}W«ñ y¤j!›Ïˆ›;ˆ¨éõ–Ì£W“.d>Í>N¶Üù& -o°6boƲ½Á^ñ&Y[5Ý–¨†î:ÙP•Góé§Mu¾›è£êô0ýµ¬ Ãtî/'tk×Ô'‘Êghצªvj4;•ÕÕ’mB¨Í“@ºœâçª6M˜ÌÆfO"‰±µr©–H—“X®´æÚL…V*öª©j¾‹ÒMÝƦxv>Zøç9†5¢l½\’ùéu›k»1âåCòÓÉ¡´ëX¡\5½‘h‡v9ªn/bU–f¥ñ9Žüÿ ®Qyò…¦fR|k¿ëðÚl䥒Fºo¨C’4…^vP—¡Ùì¨/•PžA·•n[P• ôªx R <–dݬ®‘ª~VŽDU…@wìš)?-È]N×–ªS­3¯sw­ÝNö ;ŸFrh3®ù`Ý&okw°ùJ¼dÇFk2›~¬t²QÍÛõÎb  ÐÉFŸ2¹®Ö†NùÄŠrÙ™äq/§NÙÍë ?EõVó9ñcä¥ÏÿA™¯ñúç‰ÎßÔƒIg?nTC Ó°uA=ÿªHxދȾ®¦6hoÔ§‘ÚÆÔx2Õæ[¿¼m>Ç懧uñv µ¶ì°öl rúÒè¡-nF¨±W+ÜØ)UÚ¢Óê(\€¦*­µªL¾T«jÉ#Ž¢–B‹):õ‡QÓnœ•¦D7Ίߔåv«ÇkÑ’mÍ9ôÑ©^²Å’Q ù±v£R/i+mÛ7-û®Þö< ƒº ¾G¦ªWs›’Ï¿笹Îj'B*Uÿòý(o8jÒÁ›MEï!Ä?°(Û%w×Ùß?Ùî’Ôý“±'LÇDÖª ùwödžÀH·CSõ7øäjI‰CºOÂöP‡9µÙÊ?´”÷ó&Q» œ*òïªYz#ÿLPZþ9o£ÄÅöIþû/Q“Õr -endstream -endobj -586 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 585 0 R -/Resources 4 0 R -/Annots [ 587 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -587 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 292.623057 101.433071 273.873057 ] -/BS << -/W 0 ->> -/Dest (cb118-1) ->> -endobj -588 0 obj -<< -/Filter /FlateDecode -/Length 4632 ->> -stream -xœí]]¯ä8}ï_ÑÏHüQþ’H€Xb¥< îÜÙY„î"-<ð÷9NÇNÅ©$î¾wf²°sÕÓ*—S±ËŽë«ÂßWÿEÒCŒ)xº>ùᢆàþ)£ú|‚»jEap:ùè®ßg CHÎ}¹à¿æ'¹üåg—.môÕ )y£Ýõ_ßfÙ!Ä”T *¥­ rnÁ8/¨¼p‰)I*¸áZ«Ü ¤‚dLTnX -Ú®U n˜ IRÁ \TZÁm”upDY#è´< -ÝK:£“I¢.@§ƒ‘tÖ>vZÒ¥Á{#øâ’Ò’ÎÁ§‰”¤ƒ/dct¾Xo•¨ƒ/&+é|1($è"|º¢¨ƒ/Ê+-é’\ŠD¢.A§bˆkQnpÑZ%é´°iEZ*ÉAgà‹W.‰:øâ¬2’Ο¤O8bZ«É­Û*«%ƒ/Æuð•/1€ñðE/QZÐyIâÂ@ÉD&Ú"E‰LL…`%0É äSxÀ* ÑX_y‰ ¬†/„–+êà‹M$q5ð $.°¾²X°--XÐ-©¤%.°à[RÚK\`A¸pSI\`Á¸6z’¸À‚r¥$qçZp§Ä¤‹æ$.°`]뼑¸À‚v-E/qïZÒJâïZ KQ_`‰ ÀŽƒÕÑJ\@à]«U¸€À»hFFâÔêz‰ €•ÁĨ$. 𮉊$. ð® èD]ЭÄÞ5— õÜà]㔑¸€À»†Œ—¸@À?JŒÀ» '‡ð+qú{茕¸™ a‰Ä¼«º?¡Mƒ­“—¸ÀwuDõ‰º4è€Ú-JyÐÞ'‰ x••¸ÀwAŸQâpü€ÕH\àÀ»Ú¢§–tà]m’’¸Àw78‰ ‡A#¸ýÛ  +êÒ RŒ8ð.hÉH\€^xPL"ê i‰ @ƃB*qï¢{Oxð®rÖJ\àÁ»Šöˆ:øb£‘¸q th¶B›F°:(¦tà]¥QÃ’¼«THxðnî6%.ð! L”¸ˆ‚Ä>ÒBðø¤ CÈ'êü€c'qAP8P–¨ƒ/HâÖC²)J\ |±ÆH\ |AÈ q"‚!iDßâð¾.âø€à "E‰ ÀdCLDç1C©J:o†@×¢.B§ƒÄ!Ѐ®XK\€±ÔÑè%.Á9\’¸n@§Iâ‚à šŠÄ芆h™K: _dK\€H:­%.ˆ¾ ”¸ šˆQ¦W ‡ÆXE-éHåqf”¸ ’r¨(qš Fš`JQ_@ ~ò`ÛI\€Á›æˆ:øbI\£ÉÃÍ(qAŒðÅ(#q°™Ç›A₤à ">‰ ’òC“%.C§”ÄIGŒ7 I\€v™Ç›Qâ‚dÆ›â í6YŸÇ›Aâ‚DðÅ!DuðASÚ-8 ãM°“¤óðÅ$’¸ yŸÇ›Qâ„o"¢§boqº¼ë˜IÒw™z‰ p€ñ&"[il¯@¼. >“•18£8c @½}«8e À½è­‚8g @¾yŒ$NÀMŒ,£g ЭB©•8m À¿ˆÇhÅ ·Ù'>E净>3†|‘ Í‚Ý×1ÇœÌn$»Íýë»ËÏŸÐù^¿û÷åãÏÆ™²ò§ Œ© ñšI¨n‡è[ãò­GEëaÒè!|Ä&;Òì¤-N“nÙItùßuýcá9ÿf<½­§OèÅo§GƒÆS®åˆáë87È<¾Óä Î'Aoë‘Æ&“Ù C\©h‘øWï.êäÅm´2÷Ñ_b0LÆ]ß}ùùï¿þóÿð `ôîã寿Pàè_~¥ó÷3>öö›â$ó·oŒC•Éz=§¯iÜô Ѥû8ÙÁÆ‚éÕGüŽHóþöÙÖ,ýª¾3[§–ù«éšdü´ç(ß5ï§[ºRÅ?zžŽÓü»æ1‹žØï0—]õ³\k|üÛõÝ×—_¿[BoŒGGèQ&¬˜çÐÚgò´~ -bp»Ò¶òF öûy®ø*o@¼°KÑû[EQZ¤Øª6žçíóPTÅù¨9o|ÄNý¶Íõ}ÀÇäÏ/E(å¹õBc[¦Ht€¥N›³ ã›=4Ñ·¬F\S꜎Z”´ˆÒ¬FK~I¨õË|²]¥°4×¼æ(ø¸Ì£¥¼ÖßѶ¡²šWƒèL§•Ö¾óÒnÝB‹©-­¥ÈÌ®Aj{C¨ô½ò£åA·DÒ˜¦E•cç2S«¢¥.Ëk‡]ø·ê6ÈC¿ûlN‡Äƒ0±Ô2ëkM½øÈls̨۪崑W©ñ¦W^èŠ]i5¥‡lyªAFŽzWι‰Ø]¬w_ ·áe]"°rÕÈÃÀîqN§Íé»;n·ùs£úÕ¨b×Ò"y…`‡Ò²œZ4J}At=/¯£–ǽ¿™cN -q@Ǽ?@n§ÍÙköãÔ:¢hbÁq˜ÉziÞÓE9XõÔmO^ÖÆœB-ŽÑ…]ŸÏzû¥ÿ«x‘MA,òj‘ïçt»nQϦ6‰G½ŸK;mN‡Èƒx´™©¥Ç{¯­ -ã(^ê‹žïé51Ü—çóyídИæS"•ÅžÚ IE“§Í÷‘Úgs:¤îÇ«=H{ÈŒ9¯mñK©ßÔ¬Ð?ÓåÛQË*Ù”drƒçG¨ì³9*bÑ#Ý[o÷õ zcTôã@¹ŒL«îçËN›³!ÓÄšo9ré@ù]£›·F4CGîqÏƒà ”Î±d÷ˆ¨Óæt(=ˆ??×ØûS ¸AÝ#Ƚçßúþ‘u÷Ë;mN‡ÂýØRÓ„º§YmšJ3§ñS:©Æ…1üᘙÍÂlÍo–.3ï«óîÜÿjùOœaÚŠJ à|ÚD'í\íÖHƲ¹Èîž¹Ïæth;ˆ¹ÇfT΃½-G¾8YF(±80?~†‹ôG³B6gC(=~?½‹Oîá~Cþùßlˆe1a^ m¢6î±}6§Cì~y7òv¾·è®½g”ó¹Z\³¾õýubñ¡3ƒrä3zöÙgs:Dþxﯟ¶µìŽ¨6ï_[Ôis:ÄíÇ•[÷rÄÙ¾&èéñµ’›÷Þ«õ*Œ7Š -^·ºâ­#•ŽÝ¿î!ï´9*ÝÁ<äY9mgÖ…ì;z÷OÒJ®ÜâGÇï[w®xë´9bÄÓpÆÿx«x w¬Ëì´9J;ãÆR‚¤V—¬ÖŽ3”­VõJ3'̬V:(µûXŸ®þ= ¾6k:õ‡×£nÅ·Ÿ¼ 7PïwÚœÅsœ_tí—¯Aîýó™6gC£?˜Ï¼—_±ã³ðw‘ñ»€ ªÇtwäËŸª[=*Yò`-ÒMOØÙ‰£ëPÛ'÷:ïy67éêY“:º#Ùis:ÄîǪíõRí~ä= ½pIÇüyy£ ¶~õÄ¡žÍEv#°Ïætüòqhû,ä -;ñæ—@™Û¾®ZãÝ÷ÿ79LJùåsQ¹£ûæ6§CdçüæÞêˆü—0}„g"wcµö£0Ã]uí -ã­¸vãù™UKró5¼ÅÚžðÀ:ÈN›³¡&üôlø™í³á_ºtÎS6çØ;Zé´9bš§\´¬£¼¶PÙ±ó1´o ÔÝÿ¾N›Ó!ôàYœ¹ }ztMhµº)óÆÿcËØ@b¼ÿžN§ÍéxžŠ7^Ñ£óX‘ù""ó©A}^\V*Oqïj³™Ò¥OË‘ñwuÚœ ™ñྷV›Ïl÷¬õî®}?Õ0ÿyYÓžnß[5_GïÕàç‘Úê :x«bñ²ás–[OCH£µ-^ÜBßë!;mN‡¾Îõm›>åšsÅ™m²½òm…<³Ýis:öʼnŸkí6_¨ý×?n>ËòcŽC7Ðïö°Óætè|EìøEyå [ÎFœ»ºWÒÌz×–§SË· Æ)ÖlcÊÒ‹‹ØKêþU>6gÃ^ÚÇr ÓiíKG wzߪ´Õ_§žÆî´9*¢Æ7 ã>27Ÿl1÷¡àÞ÷jmÆ -«¶oAã÷#Û{|ÜÖŒíï*xš[ã&"X Ùis:Dö½Ì|¼'ÖÞ½a‘ÑŠ»ø=AR‹ÑñÖêìÃÚß©aqôÎ#·¦ÕHÏ_t½TœsèkÞßÚñÄûN?þÀ³Ü6§Ãç}ï1ßZQ{üÔ¼:œ1ªy<Ëõ½X{/–$\ -ëÂ?)Ö¸?‡ó•9¿™ö²•è\ÞK(:ÙÖŽ‡IзÞH£lGqÍ-¼ü„+paÈ›ØÚxEXH)ä}_2œ¾þÍï~û'§ñµÎßÞ–ÝÂíÛ«Ç}üí8wŒc‘êÞ^M± 'J«-Ý­VÓÄ`þ¾½Ì1ÃôŠK¨rZûŒyM¿Ç|b §óå7Ù>¿l'Üô‹üÝtnæϘ‡c×àÊ5¬ªò‡‹÷0Òã>vÊ#À2y£Û«§ÁæºI×¼oRT–t©:=¶¾nXŽÛÿPSM;«¼‰`Þ@ê¶0;˜Òÿ0Vú÷hÈåŸÉᶻ§ÅÑ”ƒYürÉ»»’ &L§8 §ŸªæEº$¬²gplR›ÒºAM?SÍܺòÓ¸r5ÙÞ³¼ë©’ÈŽûÎÜN,aéõZœ¯^ zçrã`§#_]q¾ø áœ!ñ´s†³á¡X[Å„n-Tìt³ØPñGçÕjÑùYX]çE§Yõ—´&°êÜ>_pZÛJ_DiÞ—³dUJר*³Ì©T¥®¤¬BµžÑóE~¥JքʬzVkyw³›0 QM—J:Aô|ÓM¹¹ZS¡¦Š³i*%?»2CÝÆZð‚l,£Iò–߬([~.Å>×@©knÌJø|AC+ñËÅ!µ›¹B¹=.´,ß*ŽjÆË,ÍCÑÛ/4Í"Ë{CåÿoTáª43ÏøCS…TÞßm>šO’Ûf/ ‰Ë}e’J@S˜Ó²âÒ!TÌòòÒQ é3éÖÔµÄRVdLRq/“T%¥XWÔUq¦°R>•+¹P'pºYì*”_âÙOW›*À^Næ5ƒ»«ùÎb_¹ó…‹C­q7ë«þÖ|æ‹ðyìبgèÇr’YlTííæ“1áìHaÏ4ú2ŠKk­ì4¾ï}ú972©Ç}¾üý2vsÆ:“ðÃ[÷žå‘—¾þi¾Æçºþ¡lvvëǪla*·.ļ'Ë;•ÇNqÞ¹¼k³aBCŒög±ŽsZWÐPûqc_Ól®fb/)ueP]µ\èæ2dbS¡k´e%ãv„ÏM)Ö@æµu3wØ·C[.§±y›¼âøåà0Î:;wÉW–%ŽrÒ¹K‡– 3Äχì„iöláf$?I-úì?ñª°ù\쀅ùÐÎ:š»Yžu‘WÁ’ ¶ü€gLšŸ4-üœ~¸y½ºÞ'—}iYZ©½J_¸´^X–V“¥v<ôËÃÚçØk>(w.¡š—emÏÖ gnshA‹ŽQ&³Ù”Àñ“R‘-NZ:ŠJ©"«9†â“ŸÌJ±ŒWÅR -5¦˜¥ç%íx­ÔBt¼Vü*mηôx5Z²5rÎa¾:5§¬±ddž[W)Í)m‘­ÏMËs—ÞöÊ.ƒfGü™ªÙÌ­R>Ä´›M3!¥*ã숎óö è¨Ikì5åp'z¡¼iw È¦Kî¶ÙŸ?YÏ’”ù~&TÇ@Öª · ^ HÇ -–ÕË´³ªl–”xI÷€0=4ÓœZÍÙÁNS˜ã$Q= y¨èҸŶŠ1o1”§‹Æu]Ëé“ñï¿ÇçÙ8 -endstream -endobj -589 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 588 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -590 0 obj -<< -/Filter /FlateDecode -/Length 4360 ->> -stream -xœí]K#·¾ëWèlÀ4Åø ²ˆƒX$‡ ‡‰¼k#˜ °Î!?_±›n•Z-íìF»ö f¤®"ÙÅbÕWU”D™£Æï×ÿ•RŽŽ§w‡÷­¢×ø)-…ý=þ¢?MQy“CòÇwLpQÅìm Ççþ­.Çæχ¿}uø÷²9Z•s°Æ~Ã,r*¦µX,mœÀò^Åh}XÁ(L1g‰1|$Kç¬1('/± Y›V‚Ž¢qç¬ 1l4$± †É> -,£!‡±Z‹<¢‰œxÆ«¥‰g -)Û,ò"x&Z‰çœ -‘Œ7/«‚O ‹ÏÚH<Y¼!Ò²KQâÈâ‚Ó"²ØÄ‹ÅB;Yà%ÈëJ"²è ÄËNùœˆD^O§˜ÎyV{å“sZ⣋<Èâ¶ÏA¯ÄNxS¼Õ²w;íŒÄóÅÚH"²`ñ%°²è$€)Æ% lŒŠ²% lrŠ% lÊŠbt Øì…%pÚ€gNCOABg ÁsEdq™$,p² „ÎAKN´%X‹„pK: ð–´ 8.ÄÔ8 ®K$,p€\˜R–°Às°SÂÐ…»G P×ù`%,p€]G)HXà€»ŽŒ–°€€»Î¡§Èƒ,0` €ŽÊ™ä$, à®3:JX@À]¸‘•°«ª`‡AÂØŠ²)i ¸k“& ¸k#B€È‹ ->è$, à®õ˜‚¹»Ök+aw-Ù a E´˜ w!^N VÂÄ{𬓰ƒ)‹´DÂÜ5áOði •2) WEŽÈò±=1²¬]Uã}»®$Yoîóâ²¢þEÉê‘p.ï+ -y­ñË.>›³íežOÑ Ô€ËìâI»2×»¼ À|¤Zm\¶š€7(*4-ÿöõ(5K1m€·ËA|$KQÇúãëw‡oþôê¯þî{,æë·‡¿ÿF£büökçéÑûéÑbÞ¢õˆqDKÓéí² ¼Ú®õ¾P˜iÿÄ_:¯õyÓùÆϼÚwÕ¯È&Uç4ËXû¹1¾OK™Ûýt—ÓÛ.{¯Ý×.ÇokY0ž×‚.æçôtÞG;<þãøúÕáw¯—fX -“Û,w_—±Üa°9o,+u\¨¶Èi¹ØÍ„Ei}«ñ®¸?ä2ÈQLeÈdŒf ¹É J»g•´‰•M›óJ›a¥×÷eã×:Xº?}¨G^°Ô!µäׯáR᪥îëóp–z% ýEàÕ\YÚÿÇ/XèBjR%X_ðûú<œ…nç[8uVH+þkfðž&[§Õ·Wó;û<šuÚ”~¦™Á‹zÜ'ˆôvÈ/÷Fú}ÎR¯ä¤Ÿ%þ|ù‘Þy¥±*ëdùõ–m Ý×çá,ôJ.z'îlZ›„o¿Fúý‘~ÜÊäwo¤òŠû¶uîëópÖ¹‡Þ]÷~‘þfû‘ÞéÛkú}ÍRÝ•œô³ÄŸò°ŽôÎÝ^Óïìópº3M]“íŹÐW¯h}Èó -^q¾W_$œWàר~[Tww¼¿³ÏÃYâ•œóK¬ß?†w}Šžn¯Õwöy8«¼²çùYbÍ yÓÎ>¾Qda‰OƒUo¼Ñ¤É_Ç©ÞråUNºãµ÷}ÍJi;Ï\¿-§i}c¡c x°¶ Ú~ÏŠßûÖ QýþÞî¯hÖFë»Sµý~ \â1­Æ»h¡=gÜo¡ûú<œ…Þ¸ç9`Ú Ïpë’%nÕË;pésÎ1×Y­­õBT§;^kßÙçá¬q_®ù"oq4nkë®ïôh}VùìâÝylEiz¼8ÎzNR¾¸Ê_ïgl—²_ÄÊtVîëópÖy%ç\çb¿ÈzùƱ>¨"”-Ò¯“ïÜqßÙçÑ,Ò_É/W+Ñ´º‘Ýß…aÞ‘Žïšk¼5_¨„Ö˜Ùpqô®³üï¼Zúx^{ÁZïØÓÜÙçá¬u;×ül1í’5ï¨Å×;X Oü¤tÁ:{i«]ôúšuîëópÖ¹3÷¼½K;4m•.äbŒ%gùkÆ«kÒ>×ÈsɪÔÞu.írøПŸŒ36•¹¼úýÿð—ñ“(4Y§ráö<²•B¶6Ÿ¥Ì=v°ŒS[ÙCë\§ë3úܶU‚4Ö묫©ý´ÿ:ä¼óž¬¯} üôœÂ2‡÷nºGiçõr'KO2´ùÌ2–û†ªë]Êu£r—qv9÷:‡2ï3ûu¯ƒÌ¡ó˵›ÿüÐ~¾f¹«®«n5tc½Ž24ýÍíYçú4y½ ótÃbž1ª6ÏÓÍkîßc^'^³ÎÇ Ž?EÏ'5£çyMs.óÞ#wIÝç²Ð¯©|QOì -šlÈÂØ“í/m²Ûr×5ëÙñãiæ‡Y&_#L_Û²fvÖùܶÌ?Í6|ª9Ç|-Ì£ØDmóv𧖋L÷›r¹]„³¿LµÏcj¿©{·ÖOëÍÔ¿FÚâ‹OÕ¿f›°Ëy/|Ø s®ö§ÇþQÇÙÏÓ€Í_e]3Žùj3Žh·Ôáz›L¡ûF[7ÓåoéɯõÔæWöqÁž–¸x ÷âaÇÂæg~ÐKæ§ñ;V ºÚLóÛÔIu²À´m<«v]æžf[0O_½¶ÙšWB­¸œ—•døAΨ’ó*¸òñq> e¦½šQíìs×çâ_0•òýÓ»Y%ïáÊòayYÖeš©1¤Ó"\¼aH.ùt©Õ 'âšfÔ»nkß}ÀEÆõo¿½Ò›R9’-„KR]éïƒÊk'õ/ Í*õ;Æ,§’nCSŸâãl;æO®=ÄÇ°Ü¡}>€Ê ñâL¯ôçÕV8ûrÚ§dáq‰nlÛ©>Œ½}¯uI ãúåEA,8Éa0‘Erè.%|ç i™ùð¸ÕM‹·_ÂlB5>¶”¼W_ÖØÙçAJˆ‡|<Ò¶p+{Ö–M\ÚÚZxÜXü¯è­ýXŽ­ÊÕ6F\ŽÕlw™»,3G³e™ÍêâšýœJ–y–VI*gŸ¢YÝpe•ßÏ'EŽÞó mÉ›48ÔLñj“+–W5s~ÎËѬŽ©Y*CòÑà.Áîáj‘OÓº¤:ûfrn3gm6LUŠ =«j;ynSU>T-cš3þšuõÏÙl©4òD·­š@# §éÙ¯}š—íT³ëÕøK›C=×"Ÿ-åûC('Ùr:¨IËLJ)ÇküH|ªœ#S—Îe›ã…žåÐõ÷­Õ|»æ£YùX¾éöábnÿ¾,ú»ƒÉ¤Xÿe+¡œ™¬ ±Á¯ÉÏ>3›2Q߸BfâüT·±È´íJ;_£Êë–/=?í{ ŒhzÎRêl¸¿¯Ýø,3Òµ‘+§yM7ˆèÌ9™g¯•™É|îxRn¾ -MÎ’±HcÛ>`ïx•lœˆþœ¨‡Ûu²¥*ás*›êB'6ÑGÕ™aùk[‡åÜ"ž¸­[SŸE*Ÿv\‡ªÚµºÑÜ TnT_[¶¡¶Nétˆ_ë:4a1X5>3r"¦jHÔÚåÚN b»y4ßV*¶V©wÍUó]”nê.5Å ´Ó°Où‹Ñ®>]’yÛ©­µNƒÝØ3âé€CgäçƒBkß±Bûjz#Ñ ã6rÒÝ^:5¦ª*¸f¥ñ‰{ü‚ -ߨŒ<剡fR|jf¿ê7aßl䥒Fzh¨C’ ÅÞvP—‰±Ùì¨/“´ÐžA·µn[P• ô˜«x R <–dÓ¬®‘ª~VŽD]…Àí:Ù7S~^»œ¾¹ª×ífÁ æîÛ¸v>äØVÜð¨MÞ6î`ó•x*Öd6ýToÒÉV·h×o6»`…Nî0ú\ÈÕ[:•æ§Ýɤˆ{:üt(aÎ:oy+$ ÐŒË£ìÌñ¿hó -ÿ:Ðñ»z„äÇ­nha¶.Èc$ãïH;Éü}•ØÜf Z`¿“Mêm}µ†Ç­ðšzwݽ¶4 AMãŽDßu8m3]kÜ ¿A<­´Ø™]›°§KW'Ç›:|øh• -ãtp™:Ïõ|†Ä7í!\²CG\Œƒâr¸aî’-ÄdƒoÒTÏòÓ¸¼%1^ i_ºÎ£fÇ¡+­Ìbh‚ØãÀdÆ›æ…<‚Ðw»×¯û,r¨ÀÔíú> -endobj -592 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 217.623057 101.433071 198.873057 ] -/BS << -/W 0 ->> -/Dest (cb121-1) ->> -endobj -593 0 obj -<< -/Filter /FlateDecode -/Length 4598 ->> -stream -xœí]]¯Ü¸‘}ï_Ñφá÷°ÈC€l°ƒ$ÈFò°Ø»=N°¸`²ùû9T‹d‰*Iì¾×¶œ/Úݪ"©yxX,Q¢ºJü}§ð_´JĘ‚·×ÛO—Ÿ/R'ñoJ±8˜Ô?àÜUI„SÉGwý) L!9üõå‚ÿºCšüåòç_\þ¶Ì£®Z¤äµr׿ÿ˜UÖˆCŽQ%¨¤2ŒÊ9‚vžQy%p‰)q*˜á‚Õv­ -0æè8Ì°ZGFa†±A™µ*Á ”åT0C%•’°Ci)Y ‘ÖÍ蔕î9VÂǤ« Щ 91«œâtIxï]ät¶¸$§s°Å)k%§ƒ-ÖÄÀéÇÚÃIèàò±:/pì8.Êbu°ÅËqk‘LŠ [ŒÖ [à2p\@$ï›ÀÀ…XØO‘ã0™ˆÉZŽ ‚ó˜¡V9×"Ð5«‹Ð©ÀqAV`(V`.%":=Ç x‘Ý%Ž `tÊr\lAWá¸C‘ˆž9§S°N6Çðt¡SŠã‚¨a ¼AŽ ¢Ž˜ezÉqFhÌ%QÕœÎÊ<ÏŒDëEv9.@7ÁLLÉê` h‚ã´Ožl;Ž 0ùÁdÓV[Œ³Ĩót3r\#lÑRs\læùfภIØã‚$½Èn2Ç qè¤ä¸ ©ˆù¦¶ _æùfä¸ ‰ù&¦xL¿MÆçùfภYØâࢰ:ا)1ýœ„ù&؉ÓyØ¢“å¸ yŸç›‘㸘o£gC1Ï7.ïºfâtà]x¦žã`¾ Ï–›ÛK¯ ðÏxeÌ3ÎÈF $¨×aleCÜ‹Ñ*°1 òÍs$6h31³Œž`X…RI6l Á¿ðÇìŠîÑ'¢ò€CÀ˜C¾È„naáÝ×9GKf6’ÝãcÿËå—ï1ø^ÿò—O¿˜"eåOÁA˜R[øWè:¡¹¼o…Ë7 ­Ä$´“…0ð™<Ùˆš‘ -´8ݲ‘þò¿ëúÇÂrþÃtzSN(N®¦ÐrÄôuŠ ‹Ìò†KLŽ0Úz¤1IgväàWJ»Hüëwu¶â­‡Ê¸b>8“a«ÝõÝO—_þîû?ýá÷?Fï>]þû?¤tîWß©ü­»ïpÿ–æþ Ç^>ïï¿WòùSå¶K—Q7êãœçCÓiMÒ™ùóqþ¶óï\~jéì°1οçk°ó13_GI›ý2m½þ´–U›dWf9oèÊ%ý¯þçúîûËoÞ-¤),qM™›v±7–å5Ø{CÈU«Á »˜3K¬ÙOËz´s¹Û\ï‰è>-Û/C'G“kÛ…eYWÚ³¶ŸjzûaÝÊQÚï\ƒ ¾ô÷±õí[iÃŽíéd /=m²Ï~Yûjï)å|ìêË6¿diÓ*›Ç¨Á/Rsèdæ9*÷½Ë=/­ÉÙQ³ÏÃðÙ* Eíø<•·Z6>Á7cyÎÖ²úÀ‡+5y#£dW›¹ïèÛ}t«#gßzŠ´ÒŒˆœÇä¾ö ¿ãÜGŸÍÿÌiüi4oå…¸ïkUÔvüâÞo ·pÊŽKù¹ 4×ëÐZ{µ‘Å©nޘ͑Ž˜oPàt0ÏépºïÁ­ÆEÚlö·KÛWy‡cnìé=A›Öé½²Íñ¬›£ŽŒuµPÏ‘é–ôúmºëûx÷ú”æYOIÚ± É`žÓ¡ißËÚόԣ¤G”"-JǶ¾Õ?-Ë™fˆ…Å™åR|Z–ѳÞj>Àùð¥¬Ñ™Q·æ!GÞí1µ§õ,ù‘™kÝ–¶åúÝŸ5Õ"u,Ïéz×ë8­GÛrSûirk´¬ÎŸ¹U´gZºoE‚î×xa“ïmîå¾WvlÍ‚©-=ª9×S³ù $R¯/ßqŽÓ]Â}$Žå9ͧø•c•GºQy¡+ùJ¯é¢v«k(ç¼!¯œs±=ºÈè¾@oÇË£ÑQÕã‰Oì—ö¯üE…X”µs—eÁ=êItãÔø'¸t,Ïéyàvq‘Z{tôÚš¡Ž¢µ¾ùÞãwd:ä­¢™ú3#•øžJ‹$£Î+nö‘:–çlHµûþêÒ¦ò#áAÊk[üÒÝ™¶;#ðó>ݹQ¾íµð¨´$&™œpÓäü•ƒyN‡Ê_ôE¶Æ[ù}#¨Þ˜}(ß@¦yœ/󜙾æ[Î\PþÐìæ­MÐ1­Ô9 ‚7PÚ|ÉáÑ`žÓ¡tlãgŸ{w¨{¹\ã[ß?²ññyù`ž³¡Ðíû–ÓJ’²Š–‹jÓÕ®~Nǵ83‡?œ3“(ÌV|³´p‰¼¯ÎûäzŽCO ôʧwÒÇj·f2ŽÄ"GGæÁ<§CÛÏøÌ8Q9ö¶ýåüä „šÇ‚æ9BŸ¿Ÿ>Ä'F¸ßþ5{Çb‰O˜Ÿ£ÔQiw„ر<§CìÁŠÆG‘÷žSyh–ó¥z\ç³¾õýuGüC§…tÖgôì#r,ÏÙé¿Ýûë§í-»3*q^=¾¶h0Ïé7öTL/‡†Ð5AïŸ_+¹yÿèƒ\¯Âx#¯àu«+ÞÚØ@%¹=!Ìs:TÄ!ÏÊi;³°!d?0º–^Òqå&?ÒûÖƒ+Þóœ‰>âi8ã_¼W<3Š?±.s0ÏÙPýÆRƒV®ž0Y­'([­êå"'OͬV:H¹ûdNWûnŒ­ÝšNõñõ¨[ñíg¯CÅA=>Ìs:Ä8¿ê -Úo—¯ŸAî&Ÿˆgæ9â™òã+V`|þ.2z°Cõ”îréSu»ÏùÞÚ¹§õ©3G/Ö¡öOî Þ# -$6éÚYYytGr0Ïé»ï«öÏ×r­ûU÷ž…K:bÏ3È{MÈ;`׈H,rcyΆÀøõýÐþYÈ2vüͯ2·m]õƇïÿo¼ªù‡ù½ÕQYëŽî›æ9"ã›{«#òëÃüaž‰ÜõÕú;ŒL„»êúÆ[~íÆó3«žäÚ5¼ÅÚžøÄ:ÈÁ<§CÍ¿Ÿ _ ³6ük÷€Á8e$1Çñ×ð å9bÿ§\ô¬£²¶P9°ó9´o 4>þ¾ÁiÊ•ò¾“Ü\÷æžî2ä´þþ™ÊšOåÄ2ߙϗç69~5Üõ‹òÝ|nbÏT†#×àÊ5¬šòç‹ŸvRÓ.qÒG¡tÞFöê­0¹mÒ5ïJ¥±ª4š*[]7rN›ïþ\SÍûñʼE_Þžé¾Y/9˜Óÿ<5úO•¬ÈõŸâ¾w¦œÄQ—ƒ&~¹ä½S-#¶pÅY8ÿ”µ,«JÂ*»hƒH}Jã„œ¦ZxÞŸãþS»r59¿+Ùòž6V–DfÚÕå~bFˆœ^­Åùê¥P³8ï?…™|5Åùb3„­@KÓ¶[ÆC±2’ÝZ(ÉéšXÛbÊû•ÕªóMXM§U§Hó—´:æÜÞ.8­é¥/¬4ïzYŠ*µ«e•bTªRWRÖ±µÑí¿“¥h‹Æ¬zÒjyï°»0 Ùš.•tŒèvaÓÍ¥¹ÚR¡¦Š-k*5ßLiP7±V<#›êh–†¼¡6é#Ò”ŸK±Ï-PÚZF‚½Þ.bìJürqIíWHW G…†”[ÅQ6¼4i~jùþ ]³ÈòÎKùÿ;U¸*ÍÌ3ýP¶B*ïžÖŽÚIr߬âe%Q¹¯¬c¹P6´´¤ºT³´¾T”LúLº5u­±…”T‘‡TÌË$UÉc)VuUœ)¬ÔOåJ*”Åœ®‰]…òËBÜìtµ«ìåd^¸»ZnûÊ/Tj‹«¼^µ·–K0_„·i`³½8C?–“4±–u´k'#ÂfH¡‰¾LâÒ[+;åí½ËÏÖɸ÷vùëeæ´q:á‡7*ïìJ=/uýÒ|Ïÿ^ìõ÷e+±û8®ee ]¹u!¦#YÞ<Šó¾àEX» jKh¿‰Uli]ACǵ&|m[vÙˆ½¤T•AUÕR¡kuHĺBW+CjÆío]-VGæµmÓìû¡)‡Ó˜¼ ]± -ôrp›Î´!ùJŠÄQNÚ†th­&q@ Å!9aj–-ÌÌ€¤'©UŸí·´)L>9 nD>4MgÛ0K‹.²é*H¸À†Ђ­¢'M {£Ÿî^¯n÷Ùd_z@–Vj¯Ò*­–¥•ðx©™ýò°Ž9æšJçm5TË2¤ï™êä´®Ñ\ »8 %ÒØ²Í =©-²ÅIË@Qé2YdµÄPlòs¶R-ÓG¶–Bõ)šô¯´¦m•Z‰Ž¶Š_¥Íå–¯zK¦:@ŽÂ9´«“-eõ%##ó4w•Ú–ÒÙúÜvyî2Ú^ÉeØfˆož©lÙÜ*åSü÷Lß¹çé"\ªò7EGTl›ob ¶*m®)»;Ñ{pˆÍ[bI¸äá<ûñ“u”¤ÄOè™ÐÂ#ƒÞ6Lx"+HQ/ó¾¥|¶$ÙKz¬˜ðP£9¹Šaæ8æ$ª‡!O]š6°–1æ ܃Tl¸hºõña>™þþ úó¸L -endstream -endobj -594 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 593 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -595 0 obj -<< -/Filter /FlateDecode -/Length 4598 ->> -stream -xœí]K¯É­ÞëWh`:õ~Á,$AIp0î] îÂ–Ç ‚3&Yäïçcu=Ø-v«%;òÌøàXj²ªšE²>’uZ%}VøùJã¿äô”RŽÁ/?œ~<©)z…¥Å⢰¿Åoôg­\œ¼Î!ùóD°qŠÙ›Î/'ü·ºäÍ_Nÿ÷«Ó?–}ôÙL9£ýùŸßËÙ)¦•X,¥­Àò~ŠÑø °‚ž0Åœ%ÄðÑwÍŠÃåä%ÄpÆ$• †uQÛkV†&j'± †Î> -,­ ‡6J‰<¢œ³Fài?(=H<£§²É"/‚§£‘xÖN!:íµÄËSÁ'‰ç ‹ÏJK<Y¼vNI<ÈâlŠ/@¬yŤh%^„,ÚÉ/AxWyE¥%^¶“ÏÉ9‘—ÁS)¦kžQ~òÉZ%ñ´ž<|ÓŠ<¬()Dg KP>‹<Èâ­2ÏB‡‰œð6¦$¬VC«Û*«%ž‡,ÆD'ò Œ/!€ EÅ AVÐD¸$a€‰qrÙ8 L²“K.I(`Rž\ŒV‚“ýäBŽX¥Á3Z« ‹wAB«!‹ÃÊyÅf'a5 $,°²g%,°@[o‘°ÀnÊZ ¼uJ ,b* ,צà$,°€\¸R–°Às-°S ÐÅrX ®õÁHX`»Ö¥ aîZ§•„¸k-zŠ<È–°è8Y¬„¸kµŠ8à.–‘‘°Và‡AÂøÊdRR8à®IÊIXà€»&"ˆ¼8a Z p×xLAŠÜÀ]ã•‘°Àw3AÂ8ÊüQb6Ü„x9€,X ïÁ3V 6¤%xà®ÎšZM:å aîêó‰¼<é ëZžtYÂÜE ²xà.à3IXŒŸQ„¸«-"µÄîj“•„¸‹¼ÁKXw˜4 ß&­àº"/O*§$aî–Œ„ˆÂ“J@‘'8’–°`<)ä¡à.Â{–° w•·V‚ÜUiȃ,6 ×€‡e+¬i$«“2@ -‰ÜU–xÀ]¥b–° w)lJX"L’°NÈ‚„!¹)Ç$,Y‡”Oä… ×^‚¨@ð€,‘Y\t ±ž²ÍI‚h ‹5F‚h R LY#ûËÈwëY)JX$›RvN‚èê1hUâ3¥¸y <%,ˆÑMÅZÂÔRS¢—°?Qº$aÄO; b†,X* MÉ 3—x² É–°™.xZKX dA6(aA2 UfP B£–„ª%žSTg& ’ ¥Š`™ ÒRŠ<Ș°ö¡bÛKX€âÅ&Ê‘Y¬w¤d¨ÜL¤YŒ2À7©ÞŒdYñIXU˜(M–°0žRdPo'aÖ%Õ›I‚lêM”xºÍ6P½%,Ȳx¤("² iʺ&¡Þ:I¼YLvä¨ÞL Í@½‰Œ^ÜHToFq»¸ë3Iâw‘™ pz™­TÛ+¯ÈÏdf¢Š3‰; -Ðë[Å-ìE´ŠâžøR$n@LT–)ˆ»«`j%n(à/ò1w… óîߢ -p‡ˆ˜™"M2cY8d÷½æÍìF³yìŸ=ýú-‚ïù¯ÿ:}øUÙ)k? Bií_a˜ s{dßÓ· ¡Ê¿"!|¤ óRë¦ ‰ðGÿÎ×o’Cp½QÚ È”nÔû‰ÊèE1êC1sˆ|wŸ›"GdùÜßhYÖ¡*~ß¡+IÖ»û¼–¬¶›5SSº­ÃBGÉ@.Mà®<áÎ.¯è -E'²˜€66B},eäëÊ-ÿöÍ P¥˜÷–û%yˆ ~óÃé×úæÿòço¡§7NßýF)¾þJãÕ¥ùÕûúš¯i´êcmÿ¡òãíu©ï±ŒÝ[´‡”î{\׶Î/û¾«}lå]–÷<$³žïÓéJÆWýÌêµÎ±µC±7ÿúùwA‡½‘Á\Œêûÿ?¿ùæô»7Kw*¹ûìø”Ê"_ ÞõÀc]>Æ?…ãå¼çxEi¤¼÷U‘ï†aÊ´õ÷ýêýJé7)¬Œ¬‡¡×ŽÐœ»¿® -ãyUynŒ×Þ“ƒ¯ûôù¨*OÆWÇÎײ´¹õû²¹õ²j[ä` O«¯E—¤¿gÜ‹Šû<›S¢¦ÜóJ×àí²´9d¸Ì,Î`±[ò²ôÀÂÛñÌ+ˆ Nïð‚£РsíÖתVú`^¾îÓtÇ=²ËÏxE¦6¶<ÒÞ’ûOç™û槈åÝÚ<ëã('•L­+CŠ7Ü*™î,¿¾ˆ XôY3rÉÃ>{°Ï³ù¬ÙÏ?¯Vÿ:ïk6ÜÈ׎ ä"#е -ó2¡´}ùüZ¾·Õwþ[[HjF>鲟¼ÑŽ6“÷½òXŸ§óÊýtmín¹4,Æó¾Û±«Ö¿—Õ¸é'ŽÐwéqÃ+ýXy¬ÏÓyå~æ¹Î(5³ôÚã~ÚøõÀ -]m‰~ÜŠÜðT–UÒƒ¯XRᦧëótžz#ýYàÕÆŠÜØ|ÿ¼+QöPËrH妬oEøƒ}žÍCí}ÏGö(Á_2a¥mx§½¿’?Øçé¼óåŸ_hfðª+î3DzËòË£‘þ`Ÿ§óÔ9é‰??ƒHÏòÊ£ûõû<‡ÞÈEÄ»îø%ÒŽôŽïeükçÁ>Ïæn?}¸îý FúG§úÔ‘ÞÙûkúƒ}žÎSoä¤_$þ¼Ò -{âHïüý5ýÁ>Oç¡sQþ,Pûû\Ö+Zgy^Á+ö—x_-ðKT¿3ª?ð—øƒ}žÎoäœ?ÅúýS¬®ÏÁ½º¿V?ØçÙ¼ÒßØóü"±æ•VÓÁΟYxâ[æÕ;Ïš¬Ÿëyð¿rúþö~°ÏÓyéç?×RXU -ëçÎLà '{Ðæóo¯øt—E½Çï‡ãÍ:Ãè}꡵?îK<¾~îpÃCÙÇ‚{è±>Oç¡wîy2Lã‘ð -·¶€K_rŽ¹Îr®ž­ßŠêü­ý`Ÿ§óÆc¹æ«<å¨?Þ·žµßzn~ñtyQýàÙæ8ë9Iù¢ð¬ý#1âÖ涰2¨û±ò`ŸgóÎp#ç\çb?Ëzùα>ª"ÜðÈ>_t°ÏÓyäüre‰®Õìþ! “°ð|?5×ykÞ¨„Ö˜Ùq‘¯.és'¯Z—ï­Ú o}`Oó`Ÿ§óÖWÿR1mË›Ôâë¬ÅJü¬+hÃ;G©¬môê–wëótÞy0÷ÜÈÞ¥šn¥\ìægÙšMú(4—<•Ú»Í¥_²ÓBè°¬ ­6©Ìå›ßÿñÿ³þ|>íK²\¸¿ïù!äësZÊ=âÉ9·õ‘Vi›ï|}E¯m{5èxÍNúšÛÏ{°,ï­û²¾õyÇVõy?Æ.|¯–»Xjæ÷yTÙJß0æ;V\±KÑþ!u®îïêšôeÆ%bV [vG34Ù¥g•k[=k_¯iMÛM -Ú1L³\–®ÁÚž´®.u¦¡N1ð¹%EçLY:g¸ÎÍV«û@÷¨–*§=\,ÂE½^£ê¼æ9—yïÉ´lC5æ²ÐY×Ì+Rü Ê™…±gï_zåðæ¡kÒ³¥×Kó *“oqfضØÌT׶eþtŸPeÏõ5Èó(>ÑÚ|`+ªg$óýæL¤¶kñÐW¾®ã¿òµìdC÷~­Ÿ2Ö÷sÿoiìù³ ë}Ù¼«X³97ŠóëøÌã,¹Oë×W®¬kB3ßü "‰²K®íØe -cmt»é!?PyOOq­§>ϸò Z"ã*n!â5öõå™>’0Ç8Û1G« üÙÇI†r­wõ–¯Ö6ºšj˲Îr½wÃÉ4Ϲ̳ͩ­‡×sZë¯éf÷Óªž¤ÀäxÿúöYžÞ°§ŸŒêt©#Ýÿ½œÃ•“ô,îžËaÉ(lÍÍî`Ÿ‡ŽðzÅäÍwyéDNïòGoÉ$ëÂP7xbÉÍl„Íæ€t–Â]Ýp,oIMûxíþ¸ÆæÉ\Da\ÿáë½]*§G‡°%Õþ>LÙÃvRÿ’F­R^`ÌòŠλ£©Ïñºów¶œ’J'F> }:+Ê qs¦7ú“õ€Ö¼žö]2XqÉ!µÙ÷SÏÙڽ׺qJ#€+Œ‚Xw˜ŠÚ<ëYd¢v+»¼ÎÞèøýL]¯ïZÖû€ÂoëÁ‘Ñ£§÷tpoò:±s(;þÝlrîš~®Ï(<ëÕé…KbHúÆ›°–1«H‡¬Jú#ݘïg=ê M˜³O[#™´×w¹¶i:e™_L5“kÑ­Ø FËQóL7=Kgö ,£Ð#¢š·Õv—–5­ÆßÉDûÚ©ùÊ”?žB90X—CãUH“6ô­2g”a–l“ÏtHqRÖéf:]”­Ï=ËwñüØ[Ñÿ ):±ŸNk.¦åµýÅè? HD€VsŒ˜¿JC2Ö¡_“_NôU*N £h7ÉD¬oUËé^ª6ÚA=NyÝSÕ·£ž¥hªjDh³¡þ¾u£#njl9äu¾±@DÏ ¯É4{5éJ¦¯£I“­W¡‹B©Ç€Ž·ŽŽ7ÉÚ*Fô×DÅn7ÈÆ5y4_ÞU±‹ÎU§™ù[[™9÷ˆ—nk×Ô‘J_‚цjÚ5ªÓ,*wªo-»A\·“@ºœâWª í`ÌÎgV££ÄgbjŽäz»ÜÚ ¤ËIlWGóÝR±·J£knš¢ W§r›va{>‘¾_‹­eÛÛ%™¶º­Ub~c®ˆ—BŒ»"¿œ|ZûÊ7×ãDËÆí䤆¿ *å8¿ÃÒl4:ˆ™þŸ¡Âw*!Oy£]w):L}\›ÐÚì䥒8=tÔq’´‹£-S—Ž±û,×—NJhO Û[w-¨LeŒs@ªƒÇ’¬»×u2AXÓOÇJNTMÜn}wå—yÈéûRõªß,hæî¾;È¡cç 'ÇnqM'ãwyû¸ÌçñR›[“ÉõS»É գݸ#Á -ƒ<`ô¥ÛjíèTŽ«oÇ"“"îåô·S sÆzCeg@R—Ç0ëó¿ÑæüþýäÎn'‹ÏqܨŽ¦cë‚Ì#}-X:H¦¯ kľlÑ8ûƒ¬Óhë›7ô8n Ãk7º«ì­¥îª;—ýÐ!#›îºF[¦¿C¼¬´Ø™µÍØó¥m“£šÎ¤oRá‚O—iðìÉg6$®¨ééà:Ã:â‚ŠKvÃ<$[ˆIÉoÒUOò;n -K÷b, K;xn„Y>t£•Y°&H-¿à;ÍošòB?¼¼>ÚîUäÐVQ;´wê §ö‰µžLµå2,/{̱¥Øl‹wh¨eÙÚ³=ÉKc¤nqÁ}”QÓèVx~S×h‹›¶@Ñá4Õh}ÄØd -µ[SK™qµ{N1¨ãšöÜ*]‰ž[%\µ¥q[ÄëÙ’í çîÇìÔhÙsÉ$ÐïÝ©n´´v}o·¼w‹¶g6 7 #3U£›¿jùþ=²væ>«©Uû)»#:ïâ@ v:ZcË׫ª0ÄÑ7dE—ØvÉÝ}ö÷O®wIÚþ ¿Ì19kUÔôE¹²/`äÛ 6Tû]¹[Vâ”îS€°=4`N]í•oJ,Ï=”M¢~©T¤/Fµ”ô&ú>·¨´üg~ÚF¹,¶OÊÏm -endstream -endobj -596 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 595 0 R -/Resources 4 0 R -/Annots [ 597 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -597 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 123.873057 101.433071 105.123057 ] -/BS << -/W 0 ->> -/Dest (cb124-1) ->> -endobj -598 0 obj -<< -/Filter /FlateDecode -/Length 4611 ->> -stream -xœí]Mܸ½÷¯ès€Õòûö bdƒ,`$‡ ‡ñØÞE0àÍ!?’H–¨’ÄîÛòf=O«Š¤Jäã«bI-Ê«ÀÏ7ÿ#‡¢wæúøáòñ"oþ%£úüz{•ÂøÁÊ肽~Hí­òîútÁÍ!-þtùûo.ÿ^Ö‘W5Ä蔴ןß%•ÑƒÞ ˨"TBjFeíིŽQ99àcäT0Ãz£ÌZåa†‰Ár*˜a” -Œ*À m¼ÔkU„ÊKé`†ŒÖ3*)`‡TB°:"ŒÑŠÑI;8tºãtJ.DY‡NzÅé´œ7ÒJNçœ œÎÀ…ät¶XiŒàt°Åèà9ƒ-ÚiÁê`‹ -^s:[z'2º[€®Àê`‹pBrº¨ƒ1¬.B'‚kv°AkÁé¤,°©YfÉyF§`‹6²:ØbµPœNÃNž°Ú‡ÀÌV•f·Zr: [”ò†ÕÁ >ÇÊÁáG˜ACâ%Ž”÷ƒ‰Êp$ ‚L0câ`¼× ¨hã¢çx@ ’h[¬qh [ f.«ƒ-:Ž ´‚-(ÀqÖ°EÍqÛ …ã º5"JŽ 4øÖé8.Ð \˜)8.Ð`\œá¸@ƒr¥Èqçjp'Ǥ‹éî9.Ð`]mâ¸@ƒvµ Žã ÞÕF -Ž xWkÔdu°æ¸ì8h4Ǽ«¥ðð.¦‘⸣:‡Žã`eP!Ž xWa8.0à]åáX05Ǽ«,.óÜà]e…â¸À€w•QŽãeÿ6ï‚B,À,Çð÷Ð)ÍqÂŽ ,xWF¸?fNƒ­¢ã¸À‚weÀð±º8Hgæ-zyÎEŽ ,xŽJs\`Á» ÏÀq8~€GUXð®ÔðÔœ¼+UXð.âËqà0HÀ¿ Rº¬."†Àqï‚–Çðƒ`VçIr\2âPŽ xî=r\àÀ»ÂjÍqï -ƒ°‡ÕÁLjk Ã´eæ4‚ÕA(0§ï -‰ætà]!|ä¸Àw“Ûä¸Àù$Pã8 -V¸`†è½ã¸ÀEB>Vç[Ž ¼€À‚²Xl1Þp\€Àzˆ:Ž ¼‚-Z)Ž ¼‚-8.@D0D‰è›]ÀÀ…]Ø‚H‘ã0Ù¢1xë°C¯r:§†àA׬.@'=ÇÞ›®Xr\€µÔ0é9.Á)\â¸f@' Ç>ÂLŽ àŠ† ™s: [ds\€H:)9. -¶ ä¸ ¨€U¦ÀCc-‰®ætF¤ufภ7¤P‘ãL¬4Á”¬¶€&8.Àø¤Å¶å¸‹,6±Ìau°E[ÃqA*-7Ç!À%ÇÀfZozŽ ¢€-ˆø8.ˆÂ )Læ¸4D°ÞT†ãÌË´Þ D-°ÞÄ™·Q»´ÞôD[,BV[4EfÞ‚“°Þ;q:[T4DçÒz3p\€0ëMDôlJ ¤õ¦gÓà]ÁLœ¼‹ÈÔq\€¬7Ùrk{âµñ¯ iÅØŒõZøV6e À½ðVžÍoZ#±I˜‰•eplÖnJ)Ø´ÿ"3+N˜²O4EåŸ|ºÈˆiaÝ—5G-¦7ŠMù±Ÿ¼|ûç{ýñ?—÷¿3eùG"@KÄW˜*b¸-¢o‰Ë× ÌÑ2vKÙtR«Q48'Ù’Qpwéßuýaa) ýayZ‰k^Ÿ7$gž„†µµ·Ò ­óùö`*¥Óc}o€Ö™€5ö˜À$&ßXå XÁ!$p(££JŠyàW˜Eáß½¾`6ÍVL‰Úr(µÍæƒø±b7Ê^_¸|ûçWûË÷?ë¯ß_þñ[ð,ÊK=ý -ýÝ72ó8ýµnú[äÙùs˜ÿš¹¬_Ês¹\×*^^ÊÃÛ´iÞ7møe[Y^¯á»^_¿ºüþuj©“ÜÜ;. -VñnÌ\a¦à@©_^ýáOü+é,1a[:g²+Ù_9É@(ädk²s*ƒkÏONf§XÄ*Í Ç¾[ì]ÑRFœ…«TÒc@ÚYç9(ýàLiÛtf´ô¨% -Ðû#$¦Ï+ùü»@LhŽ}‘¹Î›ªSŠ”›gÊXNÏõÞÎíG‚êwÍÍŒˆê¬Ù˜qí,²q{f¥ömæóú¦mŸËo «¾Œ ”ôÇE%ÿ¾º¾:'A]5ïêÎÊ<”{ÒÌ£dçžD÷~9‚ <é–L=¿l#é -§æ”UoÞ¬G~QçA–ÏÕ„¯UNKû‚çéÛYÛ(v<ì 5V®Ó &ªC¤öÕ9R•ØçGÝ ÇWÔdäÜaÖZ4‡®Bä-¼Fm£h°dÆt#Kòm}.¤¦»o·"µ³Îéª÷9U4ˆzC⼇†/Ý2}¹QÚ°£A{A:ñây¦ö™Ïk_™=¹·M11üdÓ*k¬¨°ªÊëÃø²³ÎéP¹_îÅi­'g½f[‡á³UŠÓ Åóu2 -n¬»ƒoúêœndb¸Ü“ÄK6½™æŽzœ¼ÛÖúuô|Íz4ÕÑi®aݧ´jÖ¸„ž}DöÕ9"¿Þûë§-»+ª ÄÅÛŸ-ê¬s6Äù¾oÅ´÷rØl}&èáþg%7ï½ë§0^(*xÞÓ/ð¨ôäþuo†¼³ÎéPy‡<+§í¬Âº}ƒwÿ$³¤áÊ-~ôô¾uçouN‡Äƒñ4œñ ŸwxqÇs™uN‡Òθ1÷ }CÄÆs>e«§z¹ÌIÇ·fVO:±ûÍš.ö=2¶6ÏtÊ·ÏGÝŠo?yn 8Þ¾ï¬s6‡ƒç}‚öëåë{»…ÆpG>³³ÎéÐxϼ•ŸñÆgáï,£wTånh—~«n÷{¾õÜãó©3G/žCm¿¹×y(ܤ‹giÄÑÉÎ:§Cì~¬Ú~¿–Ý/‚<ò.¬Õ÷2‰=÷ ï~4¡n‡]=qh ¹ÈnöÕ9¿|Ú~r…ŒxóK L‡m[W³ñæûÿˆ¬ñazù{ÆØ£ûæuΆÈØ™ßÜ{:"½CÕÏ¿Ìw"wcµö#“á.ºö ã­¸vãû3«™dë5¼Ä³=ñŽç ;ëœ5¿~7|Ì·H~±Й§Œ$çØ»Zé¬s:Äþš§\̬£¶¶PÙñ æ}hß@¨»ý}uN‡ÐƒïâÜÉí·GÇÕ„«»‘±Ò´1]n*÷®E¦‰Q±Hm.YÄ”qbDFøÈM fÑ“QKÛûLÂdJ¹˜Ë1¢Ç [nnÍ–‘ò¥T¨UcîùjJ…º¥ãÙØG³Ô§=oÉ:\Š]<Ö"ܨ•ðñcV⧋õLi[¹BØ =*Ô¤Ý"¢â¥JÓw¢¦O˜šY–6GIÿOTa‹41Ïø!íb sô¨ž$ÍÍ"^v•»Â:†ëi|-KºKz_0KûKÁ”O¤[J—[HI—¹Ù¼DR…<–bYPWĉÂrÿ®¤B‘ÀéªØ(?-ÄÕN[¦*ÀžOæ$»-íV±+ÜùDžŒ¸L»U{K»óYø8:6ÓŠôC>I+Q¼]=VÃ@ -U\iôiçÙZØ)íÀ›?ÖIÆyÜÇËO—ÑÍ)mUħeÚ|‘F^òú_”y…ß]Ìõû¼ÛÏäÇ•(l¡ -·.ÄÔ“¥­zC§8mÝ›…eÚ¡2„ö«X†ZÖf4?®ákS«‹J칤, *‹– -míC"VºJjÒ3vGøØôb dž;6ÕaO‡:_N£Ó>QÙ*ÐËÁa¨:]]ò•4‰£T´ºt™Þ®M*â€6ŠCrÂX-[˜™IORº>ÙoèPèt.r@ˆt¨«ÎT7K›Î²ñ*H„ÀšІ¤' {£ïž^Ï÷Ùd—g@’j/Ò'*-–¤…ðx©Ýò°ø}MyòÖ*mi2÷t rêÔ¨¡…YPŒi¨Õæ–žÔdÙâ¤ÙQº€LdYiÑg›Ü\-wËxÅí%_bŠ*ý‰ö´¥£R:ÑÒQq«²©ÝìñJ´¤Kd)œ}½:QK–X202Gk©©%u–­Ïm–çÎÞöJ.ÃTC\LE­fW%ïâ¿{æÎT§ÉDp¥òϘ‘¡îGm¤×J_c -w‚sà“v­õ&tÉÍuöó'ë,IΟÐ3a8£µðxÛ0á Šx¬ M=Í[ òÕ¢`/é¶`ÒC•æÄ*;4î^>æ0Ç$Q9ôi©hã¸Ç¬!í±ì¿]Úø"½HŸŒ?ÿ4Ói -endstream -endobj -599 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 598 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -600 0 obj -<< -/Filter /FlateDecode -/Length 4420 ->> -stream -xœí]Mܸ½÷¯èóÖ’¬âì!@ÄÈ1`$‡EvÛ³‹`À›Cþ~%ñCR©¥n×´»UEREòÕ«"[-é³Âß ÿë.„èŸ/NOªóVá__brЫ_áåíY+öÕÑ{þä;­ñîüx³öøãéßþ=­£Ï¦‹ÑmÏ¿¾O*¦Îï•T*¥IPYÛyo¬TNwèbŒ’ -fXφ—*38+©`U€Ä^ÓRa†ñš%ÌÐÑzA¥ìÐF)QC3A§mç0èNÒݹMu:í¤#êœgmµ¤‹sÎIÇ°ÅF¥%…-V3+I[˜‚—t¶#%ê`‹ ž$‡-£]€-@Wu°E9¥%]¤ÎÆÀ,ê"t*ø°Ôe;ˆ”¤Óº³À&‰:x&ÉyAg`‹S6Š:ØbIIG°…ñ'éÀ–|‚·šäݤHK: [Œñ,ê` &_bã`‹òN¢xP—xIâã}ÇÑ°D&PǃÄ&ÄŽ½'‰L´»è% ¥¡3Z"R°Å²“˜€4lax®¨ƒ-Yâ2°$. ‚-†IâÛ2Ð"qnYE-qoYi'qpa¦’¸€À¸K\@ \@)J\@à\wJ\@ ]¸»—¸€Àºd‘¸€@»ÄÁI\@à]b­$.`ð.jŠ:ØK\vìH’¸€Á»¤•—¸€Á»p##qfµÄÀJgBP0x×Å0x×x„Qç;ø I\Àà]cÑ)rƒwUFâï6Nâ¥ÿ(1ï‚B¬œÀ¬Äˆ÷Ð’¸ui‰Ä¼«#ŸàÓ`«N‡è$.°à]0}¢.vÚcÄ¿Å(wÚ¹(qï"P‘ļ ú €ã;DT#qïjB¤–tà]m¢’¸À‚w‘7X‰ ‡N#¸ñ­Ó -Ðu±S1‰ ,x´d$.@îT“ˆ:ßHZâq§‡J\àÀ»ïQâÞU–HâÞUŒ´GÔÁ -Fâä5ÐÁmŸF²Ú)¦tà]¥1Ã’¼«”8ðn -›8Ÿ&H\;dÁF⸋Þ;‰ \TÐ!åu®Ã±•¸À+,(KÔÁö,që.R x[ȉ ¼-H$.@FÐEì[\ÀÀE\0lA¦(q˜¬ ‘YâoÖcUIçL<èZÔè´—¸À{ÄXKuN/q¾Ké’Ä0:Íø[à* uÁ 3—t¶ É–¸™.tZK\ lA6(qA0«L§$.@„ÆZC-éX¥uf¸ °ëRª(qÜ+M0¥¨ƒ-  ‰ 0?i±m%.Àâ‹M,sDl!Ë„`Òr3H\l1ÊH\l¦õ¦—¸ *Ø‚ŒO₨\—Òd‰ @ãÐ)%qAÔëMÃÀ/Óz3H\Ia½‰%žà·‘\Zoz‰ "ËEÔÁ$MQð[pÖ›`'Iç`‹‰,qAt.­7ƒÄH3°ÞDF/n „´Þôâvx×F0“¤ï"3uàëMd¶ÒÚ^x­G~&+CZqqÇ@z-b«¸e À½ˆV^Ü3P ß´F7 `&V–Á‰»«Pj%n(ð/ò1^p°ûÔnQ9ÀÁ#fŸ:áŒì¾¬9j1Z)6ìýúóéû7¾çŸÿszø®ß)Ë B_š‘_Á LÄt[dßÝ'‡ÔæDRÉBxOd„ÕH Z7Ý’‘éßyùab9 ÕŸžÊé#¢øpz·ÑXBÈË×¹Å7VyBƒGˆ¶e(šÄN€òJœ¿}PG+†=Ðrؘx‰Å0{~ýáôý_^þý¯?¾Œ^?œ~úùáe~x¡ñ™ýø†w¨%ŸskÇwß”eÌ£B~SÛÁ:T‰Í^YnñBy‡wEµí¾}7=çÜ–|Þöœ©Ïõc;ü¾–ëmõÕÎ"÷³:¹¿N°/—}뺬ÿáŸç×/Ox=TŸeö€â”” }0vƒûª| -?ô°d½½2´aZ Hðe:¼Xá?èm$y)Ÿë7:²Ùž·K›&uøôÐ5uÊ}‰+m­Af«­ËÔÅú1‚=6LûXÝ@†`ÚiϤ†d&*¬ôiƒ;ë „Xí\EaFMÑrÓŒ6虣x?Y4dkg¶´HzBh—çä9+è¤JwHqèÛBç¾:‡C'_åÈãòÊzÎ ½jæ%Üç÷¹g…ñe‡×DŽyÆ2»O-Š<‡p{Mº—¶DBè—÷×±·¯Îá°w=5ìÇ-ß»q,ßÖ14¦Ϝν›}žû&žÜlžu“òÍ°PêAÆZϦJ`*!UÌuæLÝ3è¼ý·cÛqiKî[9¯FÏËöv4¾·¯ÃŒ¸¯ÎáP¹‘5f†»LgïSbÚ5d.àk½[P°™=Wó†9«ªÙx4(Ÿ×ávÑ6[صºÞ¦EŒQ·óäÎ:GC¤¹žA–Q~Ûd:y–šÌhÁ]Ͳ³çÊfi¼˜}Ú9ûWfX\º·™ÛÌkæ9iPXÚ -S»ÊÓ¾ò¬þ|œò{“¼5 Ç±ißùZ75ܽÂÙYçpø¼žC.æb; .3®¬4¶¶‹Jy¾Ûù½K.[ÖúXkíÙÜ¿XaÎ6[LHà˜vš¯#s_Ã!óz†ù9bù‘wvžE,c¶æ’û1»¯Îá0{=ÿ\xÿ<ï›mVKó²Å’“Œ@«0+0“V·O`ŸÛ÷fÄÎÿk—`…I©æ“mgûïf6P¹³ÎÑPI»˜³Ù.3×|Í1ÙWÿ¶÷.3ôM㸂Jº+wÖ9*¯gžóŒò–}ò¯‹¿îðÐ'ÝÓ_Aj“U¦ŸPÀ¥Ü&R÷Õ9R72Ñß_­xäÊþû—õÄ„69äÞë5vÖ9B7ö=ïÙ£¼‡w¾e‚§ÉèduûJ~g£¡“?SþùL3ƒ'õ¸/é¹É/÷Fúu‡ÔœôYòÏ×éÙÞ~EÒÎ:‡CèF.z'ïÜ|}Ç·H¿?Ò·{™;¿íÜYçp輞‡Þ½îý -#ý=WT}îHoÕíkúuŽ†T»‘“>Kþy";p¤·tûš~gÃ!tg.Ú^ 4û±Bæ‰2Cãì¶ßÄÛq¾EõÛ¢º½ã›øu‡Äœók\¿ïú<ܾVßYçp¨ÜØó|–\óDÞ´3‚·×ŠLø¦Aõ•kMæW•';òxåñQ`:ÃÓþ•zjZž“­—ÁsµMs›¼ï\¤t¿ùÑ&ÊãîÒ9&DZ~·lÇQºcºá÷²5ök§~¬®Ø2X³CÕ¾LÆ#Í‘üI°-ÝøÝ)6. -mø­mNñXÇ:3¥÷KÆÁh“ÍQbøœûšìa_ËöýOçq£íq|wr?z\å2O”|b8ßGŒår4³£^í¿­öåÜbeìi>>}[ï‡ú9Z¦¶‡_öeÏÛô»÷GÕØ‘ûœñä‡÷ú‹ÅÁþþ<¹^ñ?y¬ÙŒ5ŒCñG=ÿÖ_çs›ÏÛã;õãÍÕ1²‹1j9%Ûªïe\dü—Ï¿îëó>åñìû£Gû3ŽÇw=âÈıýlG²émµµ·?cìá÷Nç/g+ãäã´àç¡Í$ïsåæö}×9B§ÛIN7ÙÀÆ‘3 ,¾o/é-Z³6ÝÞ7Xš»U–üd³ÈF:²¼·e¾Cä9ýÍóÚA4™ž+CጵGŸnÅ*ÅäćæýÀ[zœSãn¢_ÉOJìÎq:Ïeà ÅGG?ÏsŸÞÉU¿HXKrS8¼Á‚kãgõ3ófœ’KÅå¤ý+‘n)]Fl"m†¬‘û˜ÍK$UÈc*ÖuEœ(,OáÊV¨²8]Ûålj¸Úi‹«ìùdN7p·¥Ý*v…;[±/3®Óýó‹½¥ÝóYxéÏÅ ú!Ÿ¤Š*Ñ®ž¬VÃ@ -U\iô±go-ìÔß²müXLŠ¸—Ó/§>̲&âƒ#Óf^úü_”y‰×¿N|þ1ß|ˆãF¶0…['â6’¥‡‡…âô0±,,nÓ 7´_Å:Ô²6£¡Äqc¾æZ]UbÏ%uaP]´­ÐÖ1lĦ@×hjFÆ^^f£X™O›°‡CÊÃi(ݹ>[…ƒ¶;8 UG5$Ÿ›&q”ŠÖ-›¦"ÚFqØœ0VË&f&@¶')CŸìçv*(«9hÒˆtHUÇ5̶MgYß‹¦R`jÚ†Y·'{£ïv¯Ož÷Ñd—= I µéc+-KÒBx²”úC7=,1‡Îé ;o¡Ò5¾G%É©®QS ž´m¤¡V Øö¤œe““æ@Qè2•e¥EŸmrcµ<,}ƒ8J¾äUúK;Ò¶•2ˆ¶·(›ÚͯdKT ÛÂÙ×Þ©Z²ä’A¹¶v‘r-IY¶<7OÏ£í¹éWC\ÍLU­f%ïâ¿{|g¨3Û‰Jå¿~wD‡úÄjÖž õaUÁ9p§çhyÍvÉÍu®ïŸ,wIòþI{&LGÇDÊëô8]Ù„G(ⶢi*?jW®•Ø¥Û@ت4§»Cýóûï´úM¢r˜fbÒãS)%½!=õÍ+-…“.UçÉöIÿ÷?´rx -endstream -endobj -601 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 600 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -602 0 obj -<< -/Filter /FlateDecode -/Length 4762 ->> -stream -xœÝ]KäÆ‘¾×¯¨³Ñùˆ|‚ ¬Ö‹0X fzÔŒ–iþûþ‚Å|0|TMÍ åiôt1"ÁÌ/¿ˆ ²H}UøùFã¿Hzˆ1O×—Ÿ/¿\Ԝ¿±Äì`Tÿ€ßà®ZQœN>ºëÏ,°aÉ™à¯oü׶Åß.þÝåó:új†”¼Ñîúë¬";„‚r‚*A¥´TÎ !ç•×N1%I3\ CKU€”¢“T0ƒŒ‰‚* KAÛ¥*Á 4I*˜¡“ ‚J+Ø¡R¢†("kvƒÇ {Igôàc2IÔèt0’ÎÚÁÒNKº4xï]”t[\RZÒ9Øâ4‘’t°…l ’ÎÃë­u°ÅÄ`%]€-£“]„-@Wu°Ey¥%]²ƒK‘HÔ%èT q©3Ê .Z«$Öƒ6­¨ÃŠÂ$ù è lñÊ%Q[œUFÒYØBø‘tà gCŒÂj5¼º­²ZÒ9ØbL Q[0ù[Tð` ÌK˜J†$0Ñ)J,`b(+Ñ€In Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!¬\Q[l"‰ ¬-( qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ],÷ qëZçÄ´k)z‰ ,x×’Vx×ZÔu°–¸ì8X­ÄÞµZ‰ ¼‹ed$.À¬À¡—¸XLŒJâHâïš ê€5h%. ð®q8ÉsƒwSFâï2^âeÿ(1ï‚BœÀ¬Äð÷Ð+q ‰ xW'¸?aMƒ­“—¸ÀwuÄô‰º4è€Ö-FyÐÞ'‰ xŽÊJ\àÀ» Ï(q8~€G58ð®¶ðÔ’¼«MR8ð.â'qà0hÀ¿ Zº¢. *Å(qï‚–ŒÄðƒŠ`QIK\2âP‰ µ)*8øÌø$–!º/{ŽZÌ®»åÇ~ýÛå÷ïá|¯ûÿËëïÆLYþÑ¿%ÏkÇKÄ$L7èj›#l0kö?l ì{  -›R5Qƒ§”›G g›®åƒž {ÙbPfAc¢¬-½·ÊÓ-Õ˜$xaDnm¿X‰’{…w­³üïºü°c$öåB¿Ë8vp¢±G+=Ùh›ûGÀMwÏûV8mlí®`khÙ£6&ßYåPØ#Âò(e“ašÁ^BѬ𼻀œ¦îoyïr¨­ËvÃÆب뻟/¿ÿïïÿïþôº}÷zùË·p[F!ÂÿîÏôrûëôMîìtìñ÷¯×wßoôöU‰·&óþ¸ 55ƒVÅ©«4É·›56}q–ͺ×ïv*ÃãñnÞû›vªcÑcקPÞ£ÿ…¸? òå– Tïoó?b ŸsjVdœ¯6ÌDÅNèV¤êê˜éoœ×å¾ÕÊjÎr¦äR?t:;_ݽåX/ëZsCX>>õ8Èö1ã1…aŒÇì„U9 ‚«Õ ° ?!Çn¼$·Îp…½Â½œ»õ2c8öP41[­Y²a§ãbÐ]‡[ìf(¦ÂÞhŠD;Ð8Xç$Ø(ìf¼ÝĆëVÞ -N4F_c†ôûÛç…|ú-rêÊñqà™ê|¨:cšrvúý8ý¥é3·ßzà/ }[Y¯´™ûíÙ¬0Ý -êñ­8)¿çSÖ9 êªÙ1n¢ÎÎÑF¯ó‘¤ì;^¦‘Oîu>ƒ žq«ÒùŒÜƸ]ÉÉ3¨«ž>,g~VçÇYnêë0îRËH‡ŠšŒ¼‘;h‰ ÅLKèz"ïáµÖ¶ ®Y1‡‘¥å¶¾R­¡»‘z°Îéj·9UuˆúP?óÎøÒß¼ëógiÅŽíéÏ+m´¾¬}eõäv>vãE52™Û´‚Ê+ãe‚Ý/Ö9*·ãË­8­÷ä¢×ìë|¶(Ó¢€:¤¹NÙ­f\›Ùðß«sº™Ý‰áòH¾4^²M^;æež_XÌžnfiB×±¼Ö^›LØ£õ?4»š.'ÑÖískÜSPÛñ‹{¿‚ÜÌ)1lËÏ¡¦É—”s‚2Nk4F|3ò½‡{8=Vçl8¥íná;ÚlÈoç¹_äŸ|Å@ï{úHÒ#}T¶êϺ]ê_×ff¨þšõGÍÚ)mw~oQŸ62ëQ1):–/9XçthÚŽ²¶üÙŒ‘z”ôˆÒÍŒ¶¾­Ÿõ×y;ã1³Xjv¹- -^çmô¬·ØH1|n«C43êÚ>d/ZkWLYi=K~öZ/sÛÆ‹+þ™Ú,ÝQ¤«s:¤îdö:NëÑ6&ÝôvžmÎÓþfÅxa¦…ËÄψÂÆØÛÞ*ý]ر¶ nméQåš¾Úͯ ±úøfÒ8Þ¸ÄcuN‡ÄHñ+ç: -t^y¦Ëõòªé²v‹sÈ}¾C^ÕnØ]•¹Yyjd²£2ªWû@öï`³!×mÇŽgÎàm¡ú“QÕœKä‚Û8”æãÔ£QòeßÕ]¡YädxWcN -qЖøŸmä¬s:äîdm‡Žv§ÙxéÖÓîE·+¶Ý,õž¼¿ª±ÃÑ…]ög}û¹ý‹x±ÉBÌÚڸʲ‰àõMvã‘xÔÑý\z°Îé¹vy‘2z­÷ZÛ¡4ÕŽúÌó½ÿ_‘é·ÈfšÏŒÔ&öÔfH*µw»ÌÁ:§Cêv¼zi£‡üØð`ËkküÒ]™¦ üxLwn”¯G-+¨lr’É nÜœï¡òX³¡ÒïÄ¢{(ºw6ž÷AõÊ®è·r™ÞÜϗ뜙;±æ3w.P~×îæÙˆnÐ1Þ©s¯ ´Æ’‡wD뜥Çîtüì{ïÏàu ÷žs|öõ#îß—¬s:nÇ–ã$ù>Z)«ÝÞïê§rÒŒ {øÝ=s“…YËoæΙ÷E¿Þϱ äÐòiô¹ÚµŒor‘‡=ó±:gC[؉¹×dT΃=—£¿\œ,#4˜ûï?Xçt}üzú!>¹7ÃýDþù÷\+ˆmbB~DÊø%ç=Ä«s:ÄîÜÑx/ò¾À7UîÚå|©×ŬϾ¾šøЙA9òŒžmD«s:Dþv¯¯Ÿvµlî¨V—î¿·è`³!.ûVL-Ğ´÷½ü^ÉÕëGÔò.Œ'EŸvwų#•±¹~}4C~°ÎéP¹“‡<+§mìÂ!ûïþYVIÇ•küÛëÖïx;XçtH܉OÃÿæ«â/¸/ó`Ó¡ô`ܘGðÀSË£›Ñ—pYû-OrõS;1OñÔû®ÏwNO‚µï¦¾{hz®b9—Ïa1•¿\üøŠ=¾æGù8hÃï¼z,ÏMºòk%¢²¤óÔéq°õu¥æøöÄ_J)þ"ÅïXâ÷kŒSÛLå'ýç‹N4ðøóʽ½üLâhòA¿]øåw$ˆ ó ˜…ÓGUÚ" ÙËe| z_ÒºAMSiœÄxûh\>®ïr5~)©\ÈŽå¿u,QÓ류Ï^ zó ã`§#_Lá‡VamÚ²µÁZqW¬­j„n)TMwUl(Û£ù…3eè|ÓÛ¡ÓÍôç²&4Ó¹%|¹ [ÛKßD)¿¶,7•Gר"³Q©H].Y&„Ê< ¢—‹ üFå¦ “YôͬñË_n˜D¥\ÊåÑËE,7µæÊL…R*Öª)|5¥BÝÆ2ð‚l£Iø¨ÍQ6œ‹=Ï@žkܘ…ðåC ñÛÅ¡´«\¡\†^+´M»EUÅK•ò½©·OXšYƯÎàÿoTኔ™gü ©@Š_Sj'¼6‹x>H­ÜÖ!i4…Z¶.BÁl;^:*¡<“n)]Fl&m†¬‘‡”Íc’*ä1낺"f -ËãS¸²ªlº«bW ü6W;]YªN•Î¼nàîJ»Uì w¾µâPf\󻌊½¥ÝóYø2:6êÅ ý˜;©b£Š·«5ÂjH¡Š+¾â¼Z ;ñûYóǺÈ$ûrùé2º9„ù†_Oá­æW󵑗¾þe¾Çïß/týS~ÌÍUØÂn‰[OÆqŽÅüb×,,˦jh¿Šu¬e]FCñãÆ4|MµºªÄžKê ºh[¡«c؈M®Ñ¶·!|éF±2Ÿ:7Õaßm>9~ÿE([…ƒötp«ÎV—|mšÄ­.Z2ME´â°é0UËff2 ÛNÊгýÔN…徚ƒ&ŒàC[uTÝlÛt–gÑAlÛƒ¶aÒm§if`ôÃËë“ç}2ÙçÀÒBíEúÖJˉ±´ž,µã¡ŸŸcÇ×RäÅ[G¨´e›µgKS—F -hvÐb´‘ÆZm*àÚN)ËffGQè2•e¥ÅmòSµ<,ãGq”B‰)ªô§v¤];+e];+~Q–ÛͯDK¶@®…s¨g§jÉKFAæÛÚEJµ¤Í²eß4ï;{ÛksT ñ52Uµš[”|ˆÿY;·:]&B*•Æ숎õíipÔ¤ƒ5öÊoúQÑ{pñ;MÅ&]rwíüÉ2K’ó'mO˜Ž¬UAo+&¼A‘öMSoÓ‹çäjI‰§tßé¡Jsj‘ßm=æÇ$Q9 ¼UäWÙ[z#¿7(-¦‹Æ/d¹YúdüùJk -endstream -endobj -603 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 602 0 R -/Resources 4 0 R -/Annots [ 604 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -604 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb127-1) ->> -endobj -605 0 obj -<< -/Filter /FlateDecode -/Length 4327 ->> -stream -xœí]Kܸ¾÷¯ès€ÕòQ|Á$AŒlŒää0î]ï"ðæ¿Ÿ’H–¤RKÝ3ãhl{0žVIɯ¾*²õÐg…Ÿo4þ‹¤»Sðt¾|8}<©.8…}‰ÉA¯þ¿Áµ¢Ð9|tçY`C’3ÁŸOøovÈ‹?žþþ›Ó¿§uôÙt)y£Ýùן²ŠlbÊ ª•ÒVP9×…`œT^wèbJ’ -f¸@†–ª3(E'©`U„–‚¶KU‚&h’T0C'•V°C¥D QDÖ:í:A÷’ÎèÎÇd’¨ Ðé`$µ¤–t©óÞ»(鶸¤´¤s°Åi"%é` Ù$‡-Ö[%ê`‹‰ÁJº[ F' º[€®(ê`‹òJKºd;—"‘¨KЩâRg”ë\´VI:­;lZQÂ$ù è lñÊ%Q[œUFÒYØBø‘tà gCŒ‚·šìÝVY-él1&¨ƒ-˜|‰Œ‡-*x‰àA]æ%‰L%C ˜h;Š%01u‚•hÀ$בOAâ«4tFKD`lqä%&°¶F NvŸø•bf ¹“ nAÈî뚣³+ņý±_>}û€à{þù?§÷¿éwÊÊF‚З&äWp“0ÝÙ·F÷­Iõ9“T¶ÞS'R3RƒÇM·l$Â_þw^~˜XÃèOoëé¢øpz8qRÈp¬ˆåëÜâ«<£Á -‹#D[26™ÌN€òJE“¿{{PG+†=ÐzÈÌG¼Äb˜Œ;¿ýpúöÏoþö—ïŒÞ¾?ýã·JÑOJ¹øÝ7:vãßñØÇN3Y˜•ñÃ_ËÌtŠ$ËÙûi;¹^iÃåò¼=?«3;çÂÇê–:f,SÚ¢i›ÊŽuÔð[Ú^ŒA¶í2k+¶ºµ]?ý[Î_m׬ïjÿz®K–}÷ÏóÛ7§ß¿‚°ÏLæÍNdÌ™×®âv_•§àö%àŠeî5¸òix?“§ÐŒSE3HV¾ÔgºR®Öãð{'@Œ×aS¨Ý¨»#©­0íSu«­¶Ö ©—Ðz¨ËðÌ;÷lHŠ¦H´ÏuŽP¬ž®"ôN"¨³QFþaDá…!òa4¾DÏXA¢m´——´X7älì:÷Õ9é*W‹7žÎóf‹ˆÌ‡ê1hÚýÒ!¯ØÆÏ–ý5c¹ôÂéîàÈ}u‡ÌëIgÏ}%1 K¤”Y®œé¦Ù=û~œaþ[䙆YÏ×f¾œsnKåù‡Êçú‚îU,YÎv.’k?›lï¾5^\C_K)o…áŒÛBß¾:‡CßF¹æÓ<-ÿâ¢é>®›g!kKÇ5uûú{g£¡ÐìË ×Õ¾eFzæ(ÞÏŒoÝÌŽp§_oº‚ΖRˆÒÂàý:÷Õ9:Ÿ;þ_yå=g%Ï­õÌìïܳâøë†ß‰<9e‰â2öX¦·wݲ³Îá°w=;ìÇ-ßãX¾kch Ï’Ñý8û<÷M<ÍWèle>ÇBe¨÷2Öz6US Ùb©3gêžAçí¿ÛNK[ê:J-ûV}dV¶·ƒùÞj¼Žw0â¾:‡CåFÖXî2½§Ä´kÈ\ ´z· `/ -{®æ sVU³ñ`(Ÿ×!¾n›­í¸®·iccÕí<¹³ÎÑi¯gu”ß±Lg¶§ÒëæÜÅVžudü]̾Ý9ûWfX\½óÌmæ5óœÀ0Ö¶âÔ®‡Ò´¯4«?§ò·ŽIÙ˜ïéA¿Ç-ÛKÜ»ÂÙYçpø¼žC.æb;×¾š“V[;Fµ‹<ß|~oÆ’„KÎZŸkÜžÍý‹æäÙbF%³õâÎ:‡CæÆ—Þ/˼³ó*2`³ìKìݘÝWçp˜½ž.¼ÿžoQ6XRüÆÄ Ìt哧Øwëw /¾K°Â¤ÔòIJ®sý×2¨ÜYçh¨¤]ÌÙl×™[»ÜåëÞ»ÌÐ7ã -*íí\¹³ÎáPy=óœg”·ì“^üu‡‡>ëžþ -RYV¹÷j¶u‡ÔLô‹à«ܸÎäÓxâ -BY¹÷Zu‡Ð}Ï{ö(ïᯙÁîkÜœº}%¿³ÎÑÐé^(ÿ|¥™Á³zÜ'ˆôÎÞ~ÝúÎ:‡CêFNú*ùçóôîž;‚^þ– Aèý·]㛯ïøé÷GúxûÕì;ë×óл׽Ÿa¤¿çŠª—Žô^ݾ¦ßYçhHõ9é«äŸgò°Gzoo_Óï¬s8„îÌEùµ@³û -OðûÕz¾bßÄ»q¾FõÛ¢º¿ã›øu‡Äœós\¿¿„w}Š~Ç=æ;ë•{ž¯’kžÉ›vFp~­È‰ ÕW®5™_Vóào9Ãß½ï¬s4”†ë?ç÷)ÌV -óëÎLá ’´zýÛ3^ÄmQ?â÷ýþÍ<èuwŽC)¿S>^^w¸‚PvGÐn„î«s8„Þ¸çÉ8GÂo­!ñÚzy/½æsžå,®­_‰êáŽïÚwÖ9÷åšÏr•£~:×®µ_»n~ru^FÑxïÙj;ó>Iù¢p­ý=1bëž¹U®Œwpå¾:‡Cçλҩ엷^¾±­'­W´uÇýE;ë ‘q#¿œÍDÕ+Ùý]våé·äƒüª¹›Ÿ¾tø;àWÐzÇžæÎ:‡CëÆ믕Ӟò$¦Ù -o≟ԃVÐÙòHM˜ídƒS[èÜWçpèÜ™{®dïÒM¥•\ló^¶2'õ‘®¹/©ë×Þ¥/õ#ØYòù}) R¯­6±ïË›?üéߟŸ÷%Y.\?÷\Ûj¦6·Ø‘mʺ=´ôu8^ÈDzËø0´5 :ó <{ ½…ÓËží2wåù½³Ãù{ûœšîr©ÑŽÚæà »†Úò¡î‘ri½ëG÷”L±²;>ûƒ\÷ 1KY=§Úhçò”Û¾Œ–ûÑd?±5„Î'›ßz4ÚjÇYty„ã8Šý“–íx› ž_;³l§ïC]ß÷¹`÷‡ñÙÃÁ¡!çò³ß£Ó‘=ʸ’Èf‘ ÎX>ø¸<>øœæ¤Ðú†&óKÇl<#¡"tÏ:Ñqòp™Ÿ²s”…>£»Sný8 ‰9XË”aÖ# ß±ésP‹sä¿vt‚<9ÉrS‡–M™çàmð2ãt^XpçëÛwã¹™=ÅkÊmci1•O¾æ¼îß;¢|ì´É/&;{êlž›tÎϹʒ.S§ûÁÖç•šýëÜ>ÖRãÞT~éK~àÿðú7v0–ÿØOúx*u¾øfÿ6&Õ‹£)MüxÊoã"ALÔ|Cœ…ãGUÛB´33Ù‘1ti^Òºò´lF*Ö•Æ•Þäú®TËOI'U -Ùþ9áÉ!jz½çÞ«NâüF³ØÙñÈWSœ/6CØ$^¶5Ø*nŠµULè–BÅN×ĆŠ=:¿£oÂj::ͦ¿”5Mç5áå„ÓÚ¹ôQ”æ÷(•¦ÊèUe–•ªÔ•’uB¨Î“ ºœá7ª4M˜Ìªg³–ßF1cÕr©”D—“XnlÍÕ™ -µTlUSùfJƒºuàÙ…Þ_ÑÈ|DÙòq*öyÊ\«ÈpcÂË !†âÇ“ Bi׸B¹=.´¬Ý*Žªá¥IóÃt†OpÍ"ËÏòÏÿTáª43OÿAS…T~G;j'ɾYÅÓAâr_Y‡¤ÐZY6\:„ŠY>^Xû å3éÖÒuÄ&R6dLR1/“T%©XWÔUq¦°2>•+¹P#pº&vÊq³ÓUWØËɼfpwµÝ&ö•;¹8Ô×ùå*ÕÞÚ.Ã|^úÀFsq†~,'ib£j´k'cÂfH¡‰>öââ­•ú§qŽ›“I÷rúåÔ‡9cIøà­Îï -ã™—>ÿeÞà÷_':_^N1Äq£*[˜Ê­1dùÍ’q§8¿i²«Û0¡!FûM¬c+ë -j7†ñ5µêª{)©+ƒêªåB×ƉM…®Ñ–Œ»"¼ÌF±&2O›°‡C[:‡ÓØüZ“bxwp›Î¶|fMâ(m!Z2¬"x£8d'LͲ‰™ü$uè³ýħÂæs±–FäCÛtÔÂ,oºÈú^°"H-?à “æ'M{£ïv¯'Ïûh²/¥•Ú«ô‘KkDz´ž,µý¡ŸÖ˜cÏù 8o¡Ú–e¾gk’Ó\£¥49àeÒت?)Ùä¤%PTº€LYm1›üX­ Kßã(ŽR¨9E“þÂGÚñY©ƒèø¬øEÙÜn‰x5[²5rΡõNµ’5—Œ‚ÌóÚUJ­¤-²å¹izîmϬÔ ñ-3U­š[”¼‹ÿîñ¡Îl'B*U~úÝÛ뜨Iklÿ†n½‡P~Éb È¶Kn®s}ÿd¹KRöOø™0Y«‚ÎïZ—Mx„"m+XSå=ìrµ¤Ä.Ý6ÂöP£9µØê_¶Ûo<÷›Dõ0ä¥b~·¶ÍIo̯ JËû¬ùzÒéNXÿó?u ½˜ -endstream -endobj -606 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 605 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -607 0 obj -<< -/Filter /FlateDecode -/Length 4832 ->> -stream -xœÝ]Mä8r½ç¯Èó£å÷°˜ƒ{áÁîÂ4ìƒáCuõô.Œšf}ðß÷ J$CT¤¤Ì®nçLª3Á ùøA©(}UøùNã¿äô”RŽÁ]_¾ürQSô -ÿJŠÕEQÿˆßè¯Z¹8yCòןI`ã³71\ß.øo¸äÉß.ÿñ»Ëß×yôÕL9£ýõ?‘ÊÙ)¦•T*¥­ ò~ŠÑø ¨‚žÐÄœ%ÌðÑ·UE˜árò’ -f8c’ J0ú¨íV•a†‰ÚI*˜¡³‚J+Ø¡R¢†(ç¬tÚO$ÑSHÙdQ¡ÓÑH:k§öZÒå)„à“¤s°Åg¥%‡-^;§$lq6EI`‹ V‰:ØbR´’.ƒÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…A -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ³ÕÐì¶ÊjIça‹1щ:Ø‚Á—ÀØ¢b(3h"^’8ÀÄ8¹lœD&ÙÉ%—$0)O.F+Ñ€É~r!G‰¬ÒÐ-U°Å» 1Õ°ÅaæŠ:Øb³“¸ÀØ‚X [Œ³X°­Z$.° [§²–¸À‚oÒAâ Â…™Jâ Ƶ)8‰ ,(PÊXp®wJ\`Aº˜îQâ Öµ>‰ ,h׺$.°à]ë´’¸Àw­ENQ[`‰ ÀŽ“ÕÉJ\àÀ»V«(qïb‰ 0ªp$.V&“’’¸ÀwMRNâÞ5K€¨‹æ •¸ÀwG¤•¼k¼28ð®q&H\ Là%zà]Pˆ—ÝØ‚•¸ë=tÆJ\€Â&·DâÞÕËŸ0§ÁV“N9H\àÁ»:aøD]žtD ó½<é²Ä¼‹…ÊJ\àÁ» Ï$q8~Šj$.ðà]m±RK:ð®6YI\àÁ»ð¼Ä€Ã¤áH\€õmÒ -ÐuyR9%‰ Â?“•‰"Î$î(P¯ÇÚ*n(p/V«(î(/ÅHâ¦ÌDd™‚¸k€eJ­Ämþ…?æ6œ0ï>ñ-ª8D¬™)R#3¦…ƒwßbŽžÌÞH6ïý㯗߿`ñ½þõ.ŸWvÊêø­ XÃ;Ä<0ã ¾šJy&œmC YÉCFÄÜÔ ÅeÓŒÄRŒå6_Û½6“ÍÎLi™[Õ‹PAc¬lm½;ÏûÛ -?+1¼7^/f£häAâCë,ý»n¿ ÷X¨7äpÆʼnƞÍôŽFoýO.`îy×8\6A_<Œ úáçËïø—ýã¿ýˆÑúðùòŸ ¥\RŠvkèÓQ¹Wü:È–ï1»ÇŒÒŸ¾ÿ¯ë‡x=´É"Ƽ®‡Š†ã¬ +’Š#Y)öã\]Iƒª,}¾.ú°˜›|îß‹ÎÎæ¸ØÓ’¬˜ÓóòäfP¾–æs·ƒöoK}n®®‹žÒ-×$/z½”ÿ±Û§Í¦{Ø0ä±{JQ?ÍÙu­E»—¥H=›^ªeͦ”ѪfÔ&§¥;âüYÊCù>Íæ—zj>»tÉ®ÖTwEš»AÙuŽÃØlZlX ›îö»´×MôuÝO­q€Ç 8Õ¶’ÍÅÞ—:´­]im«^ÚF¥ŸÇþ©°b}Y®ÃR7Ål`cAvµŒ“_Æg¿OìØ'4eJÙÌöÒGî™õM­:†¯ÝÖÒ_¡÷q¹Ž=﩯¿v?·Ý¾ó<åÅN3—µj×2'nQ„_ì_åq;X¬}Yi¥ŽOï:´ºkž:†ËœÒz·­ˆ¶8ñWÿçe³mÉ…ƒhlYÅh ñŸñpÍÒD"8c+ß½yò%–…-BŽöN6 -j੪Œ u³ú¹ZëÜ5íR[ßìE¬é°FUÃ?ýðïù3[ eúï¿Ó“×ù³,|…‚—ë€ÏynV^eÚÞ*œWŹœû´Ô•ù~¹Æf¸ð¸ˆB¹þó÷¹7Ñžp·¬:È，”Ÿ-_{ni•?Qf¹Ýê|°;=5Âò}¨c&V¹0سä‰q-;Ñ~„÷´÷Aqà½OwÐyˆ…ë}G£¾BTøn½ï®˜œ·}œúÌFc·.JsMoz¤ðm‚‹‚è’’Ïè?®ýºJöÕ hnkऺuOéžZ¦Ýë¡Ò2Ûo!ÜùJj`ÔTXíˆÏåù’àkð¡E”¼Ã‡ê…/ñ;³i™q.ÜžM·|z³|ÖòŠ;Àò}Ò™-Ô¯^>‡Ù_å³ º|ƒÎ®ÛÔÚ8¶YoóZ3£Q1[¾¬ÏdT¢žŠ0C»Ì„ }€Ê“yž•ÝlëöPù›DÔyö´Ñï±gcƸ¸Ñ54à칸£…5åðÃ` rö)ê¡Â=ætJW¼y&x‡É¹ŒžÌó$mÌIOì`´Íôk#Nt þ_æïùòÛänHG×Å©_ò|ì:cX:»ü~Z>ÝòÊç«û·òµþÐY²•YëCÙmß@ AôÌEÛãû¨;—çIP×Ívjuv¶ÊxãZC[¥çù:ôy=‚ž¥õ(Ô2æÝ°EVGP3Vþ¸ùUžŸ²Úö×Y$ÜÙÖ¶µÈÔ:ÏãˆÜ®*îe©¾s%d¸l‘z.ÏÓ!5ìó£;j*òæ½Ø-‚6#-¡ëy¯qÛ8<›1§‘¥å²¾Rc¸©çò<Ró>§ªQ™ú2ðe˜W×÷¥v hoH<ÚbŸû¶öµÙSËù4ô—ëžÉÚ&•¾ûŠ ¸2Ñú—'ó<*ý¾¹ç§+¹¸jŽy>Û¤á(pR¢œ§" qà­‘5÷óÍÉ\íÉW¶J½Is‡î–òw3zšÒ‚ÊCwZéVPÛe{4ÿGÕ„5ÒxÞÆ iß×j¨£ô—È­œ²ãÃr~®o½ mM‚2N»7æèi›DÉáô\ž§Ãé¾·Y;ønÈâo×±ßìÌ„Žqí=A—·½²›ëÙ¥žYëøÎ̸7ÇçŸcs§}Ú¡}Ÿf¯¯>°Aó˜”;·_r2ÏÓ¡ißËÚ[ÏVŒ4¢dD”f#Ê׶qÔ?¯Ë)be±Ì¢\Ž‚Ïë2FÖÛÄ’_ËMŒz+9òÖøŒi3mdÉOB¬õº¶­Üé¼±>¾Kw©'ó<RÃÁÎÞÀi#Úʦ›ÞOC£Mû´†~—Q1Aiá^ô{xaÅ÷¶3B¥Ï·¢`nˈ*Ïêz(š¿DîõÑ_=$sxädž§Câ§øÿ¼×ÑxdX•Wºš¯Îša×nÓ†Zçë9ä÷d6ˆÑuëÞÐÀËgwGeTß@î»'ó<r÷}ÇgÞÁÛCõ£ŠµeDòÁÜuë~Ñ(­-îîÐlödάþÝçt1MÚ:zŠè¹çò<rví€i²Uš¯´GÞÀ|Çv¥q%ïjìøpÅ»°Ûúl`>qXÛ¿ñÙ.Ī¬»,»QÏv7ñG£ºŸKOæy6DÆtØi½ÇW¯[ -ã(Þë«•ïåW~Gf@Þf7Ó|e¤2ßS›)«d课ö‘z.ÏÓ!uß_=ƒ´²B~b<Èyí¿ w¦ÝÎ -ü¸O÷Ü(¿íµÜ@%Û“Ì~ò%8?Bå¹™çéÐvà3>rŽí¨<ö¾ýíüä÷? ~2ÏÓ!ôñûé§øäÞîwäŸßæì›™OHgyù[Óyž ±ùà‰Æ{‘÷ þRå®(ç[͸Ág}ïûë™ù‡ÞLÊ»@èÙGä¹E˜*\K—k:AôzÓ-¥ù6R±¥J=k®=ßMéP·©u¼ +}´H#½lŒÍeë×µ˜Î™mc­ÃÙ_/XbÜFüvñQHí;W(_¡Ç…–•ÛÄIu¼t)ÝM›¿ajVJMÿÏTá›”˜§|Ñ®AŠN–ïW½š›M¼î$.uœÔÚÅž–u—Ž±a–÷—NJHO¤ÛR·[IY—1yÌÕ<"©Fk±n¨kb¢°Ú?+¹PU#P]ûå·•¸ÛéÛTõªU4ƒ»oåvqhÜùÆű¸¦×4{[¹ óUøZ67Š ú©VÒÅFµÕ®WÆ„Ý0Bw}+â:[;Ñ«Ïê×>ɤ÷õò·KYæV:­3XMo½áž—¾þ/Òü€ßÿ¾¸ëŸë1ëó:nTc Ó¸u%æ+½#-Ó;Óª°M&4ŽÑ~ëÔÓúŠ†¶ŽÃøÚõìª{M©ƒê¦åBßû‰Mƒ®Ñ–õŒß¾½Ø™/›¾`Ï—¶6ŽÎ¥ú«U¸àÍÁeê:Û—ä++W”´/éÐ:Ã2â‚ŠKVaî–­Ì$@òJZדýŽ…¥ºØs#èÒvëË,/ºÊJ+X¸À–_ð‚æ•æ•=‚ÑO¯/÷ÅäPgIµ7é—¶†‘´ž,µå2¬/ÛšcË!uòöjeY6÷lsrúÔè®…[]pŒ2iêÙ–žWêªlUi](]@¦ª¬•«MaÉV»¥´8‰½›OÑ¥ã=íù¨´Nô|TÂ&-•[W¼æ-ÙæyçØ[§zÊæK&Axî&u=¥­²mÝn]w]m¯¬®ºgªz6¿Iùÿ=2wÄw/H©êOÙÑ©¿˜ µÓÑ[Þ5«RàG¯ ‹.±í’»óìïŸlwIêþ ¯ Ã19kUÔôÖ`Ù„7(ò±‚Uß(,gËJlÒ} lušÛ¾)£¼6²ìg–M¢v)T¤·ÄZrz½Ü.*ùÍ岸Ú>)?ÿu…¢O -endstream -endobj -608 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 607 0 R -/Resources 4 0 R -/Annots [ 609 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -609 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 683.673057 101.433071 664.923057 ] -/BS << -/W 0 ->> -/Dest (cb130-1) ->> -endobj -610 0 obj -<< -/Filter /FlateDecode -/Length 4388 ->> -stream -xœí]K·¾Ï¯˜³Ó|_@àC€$ˆ $‡ ‡ÕZ²¬Ø9äïçcOóÑìêiÎìJjIÖb4ÓU,v5ùñ«"»g¨Î_+üH‰¢wt~üùôËI -o%þM%“ú^Þž•$/¬Š.ØóÏI`¼ðÑjïÎO'ü׶şNÿøêôŸ¥:k£ÓÊž}›Td„ÞK˨"TRFe­ð^[Ǩœ¸Ä9Ü°ž4­UnP –SÁ Ò:0ª7 yeÖª7´WÄ©à†ŠÖ3*%á‡ÒR²:8"‰ŒftÊ -‡FwœN+áBÔ‘Õyè”לÎá<)«8]Î98Á¥ât¾XE$9|!<§sðÅ8#Y|ÑÁNçá‹FëDFà ÐX|‘N*N°1±º >¬uZZaƒ1’Ó)%,°iXF:ÉyF§á‹“6²:øbÔœÎÀ§OXãC`F«N£ÛH£8…/Z{buðÏ1€vðEzÇQFH¼Äq€ö^PÔÄ‘€FP À±€Q÷†£­ =ÇF*è´âˆÀHøbÉqL`|!Œ\V_L$Ž Œ†/(Àq1ðE“á¸À€m há¸À€nIFÅqß’TŽãÂ…›’ãÆ5ÁÇ” (EŽ 8×€;9.0 ] wÏqëë4Ç´k(8Ž x×’x×X²:øs\vFÃqw’žãïbiŽ Ы8t+B‡ 9. ð®’8. ð®ö¬Î ŒAÃqwµÅ%p‘¼«­ÔxW“v(ü#Ùl¼ -±|:_@° ÞC§ ǨLh¤%Xð®Š̘[ ¢ã¸À‚wU@÷±º(”G‹3ã­,”s‘ã ÞE 2Xð.è3p\Žˆ¨šã ÞU‘šÓw•Ž’ã ÞEÞ`9.„BÀqâ›PÐeuQÈǼ ZÒ - À$¬Î Iq\2y(Ǽ‹ð9.pà]iá¸Àw%!íauðÅÍqòè0l™1dUH ¦àtà]©ÐÃœ¼+¥8ðn -›8Ÿ:p\²`Íq $¢÷Žã%tHùX8¶x e±:øBž8.@b-¢‰ã¯á‹Ñšã¯á RŽ ˆ¨}³Óø¸°ó‚/È9.“‰‰8.ðÖa>†VåtN‹àA׬.@§<ÇÞ“@(V`.%=Ç x‘Ò%Ž àtŠ8.ð¾`¨p\€P$‚FfÎé|A’Íq2]è”⸠hø‚lã‚ f™Nr\€¹$ššÓ‘LóÌÀqA 'RªÈq† fš`JV_@ ÒdÛr\€É&›˜æ°:øb,q\‚NÓÍÀqAðEKÍq°™æ›žã‚(á 2>Ž ¢t"¥É€Æ¡“’エ曚8.À¸LóÍÀqA4óMLñ˜qKóMÏqA$øb‘¢°:ø‚¤)2㜄ù&؉Ó9ø¢#q\KóÍÀqÒ Ì7‘ѳK!Í7=»\ÞµÌÄéÀ»ÈLÇ8À|™-7·— ^ë‘ŸñÊfœ]1 ^‹ØÊ.Hp/¢•g× $È7Í‘ØE¸‰™epìªÂ*”J²Ëü‹|ŒVœpY}j—¨àà3ƒO1,Ù}™sÔbf£Øe}ì×Oß< øžüïéÝWÓJYþSH¦Ò„ü -Ã@Gt·Eö­pùÆ¡£•˜„4yï±INøXT ÅyÑ-9‰ð—þמÃñWÓéM9}D¿œ><°Jê«€éë´6Øx|£É :,19B´u(c¢NìÈ!¯”´(üû×'uöâ²Z÷/1&mϯ>}ó—ïþþ×ï_F¯ßþù;)­ýök…w -—w {:™›ßý,SuDó»ïlæz®ZæÝòÝêùý¡©ÏW;«ª­•¼OZ6þ=2¾†¥½ú¡©3¬¯k:¯Y^CñóÍåÒT§òï½ ¿ý×ùõw§?¼^sÊV'`RJnKmw°›æ]ÏåâûåH#oçÈA›£!Ó\Ï;'î˹3—Ü›Í ÷¾›{¸}ey⣇yVô°Ýóe–ÑùRxþ¡Cy¯ÏèhGU“/ëvÍÒw6ùz¹ÙÚ/n¡ÏÜ~÷eÐæpèÛÉ!·Æt›™qÑtŒëú,dkö¸‰B{ûÜ{Ðæp(Ë3×õ«!C=z˽—M¾ë{Í9iYï‚ë>Ùwí¾‹§~†ÞÌÌ{,ô±wnòݘ–©˜lqëîÈÄ }ýùQŸ¸ö¥Ì£˜»@eŒte'?š±·¯ÉÜΈƒ6‡CåNÖ˜îqÙ{ωi×¹B€¯v· `™=7ó†žUe×íýÈþ^@;oëæv­nòigCw<9hs8DîÜ…nî,¯îH7™ÑŠ»Ú{‚$³ãUï›ÁÞ¿ÒÃìì½ÍܺQÓçºAa©«»G¸âÐþŽwÿ¬H¿öäº6É«ýZ‘ºè¯Äñf-qt†3hs8|^Ï!W}±ñ8mwŽ›iì­•:ùþ^<~{+–8\¶¬õ!°Öú³»~Á3§m³Å„Šzï.â ÍÑiwî{¿‡X~ä•O"æ1ÛÜÅÆì˜Íá0{=ÿ\þ{î¢ì°${ÇÄ2ÌtåŽÉsü»õè{_%ØbÒæ©Æh…nËì¡rÌæp¨ÜYż÷» ¿­½/ú¦vÜ@e¸ƒ+Çl‡ÊÁoØÜñ…Ï‹¿î¡/º¦Ï#ÕÝñí›A›£!Õíd¢__mŒÈçL>ÌHÜ@h“CŽ>«1hs8„î¬{Þ³Fyïü– ?ãæìí3ùA›Ã¡ó=域hfð¢#îCDúpû“ëƒ6‡CêNNúIòÏçéýß´9BýýߺÆ;7?ßñ[¤ŽôÞÜþ4û ÍáÐy=½{ÞûFú{ž¨zß‘ÞÛÛçôƒ6‡CêNNúIòÏ °#Gúpûœ~ÐæpÌEÛgºï+džh¿¯6ñUs'ÞÎ=ð[T¿-ª‡;îÄÚ ‰a'çüçïïct}€îø–ù ÍáP¹³æùIrÍ ¦ÁÞ>+²@âCƒê+Ïš¬~T1–»œáŽ{ïƒ6‡Céد­¾Y¾ñ+:sñÚ|þíŸj}‘?àõn|FÓgÅv°rùq.ùxýÜáB›o #tÌæp½qͳá´6®xk ‰×æ˼ô)ç˜}–³z¶~#ªÇ;îµÚ q,×|‘§ÕóѸõ¬ýÕßðÊOç%Íß=Û¬§¿&._džµ¿'Fì}gn‹+£¹+m‡ÎÁo¥é¿òûÁÖy7yÇ÷‹m‡Èü²ë‰ý_i¼“îüúÆ-ù`ûÔÜÍ¿¾tøoÀ´¾šw7ðkmÚ]&XšÍ -Dw‹ì r½µBÞ àœþzȹk-Ò¶¦&œ’)ú´H‚ØwüóŸþÖ@,ýȨ~{ùIßK(Ãg‡šÒ¸Ëqjª 2i)$Îe¦'ÍÄu!-;ujÎK·ÈùÇ^Ò{ª+•§w—îIrʺËkªkþ<Õ2DæóM“ÚÔ-)áºèõÛùÜ?S¶¹†ü }\uå/'7íj£¦Í¤ Bé´õéÙ‘0©oâ9í¤¤!•»NM­Î–Ó†±¿”Ró²2m+—¶ºl0ÛÌå™:ýç“Š$Rû'¸ì÷('qÐù ŠŸNi¿ObÄDBŠ“pþ(K]¤rÁ"{ïzû’Æ -9Œ¥rcóGmóÕ${›ÍÒ>,$s!3íDr91#„¥Skqºz)Ô,N{¦aæ#W\±.û a­Ú²µÂj¸+VF6B»ÊætU¬)û£Ò[¥é\×Û¦SM÷ç²Ú7ÝyMøxÂiM/}b¥i§Æ\Un]-‹Ì4NÅ"µ¹dé*ýĈOŒðk™«&tfÑ7½–ö»ºC•r1—cD'¶Ü\›-=åK©PMcnùêJ…º ¥áÙÔF³Ô§M ›1"Mþ¸»Ô¹¯ehp£WÂÇB ­ÄO'ë™Ò¶r…´z­Ð4õq/Uš~^àò C3ËÒnAéÿ UØ"MÌ3}PT •vüªGõ$ilñ²‘Z¹+¬C\ (òµlÓ\Êû‚Ù¶½ 1åé–Ò¥ÅҦɹٽDR…<–bUPWĉÂrû®l…2;ÓU±-P~Zˆ«Ÿ¶ U€=ŸÌ©î¶Ô[Å®pçS+ö¥ÇUÚ¾­ø[êm0Ÿ…S`£^œ òIªXËíêÉau ¤PÅ•FŸ&q­…¦ßòž?ÖAÆEÜÇÓO§)ÌicuÄgTڴͼÔù(ó^ÿ>Ñùû¼ýÕ%ŽkYØBn]ˆÛH–ö®ƒâ´—u–aÓ55´_Å*Ô²6£¡Äq­¾¦j.+±ç’ª0¨*ÚVhk6b] «•iZÆ^>v­X™çöM Ø—C“/§1iã´ìÚËÁa¨:SCò¹©G©h éÐ’n qÐVŠÃ愱z¶p3²=Iiúä?µ]aÒ¹šƒ&H‡¦ê¨†Ù¶ê,›®¢)‚Ø´mŤړƅ?ŒÓw¯g÷ûì²Ë# I µéS+-–¤…ðx©™Ýò°ÄsNyðÖ*u™fì™’äÔ¡QS Z´m¤¡šÍl{RʲÅIs (t™Ì²R£Ï>¹Ù,7ËtÅm%_rŠ*ý©miÛöJiDÛöŠ[•MõæˆW²%S ÛÂÙ׫“µdÉ%#s­u‘R-i²l}nZž;GÛssTq53•ÕÌ®JÞÅ÷Œ‹M·Á•ÊÓêˆ -uÃHjRÞhsŽ)Ý ÎC(mãì)4Ë%7Û\_?Y¯’äõ“öLèAÆH¯€· ž ˆûŠ¦ª§y¯MÞ,Jö’nkfy¨Òœ\­aæeÍi‘¨ú4U´qÚtY†6÷R±ËEÓ¯¤„ÅòÉô÷лv -endstream -endobj -611 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 610 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -612 0 obj -<< -/Filter /FlateDecode -/Length 4803 ->> -stream -xœÝ]ˮ丑ÝçWäÚ@Ë|?€F/ xŒiŒÓ@a¼0¼¸•UecpÛ@{þ}Ÿ D2D…”ÊÛ·Ëiwáv¦"ø’‡‡”ÄÔW…ßhü/9=¥”cp×Û—Ÿ.jŠ^á¿’buQÔ?à/ú«V.N^çüõGØ8ÅìM ×× þ7\ò䯗?üêò×u}5SÎÁhýÛgR9;Å£ò‚*C¥´TÞO1UК˜³¤‚>:㶪3\N^RÁ gLT fXµÝª2Ì0Q;I3töQPi;´QJÔÁåœ5‚Nû) Óƒ¤3z -)›,ê"t:Igí¢Ó^Kº<…|’t¶ø¬´¤ó°Åk甤ƒ-Φ(él±Á*Q[LŠVÒEØbÐ;YÐ%Øt%Q[TPZÒe;ùœœu:•bÚêŒò“OÖ*I§õäM+ê0£0H! -:[‚òYÔÁo•‘t¶8ü“tà ocJÂl54»­²ZÒyØbLt¢¶`ð%0¶¨$ -À šˆ—$01N.'‘€IvrÉ%‰LÊ“‹ÑJ4`²Ÿ\ÈQâ«4tFKD`lñ.HL`5lq˜¹¢¶Øì$.°¶ ÄÖÂã¬Äl뀉 ,èÖ©¬%.°à[§t¸À‚pa¦’¸À‚qm -Nâ Ê”²ÄœkÁX.¦{”¸À‚u­Fâ Úµ.‰ ,x×:­$.pà]k‘SÔÁXâ°ãdu²8ð®Õ*J\àÀ»˜FFâŒê‰ €•É¤¤$.pà]“”“¸ÀwMÄ êâ„9h%.pà]ãÑiå﯌ļkœ (øG‰Þxâew¶€`%.Àz± °ÉÀ-‘¸ÀƒwuÆò'Ìi°Õ¤Sxð®N>Q—'Ñã¼E/O:„,qïb¡²xð.è3I\ŽŸ°¢‰ \@¥‹ó.}»dæãÓX¿~øñòëÿúþÿû÷?¾\þø­RÞ÷Ƨsó§a¹°È>â/-ò%í-·<Ÿ»^ûEWóù|Þ)+.é¿,ºÀtGeÝÝFëµ]þFaÌ¢SóŸOëºZ^õÆ:U￦[>½Y>kyº·Y«ïþtýðýå·Ö€+qRœFH¯Ñ{u£ç²üŒþÐÌùš­ ýº»]†ˆui¢:¬ŒêiÛÐ&V^¶PSSÀ÷Š5¥]²UMÉ€S£M*mùþ?þówÿÃÚ‚`¤@SûÓöýãü‰ø^™Ö¦µÝ >žìœÓbõÄ­í¯7ò%mƒ~èr*k†5õõ,›¡¼\ ¾Ëg\Ò~^ʺ-×µ¼/½îbÙýÂÊQK¾VÞ<Nuuà]]rë-+=À[™,M¹¶ËŸg-]®K+–^­-Q DãX+"˧ÖéÕ{[Z–æÞ„TpÚ,ÝçZÚa—ÑõÔóiîÅÒÓŸ¶åKA ÝhØ–£–vÍm.í>²ÎñŽª·eÕÔßfžy‚mtÃ)(I({Fy/sÚÞ×ÔÏ–>ouLÔ.ßk[É{ÚÒþ´ ùÆävLè- Qî(¦ë¢§tuÑó‹^/åìöisØ÷~ìŸRÖ2«ê¢ZfäK1 &̺Ýev+fGmsÅSœ?KyŸ|ùõ¬/}vÛïkb-_q æ~Pv݇ã86›BŸmÜt·ì{ÔOqì§ÖÎ8àcOa¿¹ŸZŸŸd<ÏY¯öUÚç:Ä~³lŒ¾t; N™ [ÜöcÞôc^ÚéwæëŸÊ›{ýSðõéëö·QGíµÖ íù{Í?•ÃFGÌÒN-Á -ÝŒ3I›»žØÉ؃žš |ù>ÔÁ£‘:BmäˆÎN´ßÙ² O;’oè}ºÎ q·¥wòÓè[­y¿ÞwÉ`Æ%×å§>³Ñ8¬k &Dž¢ç²1| ‡É\;5+GÓî9[猞îÈtu¨´Ìö"t*R£'@”ÓewþOæy’˜´ñ¡óþˆÕ‹L}½µÙ×èËá:Ø­iÈVµÃUÞ8|Äïضj˘¦û¶û˜nxˢczq¼ –“èܬð9ûõPáž=@¶`Ó«prð\žgó·áÏ ³føŒkœèŽ¼Ìß7òå¯ÉÝŽ®ãì–<»Î–Î.Ÿ–O·|§ò9ç~­ðÛ>ß[™ãFÔmÝg{ûzôNE=S‹FÑí³cÔËó$¨ëf}ˆ:»F[c®5Ï°§x©i= -Žï$¿ó.÷y$<ØÖ`×M¥už·#²—Ñìx9@jì\g .›»H=—ç階ùÑȉ5yóöÐA›‘–ÐõOºï"¡ß{9,-—õÕšããH=—çÙô1§ªQ™§ù2ðe˜W×÷¥;´7¤³U¼Î´bŸûºöµÙSËù4ô—ëžÉÚ&•¡ûŠÆ„I™hïú—'ó<*ýË#?m\ÉÅUsÌ#ðÙÞ ÂU¬ן{ñNãÀ½‘uóÍÉ,ççŠÐ»·ª«2N»7æèi¼D/ÑÜÃé¹Í^_½Y¹Aó˜Î>6u2ϳ¡){YGëÙŠ‘F”ŒˆÒjó GÖHîo7Ë,Êå(ø².cd½M< ùðµ¬ÑĨ{qÈ=oϘ6ÓF–ü$ÄZ·µmåþÓÎúù.ÝI¤žÌótH½³³7pÚˆ¶²é¦ÓÐhÓ>­¡¿eTLFZ¸Cø^Xñ½íŒPéscÇ^ÌmQåY]oŠæwȽ>z+*•7YŽ‘x.ÏÓ!ñŽ§øÌϘŽœXgÍ°k·iC­óvyã}— bGtíÝxùìêä¾a÷ïdž§Cî±ïøÌ;xG¨þÙ¨bm‘¼A0÷CݺŸF4JkA‹»†;4›=™3«÷9]L“¶Žží¸ƒÜsyž ¹éÎn ÐÁ#M¶Jó•öž70ß±Fi\ÉÇ»>\ñ.ì¶>˜O¼yz(íB¬Ê:¸Ërˆàõlwã-þh2séÉÏqר3@zv~¼ÔÚ±ƒ6¶yve>™çéÐvÇg|Ë8¶£ò<>Øûrô×ó“wšüdžgC¨Vo¿¡~ŠPÝâ~Gú÷œ ²?,'SEÑõžNL^'vÐUÃéÝ$w`Y_&ÚÝsÕÃqIë÷P$IoÓÕ}9Ò)n{o™ÏóÓdzyÕ™îd—'Ŗת©«ÚAyISßR*ó0g¹‹¡Ú«úõuçòÆÒòjsy=9ÏrS_¯¯B/ßû!ª½¶nÊ!j~Å™=ÑÊ?8j µÁ×6l†ò§K('êr*­ -ð« [ n²46ùJ§ &e®C§KgëëNÎrØÿO-Õrþ¿¢#é8È2´übIÿSô/:»‰ú¿œñQÎêVEœL½èâ× Õî±sý ;b._U+ËévîH•Ý@¾qÊcJë'µ|퇓ÐëVóWãkk(¿¯Ùè =§j"[N‘›+„ÈôVL­W“^ÄtÞ}šìrš)ôJröOÛ ìULè·BŪëbãª=šÎGm]º°™Î»N³á¯iMdÃy$¼]P­¥¯¢”NÙ®EÕÞ5ªÉ,3*7©¯)Û€¸6N‚èv„ߨZ´Ã`6=5:«t¦ -$×ÒåšNÝ.bº¥4ßF*¶T©g͵ç»)êtžË¾ìÆð‰ôlŽ([¿®Åt^Lk•nÌFx»`‰qñëÅG!µï\¡|…ZVn'ÕñÒ¥Îß05«ŒNz¤ÿÏTá›”˜§|Ñ®AŠNkíW½š›M¼î$.uœÔÚÅž–u—Ž±a–÷—NJHO¤ÛR·[IY—1yÌÕ<"©Fk±n¨kb¢°Ú?+¹PU#P]ûåו¸ÛéÛTõªU4ƒ»oåvqhÜùÊű8=UÑ×À0_…·²°¹QLÐOµ’.¦#œ*|ZeLØ )tq§Ñ×"®³µ±ýœHýÚ'™´âÞ.¹”eÎXoèÜ‘`5$Ï=/}ý;Ò|¿ÿ»¸ëïëÑ¥ó:nTc Ó¸u%æ+ýîH:)¦ß!©Â6m˜Ð8Fû]¬SOë+Ú:n ãk׳«Nì5¥n ª›– }ïC&6 ºF[Ö3þ@xz±92?wlú‚=_ÚÚ8:A…½­Vá‚7—©ël_’¯¬H\QÒ¾¤Cë ˈ ^(.Y…¹[¶2“É+i]Oö;>–êbÌ KÛu®/³¼è*+­`Ià[~Á všWšWöF¿yzýìq_Lu´Q{“¾rikIáÉR[.Ãú²­9¶7R'oï¡V–esÏ6'§OîZ¸ÕÇ(“¦žmIày¥®ÊV•Ö…¢ÑdªÊZ‰±Ú–lµ[J‹“ØK±ù]úÞÓžJëDÏG%lÒR¹uÅkÞ’mçpŽ½uª§l¾ddçnR×SÚ*ÛÖíÖu×ÕöÊšáº!¡{¦ªgó›”oâ¿·Ì9Ï°!¥ªÿÊîˆNý°o,ÔNGklùý6•B‡8ú ŽèÛ.y8ÏñþÉv—¤îŸðš0“³VEM¿Ä'›ð -E¾¯`EÕ_铳e%6鱶‡:Í©ÍîPù)¦²·Y6‰Úe¤P‘~yÍ’Ó›èc¢Òòy­/›í“òïºØì -endstream -endobj -613 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 612 0 R -/Resources 4 0 R -/Annots [ 614 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -614 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 573.873057 101.433071 555.123057 ] -/BS << -/W 0 ->> -/Dest (cb133-1) ->> -endobj -615 0 obj -<< -/Filter /FlateDecode -/Length 4396 ->> -stream -xœí]Kܸ¾÷¯èóËå£ø‚=H‚Ù Œää0îÝÙE0àÍ!?ÕâCR©ÅÖxlÙkÆÓªbQ%òãWEJjª³ÄÏ· -ÿR"„è/ïNïORx+ño(19Ô¯ñëíYIòªè‚=¿Kã…V{w~:á¿Ùa[üéôoNÿ™Ú¨³1:­ìùן’ŠŒðÁ{iU„J*è¬Þkë•S—#§‚Ö“¦¥Êà ŠÁr*¸AZFà†!¯ÌRá†öŠ8ÜPÑzF¥$üPZJVG$‘ÑŒNYáÐèŽÓi%\ˆ:²:òšÓ#œ'e§‹Â9g§#øb£TœÎ«ˆ$§ƒ/d‚çt¾g$«ƒ/:xÃé<|ÑhÈè|º«ƒ/ÒIÅé¢6"V¡“Á‡¥NK+l0Fr:¥„6 «ÃˆB'9Ïè4|qÒFV_¬‘šÓøBøátà k|ÌhÕiti§³ðEkO¬¾ ó9оHï8 -À‰—8ÐÞ Šš8ÐÁ -8Ð! -òÞp4 £ä¢çxÀHV _,9Ž Œ‚/„‘Ëêà‹‰ÄqÑð8.0¾h2°--Ð-ɨ8.0à[’Êq\`@¸pSr\`À¸&8â¸À€r¥Èqçp'Ǥ‹áî9.0`]cæ¸À€v ÇqïR’ãïKV_`Ž ÀŽÂ¨`8. ð®QÒs\@à] #ÍqzU‡Žã`Eè$ÇÞÕAÇÞÕ!€Õy1h8. 𮶸.rƒwµ•šãïjÒŽãE€$› €wA!–Oà –ãÄ{è´á¸• ´„ã ÞUáÓ`+¡BtXð® -è>V…òhqfÜ¢•…r.r\`Á»T†ã Þ}Ž ÀñUs\`Á»Ê Rs:ð®ÒQr\`Á»È,Ç€ƒPH8.@|Jº¬. -Cà¸À‚wAKšãDa!˜„Õy )Ž @ÆB"å¸ÀwÞ#Ǽ+­18ð®$¤=¬¾˜ 9.@^†-3¦‘¬ -©Áœ¼+z˜Ów¥ô‘ãÞMa“ãç“@Ž à @¬9.pDôÞq\ࢄ)«sÇ–ã/!° ,V_ÈÇH¬E41p\à5|1Zs\à5|AÊÀq2²ovz_v~@ð™"Ç`2"ÇÞ:ÌÇЪœÎi<èšÕè”ç¸À{ÅŠãÌ¥DÀ ç¸/RºÄqÜ€NÇ> Ž ŠDÐÈÌ9‚/H²9.@¦ R _ r\tÀ,ÓIŽ ¡1—DSs:’iž8.äDJ9.À0ÁLLÉêà h‚ãôOšl[Ž 0ùÁdÓV_Œ%Ž BÐiº8.¾h©9.6Ó|Ós\%|AÆÇqA”N¤4™ãÐ8tRr\UÀ|SÇ—i¾8.ˆFb¾‰)3n£qi¾é9.ˆ_,RV_4EfÜ‚“0ß;q:_t$Ž ¢si¾8.@šù&2zvI ¤ù¦g— À»6‚™8x™©ã¸˜o"³åæöÄk=ò3^ÒŒ3°+Ôk[Ù% îE´òìšù¦9»h71³ Ž]5@X…RIvÙ@‚‘Ñ‚®«O핛á´3oÌ-HMî¦=ÜöN™*äîyµ½\Pñ8ë͇¦¾²3B$ïSIÅ¿ ãk˜Ú«Ÿºß¾xò(Öòþ9y§ÍÑP¬o碻s>jd¿A¾ÞƒÜU4Ö|ҦNJàpZA¼Æ>›Ã¡ñvz7?ÎÑxO®÷1ø;ËÞÖ:æ¨ÊÝQoA!÷¥ŽfD¦s§QhFŽ6vÉí…§gç\El³@é"úY‘t[ˆí³9boçª:l÷î'AÞ…s¹ÆŸ=ÈÛ&ØvøÕ“‡êf)²}6‡Cà§ÏCí¬ž2n䛟e&¬ûº³r%~Ìì¶8ÑÔü0=„‘5ˆì´9"Mçú¦žõ¬¯=«Ò½l?þºí^™äj—iOq+ÜEçf¾¬åµ³•p;CÁÜ=¢ºð~þk¦öiÖ”òŵõGÓäqJ‹(ƒ–›¨é³9j6r¿÷.&<3Ÿ{θiÈgºvżœãqZO²+½+rÚœ²Ø¬ñ*w¯d6gŸç¬YÿÉG@ç:¥iÖ{g+6‡Cì×uÊÉÈÚªk •›k{Ѿ‚Ðf½±÷Nc§Íáz;7ÜË¥7rË?Œ(œÝäyã·82x$’¼ÿžN§ÍÑH9á¡xã½Í_Xd>ÌPFSæz]9ï>›æ¯ËÅ—åH2÷sd§Íá¹qß[5¹3—ÜšÍt÷¾{¸ýÍòÄGã¬èa½çË,cæKáù‡ÊçúŒŽvT5ù²n×,ýÌ&_/7[[ãÅ5ôíx&²Óæpèë|r>¦ù ͱòÌy²þäÛ - -ÃýsïN›Ã¡°/OüXЮó…\ÞÓ¸4ç¤i½®ûlóP¶¹ßìƒP†¼ÛZáî´9:í3rÇOÊ+pä¬ä¹‹{%³Uï2²Âøk¯¿¹grÊÅyì™ûŸòé´9öng‡C»ùq7µåÛÚ†Z7í™3ºgŸgí¾‰§ù ½™™/žž=ÄÞ¹ÉwcZ¦b²Åµ»#ƒÎëÏOûÄ¥/eÅÜ*cdVvð£{kñÚÚŒØgs8Tnd™á.ÓÞ{NLÛõZ‹¾½È칚7ÌYUÎÚ£½9¿ÐÎÛfs»V7ø´1±;ž†ì´9"7îB7w–w¤›ÌhÁ]í=A’“ÙñÚÓÙ›½£‡ÙÙ{›¹ÍF ÷þÅ‚g÷:¿ã=Vd¾öäfm’WækEêª_ã®YKìátÚ Ÿîv¹è‹•'jçw縙ÆÖŠQ©ãÂ÷÷ä Ü{±Äá’y.üE±Öú³¹~Á3§k³Å„Šzë.b§Íá¹qßûbù‘Wv>‹ ˜Çlû¶M/fûl‡ÙÛùçbô﹋²Á’ìË0Ó;&ÏñïÞ{ /¾J°Æ¤áþ7;m‡ÊUÌ/úýÕÈÐwµ#J/ïçÊN›£¡Òw¾a³ã…/‹¿vŒÐº¦¿‚ÔoßtÚ©™èo‚¯VFäÆs&g$® ÔÞÿÍ6‡CèƺçÇúꯙA÷3n>Ü?“ï´9:_(ÿüL3ƒ—ü²«—ˆôAÞÿäz§ÍÑ6rÒÏ’¾üHv¼ Ôis8„îèïÜý|Ç×HßéÃŽo(ê´9:oç¡»ç½_`¤ßóDÕ‹Gúpÿœ¾ÓæpHÝÈI?Kþù@#ìÀ‘>îø6ÌN›£!4væ¢í³@³÷2O´ï« |Õ܉·c|ê÷Eõ¸ãN|§Íḑs~‰ó÷—]!‚Ço™wÚ•kžŸ%×| ÑÔÁÛgE&H|hP}ãY“Å÷*æѲq—3î¸÷Þis8”ö} ÑâÍò•oéЙ3îüëùtPë‹ü¿ý3šy†Ql;Û!—ïGà”—Ï„¾÷ÎðimÚ»(Xš­8 -,7‹l p¹qGÞþâœ~æ0s#¾‘6Í5áŒä¢OûÌ$X½úãŸÿô·Vé‹ŸôOׯY»¾Ö‚Ï¿ ã®Ç©[†€RxŠc™á £2!^É0™'\[{%9¾€›þ¦ºRyz¼Â2Éu*뮿C]ãç¡ž¡7žo šÔ5Wý¤~;ž»ñg¨Ã6×nŠ‹®|rÞIjØ7Oº ”Nëž “ú&žÓ>MAR¹ëÔÐØê¼b9lGü¾”w(–iÓ´aÕuûâæ`,ÿ~èôw'I¤öO$qÝMTâ óA?Òn²Äˆ ³˜NqŽe©‹T.Xdp­q^ÒX!DZTnlþ¨m¾šdo³YÚå‡d.d†}n®'f„°tj)NW/…ÅiGÞ ÌxäŠ+ÖeŸ!¬R[¶VX 7ÅÊÈFh—BÙœ®Š5eTÚÁ­4«ÂâzÛtªéþ\Vû¦;o /'œÖÌ¥O¬4íš«Ê­«e‘™Æ©X¤6—,B¥ŸÑåÄ¿•¹jBg}Óki7µ«0d Q)s9Ft9±åÆÚlé)_J…jsËWW*ÔM( ÏȆ6¥>m1ÞŒiòÇ©Ø¥È}-Cƒ½^N1´?¬gJÛÊÒfèµBÓÔ[ÄAV¼Tizåëú C3ËÒ^Téÿ+UØ"MÌ3|PT •ö“«Gõ$ilñ´‘Z¹+¬C\ (òµlÓ\Êû‚Ù¶½TLùDº¥ti±‰´i²Fîcv/‘T!©XÔq¢°Ü>…+[¡ÌNàtUl ”Ÿ&âê§-C`Ï'sª»-õV±+ÜùÔŠ}éq•6,þ–zÌgáel4'è‡|’*Ö²D»z²FX)Tq¥Ñ§AœGka§á›çÇuq÷rúå4„9m¬ŽøàŒJ{ݶ™—:ÿe^á÷ß':ÿ7W»Æq- [è­qÉÒÎè¡SœvJÏÂ2l¡¦†ö«X…ZÖf4”8®uÃ×TÍe%ö\RUEÛ -mmÃF¬ tµ2MËØÂˬK"óܾ©ûzhòÅá4&mË—½ÂA{98 UgjH>7Uâ(­!ZÒ!ÚJqØœ0VÏ&n&@¶')MŸü§¶+L:WsФéÐTÕ0ÛVeÃU4E›ö ­˜T{Ò8ñ‡qz÷ðzv¿.»<’´P{‘>µÒraIZ—šáÐMKÌ1çtom¡R—iÆž)IN5µ ÉA‹ÑFªÙXÀ¶'¥,›œ4ŠBÉ,+5úì“Ír³ WØVò%§¨Ò_Ú–¶m¯”F´m¯¸EÙToŽx%[2%²-œ}½:YK–\202×Z)Õ’&Ë–ç¦é¹s´=7—AÕW3SYÍì¢ä.þÛ3v®6³•®TþVGT¨Û‘"P“òF›sLéNpBi“pO¡Y.¹ÛæöúÉr•$¯Ÿ´gBw2Fz¼­¸ðEÜV4U=;¹òfQ²—t_0ËC•æäbuÈ3.e‹DåЧ©¢Ã–Þ2„´¥½—Š].Þ\}˜,Ÿ ?ÿ,ö“ -endstream -endobj -616 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 615 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -617 0 obj -<< -/Filter /FlateDecode -/Length 4878 ->> -stream -xœå]K䶾÷¯ès+|?€À‡I# b`‘Œv{wlãNùûùŠÉURkfÇ‹6²ƒÙnUñQ,~üX¤(¾*ü|¥ñ_rzJ)Çà®·/?]Խ¿’buQÔßâ7ú«V.N^çüõGØ8ÅìM ×ç þ.yòçËßuù×:¾š)ç`´¿þû©œbŠQyA•¡RÚ -*蓼*è MÌYRÁ q[U„.'/©`†3& ª3¬‹ÚnUf˜¨¤‚:û(¨´‚Ú(%ê`ˆrÎA§ýàô 錞BÊ&‹ºŽFÒY;…è´×’.O!Ÿ$ƒ->+-é‹:Øâ­2’·Ižð6¦$ŒVC£Û*«%‡-ÆD'ê` :_b`‹ŠA¢Œ ‰xIâãä²q ˜d'—\’XÀ¤<¹­D&ûÉ…%°JCg´DVÁï‚ÄVÇ‘+ê`‹ÍNâk` H\`-l1ÎJ\`Á¶h‘¸À‚nÊZâ ¾uJ‰ ,f*‰ ,צà$.° \@)K\`Á¹Ü)qéb¸G‰ ,X×ú`$.° ]ëR¸À‚w­ÓJâÞµ9El€%.;NV'+qïZ­¢Ä¼‹ad$.@¯NÀa¸X™LJJâÞ5I9‰ x×DL¢.NƒVâÞ5Mfnð®ñÊH\àÀ»Æ™ q€2” €wA!^` VâÌ÷Ð+q -› ‰ Ê­ÿöÝdºX1ïÓ·Kf>b:ÉÑøë»/¿þÓ7ûËŸ¿ß=]¾ûRîéë¯4}Þ–OL½.-ßÃüéoý{K¿¤QvþÓ•_÷ ék~¿NÛÊ3˧^ê«u¿Ç¼Båà?Or·¤[Ê!ùÆ^¦«éZ>ÍìþÐíðRžO]¯ý¢ kûkZŸå²ZûÆvÇšæë\ß}sùÝ»5ÀÊÊh&ÚlGý4¯bò\–ÏÁäÏÅœ¡(ÀÃÇÁõf€á“ÜEZ>Gh{;ä©6-6è¢ÍÚ.Jóçn9c›xýÌ‹}ËðplhÔt#T7uuµÏ -M%C“î½”/Oæy4pbå~ÕóZíôXbhø…YEň®—¥¿±¶Œ#hÚDÚN}´­‚µ+­Žy.ÏÃ!ÒòåØÍ«C/44¼–Ã$.wsZi„Ö¶Î×ù’¶-Ó¢äà ,r¿è -ÒÉo=)_Wߟ(óÓ"¿å͈?åÎÀÝù]m¥Ÿ#îæ‘jAõXì^k–s¯…î™ê±’fÌc—_ÏÆðr]Z³x¼–«À•Æ1»"˧Öé‹o‹'Ââ‚ÀÛní¶[:mµ´Ý.mð꘽IåéÛr‚¥[tÜe[ŽZÚ5·¹´ûÈ„e;v¨Þ–•?nÔîyD -¶Ñ±§ œ Y(»Œ€<ç/hyZÊzÏ‘Ý}n>-¾¨6ùeþJÝ×ÔÆÒ§q)wñ_ÇÍ’V°¿#¿£ÞµÂN)ËÊöY\´ÁûØ~(6.6Ôö™dŸïöŸJÚÔõ£MÛ¥>òsÿ.µ{3Êuoc-¿ÔùÔÓWl¬™‰õê°ôy|»²çÐwqô]£fÝ_Þv:ÎHá ßìèl£®8½Íý0ÇFÌwù†ëv¬1¥wï×x,iY[Jl¢XÙµ•âüY#Þå Ö†1¤kw0Býïë¸W³”]ûpìïfÅ2Ã[i÷ÒÖõ¬s0öFl-²qvÛëÿtä7§7~Ç›ñöðÓx·b„ÏžÕÆÐÇÖçÌÚFmÚãè~›Ñ&h¡=¯ŸÑź¸ïè®ëª®yž\óC+ÆXåOÁ–tôÎ$mîÆÂ'ó¼êöÐÁ¾Ù›Ý”¼ÇƒàBã[WŠ`âÜ »æ€e«*ünØâiAv^äÇå›'p…rýÓ×wr»TÎ"†°gÕü>LÙ£ï¤ü%P–þD™å˜¿óÁxêh›/kµž{ÁùDû-gn¬–l½ë}:y -ç…¸ÛÒ;ù©÷ÀcÖ¼÷]2qÉ!D<ƩϬ7ës"OÑ)ÎìÁEA\¾"¿ë`bÐÛ½ }ÓYîL§&‡JËhß!Bt%5oü¹ÛQ'ó<Ȧ@ãCýª÷|ª6ëèb›”ãv͸¹z´ñ¨Ø&ë8‚«|³ º³½Ä7)j^³°„]–¯&vÝ‹Û9l{}ñvkA‡£±fù¢fXص±¶âeŒ%1€3t!ûõPáÑ8£ÓDųpnkødžGgΪî³{7'×¥ÌûùûFnHG×%\ò|`ãðtvùý¸|ºå;•Ïç‚/53ÿ†ÏZæ¸Ay[ûloË—Žv7¦>yØàdžA]7;éCÔ ·Â6·vØé—³·öØó縩{ /lk[p/2µÎózDö2šïš;×YB†Ëæ.RÏåy4¤b¶8ƒÔÍοìcøm¹ÓÈÒrY_ -©QÇ#õdž‡Cª=æT5 êCÿ>o<2¾ óìúö½´cÇ€ö†t6‹×‘ÆA|)ûÚè©å|üUellÚAe "~{7¾<™çáPy_:aûUŽÛ;óÉÓå<í&låÀ½ž ¯à›sy®gïÄpÕ“76KÞ¤±C7~V·îÇÞÓ¬—DPºiD7šÚžÌkó`«š°FÏÛxaïtõPÇÈ/þýrùq©–ósEèÝ# ÕF§=sôLP¢Gùïáô\žGÃi:Žà6s‡f}¶ÄÛµï7yBÇÀ8÷Œ‘àkŽï­RÏÌu|gf³ûÅÆŸcc§}Ú¡}ç¨o÷”<‹˜Î¥;™çáÐteÍg+FQ2"J³åsÛØëOërÊ -±²Xf«\Ž‚§u#ë‰öÇhi8:ÜV Oûë{Ñ1ã!ØUä5®µnkÛÊ}±ù9ñ]º³H=—çázggoà´meÓM§¡Þ¦}Zãû.¶ BO w.ß" -+±·*}nì¸s ¤QåY]oxü8ñ¨ïäaù“y‰w"ÅG>~ -³ƒÜWìþÌóhÈÍDZã#ïà¡ú³QÅÚrü Ð‡ºµŸF4JsA[w wh6{2'fÿÜcNÓ¤­£3'ÇÈ=™çá{g7Ðèà+M6Kó™ö^40ß±ziœÉÇ»1\‰.ì¶>XL¼÷`Õ°ãçoCYwY<¢žín¼&Íîå\z2ÏÃ!òN<ºóèíj_do…Â8êÿ÷ öŸ©,öÔfÊ*z7Í1RÏåy8¤Ç«gVfÈŒ9¯íñË™óKuvü¿{¼y•lOòìCð'ó<*ÑÇÁè=}Ñ'Ä_ëWË{˜7h~»¼1*zô¢÷ôƾäub/ jx¼›äüêñºí u®zx‰ÑúŠ¤WÅÛt5@YŽôvµ½ówôp•i¯Ê˜÷vʽ“å*r}{¤1/iê¹½âÒÙí¡åÁ—ú A9÷<ÄP$ȳܴÓT?KÔæ­R_yPÍ#°GZùã´6øÚ†MWþt åMº¼-V¬ ½NþÜDÏ=Å|¥·&e®]§‹³õu'gy ÿO-Õò^~E¯ê¥×4–®åKúŸJ§ÿxÑÙMäÿò¤dy‡¶*âdêE?_èêN;×·¼#&áòUµ²œnOoVÙ $§<¦´~RË×þˆ'@œ¿–3É-¿¯ÙèÝvNÕD¶¼Ým®X"gÐ[1µ^MzÓ{èÓd—«ÐL¡‡š°èxÚ^`ÏxW¬­bB¿*V]WíÑôÞÒæºÐ…Ítî:ͺ¿¦5‘uç‘ðvAµv”>‹Rzûu-ªzר&³Ì¨Ü¤¾¦lâZ? ¢ÛE~¥jÑÙô¬×袳0U ¹–.×t‚èvÓ-¥ùÖS±¥J=k®žï¦t¨Ó®û²{ :ÒÖ`cDÙúu-¦'h[_«Äpc6ÂÛSŒÛˆŸ/> -©}ç -å+ô¸Ð²r›8©Ž—.¥½’ù†f•Ñéÿ™*|“ó”/Ú5HÑ[TûU¯„Æf¯Ä塱Ž“< ]ìi™»tŒ ³Ü_:)!=‘nKÝ<¶’2—1yÌÕ<"©Fk±n¨kb¢°êŸÆ•\¨ª¨®‹}ƒòóJÜíôm¨zÕ* šÁÝ·r»84î|æâØz\Ó+q›½­\†ù*¼•‰Íb‚~ª•t±Qm¶ë•1a7 ¤ÐÅFŸ‹¸ŽÖÆNå]Ë×>Ȥ÷vùáR¦9c½¡'ƒÕô†wyéë‘æüþóâ®®¯çq£[˜Æ­+1ŸÉè邏búû U؆ Çh¿‹uêi}EC›Ça|ízvÕ‰½¦ÔAuÓr¡ï>dbÓ k´ežñÂÛàÅÈ|nßô {¾´µqô¬#½Œ¶Z… Þ\¦®³}J¾²"qEIû”­3,#.x¡¸dænÙÊL$¯¤¹žìw¼+,ÕÅ.XA—¶ë\ŸfyÑUVZÁ’ ¶ü‚ì4¯4¯ìŒ~õðúì~_Lu´Q{“>sikIáÉR[.Ãú²Í9¶<Xo÷P+˲±g[Ó‡F-Üê‚c”IS϶$ð¼RWe«JëDÑè2Ue­ÄXm -K¶ê–Òâ$z)¶˜¢Kàžö¼Wš=ï•°IKåÖ¯EK¶@žÃ9öÖ©ž²Å’Iž»I]Oi«l[·[×]gÛ+k†ë†„™ªžÍoR¾Šÿ^3væ<ÃN„”ªþ”ÝúK¸1Q;­±å睊8Äџƈ.±í’ç9Þ?Ùî’Ôý^ºcrÖª¨é/äÉ&> -endobj -619 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 483.873057 101.433071 465.123057 ] -/BS << -/W 0 ->> -/Dest (cb136-1) ->> -endobj -620 0 obj -<< -/Filter /FlateDecode -/Length 4386 ->> -stream -xœí]Mܸ½÷¯èóËåGñ ö bdƒ,`$‡ ‡ñ¬½‹`À›Cþ~Õ"UM•ZjÙcËöz0žVI•ÈÇÇb‘jš³ÆÏ·ÿ%2*¥ßžÞ´Š^ãßâêbPÿˆßèÏFSTÞäüùm¸¨bö6†óÓ ÿu—<ùÓéßœþsÇœ­Ê9XãÏ¿¾.*r*¦µT*mœ ò^Åh}TÁ(öëϧï0øžþïéÍ7C¤¬þ8Cj‚…n`3šÛÃû6x|ÐÐF B,„{ò#bžŒ4 Å1èVŒÄðWþç®,‡á?·wíö£øåöèÄYÃð¦¯ClY|g–h°Æä£m@—ma'@~¥¦«Ä¿yPG+.1ÐvÉÌÇx‰É0Y~ùöôÝ_^üý¯?ü½|súçï´öáûo þRºüõ~ü›ç²µóqLÿfÔ…I×Ò×4µìÈÒ„ëüôØÝßLùŽ–¾Ù5ê´ÓèËïê½Kš×,Ý#>gvÿ7×vX=>oICóz˜ÙÏëhüÜò±ç WR½~ÿ¯ó˧?¼¼ÞàÀ#':G a«Û²¼VŸ¢˜ÚÞ‚h­NÖ|ÆU}tøvÛÛ{ž±¦-ð-P«å¶¿®{îŸ.ϵÁ‘¿ƒó „˜ÝB!œõ ê.-k\÷—ÆÚ,i˜NjñG†”®eÙu­ÚP¯Y Z™ârÂ}_OåRWnO~ž“æú*bkàdZóP—¶=ÇÚÝ=:oÌs8´ÑMÎk5×óëyË7DÕ>þø±‡¯ÇÑw•¥çHÜîR, ”9ƒeÑYæ·º-ÏázÛq|o>Ù2‚>ÿ|™½c±Ì%,!0›ŒõkˆÝ–çpˆ½íGÞ¼ô®ãá{Zôž)ÎÇêqϺ¿·Èˆ´Ì?ôViO¡ ç&"7æ9"ímŸò¸\ràÞrsFµ€8æ#jRÖP"ZCܶ<‡CÜm¿²Íj-[aôìZ|@åÃ8§dУ¦¶JÏ[K÷ô¯.-ø^Ñ Ït ðŽüBÊ^ùbk¨Ü–çp¨\ B•ÓnÌÂ6!ûŽÑýYzIÇ•‹ü8ù{¾,§4,iÞFâ¶<‡CâŠxÎøÂ{ÅŽQÜM>àf”nÌs4”º~c­Ab¾WºnaÞ:m¶PGð(£ˆ·rCÅ›®5Xy®<ÿС¼×Wtð^ÅüeËc–KoCH³µ%^\Bߎýó}÷Cö}ú{hŽågö^ÈòÎ7…Aß?÷Þ˜çh( Ûüĵ‹v™/ô|Mã‘Ýsñ]–ÏÙ]@§»ÿÍÃy‡Î÷ð?)¯|Àž³àçÎÖJº¨wëYiüõ—ß+y|Ê:ŠËØó÷ïòÙ˜çpØ»íõÇ8n©ËWSZËê³zt?uŸ»z_ÅS?Cg3óÙ~ánW¸rSWc8S ÞâÒêÈÀ }ùu·OžÛÒæQÂ*Pë#]ÚÁÖ÷ÇëïboÌs8T®xÝ{W|UbëÍ{ -¶" ²ç¢ßгªîꃯGök|ÞÖÍí®¾¨àaêKˆŒ;vCnÌs4DÆ•Uhþnl¿zÃ<£wñ5AÒW³ã¥ÝÙ«­£…ÅÙ;÷ܺ^#½1ããnpÆ¡ýŠw¿W¤=…®NVÞx_ÇãŽw¹7æ9>oû³¶XØQ»þÖ¼^µ2åö¾Ú{/–$\ -ûŸkÜžÕøÅsro± ²][EܘçpÈ\Y÷~†±üÈ‘Ï–1Ë߶يÙmy‡ÙÛþç¬÷ïYEYaIqÅÄ ÌtcÅä}ì»w ôÙ£ Lšôýo0nÌs4T¦•(æýþêGdè»êq•î~®Ü˜çp¨Üø†ÍŽw¾,þÚÑC?hL©;Þ¾Ù˜çpH]ñD¿ -¾Zè‘kßøQzâBÓýßœ±1Ïáº÷<È÷]}žŒÎ¬ïŸÉoÌs4tægò??SÏà9¿ïê9Fúìîß¹¾1Ïáºâ“~–üóåôyÇÛ@ó¡ÏóÍ–wïïøm¤ß>Òïø†¢y‡Î•oCß;ïýGú=;ªža¤ÿq<#z4ª÷å|¢äMbÇm4x®&YAãüpŽzÄŹüôp #Îœ UÆué G’r,gÉx½øãŸÿô7¯òº³}}ùrËf.|øEu¹p¹.Õ1„½M }C?¼&]‰äB"~ß”*»T½·—¿¥¬’žÞ\š ÈmI.¿CYãç¡œT‡Øñ~N%9Ç!^ôWåûñÞÌž¡ Ïž¡†ôó¬)ßÂp.’ÎÆÓ!)cËá¹ç@Ê•¶ÉçrSÒŽLm:3T¶9/äŽ~×R§ër0a9”êrD1»Ó¿ýíÉdR¥þ Y\N Õƒ8Ùz1‰ŸNåÄXÄ„ùøFqŽu+‹LMØdàܨrŸÒy¥Ç¹î|ýh}}š’ß×lå$Ò5‘β¹ÜX"g0sqyz­Ì(.§î&åÆ«ÐLñ¡Ú áT ñ´SSÆU±qš ý\¨Ùí&±¥j)§´µª “°™Î«Î°æ¯imdÍyKøxÂm]/}¥å¬ÏZT­]«›Ì1£r“úš²5µvD'Aø­®E³éY«•Ó.ÂTD-]®éÑãIL7–æ[KÅ–*MYs­ùÉ” ê.µŠdCÒXŽg}D»úñZJ Ô¶Ö‰áÆ΄' 14?|Rû‰+´¯ÐãBÇÊmâ¤'¼LÒ²Ññò ]³ÊÊySåÿ Uø&-Ì3|0Ô UÎŒ›®¦›”¾ÙÄוÄ塱I5`(NiYu™fy}™¤…ô…t[êVcWRVeLs5¯T#k±i¨kâBaµ~Wr¡®Fàv“Ø7(?]‰';}ëª{½Y0 ;‰CãÎ'.Ž­ÅM9°ÙÛÊe˜¯ÂÇa`£^\ ŸêM&±Õm´›nÆ„“a …I<ÑèÓ ®½µ±ÓðÍñãÇ©“I#îãé—Ó0ÌYçmƇàL9Ï–{^æü?¤yߟèüC=@í2Ž[ÝØÂ6n½󑬜~ž6ŠËièUغ Zb´?‰MšÒúŠ†6Ž[Ëøš¦ìz"öšÒ45MË…~ªC&¶ ºÖ8V3þ†ð±«ÅæȼoÛLöåÒÕ‡Ãm\9z¯Z… þ8¸L“ÎMCò™‰«’tÒ¡%Ë2â‚ŠKvÃqi{°"m„'KÝp®/Û˜ãÎå¢vÞ©†ZYŽõ=לœ©kL®]]pŒ2iš² <¿)UÙÕMë@Ñè2]e­ÄXm -c¶Z-Ã'±–bó)&é/¼¦=o•V‰ž·J˜¥-åÖ¯yK®9@žÃ9NO§§”Í—L‚,ðÜMJSJWeó{Óõ½ëh{fA“!aòLõ”ÍÏRîâ¿=}ç’§‹DH©êÏ1i:r5™è¬;çâî¤À!T”X¸äî<·ã'ó(IŸð;¡99§£ÞLx‚"¯+XQOãi­r¶¬ÅGº¯„ðÐDszrÊ!Í!HÔ.c™*ú<Û­S*ÇÖGmÄpÑå”»«ðÉðóÐ%î¬ -endstream -endobj -621 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 620 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -622 0 obj -<< -/Filter /FlateDecode -/Length 4825 ->> -stream -xœå]K丑¾ç¯È³‘ù~ x¬;@c}0|èÎ¨10Þƒÿ¾¿ D2D…”Êêšv6Ü…êLEðŒ~¤(•¾*ü|§ñ_rzJ)Çà®·Ÿ.?_Խ¿RbuQØ?â7ú«V.N^çüõ'"Ø8ÅìM ×— þ.yñ—ËuùÛºŽ¾š)ç`´¿þý±œbŠQy•ÁRÚ -,ï§+è CÌYbA q[V„.'/± †3& ¬1¬‹ÚnYb˜¨Ä‚:û(°´‚Ú(%ò ˆrΧý ô ñŒžBÊ&‹¼žŽFâY;…è´×/O!Ÿ$žƒ,>+-ñ'çD^O¥˜¶<£ü䓵Jâi=yø¦y˜Q0RˆÏ@– |yÅ[e$ž…,?8ámLI˜­†f·UVK<YŒ‰NäA_B ‹ŠA‚Ì ‰pIÂãä²q˜d'—\’PÀ¤<¹­&ûÉ…%°Jƒg´VAï‚„VC‡™+ò ‹ÍNÂk -HX`-d1ÎJX`¶Þ"aÜ:•µ„xë”X.ÄTX ®MÁIX`¹p¥,aæZ`§„ ‹é%,°@]냑°Àv­KA ܵN+ p×ZÔy,aÐq²:Y p×j%,pÀ]L##a¬:Áƒ„ð•É¤¤$,pÀ]“”“°ÀwMDyq´8à®ñ‚¹»Æ+#aîg‚„p” ø£Äl¸ ñr:Y° Þƒg¬„hl2HK$,ðÀ]þ„9 ´štÊAÂÜÕ æyyÒæ-´<鲄¸‹@e%,ðÀ]Àg’°?!¢ "?“™‰VœIÜ1P€^Ø*n(`/¢U÷ À—ÖHâ¦ÄÄÊ2q×aL­ÄmüE>æ6˜0ï>ñ-ªwˆˆ™)Ò 3¦…CvßÖ½˜Ý)6ïýý/—_¿Gð½þåÿ/ŸUvÊêF‚PJ;äW˜&ÃÜÙ·Æðm Ek ’=T˜º¹‹¥„Ë6‰…€Gÿ®Û/+Y!* ‹ÚX Zý.‘xÍ{JëË`¬ EÉ.ëÃuäkû¢eY»Žx¿LI‚¬×y{Y±ÈÁ¢)&ï! -y§ðÛ¿÷‹Æ„~iÿÇÌ, -{¶Ò mÛLÉd„bPÚØDvL–&p)ô3‘¬ò†+,à‘”±ÙP,bí£Üªðoß]¦‹ó>}»dâ#§ÓŽÆ_ßýtùõýð¿ÿý‡áï>_þô½Rîóo¾Óôy[>ýüI»È~ùîÜüég.,´øM ]ªó©óµ_xµîPÏç¶âR~‘±Ö¸-Åä^Æ¢õZF£O/¿ªSûOk9š|BM¾ª×÷‹þnL—ï©ìoþ|}÷ÃåwïÖNWVK³Ó!6Ú%çîøé¹*_⧿„{æ|Ê=SWc5a5™®¨<1Õ~š?½Yh‹úWf]'2wÉÌtƒ F-.˜ÙÔ`nûmN)Ù é®Qu*K†wÙÜÃË“užÍ±r?ôÄ šu™×­â÷ó€¯Ò,¨ž5ÊYëžÔC-Þ×xì†öv=´§Œç=ô\§óГyfµ Ã4 7¸µç‰Ÿ˜•l9ƒKßrŽ9f9nôÖ¨nÔãkó“užÍ͹\ó-p¬FÊ/ñÆÑ»½ê ùlñ^ ZÛÅ‹Òü¹ÛÎ8&)_ò××ƈ ›µì{XiìãXy²ÎÓyçœsÌÅþ-×˶õE+Âd“tƒ9¥r³ôØ#ÏÕy:¼“_–hZ=Èî_…a¾",Þ0¬³78¼³1³á"Ÿ]›üo»Zúåf펷¾bGód§óÖã\ó›Å´=o>±w°V3ñ«Î Ù;mÏ#µƒµ³^ÝñΓužÍ;íÉÜs'{—vhš•vr1Â’MþšX{Õ&í9%Oeí]ÇÒ.Ù½dK‡÷µÕ&•±üðÿùûÿac)øMû’,Ö0½FYÈÖƳ–¹Ç’q.ë#ÍÐ:ÖùzC_Ê6Ï'Þg6ËJ&0—£¶‰ß±x.[Û(}èªÿûíz»È{«¸½”K<TüŸgÂ)5'®æâ%{ÒzµÞWSKU»±K¼ªS5º«vK™±Ží£móžœê(àªqL®Èê©uù¢éÛ¢°¨%p}Ðùë-=£²èÃ.cðúX,C–ý¸m'X:ÀE lÛQ˸æ1—qÉAϵÈr¨>–•>È3Ì<{Ùèa‘ œ Yh»Ì–<×/vÿ¼´õžÏ‚®sóiÑE•É/±.u]Ó‹MãÒî7KYAþ>CúìðA­|§´eeù,® Æ`uœF=êx -Moõ}è¿úq©Ã!÷ïZwYkÝÒÞç¥ fã51; KŸ·AGC_Õ÷Š˜>½íc,¾Tç~ìr¤K¯6ºp¤g‹ª¿Ýf_šó!fûÀtÃù ÚÕ<‰Ê—;\̯JY6æ‚¢Šµ]Ç[çvœ?K{ƒëZï„M}“ªDË#™QgG>Õd¯þÈm«û8×æ`þìΙ¥þÉvýc¯¿ƒˆUʳˆU®Wþr¨7·Ñ7U÷i­§b[½iÏGo£6²Y‹LD¾áÙŽú{,ªŸ’…ë)æA–9N®q¥ÆŠ1oÊOÁ–ã\ôÀ’IÚÜÍ›OÖyÕ¡º7L˜}“9QòS^L˜ Œ‹q]¡…%•³v;ÌKzeèpv–<ÖÄ9/ôãvÍ“¸ˆB»¾BÏnm—Ê\!ìIu§¾Sö°T¿$ŠÃ2ßh³<í|°š:Úòæ‹Çj¡f¹Ó'ÆïlyRNm¿Bûô¼”âîHïÔ'ëç¬y;í»d0ã’CŠxì§>3kö5.üDœ -3Ý‹‚¸Ô3€ÖÉÊ*¡·{Iú6 ¦'`3=k6tZfû¦PAÍ[sî ÔÉ:O²Ððrá¡zÏCÙÎVS £;3íä1<Å6cÇÙ[é›ÍÒm(¾™Qëš!ì²t5±óÎŽñkmÖÞÕ…è³QëêôÀ˜·ž¦Ü¡Ëž«ò$Û¥6þÈcö’ó¨…Ày„Z ‘âŒH|‰ÜPkIù -Z%1í-÷³OQ!=˜WÑG…sò'ë<‰ýb%Èzdÿ;·„[T«‹É÷ó÷ Ý·¹ÝPŽ®K2½ÔùÀÐÆ°rvùý¸|ºå;µÏ£ê×Êq¾ïh×Ú·…okížk§¦ÅƒÎò8YçI¼®‹mõ)Ôr ·<¹Y׬×mü·ÒÏ{ƒcmÛ# M­ë¼Þ#YŒ®r>ѱîìÑ÷“užÎSý1>ÚÁsb÷šoùp‡ä «CÊg=KËm}5O ñqO=Wçé<5cª<êCÿ>oý2¼ st}{+íÈ1x{ótÅëLã‡O¾–|ãƒ#þã ¯zf#ÓŽWö\ј0aýdï?Âv®Î³ye>Î/_ŽÇ6Žú°¿ Æí¶eÓ<%Êuڭﶂ•-›õãxs²ÎÓYöNW5ycQRx˜n½­LŒÖÓÌJ‹GPºmG·úÚîÖkë`«šá!2^·áÂÞ±ö¡Íƒ ïw<—ï{ìä°Ÿ«‡Þ=8Re”ý´gcŽÞI‘èUr÷üô\§óÓã n;ØÃ"~É·«í7ǧøžÝ{ÆLðUíì¬RÏÄ:¾3³ÙOä±¹Ó>í0¾sÖ·w€1³ŒéìÆ“užÎ›Ž³¬£x¶B¤;y•¼yàqòCŒäùvC±ÌV¹Ü }tVÊá‡Ûmúyr/[ã3fwŸ?º±2º•g}}Ù©ï—7E«yOo”K^'ö‚¤æw‹Üq·ºý¾}áËU/ÙYïУIz•¹MW¯Ê‘Þþµ·?OÇØL{€i6}É­–#0¤ªvÐ4/eê¾>;žÔŽæ,G“ꑲǿ))G6òL7í êw-ƒÚ+ý•#—j>öÁŽÏ´öŽKµ1ø:†)¾„ò&;]ÞfªBš´¡×_ƒ›èDPÄr-Ñ[ð¬ÓÕtº([_wj–—ÄÿÜJ-ïWô*Yz`1-¿XÊÿ\ŒþÓEg7‘þË9ÕòŽgUÈÉÔ‹N~¹Ð;¾@v®v½C&âòUµ¶è­EíPSKZ?©åk?`K7(æ¯Æ×ÑP}_«Ñ»×œª…lyûØܱ@DÍ ·d½šôB¦÷¤§É.W¡‰BÇ4±7èxÙÞ`¯x—¬­bD¿%*Ö]'WåÑô^ͦºÐ‰Mt®:ÍÌ_ËšÈÌyD¼]Э©/"•ÞÎ\›ªÚ5ªÑ,*7ª¯%›A\³“@º]âwª6í`ÌÆgV£w\ÎÄTɵr¹–H·‹XniÍ7KÅV*õª¹j¾‹Ò]ݦ¦xvc‡Ð#ýá6G”­_×d:«Ül­ó³!Þ.1nC~¹ø(”ö+”¯®Ç‰–µÛÈIuéÔ˜ªª05+ÞHÿÏPᕧ|Ñ®¹½å³_õNhn6òZIœê8IÚÅ^–©KÇØ|–ëK'%”'Ðm¥›ÆVT¦2F¹ŠG ÕÀcMÖÍë™ ¬ê§a%'ª*ºëdß\ùeEîrú6U½jÍÜÝ·v;94ì|áäØ,®é•­MÞÖ.óùJ¼•ÀæF2¹~ªt²Q-Úõα Pèä£/…\gkC§ò®„åkŸdRĽ]þz)aÎXoè,f°šÞ@Î3/}ýÊü€ßÿ»¸ëê+/ç8nTC Ó°uEæ‘Œþ^E:I¦¿_Q‰mÚ0¢q ö;Y§^ÖWohq܆׮WWØkIÝT7.'ú®CF6Íu¶L3þ€x´Ø™/µMØó¥­ƒ£S¥ô²Ô*.øpp™:Ïö|eM⊊ö®3¬".x£¸dæ.ÙJLrHÞIS=Éï¸),õÅ.XA—¶ó\³¼éJ+£`E[~ÁvšwšWòB¿zz}±Ý‘CDmÐÞ¨/œÚFÔx2Õ–Ë°¾l1Ç–#˜uòv µ¶,›{¶%9}jôÔ­.¸2jêÕ–žwê*mÕi  .@S•ÖZŒU¦°T«j)#N¢–bË):õ¯\Óž[¥)Ñs«„MYj·F¼–-Ù–yîαNõ’-—L-ðÚêzI[i۾ݺïm¯l® zfªz5¿)ù*ü{ÍÜ™ë ;R©úSvGtê/‰F v:ZcËßýR)`ˆ£?Ý]bÛ%×9Þ?Ùî’ÔýÞÌ19kUÔôÜd^ÀÈ÷¬©ú×ÝäjY‰CzLÂöP‡9µÙ*§ìY–M¢vi©H±ËRÒ›èD¥åç?ÐŽÜjû¤üü{ö -endstream -endobj -623 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 622 0 R -/Resources 4 0 R -/Annots [ 624 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -624 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 390.123057 101.433071 371.373057 ] -/BS << -/W 0 ->> -/Dest (cb139-1) ->> -endobj -625 0 obj -<< -/Filter /FlateDecode -/Length 4538 ->> -stream -xœí]Mܸ½÷¯èó«åGñ ö bdƒ,`$‡ {ÖÞE0àÍ!?j‘*Q¥»gÆ–x0žVI•ÈÇÇb‘jê³ÂÏ·ÿEÒCŒ)x:?|8}<©!8…cŠÅŨþ¿Áµ¢08|tçY`Ã’3ÁŸOø¯¹äÉOûæô¯e}6CJÞhwþõ]V‘B A9A• RÚ -*熌ó‚Ê똒¤‚.¡µ*À JÑI*˜AÆDAa†¥ íZ•`† š$ÌÐÉA¥ìÐF)QC‘5‚N»Á£Ò½¤3zð1™$êt:Igíài§%]¼÷.J:‚-.)-élqšHI:ØB6Iça‹õV‰:Øbb°’.ÀƒÚI‚. +Š:Ø¢¼Ò’.ÙÁ¥H$êt*†¸Öå­U’NëÁ›VÔ¡G¡‘|t¶xå’¨ƒ-Î*#é,l!üH:ð„³!F¡·šÜ»­²ZÒ9ØbL Q[Ðø[Tð  ™—$0! ” I$`¢(R”XÀÄ4PV¢“Ü@>‰¬ÒÐ-U°Å‘—˜ÀjØBè¹¢¶ØDX[@âka‹!+qÛÐ"qÝ’JZâ ¾%¥½Ä„ 3•ÄŒk£'‰ ,(PJXp®wJ\`AºèîAâ ֵΉ ,h×RôXð®%­$. ð®µÈ)ê` ,qØq°:Z‰ ¼kµ -xÝÈH\€V€C/q°2˜•ÄÞ5Q‘ÄÞ5C€¨ ú •¸€À»Æᤑ¼kœ2x×ñ(øG‰Þxâdw¶€`%.Àx± °ÁÀ-‘¸ÀwuÂð'ôi°Õ cò8ð®Žh>Q—PãB¿E-Úû$qïb ²8ð.è3J\Ž0¢‰ xW[ŒÔ’¼«MR8ð.ü'qà0h8`|´tE]TŠQâÞ-‰ 0 -*‚ID]$-qÈxPðC%.ðà] ïIâÞUÎZ‰ d‰ÀÀ^°‘¸ÀGR^âŸtpùDpí$. -Êu°…I\ÇzH6E‰ ‚-Ö‰ ‚-p$.€G0$ ï[œÀÀEœl§(q˜lˆ‰Hâ‚à<æc¨UIçÍèZÔEèt¸ 0k‰ 0—":½Ä ø!»KÀ è4I\lAW‘¸CÑ öëϧïÞ`ð=ÿüïÓûoÆHYùÑpÆÔÿ -ÝÀ$4·ƒ÷­ñøÖ£¡õ0 -i´Þ“'Òl¤-NA·l$†¿üï¼þ°°†ÿ8ÞÞÖÛ'Œâ—Û笒Û*bú:Æ™Å7fyFƒ&Gm=ÒØd2;rð+-ÿöõ @¬¸Ä@ë%3ã%&ÃdÜùõ‡Ówzõ×?ÿð#`ôúýéï¿Qʹï¿ÕøKtùëò“ì-~ã$ŸÒåÈ]ÍónÖk7éJÞ&ŸKe…)ýûIç]ɧ¦¿vúk–åÕg(÷|@9Š=OkSXÞSMåæ<‹|“môД£ç2é‰ÉË÷~™ß¨é9ÓÚvm¾ÿÇùõ«Óï^/Á8z¨3N(e–ºŠß¾,OÁïKÀÓÝ+°]5‰ÏBúÉbÏÒÂx_VfÉ_ꩅ☾¤)ÝB-m,ÏQë£ÈÍ|­dØæÈþB‚#¢Þïà¶3ÏÑ€‹ÙÕUµ :¦ 7¬Fõ\Ë™$¬^Ö45Ähkm¿DEEvAZ£—ZQ½G™v}?ëçûÔr¢|Ÿzÿ‡¦¬ù~NwÁ-êØ@påY6iogÒÎ<‡C$]åÒZ‹®©=>tµC±›[ª¶ «õÅ°÷fo¨;6Ÿ·È«= °4/‰Tæ€bâ™T4y2t©}y‡ÔëÎjÒÆò'ƃœ×¶ø¥´ŠoZVïwèŽòm¯e•³[IÉazª)‡®£²/ÏáP¹ã‹î¡èÖÖx.¿¯ÕS¢/å22º/;ó ™fÇ×|ΙKÊošÝ<7¢:òˆ{o tö%»gDy‡ÒÿóSͽ_Á êîAî-ÏÈg…mu–UþÚ湺<×& -ÝíóòÎ<‡CáußRÓ„ºÉ‡Ô¶ùKSmæ4~J'µ¸0‡ß3³(ÌVp³´ðÈ]V¸ï»¹\jg* ÿ‰¦-O ôΧwÒj·f2†…"»Gæ¾<‡CÛŽÏH J ¾]·¼Q9Žö¼ýéüd¡–ùyS1ÒïE…:ó ¡öºïød>¹5ÂýŒüóuöŽ Ä2Ÿ0oq1Q·‡Ø¾<‡Cìu?òfä]A8_©ûf¤«Eo™å|ª×ø¬÷÷– D2ÿЙA9ò=×Ù—çpˆür×Û[®Î¨6Ç|DEÃVÜ‹Evæ9â®û•[k9b4„ÍTÊ 1hQSZ¥å­Íõ£·j½㙼‚§m­xn@F%±õëÞygž£¡’vâGå´+³°.dß0º¿H/i¸r‹‰¯[wîzëÌs8$îøˆ‡áŒ¯¼WÜ1ŠÓ{3;ó¥~c©Ab¾×Æ>Ž²v'—9iFùŠœÒšoXyaÆ'áï"ã«€ ªÇt7”[Q(ðm-ƒõÈ|ïqêÄÑ‹}¨e³¾ižsgȱؤOhgMjoE²3Ïá{ÝW5q¿u? òÞ£pIÇì¹y÷£ y;ìêñC‹Ev#°/ÏáøùýP×”³BÆós ÌÆm[W½ñæõÿ DÎþaþJ‘¨‰ÜÞºygžÃ!²3¾ymwD~37L¿~¿U¾Z»Â(D¸«®Ýa¼å×n¼?³êIn~†çØÛãïØÙ™çh¨ñ÷¯e/x¦{6Ü4ú€ŽGÌë=Þ/ËÑl/Ј2^^3Kjùpe _+iæ쫽êïûxéÅ{@gœÒ³˜cïl¥3Ïáûÿ8å¢g핵…ÊŽ=˜÷¡}¡,ÞØ»ÒØ™çpÝyçN.hßgZ­V#eÞø_ìHŒ·¯étæ9w|ÂCñÆFtî+2[Dd¾iPŸw'—Ê“ß»ÚÅl¦tée92¨Û9²3ÏÑvÖ½µÚ|g»g¯wwëû©…ùo‘—=íéòw«åë,cãK5ø=G¤¶ú‚Þ«˜¿lxÌrëmi¶¶Å‹[è»c?dgžÃ¡¯s?dÛ§¹‡æX~fë…lï|Û@áïlwæ9 -ûüÄOµ‹v›/ÔzMãÝsó]–/ÙÝ@g¼ýÝÃÎ<‡Cç|ÇÏÊ+ÏØs6üÜÕZIõ®=+N¿îò»Á§,£¸üVêö]>yŽ†½xÝ;ë-LqÜ\—oç:4†Õgñè~j>7õ¾‹§v†Îfæ«ýÂÍ® q妬Æp¦¼Å­Õ‘‘AÛòËnŸ´¶¥Î£„U ÞoUÚ¯ãocwæ9*w¼ÆöjتĽcÚ]o¶˜ÛPpë÷jmú -«¶ß‚Æ×#Ûµ>okæv‹ï*x3÷ÆMDÞ±²3Ïá¹³ -ÍßmWo˜g´â.¾&Hj1;ÞÚ½ÛúWZXœ½sÏ­é5Òû+>nÖWÚ®x·{EÚØ“oêdç÷+ãøïrwæ9>¯û«¶ØØQ»ÿÖ¼ÚÕ2äö^ìÀ½K.…}á/Š5nÏnüBfÎĽÅÎoöëÌs4d¦uïËÙù"<`³w|egžÃaöºÿ¹êý÷¬¢ì°¤¸bâfº²bòûn]}ñ(Á“ºÛß`ìÌs8Tö}óä×ùþê'dè›êq•w|zgžÃ¡²ó ›{¾%ò«â¯;zè³Æô+RœÎÊê\>«(:ÙÑž»Ivи>¨£wqÎ?-Üü„3ÇaȇäÚx†ûH)äse2¼^ýþø ƒWÞmÞ]^D¸~ñÙã÷áòUàù:WÇ8Dê2LB?n©.Äs!76u®²KÕ«i‰:ÿ½|­x®òKd¹Éiýåw,kú<–KsN÷ËðËùó×>†‹~Q¾›îÍìËpìÊðŸVMùñäÇ3’ôxNžòqÐ&¤{ö4ØÜ6éœÏeŠÊ’.M§ÇÊÖçœãñÃkªéDb•)ÌT]Ž+fSúc£8éDC®ÿL—ÓCÕ(Ž¦\ÌâÇS>=–1Ñ`:ÅY8}Tµ,Ò%a•=€sÃÚ”Ö jú˜jáÖ•Æ•§Éù]É–Oõ!UÙñ\›Ë!rz½ç§WƒžÄùÞ8ØéÊWSœ/6C8H<í\àœqW¬­bB·*v»Yl¨Ø£ó‰mµêü,¬¦óªÓ¬ùKZXs^>œp[ÛJEi>÷³Ujר*³Ì¨T¥®¤¬ BµÑÃI~«JфƬzÖjùô´‹0 QM—J:AôpÓM¥¹ÚR¡¦ŠsÖTj~6e†ºµâÙXG“4ä#ÅYQ¶|\Š}nÒÖ*2ܘ•ðá„!†VâÇ“ Bj7s…rz\hY¹UÕŒ—YšE.ŸÐ5‹,Ÿ=•ÿ¿P…«ÒÌ<ãMRùü¸ùj¾Iî›U¼¬$.÷•uHªMaN˪K‡P1ËëKG%¤Ï¤[S×[HY•1yHżLR•<–b]QWÅ™ÂJýT®äBUŒÀíf±«P~\ˆg;]íª{¹™× î®–;‹}åÎG.µÅu> °Ú[Ëe˜/‡q`£Vœ¡ËMf±Qu´›oÆ„³a …Y<Óèã(.½µ²ÓømïÓǹ“I#îÃé—Ó8ÌëLÂou>Û–{^úü¤y…ßžèüC9Lí2ŽUÙÂTn]ˆùH–OBâ|2zÖnĆíÏbç´® ¡ŽãÆ0¾¦9»š‰½¤Ô•AuÕr¡›ë‰M…®Ñ–ÕŒ»"|hj±:2Om›yÀ¾\Úòp¸ÍÇð«pÁ—qÖÙyH>³"q•“ÎC:´dXF\ðBqÉn˜fËff@ò›ÔªÏöo -›ïÅ.˜‘/í¬£y˜åEÙø, \`Ë/xÁ¤ùMÓÂÁ軻דÛ}2Ù—¥•Ú«ô‘Këƒei%Â>(-†‹òþ5M‹ðÉøó_¤íd -endstream -endobj -626 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 625 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -627 0 obj -<< -/Filter /FlateDecode -/Length 4531 ->> -stream -xœí]K·¾Ï¯˜³·ù(¾Ã‡I#b@HFÒH²¬Ø9äïç+6_Ý]ÓÓ³Z+#ÇZ¬vºŠd‹?V±g8ú¬ðó¹Æ‘ôc -žÎ—O?Ԝ¿\bq‘Õßâ7¸³V&§“îü# l˜Br&øóÓ ÿ­.ÇâO§¿vúײŽ>›)%o´;ÿüŽUd§CPNP%¨”¶‚ʹ)ã¼ òzBS’T0Ã2´U˜A):I3Ș(¨"Ì°´ÝªÌ0A“¤‚:¹ ¨´‚Ú(%ê`ˆ"²FÐi7y8ÝK:£'“I¢.@§ƒ‘tÖN>vZÒ¥É{#Øâ’Ò’ÎÁ§‰”¤ƒ-dct¶Xo•¨ƒ-&+él1ðNt¶]QÔÁå•–tÉN.E"Q— S1Ä­Î(7¹h­’tZOØ´¢3 -ƒäƒ 3°Å+—DlqVIga áGÒ'œ 1 -³Õðì¶ÊjIç`‹1DlÁàK `Q—&àqaÞÂË“ö>I\àÀ»X¨¬Ä¼ úŒ€ã'¬¨FâÞÕ+µ¤ïj“”ļ‹¸ÁI\8L€ÄXß&­]Q—&•b”¸ÀwAKFâ¬Â“Š`Q&IK\2žâP‰ }»ÌGL§±8w~õãé‹?ý·¿|ó-øêýé»/•¢÷_}®ùï¥üuó_ÞEvå5Ñü×ÎÈÙüÆ"—ê¼ëz튮Ö]ÕséJ[¡”/6Öú¬kv¬íÝÖZ/{ùÒ­—6º '<½ü¢N½\ÚÑì[Û®†¾V»^ÿ]_¾æ²_ýãüêëÓï_-A—³¥t„¦Ht§Çª|N x¦´ ÏwÝíšÕÝmèãr8¤¡; 54Ç2ihguo£ -dÓ0](šÓL†&?Iª@³ J懬óhàD6¿‹Î— !¿¥RþCFqÆ­È÷ÃfؤZº{µ?XçáJû<úIòϯ™×Cp‰È8©h8ßGè±:‡Ðè3ygm¿ý¶Ò_釒·°cÌÛ±ûèåsåЭWVuûŒçíë<Åš/Ácu¥ü4®ÑíìªÎ*žÍèE§µ-(Šóß«í¬û$Å‹«øõ¹kĆƒÍÒö«\ŸÁ•Çê<:oÄœëXìÿ2_¾³­ÊeDÒøœüàŽûÁ:†Hº_®F¢yu'º‡I\øŒx0£a•goxøJ&´æÌÆ‹ãìÚÄÛlé—›µWÐúŒ=̓u­û±æ'Ëi×Ð| _ï`-fâGAWÐÙãHMídƒS·Ðy¬Îáó`ìy%z—vhÚ(]‰Å˜K6ñkÚ«cÒÞôÎ}ISνk_Úåðþpø‘?X¯MÌ}ùúúã_‡¾dþæ}É!Ö~–+ðºi}YÚÛ× ¶o.ëÏÎÚÏùz#/eû~û‚ý3ëÚ} §‘‹KùÒN¾SË*µm+—½tû³]¾ÛÔÊP‘gr°ü]í»-¿n˜må:÷¡ø§öCÕ }C=µ,Olëež¥ÚÓü¦&Ÿ,ŸúPl²eœœç{Ì>Ì>~»mÇ[þHì~ÛŽ*ýšý”}µcêóŠª÷eá#3ÏÁ6>~Á+2> mg¼¦¹~ÆÈûÒÖë‡Ýçæ]ñEµÉ••&v_s3.Bi·ø¯c¬”ìoxÒeÌìÜÞˆ·Ü–•í³¸6èƒÝ÷±]û!ÛXl¨ýÉ2Á¾ÅëÕý+Žçy3ø(õ×Zw[kÝÜÞûÒÆ0ÆK>Æ÷±ü÷²òÑê^{y:Ûû˜±TyÂKã²ëK·ñ¥À9=æ+>¨x»ÌXš£‘aìýà›Qÿn–Õ(…ËççK®rÙ¡Ï9PCÛµ¿un‡ùono…o]ëSWç¤ÊkÕžÏÂÚg{˜j¶W<Žc«{?Ü›?kÌnÖ“ÛÇþu+ã½c¿‡«ãV°ì -^שsâúWÆVíú5IóúÚZhvÛB¶jË”¾s³òí:ò ÎMÞæñ1H‡ÍÍÈï`g}ÔëC>×ìõiŠÎaÚˆ!_žNëtR×é9„Fó \½aò‚ùˆ„Õ ¿[mh´2ù~»1ˆó¸B»®Nß«µ)æsE¼¿fÕúÎOÉaì¤ú90[Êî@›ùÈ.rÞîxjoÓvL굑»#<вùóóüYâgxŸO‘ó@£Ïó>ñèW­y9ïS4˜q‘fíãÔ¥a4vïµN]Džâ“’y1Y1Lžo– þ"(¶×Ým Éç2%>euÓ<Û¯aä·Ï¤Æ˜×*ÐÍ·ú¬ó )pãÃÈge\çCõúú[qî~£B[Îäm65l)®gp•o¶ü®l¦4[îÀ$˜h“ o¡ CÑ0Y‚ŌŘ­Ù⑦”\ zuÃ=<&Άfl9åm¬óhxLVïáñÖ#«ÆY5Ü~=¿ÞÈÝê1­Êñu•J7]gÌPΖ߷å/•×ÜþÈ™kûr˜¯µÍõ¶Õeé³kù‚ £¡ÖyÔu³ùT Ô­lpõÁ#Ö qëù…·Å#án`-ë<‘½fÇΛēï\wô­¹ë<Rã>?ÚrBGͧüðYBÃâM”G‘¥å¶>R“¹©Çê<Ráš}RU+H½é¯çݱ0ý¼¼¾ü0]±c÷õa¯Sm|:þ±ì[¿³Ý½]ù«>­ßØÔ`ùm9A)8Œ s|‚]t:25,Þ,rz5ôÞ0sÖ«C}–Ñ9šä£Óm< ,>mìZlΛü¦½¹ -¯ý¼ÑlËÆ>3K{–J™Ó›·mã²lÜÖ ¾ߗż—f¹iH†|ԫ̓ƒ|¿×%/¸¨Åægkg3¹õÁÕ>l†ò§“Ï'çé|zªòqÒ†W?{šxß> 5|êž%]‡Nggëó•šùPúŸZ©rN½â£kùØÂùûᢔÿ)ú'hbÿç'iùLi•ÅÑÔ‹.~:ñ™â$ˆ‰úã¸b–—ªµEº=Ý«² 6Li]yˆ*/û#@NNæ—ÆÕÞp}W«ñYo¤j!›O;›o,QÓë­˜{¯&]Ä|.{œl¹òÍÞ€kÂÞ e{ƒ½âM±¶jº­P ·ëbCÕÍçx6×ù.l¦®ÓÃðײ& ù'¼œp[»–>‰R> º6U½kT“ÙÁ¨Ô¤®–lBmœÑå$?WµiÂ`6ý0j|¦æ,ŒHÔÊ¥ZN]Nb¹Òšk#Z©Ø«¦êùnJ‡ºÍñ‚ì2<&üEÃQ¶¾\ŠùInkܘðrÂCñÓÉ¡´ë\¡\…Þ(´C»MUÇK—†X]…©Ye|"!ÿ?S…kRfžüBSƒŸ*Ú¯úMxn6ñÒI£Ü7Ö!ÉšB/;¸K‡Ð0;úKG%”gÒm¥›ÇÒÁeƒ<¤j“T#¥X7Ô51SXõOãÊQ¨ª¸]»姅¸ÛéÚTås‹ÐëÛžqçÓ(mÄ5Ûìm혯ÂK^Øh-fèÇz“.6ª­výfƒ°RèâN£OY\gkc§|öByÙ'™´â^N?œò2g¬3ü”Í[Í'ž‘—>ÿe¾Æï?Otþ¦±9¯ãF5¶0[âq%ãïLjÅü}UØ¦Í 44Ð~ëØ˺Š†¶Ž3ð5õêª{-©ƒê¦…®ûp›]£íà·#¼¬¼Ø™›¾`Ï—¶vŽŸòá¬Õ*\ŒÝÁeì:Û—äóÐ$®¸h_Ò¡%3TÄÅØ(.‡¦nÙÂLäx“æz¶ŸÆ¡°|¯áb#øÒvõevlºÊr/†"íx16Lz¼iZØ#ýìéõÁã^Löu°´Q{“>ÒÖ1–6“¥6_úåe[sl~¸V'o÷PkËs϶ §OZÐâbÄè ½Z)àÆ›R•-nZŠF©*k-†j“/Õª[r£è¥ÐbŠ.ýaô´G¥9Ñ£â7e¹ÝºâµhɶÈp½wª—l±dd~¬Ý¤ÔKÚ*ÛÞ›–÷®«íyèuC|LU¯æ6%ŸÅÏ™;sÕN„TªþäÝû¡ÔX¨Iklþž1½‡UD 8l—Ü]gÿd»KR÷OÆ;a8&²VÍß'›ðEº­šªß&'WKJìÒ}¶‡:Í©ÍîPþÊ ¼™7‰ÚeàT‘¿!ÌrÐù‹M‚Òò{¡ßä÷AÛ'ùç¿Î—ò -endstream -endobj -628 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 627 0 R -/Resources 4 0 R -/Annots [ 629 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -629 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 277.623057 101.433071 258.873057 ] -/BS << -/W 0 ->> -/Dest (cb142-1) ->> -endobj -630 0 obj -<< -/Filter /FlateDecode -/Length 4620 ->> -stream -xœí]]¯ä¸q}ï_ÑÏ–æ÷ìC€Äð"²À ~òp§gÇFp×ÀÚùû9T‹d‰*Iì¾wf´Žç¢§[U$U"O)JTW‰¿ïþ‹V‰SðözûùòËEŠà$þM)“úG|‚»*iƒp*ùè®?g "$§ƒ¿¾^ð_wH“¿^þø›Ë_–yÔU‹”¼Vîúן²ÊbÒ1ª•T†Q9'BÐÎ3*¯.1%N3\°Ú®Ufا‚VëȨ"Ì06(³V%˜¡ƒ²œ -f¨ä£Rv(-%«ƒ!ÒZ£r£Ò=§ÓJø˜tbu:4§3Fø`•Sœ. ｋœÎ—¤ât¶8e­ät°Åš8‡-ÆÉê`‹ŽÁpº[4j'1º[€®Èê`‹ôRqºd„KÑZV— “1ĵNK'\4Fr:¥„6 «CB#ùÀè4lñÒ%V[œ‘šÓØbñÇéÀ΄™Þªsï6Ò(Nç`‹ÖÁ²:Ø‚Æç@{Ø"ƒç(=Hd^â8@‡ lÒ–#°ÑFŽtL†`8ÐÉ ëSàxÀHV [œõ[,z.«ƒ-&YŽ Œ†-HÀq1°E[ÃqÛZ …㺵2)Ž øÖJå9.0 \˜)9.0`\½å¸À€r¥Äqçp'Ǥ‹î8.0`]ã¼æ¸À€vžãÞ5VIŽ ,x×ädu°æ¸ì(ŒŠ†ã Þ5JŽ ,xÝHs\€VÀ¡ç¸X:FÉqïê(-Ǽ«\« }Ðp\`Á»Úá8Ï ÞÕNjŽ ,xW[í9.PøG²Ñxâøp¶€`9.€¿‡NŽ P˜ÐK8.pà]•àþ˜> ¶*&Ïq愈æcuI¨€gú-jY(ïǼ Ge8.pà]Ðgä¸/àQ5Ǽ« <5§ï*$Ǽ‹¸Áq\8…€ãø7¡$ Ëê’)FŽ x´¤9.€2‚IX]’â¸d,$âPŽ Z‘Bðø$¡CÈÇê¼À±ã¸ H(‹ÕÁ,ǬE2)r\4l1Zs\4lAÈÀq"‘¢ovx[v|`a "EŽ Àd"&k9.Îc<†Zåt^‹@׬.B§Ç!XW¬8.ÀXJDtzŽ @ð"‡KÀ è”å¸ $Ø‚®Âq\‘ˆ‘9§S°A6Ljt¡SŠã‚¨a ¢AŽ ¢ŽezÉq<4Æ’¨jNgegFŽ ¢õ"‡Š ›`¤ ¦du°4ÁqÚ'¶Çü`°‰a«ƒ-ÆYŽ bÔy¸9.ˆ¶h©9.6óx3p\$lAÄÇqA’^ä0™ãÐ8tRr\TÄxS[Ž Ð/óx3r\ŒÄxC<¦ß&ãóx3p\,lqQXlAД˜~ NÂxìÄéûD§¨<àà3cÈ™Ð-,¢û:æhÉÌF²ûüØ_ÿtùí œïõO»|þÍ4SVþ„)µE|…n šÛ!úV¸|ãÑÐJLB;YŸÉ“©©@‹ó¤[6î/ÿ»®,,‡á?N§7õô ^|:=Ü'‚’`,€1|æ‰ÅfyGƒ%Gð¶iLÒ™9Ä•Ò.ÿó‡ €:[qŸ­‡Ä|øK †­v×?_~ûo?üç¿ÿáGÀèÃçËý“”ö')]üþ;•»ù»^»pÿb=β>O"éÝFRŽµKYùîó8¿üVòûÿ¾~øáò/–5Epwx™\6å^¼Û¾cYÞÒ¾_¢Y1ÜiÖÒTîÖšª¯JuÖ«–~ÕtŠ4Ñ ‡œÇÀËÏø‘æãò缺kâ°Îëä²|i„0ú¼ü®e¿lÀö6§ö»‡½}YC7×ë Z»µ‘ižçž!g³#Šyþ襃yÎSŒ5öpÚ·ß„EM~ßZÛWy‡ãEþŽªìÇ{[M´Ôa¤ä?ÂTí?·íóUúº-Ëœ0܇ö?KúNý6Ýõ}ÂGçOyðš•À0 ÑÊÆCŸ6˜çth²»¬·ç̌ԣ¤G”"-J[ßꟗåä|•ÅRkyEQðyYFÏz½½SÞŽÍjY¢3£Vfû©•¥Üº™S{ZÏ’ŸH¾ñ´×n9gÕB©q¤Žå9R÷îžÓz´en0j?Mnmƒ–Õù3·ŠöLK÷­HÐý–,̡ۨÜ÷ÊŽžÝISšUŽœKϽÊ.uY^}váߪÛ@" úò„`œ&qö‘8–çtH<ˆK+\[ê#ÃGz›c&ÝV+3ƒ)}iñÎ+/t%_é5ÅCö<Õ!#G#È+çÜDl.âÝèíxY•Èc#²ÜG5\ÝâÀáÎ`ž³!WïÇŽÛ}þܨ~3ªÈµôH^!˜Æ¡vYO=9_PÇ]·åuÔúxÀûësÚBÐàýrÇòœ¹ûqjQt±à4Ò$^šzÚ£h G+OÝ{ò‚´>ædZqŠ.Ìú|Æ“˜Ø/í_Å‹dbQV|ßÒí"¸G=™Ýx&Õî .Ës:DģݼH­=꽶F(„£h­/<ßË[b¸oÏç=òVS™ú #•ÄžJ‹$£Î7Dö‘:–çtHÝWG6yÈO„)¯mñKißµ,ãŸéÎòí¨…G¥!s’É 7 ÎP9˜çl¨4±èŠm÷ŠûFP½1*úu |™æq¾Ìs:dÄšï9r@ùC£›÷F4AGö¸çAðJ[,9<"Ìs:”ÄŸ_kìý%Ü¡îä>rï}ÿÈÄÇÇåƒyN‡ÂýØRÙu/³Úv®ÍœÆÏé¸gÆð‡cf2 ³5¿YZ¸Ì¼¯ÎûäbŽÃH ôʧ]tÒÏÕnd,™‹õ̃yΆ6{3>sŽÌ¨œ'{_ŽþzqòBI˜,ÄEú£Y¡Á<§Cèó÷Ó‡øäÑîw䟿ÏÞ±Xæeî:*íŽ;–çtˆ=XÎø(òv¾·è¡}d”óµz\³¾÷ýuKâC§…tÖgôì#r,Ïéù뽿~ÚÞ²;¢âçäãk‹óœ qn?®Üº—ÃΆÐ5A/ϯ•Ü¼ôQ®Wa¼STð¶Õïl ’Ü¿!Ìs:TÌCž•ÓvFaCÈ~À»‘^Òqå&?ÒûÖƒ+Þóœ‰1âi8ãï¼W<ãÅŸX—9˜çt(ŒK Z¹zÂdµvœ lµª—›9xjfµÒAÊÝ'sèìtµïÆØÚ­éTŸÞŽºß~ñ:äQìåããñÁóQ~|à -Œ¯ÂßEFïv¨žÒ=P.}ªn÷!ß[;÷´>uæèÅ:ÔþɽÁ{DžÌMú„vVVÝ‘Ìs:ÄîǪýóµ\ë~ä½0^¸¤#ö<ƒ¼çÑ„¼vÄ¡žÌE#p,ÏéøíãÐþYÈ2vâÍo2·m]õƇïÿóˆ ->̯ŒÊZwtß|0ÏÙç7÷VGä·ó„ùÃ<¹«õw™îªëWoŵÏϬz’k×ðk{Âë óœ5ÿx6|ÌþÙðoÝç)™s­ æ9bÿ1O¹èYGem¡r` æshß@h|ü}ƒyN‡Ðƒgqžä‚þéÑi4¡äên$Ïÿ{ÆÆË®äã÷tóœ ‰ñ &<o¼Á£ÓX‘ØÂ"ó¥C}^\V*Ïqïj³žÓ¥/Ë‘ñ‰w æ92î{+¹ùÌöÈZïáÖ÷s ÓO‘—5íéþ½Õòu”±ñ^ zÎ ©½¾ ƒö*/k:g¹õ47ZÛâÅ-ô=±r0ÏéÐ7¸²ïÓ§\Cs®8³B¶W¾m ð‰g¶óœ…cqâ×ZE»Írÿ ›Ï²üšãPI>þìá`ž³¡3½!vü¦¼òŽ=g#Î]Ý+éf½kÏŠóÇÉåÛãkö1eñâ<öÌã«|óœ{ûÑáToažÇÍuù±Õ¡Ö¤>KD÷©ûÝÕû!žú:™¯Ö w«‚Ø;7ån e*&Zܺ;21h_~Yí“Ö¶Ôqshô­J[þ:=ñ4ö`žÓ¡ò j|÷·0î#sóÉý -}¯ÖfÜгjÿ4z?²¿@ÇmÝØnñ®‚—Ö7ùÄjÈÁ<§CäØû̧{býÝ­¸‹Þ´r1:ÞZ}Øú;-ÌŽÞiäÖõîù‹¡÷ŠS}Ëû[žx_øñç½ ‚CS:—÷â‰NE²µDåa’ ®7¢(Û9\ó_2?£Ë#TyX¯ül -yß” ªþõ÷¿ûªéå¹?ÝÙ܃šû t§Ôûûq¦Ÿ©’Tq´÷îÚXÂòxSCäJ¿Sœ§_ò÷ý•y”w‡7-TÉiýý3•5ÿžÊ‰Å1ÏçËÓã9~¥I¸ëå»ùÜÄž© G®Á•kø¾oÊ_.~ÚHMûÀI7¦óF±Wo…Ém“®yß¡(U¥éÔTÙ꺑sÚ^÷—šjÞqWæMøòL÷íxÉÁœþ—©Ñ¾¨dE®ÿL÷Ý1å$Žº4ñë%ïŽj±µBŠ³pþ)kYV•„UvÓ‘ú”Æ 9ÿLµpãÊOíÊÕäü®dË»ÖXY™iß–û‰!rzµç«—BÍâ¼Ãlf>òÕç‹Í¶-MÛ -lÅÊH"tk¡$§kbm‹=*ïHV«Î7a5V"Í_Òê@šsOx»à´¦—¾²Ò¼¯e)ªÔ®–UfˆQ©J]IYÄÖvbD· #üN–¢-³êI«åÝÁîÂX€dkºTÒ1¢Û…M7—æjK…š*¶¬©Ô|3¥AÝÄZñŒlª£Yò–Ù¤HS~.Å>·@ik nôJx»ÀÅØ•øõâ“Ú5®®@ - )·Š£lxiÒðß¡kYÞ[)ÿ§ -W¥™y¦ÊVHåýÑÚQ;Iî›U¼¬$*÷•u,Wʆ––T— -¡b–ÖÆŸLúLº5u­±…”T‘‡TÌË$UÉc)VuUœ)¬ÔOåJ*”Åœ®‰]…òëBÜìtµ«ìåd^¸»ZnûʯTj‹«¼Ù]µ·–K0_„·É±Ù^œ¡ËIšXËêíÚɈ°RhâF£¯“¸ôÖÊNÓûà短“q÷vùóersÚ8ðÕ÷n¥‘—ºþ/Òü€Ïÿ\ìõe³°»ײ²…®ÜºSO–wúŽƒâ¼ówÖnC„ÚÚob[ZWÐPý¸Ö„¯mË.±—”ª2¨ªZ*t­‰XWèjeH͸á­«ÅȼµmšÃ¾šrq8ÉÛÌ«p@/‡±éLsÉWR$ŽrÒæÒ¡µšdÄ-‡ä„©Y¶03’ž¤V}¶ßÒ¦0ù\䀄ùÐ4mn–]dÓU$ = [EOšö0F?ݽÞÜî³É¾ô€,­Ô^¥¯TZ/,K+áñR3úåaõ9æšJçm5TË2¤ï™ä´®ÑB »8 %ÒØ²Í =©-²ÅI‹£¨t™,²Zb(6ù9[©–éŠ#[K¡ÆMúgZÓŽ¶J­DG[ůÒær‹Ç«Ñ’©£píêdKYcÉÈÈ<Í]¥¶¥4E¶>·]ž»xÛ+¹ Û ñ-2•-›[¥|Šÿžé;÷<ÝL—ªüM³#*¶í5ᨭ -F›kÊáNôbó¦×ÁF2]òpžýù“õ,I™?¡gBskŒ -xÛ0áŠt¬ E½Î;“òÙ’d/é± -`¦‡ÍÉÕìfžÈœ&‰êaÈCE—¦-ªeŒy‹ö ;]”ïÍ(¿˜>™þþlÉ²Æ -endstream -endobj -631 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 630 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -632 0 obj -<< -/Filter /FlateDecode -/Length 4489 ->> -stream -xœí][¯Ç ~ׯÐs€læ¹E -´E¦h£}úp¢Ø ŠãNú÷ûqvç²»ÜÕJ>qe'>¥%gf9ò#9’Fú¬ð÷¥Æ‘ôc -žÎ—w§÷'5§ð/·˜]dö·xwÖŠÂàtòÑß1Á†!$g‚??Ÿðßâ²oþ|úǧÏûè³RòF»óÏo˜Ev1åVKi+°œB0Î ,¯L1%‰1\ CkV€”¢“XƒŒ‰+B KAÛ5+A 4I,ˆ¡“ K+È¡R"‚("kžvƒ‡Ò½Ä3zð1™$òx:‰gíài§%^¼÷.J<‚,.)-ñdqšHI<ÈB6‰ç!‹õV‰<Èbb°/@í$! ¬+Š<È¢¼Ò/ÙÁ¥H$òx*†¸æå­UOëÁÁ6­ÈƒGa‘|x²xå’ȃ,Î*#ñ,d!üI<à„³!FÁ[ {·UVK<YŒ $ò _Bã!‹ -^‚xÐÀ¸$a€ a dHí@‘¢„&¦B° ˜äò)H8`•Ïh ¬‚,Ž¼„VC‚çŠ<ÈbIX` dA ¬…,†¬„hK° ,à–TÒXà-)í%,°\ˆ©$,°@\=IX`¹0¥$aæZ`§„  wX ®uÞHX`»–¢—°Àw-i%aw­EO‘Y`À«£•°€€»V« awáFF¬ê;ôÀV£’°€€»&*’°€€»& ˆ¼0À­„Ü5S"7p×8e$, à®!ã%,€¡ À%fÀ]@ˆ“ÓÈ€•°ñõ[Tæ3càI&¸!»¯5Gkf7šûc?ÿxúê Á÷üãNo¿È;eåO#AÈ­ ùÜÀ$,·Cö­1}ëñÒp`fb !à=}Xˆš°8mº±üï¼~1“‚³èèºÈó^@ œ†÷åÑ E1êÃ1³‰|sŸ«"dé\_hYÖ¦ªþ¾MW’¬7÷yqYQÍ¡duH8ç÷…¼ÖøeŸ‹ÍÉöÏ'뫛ʠJÀ]˜ë]^P`…Ê©–G› ‡&à Š -E³Æ¿}JMRŒàõ²É’FÔ1îüúÝé«¿¼úû_¿ù‹ùúíé»ß!~©ñAôõ—×ôvþìÌtí§ç© ÓuŸy §»ö¿Žq™·qnzžøFµñ+/ÎÇS¶›Çvó±Y–2þl~A¾w·ÈÐË‚$ å Ox`0mÏ$Èã㺹޴úúŸçׯNx=7¶\~ŒÆfÙ(qÚµÏc]>Ä> ³LiÏ,ë2]æêËËÿ\êLqâ1½šo1±ŽW—š:)Ëôýz©f}Þt¦ì&ÞÖ§±ÊœÞÎM,Ëý¦3ñ…IöæTÜ+»ÚÒEÌ|üú¼”…ÝK º(.ò´î“Í[4X~ÃæV‹=ØçÑLEó!(õ‹u^BKØ^—kYá¨@O˜ìq Kfj—v éùÜR¾§ÉvzØ}šîsͦ‹íÙ…¯ßâW0ªmEJ™³&®Vö­òXŸ‡³JÚGÒÅjו‹mÅ\,p3p—ºq(óÙ"ôMzÜ°JwVëópV¹Ÿv.ÓIÝ­ôÒâ>oüºÃC;Kw—õÈ Kí’Jþd\Ê_µÔc}ÎR¯d¢¿ -¼ÚðÈ…¥ýg©WrÒO^ÈÃ8Ò[w{M°ÏÃYèÁ\46MÖ÷ç|[½¬õ.ÏËxÕ½ ï¦ø-ªßÕïxþ`Ÿ‡³Ä+9ççX¿ÿÞõ"8©Ûkõƒ}Í*éÊžç'‰5/äM#xÿY‘™%>uV½óY“åGÀj|å]Nºã½÷ƒ}ÎJ÷óÌå'sªÖ—8Ö}ØŒ:¤Tß+õ»2W;=\çaÓužÃ¤2$3ÔÍ!týÔ¼=ëE]FÏÔ~Í÷2ñÑ!>Y>fn’ÉNëâ<ßcÔ!§Xã-ŸÁÀç|­ÇQÓ¼F=e]íɤiCÕæ2Ó¯‘ýEÏ{óŠŒOÂØÙ>ÓØ?ÛÈÛi¬§ÞîšÎÍ›IE&7E—ØtÍsÌv¦q'ý5›Ú -òW{ÒÓšÙq¼ÞÞòXV–ÏâÚ`v_Çn©‡,ã$C™O¦Iò¹&{šÚÆÆ_ÊTl{ô¥No©½–æ½òkÝæXÆÏ÷|ÛÚÛ˜ãF·~¸‡åçËB·3yvu–ºË>jæëålÓa¶Õ‚C~gݬjùá(£.vz×aÌ\:ÝùN7=ÿÍH+MÆƧ¹=æ¶Ý\ræ º±Ë< -&„ñ¹ä£úJ+[[ø.÷¸b#¼þ®ø½õ ì\‡Ëõ®ò[îìmÜÏl&ô½¥m/l4ÓzùƒÚ^ÿ¸§·¨Wz£É÷'\YÛÉÞÝeÛŽ*þºNq®“â_÷ÄU£vçÂÇ¿Ìæb¦¹ôþZ°{õEõ¨oó| Êis5s<Ø箓)^0etUÞDCt.(á—ÍtYŽêâ²]Z5.Âæ “GÍç»-nøÝbC¤¦¤åK½û㛇LQa\÷öë+½)æC½ß’êJç‡ä°vRÿœä-mw`Ì|Þ09ow4õ1¾¶w`þdóá_|ÒÚç#0¡<6gz¥?¯ðÄš—Ó>E‹„”mßN]÷¥óý{-K§29`‘‹Àøý<¸Ïl»•4¯“R>T6ññ‹›foßÂäu5ƒ5W&Ø«<ûoôÌ?q𾶚~õ@ñAÈ|f^Úþbjÿ>/ú»“ʳþó6I>¡\e2â€[’ŸO|B= d¢¶×r…ÌÄ饪c‘®[7…v–†!-[¨Ôô²íï0z©)#)³áþ®tã“I•F6Ÿ7ÞX ¢§×k2Ï^ z"ó)ÿq°Ó•¯¢pFT‰m@êÛ¶[Ç«dmUGtk¢ên×ȆŠ<šO…­ªóXEïU§»å/mMè–sx9á¶vI}©|¶xªhרJ³P©R]iY„ê: ¤ËI ~©ÊЄŬünÕø„Ö‘‹!Qm—J;t9‰í¦Ñ\]©P[ÅÖ5Í7Qš©ó6Ú6íÒíþÙ’ÎG”-/çdÞ¦«k­bg7fE¼œbhE~>¹ ´v +”+¦×m7n%GÕì¥QC,ª‚kŸoÉÿPá*•‘'¿ÐTMŠÏ¨mWí&웕p¸Ê[Çíl¾/9°Ñ’̦ËMÙ¨íÚÍ:b  ÐÈ FŸ3¹xkE§|ìÈô²9™q/§ŸN9Ìë o{x•a~p¤>ÿm^áñ¯¿)¶ŽqܨŠ¦bëŒÜG2þµ•xÌ¿¾RˆÕm:¢¡öYÇÖÖk¨qܘ¯©uW ØKK]TWnOtM‡ÙTÓ5Úvšq;ÄËB‹5‘ùеi{¼´er¼ÃGý©pÑO—±ñl ÉçnH\qÓÒÁ%ÓuÄE?(.»¦&ÙLL6Èþ&Uõ,?õKÁÛýE—Fð¥m> -endobj -634 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 183.873057 101.433071 165.123057 ] -/BS << -/W 0 ->> -/Dest (cb145-1) ->> -endobj -635 0 obj -<< -/Filter /FlateDecode -/Length 4598 ->> -stream -xœí]]¯Ü¸‘}ï_Ñφá÷°ÈC€l°ƒ$ÈFò°Ø»=N°¸`²ùû9T‹d‰*Iì¾×¶œ/Úݪ"©yxX,Q¢ºJü}§ð_´JĘ‚·×ÛO—Ÿ/R'ñoJ±8˜Ô?àÜUI„SÉGwý) L!9üõå‚ÿºCšüåòç_\þ¶Ì£®Z¤äµr׿ÿ˜UÖˆCŽQ%¨¤2ŒÊ9‚vžQy%p‰)q*˜á‚Õv­ -0æè8Ì°ZGFa†±A™µ*Á ”åT0C%•’°Ci)Y ‘ÖÍ蔕î9VÂǤ« Щ 91«œâtIxï]ät¶¸$§s°Å)k%§ƒ-ÖÄÀéÇÚÃIèàò±:/pì8.Êbu°ÅËqk‘LŠ [ŒÖ [à2p\@$ï›ÀÀ…XØO‘ã0™ˆÉZŽ ‚ó˜¡V9×"Ð5«‹Ð©ÀqAV`(V`.%":=Ç x‘Ý%Ž `tÊr\lAWá¸C‘ˆž9§S°N6Çðt¡SŠã‚¨a ¼AŽ ¢Ž˜ezÉqFhÌ%QÕœÎÊ<ÏŒDëEv9.@7ÁLLÉê` h‚ã´Ožl;Ž 0ùÁdÓV[Œ³Ĩót3r\#lÑRs\læùfภIØã‚$½Èn2Ç qè¤ä¸ ©ˆù¦¶ _æùfä¸ ‰ù&¦xL¿MÆçùfภYØâࢰ:ا)1ýœ„ù&؉ÓyØ¢“å¸ yŸç›‘㸘o£gC1Ï7.ïºfâtà]x¦žã`¾ Ï–›ÛK¯ ðÏxeÌ3ÎÈF $¨×aleCÜ‹Ñ*°1 òÍs$6h31³Œž`X…RI6l Á¿ðÇìŠîÑ'¢ò€CÀ˜C¾È„naáÝ×9GKf6’ÝãcÿËå—ï1ø^ÿò—O¿˜"eåOÁA˜R[øWè:¡¹¼o…Ë7 ­Ä$´“…0ð™<Ùˆš‘ -´8ݲ‘þò¿ëúÇÂrþÃtzSN(N®¦ÐrÄôuŠ ‹Ìò†KLŽ0Úz¤1IgväàWJ»Hüëwu¶â­‡Ê¸b>8“a«ÝõÝO—_þîû?ýá÷?Fï>]þû?¤tîWß©ü­»ïpÿ–æþ Ç^>ïï¿WòùSå¶K—Q7êãœçCÓiMÒ™ùóqþ¶óï\~jéì°1οçk°ó13_GI›ý2m½þ´–U›dWf9oèÊ%ý¯þçúîûËoÞ-¤),qM™›v±7–å5Ø{CÈU«Á »˜3K¬ÙOËz´s¹Û\ï‰è>-Û/C'G“kÛ…eYWÚ³¶ŸjzûaÝÊQÚï\ƒ ¾ô÷±õí[iÃŽíéd /=m²Ï~Yûjï)å|ìêË6¿diÓ*›Ç¨Á/Rsèdæ9*÷½Ë=/­ÉÙQ³ÏÃðÙ* Eíø<•·Z6>Á7cyÎÖ²úÀ‡+5y#£dW›¹ïèÛ}t«#gßzŠ´ÒŒˆœÇä¾ö ¿ãÜGŸÍÿÌiüi4oå…¸ïkUÔvüâÞo ·pÊŽKù¹ 4×ëÐZ{µ‘Å©nޘ͑Ž˜oPàt0ÏépºïÁ­ÆEÚlö·KÛWy‡cnìé=A›Öé½²Íñ¬›£ŽŒuµPÏ‘é–ôúmºëûx÷ú”æYOIÚ± É`žÓ¡ißËÚόԣ¤G”"-JǶ¾Õ?-Ë™fˆ…Å™åR|Z–ѳÞj>Àùð¥¬Ñ™Q·æ!GÞí1µ§õ,ù‘™kÝ–¶åúÝŸ5Õ"u,Ïéz×ë8­GÛrSûirk´¬ÎŸ¹U´gZºoE‚î×xa“ïmîå¾WvlÍ‚©-=ª9×S³ù $R¯/ßqŽÓ]Â}$Žå9ͧø•c•GºQy¡+ùJ¯é¢v«k(ç¼!¯œs±=ºÈè¾@oÇË£ÑQÕã‰Oì—ö¯üE…X”µs—eÁ=êItãÔø'¸t,Ïéyàvq‘Z{tôÚš¡Ž¢µ¾ùÞãwd:ä­¢™ú3#•øžJ‹$£Î+nö‘:–çlHµûþêÒ¦ò#áAÊk[üÒÝ™¶;#ðó>ݹQ¾íµð¨´$&™œpÓäü•ƒyN‡Ê_ôE¶Æ[ù}#¨Þ˜}(ß@¦yœ/󜙾æ[Î\PþÐìæ­MÐ1­Ô9 ‚7PÚ|ÉáÑ`žÓ¡tlãgŸ{w¨{¹\ã[ß?²ññyù`ž³¡Ðíû–ÓJ’²Š–‹jÓÕ®~Nǵ83‡?œ3“(ÌV|³´p‰¼¯ÎûäzŽCO ôʧwÒÇj·f2ŽÄ"GGæÁ<§CÛÏøÌ8Q9ö¶ýåüä „šÇ‚æ9BŸ¿Ÿ>Ä'F¸ßþ5{Çb‰O˜Ÿ£ÔQiw„ر<§CìÁŠÆG‘÷žSyh–ó¥z\ç³¾õýuGüC§…tÖgôì#r,ÏÙé¿Ýûë§í-»3*q^=¾¶h0Ïé7öTL/‡†Ð5AïŸ_+¹yÿèƒ\¯Âx#¯àu«+ÞÚØ@%¹=!Ìs:TÄ!ÏÊi;³°!d?0º–^Òqå&?ÒûÖƒ+Þóœ‰>âi8ã_¼W<3Š?±.s0ÏÙPýÆRƒV®ž0Y­'([­êå"'OͬV:H¹ûdNWûnŒ­ÝšNõñõ¨[ñíg¯CÅA=>Ìs:Ä8¿ê -Úo—¯ŸAî&Ÿˆgæ9â™òã+V`|þ.2z°Cõ”îréSu»ÏùÞÚ¹§õ©3G/Ö¡öOî Þ# -$6éÚYYytGr0Ïé»ï«öÏ×r­ûU÷ž…K:bÏ3È{MÈ;`׈H,rcyΆÀøõýÐþYÈ2vüͯ2·m]õƇïÿo¼ªù‡ù½ÕQYëŽî›æ9"ã›{«#òëÃüaž‰ÜõÕú;ŒL„»êúÆ[~íÆó3«žäÚ5¼ÅÚžøÄ:ÈÁ<§CÍ¿Ÿ _ ³6ük÷€Á8e$1Çñ×ð å9bÿ§\ô¬£²¶P9°ó9´o 4>þ¾ÁiÊ•ò¾“Ü\÷æžî2ä´þþ™ÊšOåÄ2ߙϗç69~5Üõ‹òÝ|nbÏT†#×àÊ5¬šòç‹ŸvRÓ.qÒG¡tÞFöê­0¹mÒ5ïJ¥±ª4š*[]7rN›ïþ\SÍûñʼE_Þžé¾Y/9˜Óÿ<5úO•¬ÈõŸâ¾w¦œÄQ—ƒ&~¹ä½S-#¶pÅY8ÿ”µ,«JÂ*»hƒH}Jã„œ¦ZxÞŸãþS»r59¿+Ùòž6V–DfÚÕå~bFˆœ^­Åùê¥P³8ï?…™|5Åùb3„­@KÓ¶[ÆC±2’ÝZ(ÉéšXÛbÊû•ÕªóMXM§U§Hó—´:æÜÞ.8­é¥/¬4ïzYŠ*µ«e•bTªRWRÖ±µÑí¿“¥h‹Æ¬zÒjyï°»0 Ùš.•tŒèvaÓÍ¥¹ÚR¡¦Š-k*5ßLiP7±V<#›êh–†¼¡6é#Ò”ŸK±Ï-PÚZF‚½Þ.bìJürqIíWHW G…†”[ÅQ6¼4i~jùþ ]³ÈòÎKùÿ;U¸*ÍÌ3ýP¶B*ïžÖŽÚIr߬âe%Q¹¯¬c¹P6´´¤ºT³´¾T”LúLº5u­±…”T‘‡TÌË$UÉc)VuUœ)¬ÔOåJ*”Åœ®‰]…òËBÜìtµ«ìåd^¸»ZnûÊ/Tj‹«¼^µ·–K0_„·i`³½8C?–“4±–u´k'#ÂfH¡‰¾LâÒ[+;åí½ËÏÖɸ÷vùëeæ´q:á‡7*ïìJ=/uýÒ|Ïÿ^ìõ÷e+±û8®ee ]¹u!¦#YÞ<Šó¾àEX» jKh¿‰Uli]ACǵ&|m[vÙˆ½¤T•AUÕR¡kuHĺBW+CjÆío]-VGæµmÓìû¡)‡Ó˜¼ ]± -ôrp›Î´!ùJŠÄQNÚ†th­&q@ Å!9aj–-ÌÌ€¤'©UŸí·´)L>9 nD>4MgÛ0K‹.²é*H¸À†Ђ­¢'M {£Ÿî^¯n÷Ùd_z@–Vj¯Ò*­–¥•ðx©™ýò°Ž9æšJçm5TË2¤ï™êä´®Ñ\ »8 %ÒØ²Í =©-²ÅIË@Qé2YdµÄPlòs¶R-ÓG¶–Bõ)šô¯´¦m•Z‰Ž¶Š_¥Íå–¯zK¦:@ŽÂ9´«“-eõ%##ó4w•Ú–ÒÙúÜvyî2Ú^ÉeØfˆož©lÙÜ*åSü÷Lß¹çé"\ªò7EGTl›ob ¶*m®)»;Ñ{pˆÍ[bI¸äá<ûñ“u”¤ÄOè™ÐÂ#ƒÞ6Lx"+HQ/ó¾¥|¶$ÙKz¬˜ðP£9¹Šaæ8æ$ª‡!O]š6°–1æ ܃Tl¸(oh©â"|2ýýû„¸K -endstream -endobj -636 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 635 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -637 0 obj -<< -/Filter /FlateDecode -/Length 4603 ->> -stream -xœí]K·¾Ï¯˜s·ù(¾€@‡I#b@HFÒHk#X°sÈßÏGv“¬î®îé­ä‘m-V3]E²‹Åª¯ª¸=}VøùBã¿Hzˆ1Oç˧OjNá_i1»(ìoðÜY+ -ƒÓÉGwþ!lBr&øóó ÿ-.yóçÓ?wúϼ>›!%o´;ÿô>³È!† œÀJ`)m–sCÆyåõ€)¦$± † dhÍ -ƒRt b1Q`Eˆa)h»f%ˆa‚&‰1trA`i9´QJäAEdÀÓnðPº—xF>&“D^O#ñ¬| í´ÄKƒ÷ÞE‰GÅ%¥%žƒ,N)‰YÈÆ ñŽrRÉTû°2¤Xõ’éÆòë³È€E›5=—g©WrÒÏ~‘žå•G÷ëöy8 ½’‹Þ‰;7?Üñ[¤?é‰ïeükçÁ>f´Ÿ‡Þ]÷þ#ý=S}ìHOööšþ`Ÿ‡³Ô+9ég‰?/äaéÉÝ^Óìópz0åÏÕ¿Ïù¾zEë,Ï+xÅþï¦ø-ªßÕïøKüÁ>g‰WrÎ_býþ1¼ëDp§n¯Õöy4«tWöÿö‚OqYÔ;ü>¯h–Fë{Pµýq œãñú¹Ã e :l¡Çú<œ…Þ¸çÉ0GÂnmYâ^½|—>çs™å¬ž­ßŠêwü­ý`Ÿ‡³Æc¹æ‹<å¨?Ü·žµßzn~öt^¶¢éƒg›ã,ç$å‹Â³ö÷Ĉk˜ÛÂJ¯nÇʃ}Í:ý•œs™‹ý*ëåÇú ŠpÃ"ïø|ÑÁ>g‘WòËÅJ4­îd÷wa˜„…wäƒü©¹Æ[âðF%´Ä̆‹Ü»¤Ï¼h]¾çµÖzÇžæÁ>g­W>®þ¹bÚ–5¨Å—;X3Oü¤´a=Ô„ÕN68uÍ:õy8ë<˜{ndïÒM[¥\ìêgÙêš´Qò\ÒPjï:—vÉN ɇeymµ‰e._ýé/þûòóùy_’åÂù`ƒñpÈÕæ2—·Ç,ßØÖ…ìužãõŠ>µmU`ìc“ÇËÞáj¿ Ï»9ÆOm+/m)LcºšQ¬ûSmûf´ôCjô\ßÖ:5ß#[̨j ÌÂ×¼…û3kCó6åÚ -3®Ë &-W­*`£!&O`ýÔ¼}Ö”ºLðÓÔ=ŸsTù\)›Ïžæl§ÕvY«yŒ§q<ýn=Ž·ùЭ|°ëz5Íkœs™÷žHÃ6äP}.3}«=P-ð럄±‹Õ§±ž_™cë ·æ®só~Ò…ë–WâUìºv“7Q˜Æô×íej+ÈßlAOkf«U+V‰V;œ{$ÐfO¯n9wk¬ÝòÄ‘o6î_îY¯ŸF9ô4ËôVæõ4µgë7G ¦cÌßæ×Kõ¦ëÔßW»*:½­«÷ñ“lUF¿£óÅ< -j™]}†¥>ÇÌpB£jO—ÑVÆœ…­­gúáü÷“뤦Ï]v»)mÙ¼ B*6vsõÝ0¾öÏ“vûÕµ_Ã-Y×y]]õ95ÎMÙªÃ]=¥•žëÝd÷̇êúê>Ïnçsÿh2oØÓ<ú\·÷yĹmd¿hxç˜Î8F¸=•süV:Ë÷’æ×î5ÑëºPZ´gQzå·ï~]µ«‡|Nà³h²_†!ó—9,ÂÁ[XG*‡E£°7Ws؃}î:Âì“W×Ïc¢!:×–?zœÍ`Yë -!,Éaó†É#Ï/n8†PV‚Äžtõ†oŽklœÇEÆuO¯®ô¦XNÏö~Kª+ý’ÃÚIýK€]¤üîÀ˜å‹)Èy»£©OñÂó'[N‰Í'fÞ¡ý|V:”çÃæL¯ôÏ«\´æå´OÑÀã"!ÕÛ·SÇÛ½@å›éÊàp7çòÀÑéÈN´lHrµÉà¨åÞú´Ã³^œƒ˜¢ƒ&†Ìß=c#¼b òq­R˜séœÃšöˆ1¿Ë¹–òÖ¬œV)N1ĸyL(§Õ¸=å-5~”üoŠÉ%¾¤‘nZþÏr¯Vyq¹ß”ßòX2'—js¨ç¤WË¥üñäËÑú?¯|´ÉßOsFá—S×Îù¸ã¨,éºtº([Ÿ7z–oõù±µš¾èGå³ÿó¹ÏeiùÅÔþDzè? ,E¨S#ÚŽ_Ê¡ -í–äçSþRÈ(ÿÍAr&NoU‹t+Ž+í‚ð†´l‰¤¦·½‚ÎqIMØZg“û»Ú-–Kª6²å¸ØñÆ=½^“óìÕ 'rþb›8ØéÊ7Q2¶7bxÛ>`ïx•¬­bD·&*v»N6TåÑù ô¦:߉Mt®:Í–¿¶5-çñrÂmí’ú,Ró×iÔ¡ªvj4Ë„Jêj˶ ÔÖI ]Nñ U‡&,fã³Uˇ’ÄX ‰Z»TÛ ¤ËIl7æÚJ…Ö*ö®©j¾‹ÒM=o$lÓ.l—)äoêb>¢l};'状Ö*2»1+âå„C+òóÉ¡µëX¡\5=N´lÜFŽªÛK§æS!ÇwpÍJËG:çÿG¨pš‘§¼ÑÔL*ËÞ¯úM²o6ò\Iœîê¤M¡·eêÒ!4›åúÒQ í3è¶ÖMc3*S£‡TÅË ÕÀcNÖÍê9CXÕOÃJNTUÜ®“]3åç¹Ëéš«:Õnæ53w×Æídß°ó™“C[qÏØoò¶q™ÍWâ¥6Z’³éÇz“N6ªE»~3Fì‚:¹Ãès!WomèT›Þv'“"îåôý©„9cÉœGzæ:ëóÿÐæ+üþûDç¯ëåc7ª¡…iØ:#óH–¿`,$ç/«Äæ6ŒhˆÁ~'ëØÛºj -ŽÃðšzwÕ½¶Ô Auãr¢ë:ddÓL×hË4ãvˆ—…["ó¡kÓöxiëär)šO·¯Rá‚O—±ólÉg6$®rÓÒÁ%Ã:â‚ŠKvÃÔ%›‰™ ’ߤ©>ËO|)l¾»`iD¾´G=Ìò¡+­Ì‚5A -lù˜4¿išÉ#}·{}ðºO"ûê™Ú ½QŸ9µM,SàÉT[.ýü²Å{ÎÕy»†ÚX–ùžmINwžZÐì‚Û(£ÆÞmjàøM©Òf7­¢ÁhªÒÚˆ¡Êä§nU-eÆQÔRh9E§~Ï5íøª4%:¾*~Õ6[#^Ë–lK€7çÐg§zË–KFæyïF¥ÞÒVÚúÞ4¿w¶g6 ê‚øž™ªÞÍ­ZÞ…÷øÎØg±!µª?ewDÇþ­Ô¤ƒ5¶|Q«ŠÞC(×V È¶Kn²Þ%©û'üNXŽ¬UAç¯Ü•Ex#]g°¡ê×ñÊÝ’§t›„í¡sjµ;T¾s±> -endobj -639 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 108.873057 101.433071 90.123057 ] -/BS << -/W 0 ->> -/Dest (cb148-1) ->> -endobj -640 0 obj -<< -/Filter /FlateDecode -/Length 4595 ->> -stream -xœí]ˮܸÝ÷Wôz€ÑðQ|ƒYH‚™ Œddq}mÏ ¸àÉ"¿ŸCI|ˆ*Iìöµ-OÆömUñQ"«¨åUàó­Äžäà}p–®ï/.bpFàߘbq0ª_âëÌU -rƒ‘Ázs}Ú .åìõé‚ÿšÃ:ùÓåïß\þ½Ì#¯jÁ*i®¿¼*ÒƒóΠèTBjFeÌàœ2–QY9àCàT0Ã8R´V9˜AÁN3H)Ϩ<ÌÐä¤^«ÌPN§‚2Ǩ¤€R Áê`ˆ ÒŠÑI3X4ºåtJÖXƒN:Åé´¬#i$§ ƒµÖxNG°Å!9-F N[H{Çé,lÑV V[”wšÓ9Ø¢Ð:ÑyØtyV[„’Ó=˜à‰X]€Nxç×:%Ì`¼Ö‚ÓI9`S³:Œ(t’uŒNÁ+L`u°Åh¡8†-„§Oí¼gF«Š£[ -9-J9bu°Ï1€²°E8ËQFÐy‰ãåÜ@AGÊë=Çàø3ªâ¸À€w¥ÆLÍéÀ»RÁqïÂo0ƒ„Àqæ·A -@—Õ…Aï9.0à]В⸳ð <˜„Õ¹@’€Œ?”ã ÞÅô8.°à]a´æ¸À‚wÁíau°E{Åqüè0l™1 gu -LÁéÀ»B¢‡9xW8.°àÝ8mr\`](Ïq à+Ž ¬§!8g9.°A@—ÕÙdžã' 0 ,V[ÈÇp¬‡ ƒç¸À)Ø¢•â¸À)Ø—ãxCð¾Ùð¶.l|@°ž"Ç`²Á"Ž œ±ˆÇЪœÎªÁ;Ð5«óÐIÇqs4`*– –<=Ç ø!ºKÀ è$q\àlÁPá¸SÑàFœž]1 ^ƒ¹•]2à^ÌVŽ]3 ß#±‹0‘¥·ìª¦U(¥`— øþ­8aZ}ª—¨,àà0gzO2`X¼ûs”dz#Ù´>öËO—ï0ù^úÏåÝ7ãJYúH8cjž1 T@wxߧ¯-ÌÑ2vKÚX© Å( œÙ¢Q˜îâ¿ëúÇÂRúrY-0ÅÔëþQH¬­½™žÑèu³ÿîÕü2­mÚX6B;—30ÈØ0zõþòÝ‹?üé} \¼zwùÇ÷½¼ÆKøM˜.0™L¿]ô˜âZÃtl¢.ÊßÅ4?üóúêE]§Šavˆí²ÎX|3%ÿý«±étîf/il9 AèÐ\ Dhã´UµöY>¦­ç&Æ)À‰Áù!ÐW‘ô1’qv‚VíN©ò©)ò¡Ô&c"AèÊŒÝðçûËU7ˆ´‘˜¾äøVBfdìŽù·™ÿ>Æ®š»é/=ÎǪä‹åät¦Ñ‡’‡R~™v´Ã®Ë¥:ïÃd·Ðs¾$oíÈuÙæXÎç”’A¾‰miô¸3pÝ\c注ÁψfPûÑš5°1’ƒsÖT¸‡l‡ §¾’äéÚyN‡mزƒíþÔ¿ 'æÙáû0ý^Éço–S“.»Ø#sž×E§T•NÏß7ó_šÇòC…ç·óï»ãø %¾[ü·cjw,Û$š2S½íw)=:%tFP¼Ê“ŠÍ.ê:óœuÅlX¸‡:½D½[¶df·Ç¹åkf{·ìÁžx *÷ž[–u™ÝRVìM¯†­ó¼­e溺‘pã¹Êéo._,óÜÈRF¶ãa©ªpŽÈ  ‘Ú—çtH¥}~Ô r\AMBÞÈ´FЪ§9t="oáµÚ¶ ¦1ÝÈ’|YŸ ©FߎԾ<§CªÝçTÑ êuù[pÁ—vš]Ÿ¿—6ìhО‘^Íâi¤öÑçµ/žTΛ¦½¨x&K›6PY|E¥ì  #ÿ²3ÏéP¹ï_îùiíLÎΚm†ÏVijPƒÇçIȸѳZÜÎ7yÎÖ³úÀ‡K-YE½mkƱ£«è‘›¡dÕK3"bÇÚ»jäÞü¯«¨Æ.‘Vçͼà÷}­ŒÚ†_ÌÃr§ìø°5?'„ƶ3 ZóHªmäqZ¼1Šë£>ÞÖp„Ó¾<§Ãé¾·š;ärÕdįhú²Á17÷´ž …5FZ¯ls>k¢Ôž¹Ž[‰âÆUc'ÿÕÍù½™¼>©6X¯ò˜õ­—tæ9šö½¬½ùlÁH-JZDI±Zß«dš9²ö·3‹…*Ê­QðnYFËz«x€óáSY ¢#£nÅ!GÞZ=bòHkYò k±k¨H­Wéz‘Ú—çtH=XÙk8­EÛ¸è&÷ÓÄÞŽë´*~ç^Q–éé¶+tŒ6úÞzB(÷weÇV\ÛÒ¢ÊTuÝÍóH¤Úë‹÷©øñÞ‚]$væ9éÀSüÂk™GšYy¡KùÒ¨iVíVçP]óéA^{Ýe…Ø]íu—ï›ôTÉ:VGyTo ÷ŽÕ¿Î<§Cî¾ïxæ¼=T4ª¸«›í¡„àÚ¥e;µhäæ‚w5WhVk2³?Ÿ“0©KMÎÚ#äöå9rVuƒŽ:Ò¬féz¦=ò¦+¶M/µ3y{UcLJ½ ½®OÛÊ'¶KûWþbµ -±(kç*Ë.‚ﾦ¿Hw—öå9"üÑÏpÇÃW}E¦AÞj5S}Z¤šÊ÷”j«xŸÞ.R;óœ ©fß_íAÚ8C¾©x°æµ-~i®LÓÎ |¿Own”o{-¨¬Ö$ƒÌœ¡²/ÏéPyà‹¡èÖÞx.¿¯ÕQÑ×ò dš;ø²/Ïéyàk>gäÒò›¢›çFt…ŽñNÓ x¥Å—쎈:óœ¥}w:~òØûS ¸AÝ=ȽåŸûú‘·ÇåyΆB»ï[Žw’¤ûh¹Uíú~W;§ãzœ‰ácæjfk}3õpZy_Õ{çý‡ž@5Ÿ6ÞI»V»ÉØj-²wfîÌs:´øŒ÷\«VTÎãƒ=/G>?y¡æö;Á;óœ¡÷_Oïâ“[W¸Ÿ‘~£c±•OŸ¾V^*s„ؾ<§CìÁ·"ï3<©rS”ó¹F\ã³>÷õuWù‡F ÂèÙEdgž³!Ò}½××O;Zv#ª Ä©Ûï-êÌs:Äõ=Ó^ËaWCê{‚î¿WróúÑk±¾ 㙼‚»»â¹=€ TVׯ{WÈ;óœ•ëgå´(¬ Ù7ÌîŸd”4\¹ÉõuëÎ;Þ:óœ‰>âi8ãW>*î˜Åý÷evæ9J}§ß˜ZÄê “Õ½ãÊVwõr+'Oͬîtb÷Éœzu:Û÷ÈØÚÜÓ)ß|<êV|ûÉÛpÅêöx¼3ÏéP|°ÆùEï ýzùúän¢ñŽõÌÎ<§CãÁzæ­üøw`|þN²ú*`ƒê1Ý åÖOÕí>çûXêïO9zqjûä^ç5"_­MÚ€~–$Ž®Hvæ9b÷}ÕöùZ®w¿ò˜Y8¥«ì¹y÷£ y;ìêñCCµÙ‹ÀÎAv®/Â3æOÌ/ù^”oæº+{h~or>“ÎaÕ•.vÜBŽ;‰èɨ¸…àÕÒ cß„kÜ‘Â M2u[^7rŽ/~È©æ½EÜž)nÍ1mÔXÌé?Œþþ" ±ý#Lû¦‰QìU:(â§KÜ71è:ÅQ8ÿ¹,’)a–=‚UÝÚ”Ú bþráñEËÓOeÒÙÄü&e‹ûH‰ôøFÿ©bFˆœV®ÅñìÅ gqÜ{Ðz>²Ùc“Í–©N[ -,ÅR‹JhÖBQUWÄŠ’=2îU“›Îa6½n:YuJ«\Õ{ÂÇ ªÕ­ô‰•ÆÏRQ©u•È2]²Ô¤”¹C(÷#z¼0ÂoE*šÐ™Y_õZÜ7fú$ÊéBJLj/lº¹4“{ÊåT¾d ©å‹)êÚç†gdcÍR7S­ÆÜ•ú¡ÛØ©¯…¯p£VÂÇ ¦Z‰Ÿ.Æ1©Má -aôj¡®ÊÍb/ -^Š4>{2ýÂÐL²¸ëFü¢ -“¥‘yÆ’2¤âÎ9å¨TÇf/©–ÛÌ:ĵ€$WÒVÍ%˘­ÛKzÁ¤¤›Sç[H«&«ä.$ó"IeòXŠeF]G -K퓹²Šdª+b“¡ü´;Mª{ªÌÊ -î&—[Ä6sçS-v¹ÇeÜ)ۛ˭0Ÿ„ãÄF­8BߧJŠX‰<Û•Ê*a1 ¤PÄ…FŸFq­™âÖ®égdÜŒûxùù2NsJðÃjwõ«=/yý/Ò¼À÷_ºþ˜¶‘™æq%2[¨Ì­ q=“Å=`}§8î ›„yØTBEí±ô%­IhÈó¸R_SÉ. -±§”23¨ÌÚZhJVb•¡«¤®ZÆì›VÌŽÌÇöM™°§CNÕè¸Q² -õéàÐ.Sòµ*G1i™Ò¡%UeÄA](« -C±lafd]Inúh?Õ]¡c]ÕAåFÄC]tT¦Ùºè$Ï¢JX×uÁ$ëJÃÂÆ軇×G÷ûl²M# J3µgéS-Í'¥™ðx©íò0Ï9zÜq( ÞÒB¹,]=œ24ŠkA‹ƒ£•Ô—lsSWJI¶¨4M™. I–KtÉ&;gKÍ2ž±g[ÉeŸ¢H®[ÚÔ½’ÑÔ½bWic¹iÆËޒΩáìÊÙ‰’2û’ž‘Ù:w–RI©“l]7-ëN³íµ: *†Ø♊’ͬRÞÅ÷Œv×..UúŒ«#Ò—×0Q“tZékˆîŽ·Bq;TG¾Z.¹9ÏþúÉz•$­ŸÔ5¡;ÒZ8 ¼m˜ðE8VTE=Í{ÖñÙ‚`Oé¶`–‡ -Í­÷X·Å×,ÇE¢|èb¨h¸y©ð>nÞë¿-UܘH>,–OÆÏÿLW~@ -endstream -endobj -641 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 640 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -642 0 obj -<< -/Filter /FlateDecode -/Length 4399 ->> -stream -xœí]M䶽÷¯èsËü(~’ ‹8ˆEr0r˜mïØf¬sÈßÏ£$’%©ÔR÷Ì®5öî ·[U,ªH>¾*²Õ’>+ü}¥ñ_$ÝŘ‚§óåÃéãIuÁ)üëKLzõwxwÖŠBçtòÑ?d ]HÎ~:á¿Ù!/þtúçïNÿ™Úè³éRòF»óÏﳊlbÊ ª•ÒVP9×…`œT^whbJ’ -n¸@†–ª7(E'©àU„–‚¶KU‚&h’TpC'•VðC¥DQDÖ:í:N÷’ÎèÎÇd’¨ Ðé`$µ¤–t©óÞ»(龸¤´¤sðÅi"%éà Ù$‡/Ö[%êà‹‰ÁJº_ z' º_€®(êà‹òJKºd;—"‘¨KЩâRg”ë\´VI:­;lZQ‡…AòAÐøâ•K¢¾8«Œ¤³ð…ð'éÀΆ…Ùjòì¶ÊjIçà‹1D|ÁàK `<|QÁK€Ôe^’8À„ÐQ2$‘€‰¶£HQbSG!X‰Lrù$°JCg´DVÁG^b«á aæŠ:øbI\` |A‰ ¬…/†¬ÄlK@‹ÄtK*i‰ ,ø–”öX.ÜTX0®ž$.° \@)I\`Á¹Ü)qébº‰ ,X×:o$.° ]KÑK\`Á»–´’¸€À»ÖÂRÔÁXâ°cgu´x×j$. ð.¦‘‘¸£Ú‡^â`¥31*‰ ¼k¢"‰ ¼kB€¨ æ •¸€À»Æ¡ Rä琉ÄÞ5d¼ÄJþQb6Þ…89€/ X‰ ï¡3VâTÖ¤%8ð®NÂœ[u:&/qïêˆáu©Ó=.Ì[ôr§½O8ð.••¸ÀwAŸQâp|‡ˆj$.pà]m©%xW›¤$.pà]ä NâÀ¡ÓH$.@|ë´tE]êTŠQâÞ-‰ …;Á$¢.t’–¸dÜ)ä¡xð.Â{’¸Àƒw•³VâÞU„´GÔÁÄÈk Ã´æ4’ÕN0…¤ï*–tà]¥B’¸ÀƒwsØ”¸À‡,0Qâ8Ø! 6øH] -ÁK\à“‚)Ÿ¨óŽÄAAà@Y¢¾P ‰ Xwɦ(qA0ðÅ#qA0ð)ƒÄȺ¤‘}‹Ëø¸ˆë‚/È%.“u1I\œÇz ½*é¼éb]‹º„@B±–¸k©.bÒK\‚ïrº$qÜ€N“Ä!ÁL‰ Šºh™K: _dK\€L:­%.ˆ¾ ”¸ šˆU¦W Bc-‰®–t¤ò:3J\Éw9U”¸Ó+M0¥¨ƒ/  ‰ 0>y±í$.Àâ‹M,sD|±Ž$.ˆÑäåf”¸ Føb”‘¸ØÌëÍ qARðŸÄIù.§É€Æ¡SJ₤#Ö›†$.À¼ÌëÍ(qA² -ëM,ñ„y›¬ÏëÍ qA"ø⢈:ø‚¤) óœ„õ&ØIÒyøbI\¼ÏëÍ(qÒ ¬7‘Ñ‹[1¯7ƒ¸]Þu Ì$éÀ»ÈL½Ä8Àz™­´¶W ^ŸÉʘWœQÜ1P ^‡Ø*n(p/¢U÷ È7¯‘ÄM¸‰•eôâ®Â*”Z‰Û -ü‹|Œœ0ì>ñ-*8ÄÌr#¦!»¯kŽVÌ®öÇ~þñôõ‚ïùÇÿž×?¡/Mȯ0 LÂp;dßÍ·¤or`Î$•=„ƒ÷Ød'BjNjÐâ¸é–DøËÿÎËÏáøwýém=}BNŸX%UÄòuîñ&/è°ÂâÑÖ£ŒM&³ ‡¼RѤðÞžÔÑ‹a´2÷/±&ãÎo?œ¾þë›üíÛ§ï¯”óß|¥ñNqxwn|½ÑeÔÍÊ`нg6—œˆ:5¼îªW1ÙãX¾Øräz{Û±^Ç|)z¢Q—}hö&û‹>Óvh’ÐúøÙ²w3–K/ÕÖoþu~ûæôÇ·S°õè6$FS$ÚÀç>“çàóSÀËÙk°D¿:3vYX¤ q)S»<Ü8ô~^þ*r‡×Ã0äù}mØË9ç¾”óòsö0ë 4ø”Ò­ÝÙÏ*3›Ò^/øWÊ–©ä¯C/ï¾@¢œ,ƒæŒÛÀÞN›£+ kè›OV ]Ä'÷ã´|,3MëÈòZ¾Ø3ˆÚâÏ;ø¸ CP^³ANR]k¨ÙªëÂü}ûè}#ðŠú Ô¶ÑÒ줢ɩßuî³9 -é*VØ)ZnQ†ž9Š÷óã[7ó…#\àéyšðzfÎ -:[2HXÐxÁû-tî³9:Ÿ‘8þ¢¼ò‚3g%É­vfö>ŸYq|¹á5‘!¡,Q\ÆKôö®]vÚ{׳þßrÿý0öå»Ö‡Æ°þ,ݳϳ~ßÄ“Ÿ³fYß •¡e¬õlª¦²Åb3gêžAçõ¿ëNK_ê"J-ÛVçȬlï›{kñÚ¨Ûq§ÍÑPi6²ÆÂp—éè='¦]Cæ¡ÙÝ‚‚½(칚7ÌYUÍúƒ¡|nC|Ý6[Ûq]ïÓÆ:ÆØÛyr§Íáy=ƒ¬½üŽe:³ •^7ç.¶ò¬›#ãk1úvçè_aqõÎ3·Ù¬™ç†¡°Ö§~-8”¦m¥™ý¼ŸÊ{퓲;0ß(Òƒ~=Ž¶¡¸w…³Óæpø¼žC.Æb;+. ®¬4¶vŒjy¼ùøÞŒ% —œµ>Ö¸?›û+ÌɳŌJù;ëÈÜgs8d^Ï0?E,?òÎΫȀEÌZ•nÆìN›£aÖ^Ï?³ÿž¯P6XRüºÄ Ìtåë’çøçæþ=ŒØù¥v V˜Ô¶|’’ë\ÿ­Ì*÷Ù•»˜³Ñ®#Ǿé˜ì«Ù{—ú¦~\A¥»ƒ+÷Ù•×3ÏyFyË>ù¯‹¿î˜¡/º§¿‚T–Uæ÷`JùM¤î³9R72Ñß_­ÌÈ‹L>ÏL”J,‡Ü{¥ÆN›£!”6ö=ïÙ£¼‡w¾dÂL[A§½}%¿ÓæpèüDùç+Í ^tÆ}†HO,¿ÜéwÚ©9é«äŸß@¤·_‘´ÓæpÝÈEï䛯ïøéwGz§î¸¢}ŸÍÑÐé®ç¡w¯{…‘þž+ª>u¤wöö5ýN›Ã!u#'}•üóB3ìÀ‘Þ¹Û×ô;m‡Ð¹(¿hö{…Âu„ÆÑåßÄ»q¾Dõ£úßÄï´97rÎ_ãúýSÌ®ÏÁ½º}­¾Óæh¨ô{ž¯’k^h6íŒàüZ‘ ª¯\k2¿ -¬æÁßrú;¾{ßis8”n\ÿ9ÿÂl¥0¿îÌÎ A«×¿½àÕAÜõ^ûW4ó £Úîì‡R~?§|¼¼îp¡ìA»ºÏæp½qÏ“q„ ÞZCâµõò^zÍ9æ<ËY\[¿Õïø®}§Íáи/×|‘«õóѸv­ýÚuó“«ó2ŠÆßž­Ö3o“”/ -×Úß#¶~3·Æ•AÝΕ;mŽ†Î°óWéÔzö··^¾±®g­WyÇï‹vÚ‘ùål$j¯^Éîïâ°+w߸%äWÍUÝœ‡WVBÇÿü -ZïØÓÜis8´nübýµrÚsnÃ4[áMfâgA+èly¤&Œv²Á©-tî³9:wæž+Ù»´CSGi%Ûü-[“zÓ·Ü–ÔõkïÒ–zˆì,ù|GuÐA¾±¼6±oË›?ýåÏŸÿ>?ïK²\¸¿£RÈ…_µ-S[ÜÈþ e]ȳ³´s8Îò¬/öä›<\±¹ðܺD÷Qï˜. e)ŒuºæOšúÓKõŒÇ}]£ŸÙ†³_úwu­ç]û}iݬ%T¼~Xö=¤Ài†˜>°zÔÌËlS¼ô£{žû•T¾ç¥ÍÏ<ý²ãù\ö¯´´¿+òoó AóMç—õ”Qéýñ}ï_óéÓŠªµe2 -=†™#ø–>àŸ„º{´¦Á>·¯oc®ë£³¡Ã¼ûÂ14éñshýÕ#)ŒõŽýWüf¸ìE nã<àC±dÁŹWûÕÍÛnb‰‘k³kЛ•ó÷ç,ǃzlƒ¹´öÔ>¼°¾™Ùå¹ÒÖáëãËOgféß¾œÞ«íû¡Ë9z{7~ë)m­ãåÆrïXß_Çg˜÷ã#´³_§l%3•Ö×|éïd:TZNÆ&,Áwã­>ƒCmÎå[-G§#»shÈ›E6ðò>£ånçü7°­¨2?ãÇÆ3ÖË”B¾-®…2/äùhê.È€ÕŒ=[0X´Jc7£o…/Ý€#5Þ'0¿Û‚Ç·Yn*—1ŽôË9ÞŸoœ«|l'õ;6ç}ÃRÅnRí7˜i1”O¾¿Å³îoó¯|ì´ÉÏ:#ÐØ<6éœo+•%]†N÷­Ï+–ýÓ“>ÖRã•T~ÆB¾¿öð´%v0–ÿØú„A ²¾þá'ªGSšøé”~C‚)ˆÙ)ÎÂñ£ªu!u43ÙifèÒ¼¤uåæ´,b[W>WZ“í]1Ë7%&U -Ùþ¶¼Ã‰!,½^ŠsëU§Gq~€Pììxä«+Ο!l/Û*l†›bmº¥P±Ó5±¡âÎ7œ¯]ç›°ºÎ»N³á/eM`ÃyMx9á´v.}¥ù±%¥ªÒ»FU™eN¥*u¥dªã$ˆ.'Aø•*U³ê٨囿ÂX€Dµ\*åÑå$–ksu¤B-›i*=ß\iPÏIѺì²ڟˆÆ戲åãTœ“®:Ö*2ܘ…ðrBˆ¡…øéä‚PÚ5®P®@ -«·Š£jxiÒ|gªá¦f‘å[gçÿªpUš™§ÿ ©B*ßþ¾µ“ä¹YÅÓNâr_Y‡¤ÐZYÖ]:„ŠYÞ_:*¡|&ÝZºöØDʺŒÉC*îe’ªä1늺*ÎVú§r%ªâN×Ä®Bùi"n~º:Uör2¯Ü]­·‰}åÎ'.uÄu~–Aõ·ÖË0_„—>°Ñ\œ¡ËIšØ¨íÚɘ°9RhâF£O½¸ÌÖÊNý­óÆm’I÷rúéÔ‡9cIøà­Îæá™—>ÿeÞàõï¿-÷‚â¸Q•-LåÖ‰˜G²ü ·¸SœìV„uÚ0¡!FûM¬c+ë -j7†ñ55sÕˆ½”Ô•AuÕr¡k}ÈĦB×hËzÆ]^f½X™çŽM Øá-Ãil~Š@ñ -¼98ŒMg[H>³*q”‹¶-fˆ^)Ù Sólâf$?Iíúì?ñ¡°ù\쀥ùÐ6µ0Ë«.²¾¬R`ËxŤùIÓÄÁ黧׳Ç}tÙ—¥•Ú«ô‰Kkò´ž,µý¡ŸÖ˜cÏù LÞÖCµ.Ëæž­IN›-µ ÉÇ(“Æf6pü¤Td““–@Qé2UdµÆP|ò£Yé–¾ÅQì¥PsŠ&ý‰÷´ã£R;ÑñQñ‹²¹Þñj¶dkä8œCkj%k.™çÖUJ­¤-²å¹izîmϬÔñ-3UÍÌ-JÞÅ÷ÌÁf¶!•*ýíé)Ô¤ƒ5¶ ®ŠÞƒC(?Ó,PdÛ%7Û\ß?Yî’”ý~& GGÖª ó£ež HÛ -VUyì±l–”ؤÛ:@Øj4§»Cý³-ûoqúM¢zòR1?ÊÖæ¤7æ'ð¥å/-ò tßM¶Oú¿ÿMëÌ -endstream -endobj -643 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 642 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -644 0 obj -<< -/Filter /FlateDecode -/Length 4804 ->> -stream -xœÕ]Ko$I¾÷¯è3Òùˆ|Iˆ V€Xi‡»Ç!/Ò¿ÏYùªª¨ê²Ç;˜µ<îŠÈGddä™ÙµúªðóÆ?‘ôc -ž®·.?^Ԝ¹Äâ!³¿ÃopW­(LN'Ýõ&Ø0…äLð×— þY=ŽÅ_.ùÙåŸË:új¦”¼Ñîú¯'f‘B A9•ÀRÚ -,禌óËë CLIbA ÈЖ ¥è$Ä c¢ÀŠÃRÐvËJÃM bèä‚ÀÒ -rh£”ȃ ŠÈ§Ýä¡t/ñŒž|L&‰¼žFâY;ù@Úi‰—&ｋ ‹KJK<Yœ&R²AâyÈb½U"²˜¬Ä Å@;IàEÈëŠ"²(¯´ÄKvr)‰¼žŠ!nyF¹ÉEk•ÄÓzr°M+ò°¢0I><Y¼rIäAg•‘x²~$pÂÙ£°Z ¯n«¬–x²HäAL¾„ÆC¼XAã’„&„‰’! L´EŠ -˜˜& -ÁJ0`’›È§ á€U<£% ° -²8òX Y+WäA›HÂk -HX`-d1d%,°@[‚µHX`·¤’–°ÀoIi/aàBL%aâÚèI ȅ)% ,0×;%,°],÷ aêZç„°k)z ,p×’Vp×ZÔy,aÐq²:Z ¸kµ -pËÈHX€Y`‡^ÂØÊdbTp×DEp׸‘&¬A+awÃ$Ï Ü5N ¸kÈx `(ðG‰Ñpâäp²`%,€¿ÏX ÐØd–HXà€»:Áý kh5阼„¸«#¦Oä¥Ih\X·Ðò¤½O8à.••°ÀwŸQÂ`üj$,pÀ]má©%pW›¤$,pÀ]Ä N˜äHXÿ6iÓyiR)F p°d$,€žT’ˆ¼0Á´„ãI!•°ÀwáÞ“„¸«œµxà®"„="²Øh$,@\–­°¦¬NÊ)$pWiÌ°Äî*’„¸ËnS˜`¢„pBl$,𑦂—°À'B>‘ç'<; ‚Á²Dd¡@ °ž’MQ‚` ‹5F‚` B LI#úÓÈsó‚,ˆ%,’M1IXœG>­J[Tæà3càA&, BtßrŽ^Ìî›÷Çþõ·ËÏà|¯û÷åùgy§¬þh¿%ωµã%b¦p5åæduHS²€ï UX„ºˆ X¶ÜXD8b8ÛtmôR`ÈËk„2y\4v‹tY)õ.tWÇËXìÐ%Óiůc¬Ýò¹‰ÏúH½~í'ëïy©?xMêºm}=rHuž:_»Õœ¬êeÙ„¶j_k½P¨eæ¹ýõ§¥µGÞψǛ¹Á’åépœ«ò¦òŽë¢‰‹ð K@Ž(.Œ¦L½U¢»uÃraµxÌ°ˆ›él´ÍX`´šiŸûä.ÚxêFØúz\Ê׌»Nî``µ­fÈvÙæ(‹zhÆÐÂSÖ¦/jô×Á#çÄ›”Éúûö7¿ûíŸý™ˆ¾¹Ër±L,ù¸>‹™Ÿó˜þœÇ8#CïÔð1Dâ ¿U§À>ˬ}¬æ¨ƒ¹eõ >YçKœÒOðšSö}Kf¸äYç¿mÖ«µ®`®YõF×°£‹5ž·>`<°—f a¶çÊZí%p±“˜¥ÙÚ -!osp«lÅðyÕ<ïŽ0[1æ­¦C[9Yç£ÙŠñöÈV#ƒ+®gª»`žþ<ÿÍ+ü ÐÑøcTt+wÖ\èA›,—z.c ¥M×òVp•Í¾wÚ¬cÞkóUnyÔÙbü;Ö¨;ÖpΟ¬óA¬³‹ÍŒ>yí3a¥ú±k?ÓV3X7MKëØC¸6#kë[ÏpEÎbö©¯ž÷m{Ç*RÃ>þŽšÈÙ{Vq®ÎG³ -¾öp`¶j}¥Å½Ð·âǨåÜgµŒ•l³6âSXµéî[Å«SÒÆ“kÝÛ9+±¦á€ãƒ§3žídg%ö;ëSH®–³"¡ýÙ[ÏÐo^i£–-‰ãv?·kõà5JòÉÞ4çŸ{Ûæ)‡MÊp³‡­ã­m0¯Òªå›‡í¦€åñ<õÕÀíÍñY‘÷iÇ{œt:“—3j¶>ä>}ùeËjØ°‡KZm㥰´ÐŠ1µ]Zý홣œ¦)KX5Ӈ؟/>i>ÛMbìϾ™}·"$¶u]m˲&êˆV>µ!ðœ+pÙœg>Ö¨q~ÞÐKYCó¬°ÖsŽá;?ç ©Îm˜¥9)u¹HÎOžj^Ûåw›LjÙÞ¼‘ÕûÏyú+9ú)µ›Qíߔȭæ½ôR%x(Z¤™×4u›³÷¬-??/øUSÃhÕ#ÿf@/g«fqê¶ÉàFù}à!ƒ“w ºÿÛáÕè_Àܶ“5o‹l>Ë~ ‡SvOÕ3Ô¬§bmYGf^‚l|×+2> mÏÖÞÛ\Zï¾åò8v­ÖÎòÔL:yؙɲ§>×Ò8¸^+óÜåÈÛŒ%sçºùù©ÌdÒC¹2‡uûqGïf­›ºÂr[Uæj¡¶¹í_×z¶ŒiGWŒ<®Î£*6j—:XÏC“iØájz×]ïµ|“?¬æmgžë²­³‡:£ÎjŸnW\ʪËØøONyCéÏ×]ÌqÝõÔ¡,~#K]··¥0vY<›gF@ÐMñ}ÌcúcY+:—åuÀtö¯¼l)ŸËRñµ¥ÍìiÜœ5fþÃÜCVn×¾j¹8ûköµgåclx?¹õ×ú}¯1¼JÇCfÝ·-õس™Ò÷­Œ×—Ýèøô;èá¼~ý›7úõóœq÷îcøÊzý¢uõ6ýnð}_¿‡í¸´j‡ëº•ÝË‘‘/Lè‡Ï¢ù¢=’]äD÷ƒÏÕù_vµm_ŸÒd#ÜŽ~ý)°×ÓçÀË7Áq zï¶klšœÇCÚuÏwN§ ÅüÍï÷¤ºSßù)¡Š‘êïž9ßi3©à 451«­†8hñ6£OŒŸl¾aË· ß }þž Êû°;Ò;õyö³Xó~Ú§h°â"!ü>¶SwævÁù#°@j¢¨±D¾â‘é²Ó£c0¬ -jVóM{•ø†ð!ž¬óA¶jú¥˜¨Žð0™¶P¸&úËÕ5î·•WmEºÙ¡ÔfÓb½%³98sd«‡M‚°âýtǹnïÀ–ßÿ8wÙá‘GþŠÓl“NyD‰î]^9Wç£ÙqÌߘܵãÍÆŽäÐC¸‡6®éå·ÑiUŽÊVæçRç±óŒÊÙòû¹ü¥òÙ•åk{¾_ôuÞÚ\ÝZ¯ÑšònoL™fAü=y Êß»Sx²Î±º.vô‡Vg—Ö¶¹WQðV4?¬=/ggÞ`Z!eEáŸàŽÝyKxåXÛæR¡©e·[äà†ÍÜ]KMë¬:wûõdf©IããêVèxÁ®ZÞÿå­OÁÜ°bN[––ÛúZ– -{µ¥ž¬óá,ÕcªZYÔcÿÌ\àeÙzÿYÚ‘ceíãq¸3¥*}]ù6—»>¯ôE=2YÊ´c•=V4ÆOÊ{7¾ÏaßðeŸïÊwƒƒæãw=D§ãðÕåfCw‹Ü1™º•´ý>ÞU¯¾ÿ¶ÜmB“ü’A¯ùFbàïåïí5ñU7ë.E9Ⱥ͇IùP½\ÎW‹ÊUS÷¨²Š‹*óÔÌûUô¤Ú¡ø|5Gµƒx6¦›vDõ}Y¯ú!{ÆÆÒ_¾Ô®æ‹ Ã…€Ö~= äY\&H%#ÈcØLåŸß1¡ó{†”“6ü"«§‰ÏîBÈ藺ԾV­³²õu§f~}ã­Ty££â—<ñ >æ×=¥üyÒ¸èDS¾AÆ·’òÛ×T&GS:ùåÂoß#Ìßj>Ifbù¨Z[¤ÛM©J»ÔÖ%­›TùدSñfÛüѸ:®ïj5~+©ZÈæ÷Ì DÔôzKæÑ«I2¿Á0N¶<ù& -D5boƲ½Á^ñ.Y[5Ý–¨†î:ÙP•Góošê|'6ÑGÕéaúkY†é<"Þ.èÖ®©/"•ß›V›ªÚ5ªÑì TjTWK¶ ¡6Oévˆß¨Ú4a2˜5~ûÌLŒÕ¨•Kµœ@º]Är¥5×f*´R±WMUó]”nê66Å ´Ûpå0ð+Y‡5Â÷$ê<Œd¾éÖæZÅÁn̆x»ÀÅІürqA(í:V(WMo$Ú¡ÝFŽªÛK§†XU…¥Yiüîþw† -רŒ<ùQ×Æ§Þ ¯ÍF^*i¤û†:$i@SèeuéšÍŽúÒQ åt[馱uPÙ@©ŠÇ ÕÀcIÖÍê™!¬ê§aåHTUt×É®™òË‚Üåtm©:Õ:óz0w×Úídß°óe$‡6ãš_¦Ôämí6_‰·ìØhMfÓµ“N6ªy»ÞÙ@ì‚:¹ÃèK&×ÕÚЉ_[?öE&yÜÛåï—ìæŒu†o›x«ùÝ€c䥯ÿA™oñû ]ÿP_F3ûq£Z˜†­ òèÉò÷.O’ùͲ•Ø–Í@44À~'ëØ˺j Í3à5õêª{-©‚êƉ®ëp ›fºFÛA3î€x[i±2_:7Ýa϶ŽïÍðkŒªTx‡ƒÇØy¶»äëÐ$ž¸hwéà’*âalC‡©K¶“ r줩žå§q*,÷5< a?ÚΣîfǦ+-b(‚ØŽcäÇNÓBAè7/¯/ž÷"²¯+€© Úõe¤¶1µžLµùÑ/›Ï±ù’I]¼]C­-;¬=Û‚œ¾4zhA‹‡ÑFjìÕJ7vJ•¶è´:Š ©Jk-†*“/ÕªZòˆ£¨¥ÐbŠNýû¨i7ÎJS¢gÅoÊr»ÕãµhɶÈæúèT/ÙbÉ(ÐüX»Q©—´•¶í›–}Wo{†A]ß#SÕ«¹MÉ7áß[ÖÎ\gµ!•ª?ywDÇþú68jÒÁ›ßȯ¢÷Àâ—ª†ñ-G¯¯s¼²Ý%©û'cO˜Ž‰¬UAóÿ[AáŒtŸ14Uÿ¿ rµ¤Ä!½NÂöP‡9µÙÊ/×ÎûŽy“¨=Nù]ú–ƒÞȯJËß6ãûÄ·ÅöIþù/:Qõ% -endstream -endobj -645 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 644 0 R -/Resources 4 0 R -/Annots [ 646 0 R 647 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -646 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb151-1) ->> -endobj -647 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 330.479014 101.433071 311.729014 ] -/BS << -/W 0 ->> -/Dest (cb154-1) ->> -endobj -648 0 obj -<< -/Filter /FlateDecode -/Length 4571 ->> -stream -xœí]Kܸ¾÷¯ès€åòý‚=H‚Ù Œää`׻Ƽ9äïç£Z$KT©Åî™±åͺўV%òãÇâC¢:K|¾Qø/Z%bLÁÛóÃÇÓ§“ÁIü›B,.&õk|ƒ;+iƒp*ùèγÀ’ÓÁŸOø¯»¤ÁOÿÍéßË8ê¬EJ^+wþù‡¬²F„‚tŒ*A%•aTΉ´óŒÊ+[L‰SÁ ¬¶kU€6EÇ©`†Õ:2ª3Œ ʬU fè ,§‚*¹À¨”„JKÉê`ˆ´ÖhF§œð(tÏé´>&X]€NÍéŒ>Xå§KÂ{ï"§³°Å%©8ƒ-NY+9l±&Nça‹ñF²:Ø¢c0œ.ÀÒIŒ. +²:Ø"½Tœ.áR´–Õ%èd q­ÓÒ ‘œN)á€MÃêТPI>0: [¼t‰ÕÁg¤æt¶X|8x™#ÓZunÝFÅélÑ:XV[Pùh[dð ‰ÌKè„MÚr$ £6Úȱ€ŽIØ G:9a} -© ÓŠ##a‹³žc£`‹EËeu°Å$ËqÑ°8.0¶hk8.0`[ ´p\`@·V&ÅqßZ©<Ç„ 3%ÇŒk¢·P. ”8.0à\îä¸À€tÑÜǬkœ×Ю±Ñs\`À»Æ*Éq¬¶À€…QÑp\`Á»FÉÀqï¢iŽ P«8ô+BÇ(9.°à]¥å¸À‚wu@Àê‚@4Xð®v¸®çïj'5Ǽ«­ö(ü#Yo¼ -q¼;[@° ¿‡NŽ ˜ÐpK8.pà]•Ðý1ml%TLžãÞUÕÇê’P%δ[”²PÞ'Ž x•á¸ÀwAŸ‘ãp¼@ª9.pà]eÐSs:ð®ÒIr\àÀ»ðÇ€ƒPp8.@ÿ&”tY]2ÅÈqï‚–4Çè……Œ`V€¤8. ?”ãÞE÷ž8.ðà]éŒá¸Àƒw¥…ÛÃê`‹‰šãø5СÙ2mΪLÁéÀ»R¡†9xWÊ8.ðàÝÜmr\àCèÈq ð‚5Ç>Z‘Bðø$¡ƒËÇê¼Àµã¸ H(‹ÕÁ,Çp¬E2)r\4l1Zs\4lËÀq<‘¼ovx[v|`a Ž ’ô"»É€Æ¡“’イ"Æ›Úr\€v™Ç›‘ã‚d$Æ›â1í6ŸÇ›ã‚da‹ƒ‹Âê` œ¦Ä´[pÆ›`'Nça‹N–ã‚ä}oFŽ àf`¼ žˆy¼Øéð®K`&NÞ…gê9.ÀÆ›ðl¹±½ñºÿŒWÆ<âŒìŒõ:ô­ì”÷¢· -ìœùæ1;i31²Œž5@· -¥’ì´ÿ³+N¸Ì>Ñ)*8ô™1ä›LhÞ}s´`f#Øe~ìçOß¾Eç{þñ?§¿™fÊÊGÁA˜B[øWh:¡º¼o…Û7­Ä$´“…0ðž8Ùˆš‘ -´8Oºe#Ñýåçõ…å0üõ”½©Ù'ôâ—ìAÞZa G _§¹AbñQžÑ`‰Áz[0&éÌN€üJi÷æ ÎV\æ@ë%1ý%ÃV»ó›§oÿüêoùþ5`ôæÃé¿•Òþ ¥‹ß}£òo7ÿ¯Ý|í‘….Œ¿üU9L§³ HkçpEöa™NŽWÒp9î*ã ˆ]Eb©eKÐQjêCFz›`&ÝV-§´JX¢k¡+ñJ«1áô÷Pò|C^És±=ºb+«z;Ržd‰Äû°ŒÕÈ5MFŠMÙ¯»ŽÜ±8‡C®½Ê¡Ûmþب~2ªÈ½ôH^!˜¤YyÞuùG’W×”Wù¸ënéúUs<-Oeð~¹cq‡ÜëNjá¯Þ´o—½4íi÷¼ì ¬zê¾'/HëN¦'ï¬ó3ž8Ä~iÿÊY,ù?tiõÈ÷-ÜU÷¨ }ÁΨŠwpéXœÃ!rÇ5]É–Ò£½×Öð„p-õEÏ÷ö)>Ü—çóyµæ‘ª‰ï©´H2êçh(4×}KegԽݘնsiæ0~ÇÕ83†ß3“Y˜­ùÍRÃeæ}•ï•Å¯žÿئ-O ´Ê§wÒÏÕnd ™‹í™ãm;>ã=ËodFå8>Øórôçó“7JüÀü nÒïÍ - Æ9Bï_Lâ“[g¸Ÿ‘~™­c±Ä'ÌÛuTÚí!v,Îá{ݼyW¾Ø"a–éÝT£·Œr>W‹ë|Öç^_·Ä?tZHg}FÏUDÆ9"í×»¾~ØÖruDµ8sû΢Á8‡CÜu¿rk-‡ ¡{‚æ5ºÍ­GMÝ{ÔñÖæúÑ;¹Þ…ñL^ÁÓvW<·°J²~=:C>çp¨Ü™‡<*§]… !û†ÞýEZIÇ•›üH×­w¼ Æ9w|ÄÃpÆ/¼UÜÑ‹»;öeÆ9JÝ ßXJÐßkcŸEÙjW/7sÒõòý&s÷–¤Gg«Én²ºC¬³I“Yíi÷ÃÖ&÷9¾zÿtÔ­øöÅËpÅæöñø`œÃ¡xgŽó‹î ýzùúän¢ñŽùÌÁ8‡CãÎ|æ­üø„Ÿ…¿‹Œ®v¨žÂÝnE!÷5 Ò"sÞÓþÔ™£ûP»§\F׈™›ô õ¬¬Ü[‘Œs8Ä^÷UuܯÝ/‚¼·L/\Â{îAÞýhBÜ»FüPOæ"G8çhô_Þí„\!㊿ù%Pfⶭ«Öxóúÿ"›˜_ÕµnoÝ|0Îá98¿ymwD~›A˜¿Ì3‘W}µ~…‘™á®º~‡ñ–_»ñü̪%¹vϱ·Çß±r0ÎáPóëƒá dö†é08OéÉœãèhe0Îáûë<å¢eí¥µ…Ê=˜÷¡Gh·¿sc0ÎÑvžÅ¹“ ú§G§Ñ„’«ÕHž7þ[ÆÍík:ƒq‡ÄŸðP¼ñ„úŠÄ™o;ÔçÝÉe§òì÷®v1ë9\zaŽ¼ã½Dƒq‡Ìuo%7ŸÙÙë=\û~®aú-ò²§=]þnÕ|el¼Wƒæ9!µ×tÐVEüeMç,·ž†àFk[¼¸…¾;öCÆ9ú÷Cömú{hŽågö^ÈöηW]ÝñÌö`œ£¡0Žù‰Ÿkí6_ÈõšÆÉsóY–¯ÙÝ@§¹ýÙÃÁ8‡Cç|Ç/Ê+ÏØr6üÜÕZI7ë][Vœ¿N._%g_³÷)K/ÎcÏݾËg0Îá°wÝ;œÊ-Ìó¸¹,ßµ2Ôš”gñèÞw¿»rßÅS?B'#óÕ~ánW»rSVc(S1ÞâÖêÈÄ }úe·OZÛRÇQÌ*Ðè[•6ûë;žÆŒs8TîxÏþÆëÈÜ|²E߆‚[ß«µé7ô¬Ú¿®GöktÜÖíï*xÛZã"Ó»!ã ‘igš>Û¯ÞÏhÅ]tMÐÊÅèxkwöní_©avôN=·®ÕpÏ_¬ø¸[#Üzï]ïoxâ}»Ow<Ë=çpø¼îC®êbcGíþSórwƨ¦ñÀ×÷bî­XâpÉì Q¬Q{vç/6˜“z‹ƒoöŒs8dî¬{¿@_~䙯Âæ1{ÇÛ(ã³×ýÏUë¿ge‡%ÙÇ0Ó•“§Øwëè‹Ï4&}=Ÿ*й|>Qt*’ã6*wƒì o}8G9ââœ?=´üŒ)7BäƒqM<Ãq´)ä³d2”^ýáOü+Òô‚ü.i/——äë‡Ë«lóu.Ž©ŠU©æËKõm,Ô6;—SQç"»T‰œ—XòßËkq3.ƒÚ,×9¬¿|§´æßS:±PÏœ_®þ?¿¶,\ô‹ôÝœ7±gJÑ{(ðM«ªütòÓ¹Hj:Oz Uu><÷ì­0¹nÒ9ŸÅ¥±ªTš -[7bNGª¡æSˆe>˜0Ju9¢˜\Ìá?M•þñ¤’¹ü31\N •“8êrÑħ|b¬eÄÖ -=(ÎÂù§¬iYUVÙø5ˆÔ‡4NÈùgª‰W~jWî&Çw%Z>ÉÇÊÈLgÙ\2f„ˆéÕZœï^ -5‹ó©»Q˜ùÊWSœ/6CØ´4lK°EÜ+#‰Ð­…’d×ÄÚ{T>¥­oÂj:-:Eª¿„ÕTç5áà ٚ^úÈJóYŸ%©RºZV™!F¥*u%d­[ë‰=œá7²$mQ™UOj-Ÿ˜vÆ$[Ã¥Ž=œØpsj®ÖT¨¡b‹šJÉ7SÔM¬ÏȦ2š¥!#NÚˆ4åçRìs ”º–‘àF¯„'t1v%~<¹À„v+¤+УBCÒ­â(^š4Oê]~¡iY>o*ÿ¡ -W¥™y¦ÊVHå3ãÚUË$·Í*^•ûÊ:–+eC KŠK…P1KËKEɄϤ[C×[HI‘yHżLR•<–bUQWÅ™ÂJùT®¤BYŒ@vMì*”âf§«M`/™yEàîjºMì+w>Rq¨5®ò€ÕÞš.Á|>L›íÅú±dÒÄZÖÞ®eF„Í0B7}œÄ¥µVvšÞö>ÿlŒëqN?¦nN§~x£òy¶ÔóRçÿ"Ì+|ÿu²çïËj—~\ËʺrëBL{²|úyçÓЋ°6"Ô–Ð~«Øº‚†ÚkMøÚ¶è²{ ©*ƒªª¥B×ʈu…®V†”Œ»"|èJ±:2O­›Öa_.M¹9dcòÑ{Å*\ÐÛÁel:Óºä3IW9hëÒ¡µšDÄM—$ÃÔ,[˜™I3©EŸí·´*L΋\7"_š¦³­›¥IÙt$\`C/hÂVÑLÓÂÆ軛דë}6Ù—¥•Ú«ô‘Jëei%<^j¦K¿¼¬}Ž9ç‹Òx[ Õ´ i{¦:9­i4×Â..(F‰4¶hsG3µE¶È´t•. “EVS Å&?G+Å2ÝqdK)TŸ¢I¢%íh­ÔBt´Vü*lN·ôxÕ[2ÕrΡÝl!«/™§±«Ô¶¦ÈÖyÛeÞ¥·=“Û°Íß²ž%)ó'4'T‡°ÆÈ €· ¡Hû -’Ôã|Z+-Iö–n+fz¨Ñœ\ÍaæéËi’¨^†> -endobj -650 0 obj -<< -/Filter /FlateDecode -/Length 3465 ->> -stream -xœíœM¹†ïú:/`.É*~’ F6ˆ#{rp{Á8€7‡üý¼Õj~t«$µflGãõ3RW‘ìj²øT‘šn··x½pø“Ù™œKŠ¼?|Ø}ÜY“‚ÅÏTbq0©_ã7…½³œLp%æ°ÿ J&•àSÜ?ìðgu8ØýøÝîßË:nïM)Ñ»°ÿ娘LÊ)Ù ¨ -TÖ‘¢ -Á¤äCTTÑ\b)š -f„ÄžOU fpÉASÁ ö>+ª 3ˆ“£SU>9ÖT0Õ•³°ÃykU ±Ìä &¢Ó£¦óÎÄ\|Qu :—¼¦#21± NÓc YÓ1l Å:M`KpÌVÓÁ¦œ4]„-ɪ:Øâs"M—`‹GïE—a ¼+«:Øb£uš® %3«ºÍ)Ÿê¼ &d"«éœ3¾Iª3 -ƒ“¢ó°%ÚPTl d½¦#ØÂxi:p"PÊY™­^f7Yrš.Àï«:Ø‚Á×à#l±)jÀ 2Â%>%ÃųŸÉpæ¬QÀçb8%Ò0àK0KÒ8@ÖAç²°%pÔH@¶0f®ªƒ-TXcyØ‚ ˆ`‹gÒX@ -Ã[4p˶8Þ²uQc¸0Ój, —rdä•ŠÆs ìÔX@€.¦{ÒX@ .…è5°Kœ£Æw‰ÕXÀà.jª:ØÖX:r™40¸KÎ& îbyU?Œ à+Æçl50¸ë³e îú„ ê’Á$ îú€KÐ"7¸ëƒõ Üõì£Æ8Š¬š €»@HÐÓØÀj,@¼‡Î“Æ4f<ÒÜuáO™Ó •q¹DÜuçêŠq =®Ì[ô²q1ÜE "Ü>³Æ0Þ ¢zÜu„H­éÀ]ç‹ÕXÀ]ä AcÜÁ8$ ߌ³p]UWŒ-9k,à.°ä5 -›AU— Éi,ŒEª± ‚»ïEcAwm ÒXÁ]ËH{Tl¡ì5 ¯ÓV™ÓHVõ …¦w­Ãk:p×ÚT4DpW¦Ƃ˜Dà³Æh{1³))E±Xèò©ºhp4$ A²TláÄ X›B%k,H¶÷ ’‡-H4 #0Å!ûV—°¶ SÔX’™\˜5¤±C¯jºèMNÀµªË餱 %6ÅNcÖR&cÒk,à¤K `tŽ5¤[0U4 ™ì‘™k:[dk,@¦ s ²‡-È5dŸ±ÊŒVc"4Ö’èjMÇVÖ™YcAæh$UÔX€i‚•&H©ê` 0¡±ã#‹í ±‹,6±ÌQu°…k,ÈÙËr3k,ȶxë5À7e½™4 [ñi,(6I“5ãÐY«± ¸Œõ¦g˜—²ÞÌ -Y¬7±ÄSæm¡(ëͤ± 0l HQTlAÒT”y &a½ :iº[|a%FYofH3°ÞDF¯n dYo&u»Ü dÒtà.2Ó¨±Xo"³ÕÖöà ù™®Ì²âÌêŽzb«ºe`Á^D«¤îXÀWÖHê¦ÌÄÊ2Gu×aJgÕm þ"ã&wŸÆ-ªwHˆ™9ÉEL FvßÖ½)vÜûå§Ý÷o|÷?ýg÷þ»i§¬¾„©4#¿Â4ðÃ};\>E$ÆS`H‰…0ð1uĈTº‘Xœ7ÝÄH„?ùÙŸ~XXÃ_O§§vú‚(>ž‘aÞ°8rÆòumñU>¡Á‹#DÛˆ2T¼Ð .‡¼Òò¢ðoßìਲ਼Ç=Ðv8˜x‰Å0û°óa÷ýŸ^ýõÏ?¼†½y¿ûÛo¬åøò…“÷÷óûa~ÏÇ÷÷éø{ùªóûX¦ í¼_–ÇšÖÊî_2¼lCä'v ºZ®Õsƒ=ÿ8µiQç]×»0ëÎ]K9ÓVZ^S­?Ù}S?¾üûþÍ«ÝïÞ,mÊ>SƒÄ¸.úæ¶*OñÍÏá’XÊnqÉy˜Ý0Ìkw³ÔÝnážuˆòr¨Ú®‡×îP‡îíìb‡ÁÝÞÎçy×Û®.ÚÜË.JË6or9åz®NÏÁÍÃá©ÓQwSÙ¥¯N'ï˜OñšŸn¬soŽŠ•ÒEOýUÀêÌŒ\yÚÿg&žñPêXÄmŠØ×¢üÆ:wç¡|™¥8µf:âßÒ‚'Ì´3ÞÙÊÍq~c»óÎÏ”|>ÓÌà“θ/é‡ôrs¤ßVçî<õJNú,ùóõGz?ä•Î›b³—¢‹º±Î½y¨¿’‹>’;½MãÛ·H¿9Òû!§”¯Wrž¾*¸ìÛêÜw^ÎC½îý -#ýÍ3î Dzn_Óo¬swžz%'}–üùD3ìž#}¾}M¿±ÎÝyèÆ\4÷ž¬£Ø9s¢Ð<ºS¾çgÙ<ߢúmQìíë÷uîÍéJÎù5®ß?ÇìúœèöµúÆ:wç•Wö<Ÿ%k>ÑlÚÁ›—º•'¾¼Zû^k= k;u¶\ùŠ“ñýûÆ:w祗óÌæ)«<áXìLàkªå·Œx=ÇÚ†æyëÕK8µÅþ¿ï·¯hÖF«»±jùí¸ä1¯Ú;ë¡=gÜî¡Ûê܇޸ç90mŒ„'Ü:牗Ö˸ôœsÌu–Ãko=Õùßµo¬soÞÈÛrÍOÁ±)Ÿâkï®ÿéÑê¬òÙÉ{qÑŽf/ÊÇ÷³í¬¯IËWùëccÄ ƒýÒös¬dº•ëÜw^É9׹دr½|c[OZžñÈñ{ò;îëÜG^É/W#ÑzõBvÿ(†i,|D>8þ×\Ó­9|f%´ffãâ8»Nò¿ÓÕÒ盵g¼õ{šëÜ·^Î5Ÿ-ÓÎyó†µøzk1¿è Ò½3ô<Ò1F»P -öÚÿÊo«soÞ6æžg²wm‡¦Ò™\LXr’¿æ¡½:&¯ç»/R€ù!ÈÝo9¸<ÜÌÑâj‘+ý~zëG½b/¯uÇƹGãMÊcW(ïÑ‘\’Ü©$ùê÷üÃ_†Ž$LOiá[ò‹Ï¿˜ÇââS‘ÍÓ2— Ò) G$„ÉÝ¥óŽSMÊÉwiKÊóû#ÐEî¥l<þNmÍŸ§vr¼ù|Ó6˜ ¢ òQ¿h?Ìçì™ÚÃ5„z /×Cùq§»îÜtçµÙ8/fÙG6$cSör§_¶Ä®›:ÛíÏÔœh󱕚Ÿqcå¶w¹åñøœá`.ÿqô;WØHÿË´8>ÂNâìëA?ìäy$¬ˆñh£X„óGÛÚ1üJv]’)ë’êýB®´Æ)Ô>Ô«‘ú¡V“ûÄØÖB4Ý)u<±"DÍèNÅrõÖ¸Y,ÏtɆæ£ØL ±Ú aoDz½Á^ñªØ‘„áTh‡Óu±çj“{€[×Å.l¦]ç†á¯e}†ó’ð°Ãii-}P¥ò$‰ÚTí]o›Œ£J“†Z² ·qRD‡"|akÓŒÁlúaÔä~Ü£0WGâV®ÔrŠè°SËÍ­…6R©•Ê½j©=ßMé®N¹u¼"›úh–&yHÕ0G,ÕKq”¨cmóà7þDxØ!Äð‰øa’R:tVØP]oÒÐngÛý¥KS®]…©Yer7£ü=¢"4©gúู”Ü‘ÜúIdn6ñ²“FylÔa­§^vè.—RóÙ±¿°~RÊ t[éÖc éÐeƒ<•jž@ªÁc)vÍëšXVû§±rÚjN×Å¡¹òÃBÜí mªÂÙëÉ¢Ü=´v»86v>ŒâÔFÜÉíåÍÞÖîàóUx˜¯Åâú¹ž¤‹½mÑ®ŸlvÃ….î}˜Äu¶6:Mÿ[<ì“L‹¸‡ÝÏ»)Ìy -¾àC$'OK3/·ÿ/ʼÂï¿v¼ÿ¡Þž{ŒãÞ6ZøÆÖ…xŒdòl­¼Q,ÏÚªÂ6m¡çû]ìr/ª7´8îýÀkîÕm{-éA]ÓŽÂÐûpûæºÞÑÐ3á‚ð°êÅ–ÈR½8œ†äÆîjÆËÁaî:ê!y?4‰#)ÚC:´ì‡Š8ÅápÂÒ-[˜)9ž¤u½ØÏãPœk8Ò9¤®ãfǦ«lºŠ¡R`ƆÙ'- {£=½ž<î³É±Î‘6´7éÃ(m&Ò<]JÓa\¶˜C{9¨“·÷Pk‹†¹G-ÉéS£§¼8}tæ^m.Æ“r•-NZEÃd¶ÊZ‹©Úçjµ[¦+Îj/¥–StéÏcO‡qTZ'†qTâIYi·F¼–-QK€ÂèΩ_í%[.™Yk7)÷’Te§çæå¹k´Ý—ÁÝØ3SÛ«…“’âßcæαÎj'B+U_ÓîˆËýÔìyšžQjsŒ`Ëc¦ça»äæ:—÷ONwIêþÉx& ‡a"›œ> -endobj -652 0 obj -<< -/Filter /FlateDecode -/Length 4664 ->> -stream -xœí]K·¾Ï¯˜³Ó|?ÇI#b@ˆAÒX²¬È9äïç+v“¬î®éé]­í‘½^fºŠbñãÇ"ûeΟü“½Q9—ýùòþôá¤U -ÿÕ‹ƒªþŸÎFû¤‚)1‡ó{¸¤R 6Åóà ÿ¬yò‡ÓwŸþ³ÌcÎV•­ çŸÞ’Ê;•rJ:ª•6NP… R²! -ªhšXŠ¤‚!yë·ª3|ÉARÁ omTf8ŸŒÛª -Ì°ÉxI3L IP ;ŒÕZÔÁí½³‚Îáô(é¬Q1[D]‚Î$+éœS1yŒ¤+*Ʋ¤ó°%m$]€-Áx¯%lñ.'Ia‹‹N‹:Øbsr’.Á ïA—a ЕElÑQIWœ -%{/ê -t:§¼ÕYTÈÎiIgŒ -À¦uQ褘…-Q‡"ê`KpÚJ:[<þ$x"¸”³0Z-n§‘t¶X›¼¨ƒ-è|‰l„-:E‰0‚ñ’Ä6%å‹õ Øì”Ï>K,`sQ>%'Ñ€-AùX’ÄN謑ˆÀiØ|”˜ÀØâ1rElqÅK\à,lA‰ œƒ-Ö;‰ ØÖ-8Э×ÅH\àÀ·^›(qáÂL-q㺽Ĕ (‰ 8×;%.p ] ÷$q뺭Ĵë|Ž8ð®óFK\àÁ»Î!§¨ƒ-°Ä`GåLvxð®3:I\àÁ»FVâôª£ÄÀŠ²9k‰ y‰ X«âJ–¸ YØ⬕¸ YØ‚AâDªDßâò¶.âúÀÃDŠ€ÉT.ÞK\BÄz ^•tѪœ@×¢.Cg’Ä)y…©ØH\€µ”Êô€à…KÀ 茗¸ Ø‚¡"q¦"•-"sIg` ‚l‰ éBgŒÄÙÂDƒd›±ÊŒZâÌÐXKÂÕ’ÎkZgf‰ ²ŠBE‰ 0L°ÒSŠ:Øš¸ýC‹í q?Xlb™#ê`‹ ^â‚œ--7³Ä9ë­ÄÀ&­7“ÄEÃD|…ɀơÓZâ‚b2Ö›ÖK\€qIëÍ,qAqëM,ñ„q[\¤õf’¸ xØ¢ˆ:Ø‚ ©ãœ„õ&ØIÒEØb‹—¸ ÄHëÍ,q ¬7Ñ‹[™Ö›IÜ.ï†f’tà]D¦Qâ`½‰ÈVZÛkoHˆÏde¦gw 4¨7`n· 4¸³U÷ 4È—ÖHâ¦ÌÄÊ2Gq×Ó*”F‹Ûü‹xÌo8aÚ}â[TpH˜3s¢F 辯9F2w%Ù´?öÓ§/^cò=ÿðßÓ»ÏêNYû#l¤ iô¶-èí÷'8ËCĵ‘‰ ΈLWbšniA®q-¬»Ux911¢<°ƒ!Ä>,åXÕå*gÕÄšsjf“^XK˜øá„ÅV¤+q=í¨Ž ã(wˆGK˜t4zT5¼#ù÷rúý—1¼ RI˜Ö(+Â]`ÏèŠ ä ®LetµÁä2o]"áÐ,»=M}Í{ˆu²Týs#o.s:WIJ&&B‰”ˆà–bZ=·´øµ. 4ÄKq9‚Ÿ–^¡iS€–!¤„2R¯Å!´ôê¸C(ŠêÒÑèQÕðŽäßËËÀýU.EêôßyûC Yîц÷ò€¼:ȸ߸ï_ßËàû ¾Hÿ¥óöÇ#3˜·˜9b‰ì—Á÷2ø^ß#Ÿ8Èr^/ïeàýÎÞcBN, -•ó‘N”{ÚÂdnÒª.ýÙe£¥ åyUù”<û+QÚZ·Á—sÿ!¯K3ªîTøE½Á`Ý«­‹¢­Îóü¶Mç“huQ¯läÄ7­;Ô÷[#ë ±M½tê4èìl=šéÞnPýáÕ =Z¯ÃwñÊû\Ï_Ñe%‰öàϯޟ¾øúOùóß¿Eo½zwúç—Zƒ'5 Ö†6ÔÖßÁâ ¬C˜Žý»ù“'¥Åÿ¨iéÛ¿nú¯þu~õõÉSº_möù8d#Ç`lÃsÖe2omQýö³eù«ÏÍ—TÛüçï&Sí”–,÷o&yµ0 ò9-ª¨Ÿª›[G ô—QW+ƒô>Íé©<;ëgYõ@då½YÚÖlîò–Ÿ<›áµ²öZµ0Ltè¹Öæ±Ù µe³%Õ+qx¤§ñË4õØÍŸ0,oÇT&÷RÇôšgö$–Oo½ª/³âÜôÈÛŒ1…I ÓÚìºW©ŽÉ‹Tžù~[Ntt2†.øÙ–£çvMm®íÞ³#ÙkvèÑ–…?.cL ¶Ñ…_Q{¯Pö„üQæÉÃ×Ï3n‡/jÞVWœý“'t׶•ù;Êí¬˜iiÞ±ÑFú2ðj쮯ËÚµ,*3ÌeÖ–8|¸þí$3³lÑæÙ_5-kwÁÜO­Í oiú®å½ñ7ã 2ÁÁþ0z¯ýάÛvúŽØ24Üé©í–}²ÆM//.°êÌðGKßëfØ༱.Ÿ]÷˜UbÕ]_¹¯f[ã‰zÜúÙL2Þ>™óöùîP}ïÆØvøº¦3ú®Ž·'æûçòå®ÿÂf¬mf³ý¶‘ ëìívëÉyUÏ4G,9®ñä_ÕXËõÀÐxåJµèb°`§“°(Ò×I’ÅgÍó¤ˆwÇ”¥KCÐ^TdéTºFìW²öëÍøVëäš~h\èöÚLW,[7…lýúû†‡läò0OÙ—5 -cÁÑÔ W+,QéBU­*œ¦©œ:üæé› [åûåZ,÷BÄAÊ ï¾º‘Ûçz%bŒ×¬º‘kõBè’ò×à¨y®%ʬùûÝŽ§¦I`þ½ªcš–!ß41´ðp®¾ó2Ý49µÐt”×~O“Â2Ïß± -m>?¥çè:Ê„ñ"öû‘Ú-â2Ÿ±çBÄ" k½TkŒ‡Âzr·.R_|Ñx9Ž®™MÆe“ÄE—ÉžU‹@Ø] n·Á#]^èzËU¥•)®‘h 2ŠIzƒDåù˜5îÏÁ¥„é.Õ¯ù´*¶>Ò.Û‘¶ÎãÔ[j¦›¦V–¶•óFÀ^dº5CÌù¨¿—e¾&ïö\+?öU{ŽãQÁÞ;–ӄ帘ÞçEAÅy®Öl±îU)¶2–îa=¤ØpKWsG¬èb¨]¬ÌswX/zëëY¦§%NLž?aú,äiñ_N[Góo?§ù~Nÿfè¬eéÜüù~õ{Uö'1«~Ù8DF ]ØÞÂOºþÖfcà Ìs'fÓý‰×XÐkï¿3ðº§ÆFֶ盭ÓÖ^âQ±,ÙåsïÕKßX¡Á2[/KŽE¿ŒÌMÓÈ÷˜vmãšéwÑh·Ñé°œë•Ûûh<–çîÐè÷ùðžïÇR{|–½ÏÐs«};mèyxfßzÔ,|öz²sÃÇyi×!Ô†Á‡Áb•â#!lµÇòÜjã>‡ú%üÊ»kµïŽšÕ_ϧVÜêÛoQÔë[Íž™ WFHEŒÙŽ -iï<»F kÃãÐ$‘ymé y,ÏÝ¡m?füÅѶ^‹üósÌæ½=<îã<·Žyž· Íí´Ãµv”+eµ6½[ú±Y#4øð0Bæ¹7„¦1å'µB`¨ZÇ~ÍÎ+QÉž\Df^‰aôYa÷Ñö]Aêâ̓yî©7âÍu～ѳŠ™j/ÜBuCß•=ŸC¼#ôv·m½´N¿ÇÏ…•³I÷ÃÑWÐ:bÆ ½ªgŠníŒÌswhÝ3Ÿoû”Í=mXO¯÷œüz#ô -JG¬yxGé`ž»Céøô±Èb<@—J|:|õkŽH…™Å“ƪ¢³¥û“wQx0Ͻ¡0߈A%¾Z!íyêê>å'\A§}z™é¯s#Û«<aó`ž»Cå/³‡ù¬|ô»™é¯ 3<þ\ÐÁ s’ïéJK'ˆ.'1Ý\Zè=•zª<²–æùaÊ€ºËÝñ‚ìÂ’èÅ[lŒh×~.Åô|‰Þ×:3ÜØðrÂã7âú„§mê0¸B‡=.t¬Ü.ÎzàeHSn®ÂÐl2zB3ý;QEèRbžúÃø)zÊú8•ÐØì⥓¸›Û i§ö.}àÒÞ0’v“¥®ÆåaŸs\½ý¿ Þá¡^–ccÏõ g ZøÅÇ(“æ‘mNx¥¾É•¶‰¢ÓdºÉz‰©ÙçlÍ-µÅYôRê1ÅþÈ=x¯t'Þ+q“–Êm3^–\€‡s­Ó#e%³ ‹> -endobj -654 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 533.554475 101.433071 514.804475 ] -/BS << -/W 0 ->> -/Dest (cb157-1) ->> -endobj -655 0 obj -<< -/Filter /FlateDecode -/Length 4595 ->> -stream -xœí]K$9¾×¯¨3Ò&~„_Ú V€XiÄa¦w„z‘ü}¾p¦éŒÌÊêéjVL«§+#ü;>;Yúªðó•Æ‘ôc -ž®Oß_~¸¨)8…9Åê"«¿ÅopW­(LN'Ýõ{Ø0…äLð×— þ.ûä/—?ÿìòÏu}5SJÞhwý×GV‘B A9A• RÚ -*禌ó‚Êë MLIRÁ ÈÐV`¥è$Ì c¢ Š0ÃRÐv«J0ÃM’ -fèä‚ Ò -vh£”¨ƒ!ŠÈA§ÝäÑé^Ò=ù˜Lu:Œ¤³vò´Ó’.MÞ{%Á—”–t¶8M¤$l!ƒ¤ó°Åz«Dl11XI`‹Aï$Aa ÐElQ^iI—ìäR$u :CÜêŒr“‹Ö*I§õä€M+ê0¢à$-^¹$ê`‹³ÊH: [?’<álˆQ­†G·UVK:[Œ $ê` œ/1€ñ°E/QFÐļ$q€ a¢dH"íD‘¢Ä&¦‰B° ˜ä&ò)H<`•†Îh‰¬‚-Ž¼ÄVÃÂÈu°Å&’¸ÀØ‚X [ Y‰ ,Ø–€‰ ,è–TÒXð-)í%.° \˜©$.°`\=I\`A¹€R’¸À‚s-¸Sâ ÒÅpX°®uÞH\`A»–¢—¸À‚w-i%qw­ENQ[`‰ ÀŽ“ÕÑJ\@à]«U¸€À»FFâxu½ÄÀÊdbTx×DEx×L¢.LƒVâï‡&H37x×8e$. ð®!ã%.P&ð£ð.(ÄÉálÁJ\€ù:c%.@a“AX"qïê„éOÓ`«IÇä%.pà]á>Q—&Ðã¸E/OÚû$qïb¢²8ð.è3J\ŽŸ0£‰ xW[ÌÔ’¼«MR8ð.â'qà0i`~›´tE]šTŠQâÞ-‰ 0 O*‚ID]˜$-qÈxRˆC%.ðà]LïIâÞUÎZ‰ õ[Tp˜3càF& Bt_×-™ÝI6ïýëo—Ÿ¿Çä{ýÛ¿/Ï?Ë;eåG#@È© ñ†Ip·Cô­Ñ|믇Ù4XvWb®6¤f–.Ûll&<þwÝ~XÙ -SÙXäÆJÈóꟃcµT îÉ¥–ÁXž%›­wç¹ir@L®õƒ–míú¨«·ë$ÁÖ»ó¼½­˜P±hFˆ¹®W6òFâ·u~«—£Äm½¼ž7c@6öl¦76ÚÖÎJìv(a˜Zf"Lˆq‚–§þÎä;³¼¡Á - xD„il2<ƒ‚±öQ´JüËwébżO_/;óÓiLŽÆ]ß}ùùï¾ùÓ~ÿ-øîùò—_(Ä_¥ñ—žç¿ÎÏy™üZGOË߸¤Õ-?>¶ô´È ¤]ú'^T´ô}gZ™”ººÞCVò»uý«:Ÿ‡r–4ÔÙWòijÄuµØBr•ôë6}ý×ë»o.¿z·Q^ýÌ ò ^B|êoàî\–OÁÝ·”Žà&¹»tÿèž -»çÁ=në&õ~Ÿ7ûô=¬F>ß‘’þ.øé®mCy¹¬q˜¥¦¯ýö$ Ë;`ÈwPñf§Á æOæy4 b%~ˆÄ—b9CJŒ:&I×DAO&ÏÑ›®uå¯~Ø"w•§#TíÝâ…²jûÆv´šôØJIŽo Â=çò<zè³ñX™&?ã´êì§Øgb>QÚ.(ŠóßÝrÆ6õõHÏö½íô)p°YÛ¾Ëm] –ušx!}ŒÎsyÇAÝ&S;‹¾P.; -`ï*k/€¸²Ôwj¶m!œã-àóvæ1"Ïåy8DÇ}£'j¯„ö¯â0‰ _f4Рyxg4rfåÅ~tIñß°TúñF­ŒVÓâ<§hÊTx‹?Oæy4´šãØð‹å´=4ŸXˆW4 #áóŽ t¶8R¼lpê:Ïåy8tžŒ=w¢wi{¦zi'c.Ùį±+¯ø¤nas[Ò”×Þ¥-õ²Ûí5‰ø˜œ61·å›_ÿö7ìÚ’ù[óÝžå¯+³+lªíXÛÚæ ¶mNëÌÒÆùz#_Ò¶Øv.cÓrßÌK½s|½”ëÔzKJÍåV—zs~ßÚÒFÐÚ¶RwΓæ:¸þnÄåž?ÓÕV÷]ͽ«ÀU†:k»³åKO±UÄV=-µù¥¿*ßñ9Ë'3—òíâ繎År”£¿Û–ã-߶ä£qÛrro”ö¹õGvĸg‡jmÉž,íco˜yD¶ñI¯Èø$”=#±•¹FVC•ñ­ŽÜÏn¾Îhz^ìssZ[ú^/¿ÖgdšÅ'vé»´Í/m+hõr;+¢žZýý5b˜ë+Ñ€ÜפÆþ(£ƒÊÜ溶øÖ'®×œee>\µy鯜¶kw¡}?•6¼…ùo.ïã‚¿s,Îe¾Ùi¿Ûï|Ç æ -îÔ\²kŸŒ¸©åù6+të’¾ÖÝacd•¾üÒ'yl²ï‡ñæ:{ãÚ­{Æ<ì'Úô“íú|ìjØ!(¬×1ž\VGëzf~[Ï2ÆÇõNÞæ›O|äïÔÁÉ<¯ºø†Áƒ«ö"´ÎaXˆÁC.ãÂD—á×M´³v+Lá*üË°4®ÁIZäÇå‹.ö¸B¹îùë¹B>oêýžU7ò;?%ßIùó´?„\îD™ùQrÞôÔÑößÞ]²Wo7fb8%4|¿Ís¢ï€Ø mp_ã9>-0^D¿Ÿ©Ýx|Äÿoè9Ç7¥u jT#Æ]êU;Tš™bDè…ÍgÃòY·ÐOåy…XåR¯Ü—ª÷êÜw·)U9×w#«ÇJ®å–´u䛵ü¼=_ŸG£'„ÆŠ´0#-Oùz@c?ÅGqŠÏ+õäbÐC…GHä£È ªøDý©ÛQ'ó<ù„í>oÝ2©lÛ­žÕí–…e9Þ±/ËëgZÒ|·¤ÿÐtÆtéìòûÝðy(û‹˜ó~q¼ÁïS¨Á!{ÈDmÜ-žËó lLj´>B`æ±÷?´ùqôTÛ@Ùz¾Ä¡cÚì¥>fe” \Å{ŸrKëðfìØÆÐòÝÓγmç‰#4Ó¸íìí¦“yö˜Ç­P7x¡¿U½sK†¤[:f«Ëó]ÚRÎ!ìn"l¸Kº­µüîÝ–¿Ù¾ƒ6Œ·ÓVý¶£Fº½¸e|µÔøЬ!È3ÂŽQ{.ÏáÖs(­‘@CïŽ(ê7ï3bÜ|4o¤Ûá/mQ4Ɖã!¶ñv¸tÓòæ¡6¿FÏئÓ7 6h’÷1èÆm¤^Á‘çò<ÚŽcÆÏŽ¶½›ˆ=—þ³ùãÞÌÝAh‹Ï#ô\žGCh¼S~Q+„UcìWì܉JÎðä**ÐËJÌ £Ï«¸O¶oçLû+âÍ“y©7âÍÑ{ïô 1S9æsˆê‚¾£»³ÝûôÆ?‡÷žÀhyöxÓÉ<‡Öã8ó-#½É3B§ŽX~¿>ÞÝAi‹5Oï(Ìóp(½ŸÞ‹¬Ïv|ò‘cÊ{ûm…]<©Í”T47ïñœÌóh(L7bÐOx¦ñÉS»û”_Td £3™û9òdž‡Cç¸ó'ÃC_Bd°ƒÆn/òìcG'ó<oì_~.>úÿL¿ÏÝ^åÙ™ûdž‡CãÇ?Á™þ̃«zÞd¦ßAæ+î•ŸÌóhÈÔê8¨üiѽ ßÿÕT_aùíòÎ¥ààAçøwÑéؽ©bñf’Ð+Ç«¶¯¤¹êá5@ëX(’_¶nãÕa)ðûÉöÎ_™ó©@½çG ØÊúùšÝP´IKšrn+wý ¡z}9²_Ž~ç3\Ë1ó|„;ÍrS×Pí´¡WÝC1ªK7ù¡5×ò#¨m(ûÝiãÊ.>¿kOç÷­*'mø…ìWO“eߤ+¿ß/*Kº¸NçΞœ 9ók쨩–7Û+~Ù-¿è0»¶¿XÒÿþýEóƒOjf†ù-Ô*‹£)Mürá·“ &júܳpù¨jY¤ësCEö‚ SSZ7©åc{¸ˆ Í+­áü®dã·Ã‘*‰l~?Ú\± DN¯·bn½šô"æ7¹ÇÉ.W¾šÂG³«°H}ÚV`ËxS¬­ê„n+T]uMl¨Ø£ùÍŸµë|VÓû®ÓûKZ:w Ÿ.¨ÖŽÒQÊï.E•Þ5ªÊlgTªRWRV‡Põ“ zº¯T)šà̪ï¼Æoᜅ±‰jºTÒ ¢§‹˜n)ÍUO…š*¶¬©ô|3¥AÝÆÚñ‚ì©{/ðWStcDÙòq-æçʪ¯Uìpc6§ ¦Úˆ_..©]ã -å -ôz¡íÊ­â¨^š4ÄÒUšEÆï0äÿgªpUÊÌ“?hªâ÷¶«V Í*^wR/÷•uHêM¡¥íºK‡P1Û÷—ŽJHϤ[S×[I».ëä!ó˜¤*y¬Åº¢®Š™ÂJÿT®ì…ªêšØU(¿¬ÄÍNW‡ªSµ2¯;¸»ZnûÊ/½8Tk~©lµ·–Ûa¾ŸòÄF£˜¡K%MlTíZe°RhâF£/Y\Fke§ü¶‰åcdÒŒûtùû%OsÆ:ÃÏ_y«ùé}䥯ÿAšoðû ]_^Ê9ÏãFU¶0•[Wâ~&ãoÔˆ'Åü EX‡M'4ÔÑ~ëØÒº‚†:Óñ5µìª{I©+ƒêªí…®õa'6ºFÛ®gÜðièÅÈ|ªoÚ„=_ÚÒ8~’Œ_çZ¬ÂEß\Ʀ³mJ¾vE⊓¶)Z2]F\ô…ⲫ05ËVf2 ûJj׳ýÔ»Âr]ÝEFð¥m:jÓl_t‘åVtIÛþ¢/˜t_iZÙ#ýêáõÉ~_Löe°´R{•¾ôÒÚ0–V“¥6_úõesl~tª ÞÖCµ,Û=[ƒœ64ZhA«‹£4¶lK×WJE¶ª´L•. SEVK Å&¿d+Ý’[Å^ -5¦hÒ¿÷=íz¯ÔNt½Wü&-—[f¼-Ù¹ΡµNµ”5–Œ‚Ì÷¹«”ZJ[dÛºi]w™m¯]3¨â[dªZ6·Iù*þ{ÍØ™ó ;Rªò“wGtl¯±ÆDM:Xcó7“©è=8„øË%Ån»äî<Çû'Û]’²Ò×wLd­ -š¿cN6áŠt[ÑU¾NΖ”ؤû:@Øj4§6»CùK†òþeÞ$ª——Šüb–ƒÞÈ_…”–߷·Küjû$ÿüLzŸO -endstream -endobj -656 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 655 0 R -/Resources 4 0 R -/Annots [ 657 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -657 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 461.373057 101.433071 442.623057 ] -/BS << -/W 0 ->> -/Dest (cb160-1) ->> -endobj -658 0 obj -<< -/Filter /FlateDecode -/Length 4656 ->> -stream -xœå]ËŽ%·‘Ý߯¸k¢ù¾C ÃÂx0ã…áEw©[ d@ö¿ïÌä#3#U]ÒÜu¡úÞŒà#<< 2™Yæ®ñó•Á‰ŒJ)Ç@÷§o?Ý´Š^ã_I±¸(êoñýÝhŠÊ›’¿ÿÈUÌÞÆp¾á¿Õå˜üùö—ßÜþ¾ÌcîVå¬ñ÷|d9SŒÚ ª •6NPy¯b´>ª`š˜³¤‚>’¥­* ÊÉK*˜AÖ&A•`†£hÜV•a††$Ì0ÙGAe4ì0VkQC4‘³‚Îxàô é¬Q!e›E]„ÎD+éœS!’ñFÒeBðIÒlñYIça‹7DZÒÁr)Jº[\pZÔÁ›¢“t¶Xx' º[€®$ê`‹ÚHºì”ωHÔeètŠi«³Ú+ŸœÓ’ÎåM'ê0¢ÐI! -: [‚öYÔÁï´•t¶~$x»˜’0Z-n§‘t¶XIÔÁt¾Ä6ÀƒDAŠyI⣢lI"›œ¢DIb›²¢D6{E!G‰œ6ÐY#Ó°ÅS˜ÀØB¹¢¶¸L8 [@âç`‹%'qÛÐ"qÝ’ÎFâ¾%m‚Ä„ 3µÄŒëR ‰ (PÊ8p®wJ\à@ºîQâÖu>X‰ h×Q -8ð®#£%. ð®sÈ)ê` ,qØQ9“œÄÞuFG‰ ¼‹ad%.@¯*à0H\¬(›’–¸€À»6i’¸€À»6b -uQa :‰ ¼k=š ÍÜà]뵕¸€À»–l¸@Qà-Fà]Pˆ—ÃØ‚•¸ó=tÖI\€Â”EX"qéOÓ`+eRxð®Iè>Q—•‰ð¸0náeeBÈxð.&*'qï‚>“Äàx…ÕJ\àÁ»Æa¦–tà]c³–¸Àƒw7x‰ eH\€ùM 芺¬tNIâÞ-Y‰ 0 +À$¢.*ÉH\2Vq¨Ä¼‹é=K\À»Ú;'qAïjBØ#ê`‹KVâÄ5ÐaØ -cÁªÒL!éÀ»Ú ‡%xWë˜%.à]ž6%.‘6I\¢`+qAH¤rŒAâ‚5tùD]P¸öD e‰:ØB‘$.@`­²ËIâ‚ha‹³Vâ‚ha B‰ ¨l}‹Ëظˆë‚-ˆ%.“©”‰$.ˆ>`=¯Jº`UŠ kQ— 3Qâ‚Ia*6`-¥½Ä xÅá’Ä0:CÄ [0T$.ÀT¤’Ed.é lA-q"]茑¸ YØ‚hPâ‚dV™AK\€kI¸ZÒ‘æuf’¸ QP*J\€a‚•&˜RÔÁЄÄè^l{‰ °øÁbËQ[œ'‰ R²¼ÜL¤[¬¶›¼ÞŒd [ñI\uP&K\‡Nk‰ ²IXoZ’¸ã’×›Iâ‚ì4Ö›Xâ ã6»ÀëÍ(qA&Ø⢈:Ø‚ ) 㜄õ&ØIÒØb3I\Càõf’¸aÖ›ˆèÅ-ÄëÍ(n€w}3I:ð."Ó q.°ÞDd+­í5ˆ×GÄg²2ñŠ3‰;Ôë1·Š[Ü‹Ù*Š{äËk$qÓfbe™‚¸k€iJ£Åm þEš‰ÿî2­˜öéÛå`>b:ƒÉÑúû»o¿ýÏoþç¿þü-øîÓí¯¿ÓÚ‡¯¿2ø¤§ùó=d¦_—ïáCÓG\§9Ÿ?ëõ§åµÓ'çkuTÝœ×çýzZÚ§Y6¤]×e¡ç]ïR-ë`yKÿ´´½ä©í ÁŽj͋<ƒÆϺ£¶nÊúúo÷wßÜþðn ¸²RzF¯eùŒþÐÌùšqÙÝÕµ/v³ºtîfc¶0Ó®§_ä©õ§¥Í>¡¾ «œY^í¬6ÔaÐl˜íçOogÙ\ÇÂöµ†ay>¤dxò¤lÄ ?@Íú|^ÌóhÅjþ¡_áª5â›ýê’FUXÙ1§»ÑµƒJ7P £€2¯1ŽQy-Ïá’Žyóÿš{~åÓ·é#a)èxµ›Îx-ÏÃ!ñ$¸ü¹¹æâ ÞPjVH|? zЊUË©£e r½œfÃc¡£žį}TÓ/Û´ƒ¸þñm5"C:œ!îZž‡CÜqÌ(õxíu5ä­—.~ÛSú;ü~º¾œYÇ_-ïE”Ôô/BàÀÇ´*oÁõÕÆÓF®ßŒÌ Ñö8o¦[ Óx6 _ÌóhH´Ç±áábù/}¹³â6¤5ZwfN;Äc|ì „Sô\Ëópè9ŽáÞ’ÇêLù9h\Ϭޭò¬¢ý‚^4Ú¸EiúÜ-gÝ&)^\ů¯›A¶KÛw¹mˆÑ²W@ñšct^Ëópè<Žë6±ØÿÛÿ8†}“]¨KëåD¾b§ðbž‡CäÉ^áª'šW¢ûWq˜Ä…¯ˆ Vëì ffl֜Ùxq]Rü÷‹­Ëe´ºçyMªPá^Ìóhhu'û†_*§í¡ùÂZ|½¿·‰¿èÚAg# ¡·³‹^Ÿ¡óZž‡CçÅØs'z—vhZ/íÄbÌ%›ø5 åÕ>iG$¸-Y•µwmK»N¸Lü†±©´å›ÿøÓÿ{hKáoÞ— ýSƒÏmkÃÒÎ>_°]SZyTÖöM×ùœvík¤OuLgŸ÷4\G¹’+¿×ˆ¢ÛJq.wHSÊæò>Íu?_q,™Ñ±­m÷z¹k¦·u²¸ÞÚÖ⫱݃ÿjûÚµq1É5ÑÒPçÏëÞ'Õúiá&ÌÍ ‹vy>_æøù¢¹]nöŸg_¦ÙWìßï¶åLJïøm9¥ n¶'”6Ù‘Òžzèϧ¡}ìS;;Á6~Ð'h²! eO˜ïe.1Ü}mC¯£õ‡|R~gÜrZW}ofŒ½_êÙ%o­+ÌþI3¾Ÿjü1_ í,Xªi> ã¬Å%S}5æ}íõÚ¥,.³Î ~hKè>ñ£þãb¸Ð³@ÅR¿qµ¸yŲ8o. ,7m.ÌßiNóÝœþC×Y;¤sóïw«ï«²¿ˆ¹ðwÇ·+bŽ-h¼zpôbžA`?mÌ ﬽ÿ¡Ï›ëžêÛ-Ûž¯ñé:mé¥1–e”¬¶ëjï}Î ºW=`_ÖΫm\Ï!Ghä‡A+·]>f-ÏáÑóáÎQÛÖ ã÷L$Ý ²[]é±0¤­å|"Äá–Ȇ»¤›tóïÞ!ƒÓö´A:@?Ú·5Òa…Ó¨è -j©ó¡·X[P`„<r)Ïá6s(-‘@+ï®Q4ÞŠ(ˆñÓíÜr[À­>i‹¢uœ¸>’·¾¹/Ý‚==¢·>º½FÌÕÛ)4ÉûtrS,ÅWpäµ<‡¶ã˜ñGÛ•x~†ÙüqoMï ´Ç‡×z-Ï£!4ŸÄ”_Ô -a@Õ+¯;ãÉET`敘FŸVqŸmŸŒÔüŠxóbž‡CêI¼ùFϳ²ßÙMzñѼ—>ŽrÄÏ_Ä‘È´ö˜ñòa­‹y­Çqæ¯ïËG¡;(í±æ奋y¥'ñéK‘õ«yHó-Gä -‡xÒX•u²üF¥c^Ëóh(4ú$}ä÷,¼òõ%_NhÐàùíüV©èÑ“Þó[ý’7ixIUÃäi’Ö[bÛ—îÜÍêEGË»f(’_'ïÒÝi9òØöî™ÙÓ^3)âcjPróqNvU;ê™ç4õ^Ûp¤«SšsÕ£Aå¾Û|”§«Ê“ܶ£|ºß9z8ö¨Û±%[ŽEêé(ÏpÔ©•pĬµ¡®Qò¦+º…ò6ASÞ(«CRÆò+çï”ã¾Éw~ƒaÒŽLí:Sœmî;9Ë‹új©æw÷k~/¿Ê±tíx1§ÿ©tú7ÃGoõÄÓ{¶u'[/ºøùÆïY'ALÔŸžˆY8Õ­,2í,k•=h£Êë”Î+=í^ù¦áôÕúÚÎïk6~ÿéšÈ•7ÀM Bä f+æÖkef1¿«>)7_…f -³iÂ^ i{=ã©Ø8=ýV¨‡êºØRµÇð»M›ëB6ÓG×™¡ûkZ‡î<>ÝP­[KŸE)¿!»U½ku“¹Á¨Ü¤¾¦lB­ŸÑÓM~¥kÑ„Îlú¡×ø=£“0U QK—k:AôtÓÍ¥ùÖS±¥J=k®žï¦t¨»Ô/Èž†Cá‘ÿøÆ0F´«_—b>sÜúZ§7v#|ºaŠ¡øùæ£Úw®Ð¾Boº¡Ü&Nºã¥Kcª®ÂЬ2~K#ÿ?Q…oRfžòÅPƒ¿iµ_õJxl6ñÒI£<4Ö!ɆbO;¸ËÄØ0;úË$-¤gÒm©›ÇÒÁeƒ<æj“T#¥Ø4Ô51SXõOãÊQ¨«¨®‹}ƒòóBÜíôm¨zÝ* f€»oåvqhÜù<ŠcëqïÍmö¶rÌWáS™Øh-fè§ZI[Ýf»^٠솺¸Óès×ÑÚØ©¼çbþÚ™4ã>Ý~¸•iÎ:où,mp†ß?F^æþ/¤ù¿ÿ{£ûŸëkG§yÜêƶqëB<Îdü7CÒE1ÿ ‘*lÃfZh¿‹Mêi}EC›Ç­øšzv݉½¦4AMÓŽBß}8ˆmƒ®5nðŒ?>­¼Ø™Ïí›>aO—®6ŽOó k«U¸›ƒËÔu®OÉ÷¡H\qÒ>¥CKvȈ‹±P\ænÙÂLäXIs=ÛOcW8®k¸Â¾t]G}š‹®²ÒŠ! B`7^Œ“+Í {£_=¼>»ßg“C,mÔޤϣ´5Œ¥ðd©+—ayÙæWŽÁÖÁÛ=ÔÊrÃØs-ÈéC£‡´¸1:HSÏ6'ðc¥Te‹JëDÑè2]e­ÄXm -s¶ê–Òâ$z)¶˜¢K=íÇ^iNôc¯„MZ.·Îx-Zr-ò#œcoî)[,™Ys7)õ”®Ê¶uÓ²î:ÛÞ‡fP7$ôÈT÷l~“òUü÷š±3åYíDH©êOÙ1©¿¨5™è¬+{M§À!Ä>#R¶K^œçxÿd»KR÷OƚЊœÓÑð_Ñ“Mx†"Ÿ+†¢ê_Ø“³e-6ée¶‡:ÍéÍîPù3Je³lµËÈKEþ«iŽƒÞÄì%j#?ñË›Ùq±}R~þ ½¦Í -endstream -endobj -659 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 658 0 R -/Resources 4 0 R -/Annots [ 660 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -660 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 386.373057 101.433071 367.623057 ] -/BS << -/W 0 ->> -/Dest (cb163-1) ->> -endobj -661 0 obj -<< -/Filter /FlateDecode -/Length 4595 ->> -stream -xœå]ËŽ$·±Ý×WÔÚ€h>‚/ÀЀmX°+`p½¼˜iil-²÷÷ï &_™••ÝÓ#•äiôteÁàáa™É2WŸ/ þKdTJ9º>}ùá¢UôÿJŠÕEQßè¯FSTÞäüõ{¸¨bö6†ëóÿm.çäÏ—¿þêò¯usµ*ç`¿þû;V‘S1Ũ½ ÊPiã•÷*F냠 -F¡‰9K*˜á#YÚ«"Ì œ¼¤‚dmT f8ŠÆíUfØhHRÁ “}TFÃcµu0D9+èŒWN’ÎR¶YÔEèL´’Î9"o$]V!Ÿ$ÁŸµ‘t¶xC¤%l!—¢¤ °Å§El±):Ia‹…w² K°èJ¢¶è ¤ËNùœˆD]†N§˜ö:«½òÉ9-éŒQØt¢# -¢ ³°%hŸElñN[Iç` áGÒ'¼‹) £ÕòèvÚIça‹µ‘DlAçK `lÑ1H€¤˜—$°1*Ê–$°É)J”$°)+ŠÑI4`³Wr”xÀi58 [<‰ œ-„‘+ê`‹Ë$q³° $.p¶Xr8°--8Ð-él$.pà[Ò&H\à@¸0SK\àÀ¸.’¸Àr¥,qç:p§Ä¤‹á%.p`]烕¸Àv¥ qï:2Zâï:‡œ¢¶À€•3ÉI\@à]gt”¸€À»FVâôªƒÄÀŠ²)i‰ ¼k“&‰ ¼k#¦QÆ “¸€À»Ö£ ÒÌ Þµ^[‰ ¼kɉ þÑb4Þ…x9€- X‰ 0ßCgÄ(LY„%xð®É˜þ„1 ¶R&å qïš„îuY™ ã^V&„,qïb¢rxð.è3I\ŽW˜Q­Ä¼kfjIÞ56k‰ Ø‚HQâ0™J™Hâ‚èÖc𪤠V¥ºu :%.ˆ‘¦b#qÖR*aÐK\‚W.I\3 3$qAÌ°CEâLE*YDæ’ÎÀ٠҅Ή ’…-ˆ%.H6a•´Ä˜¡±–„«%i^g&‰ Å¡¢Ä&Xi‚)ElMH\€þáŶ—¸‹,6±Ìu°Åy’¸ %ËËÍ$qAJ°Åj+q°ÉëÍ(qAÖ°ŸÄYÅa²Ä qè´–¸ ›„õ¦%‰ 0.y½™$.ÈNc½‰%ž0n³ ¼ÞŒd‚-!Š¨ƒ-š²0nÁIXo‚$]€-6“Ä9^o&‰ f`½‰ˆ^ÜH¼ÞŒâvx×g0“¤ï"2 àëMD¶ÒÚ^ƒx}D|&+¯8“¸c A½s«¸e Á½˜­¢¸g A¾¼F7 `&V–)ˆ»˜V¡4ZÜ6Ðà_Äc´ã„e÷iÞ¢ -€CÄœ™"72cX¢û¾æÉÜdËþØ¿ÿ~ùõ{L¾×¿ÿçòñWe§¬ý%5!¾Â0°Ýí}4ß,&l1 –½(1Wó0Ë€ë6›… ÿ]÷V¶ÂT6¹± -¼úìÔŠÁ=¥tÂ2+˳ä°õÅyrÀýƒ‘m>šëN’l}qž7·K4,R=BÌu½¢‘÷¿mçOõbµµ¯×`bÆÀ cOfzc£])™;;”8hAxay¿NAËSÿdò ³¼¡Á xD„i\¶<ƒ‚±öÑ´JüÛwiµb٧ùˆé &GØüîû˯ÿôÕÿþåÏ_ï>^¾ùÖÞù…Á_¢å¯eQ¨²øMU^ÓñîrÏóÝÐ_u-ï&ŸÏ7ÊŠ5ýǪ C×í¨:zÚ”mF~|ék[ÌÔ–nGM¯ÝÈ·ÊÛìHk{ºÛ6è©Í;÷ÕO“OßsÚ/ÿv}÷ÕåwïÖ++£`XÈ"Þ 1y.˧`òs@1ç#(2œšÛɯÝÝ!ÖÝ!uÝ]˜L°õOU–§|›º¬®PÍÓ0™ ¼«W*7¼d(ò]¢ -,);ëd98<ÄâÉ<F¬ÔÑøä³AÚOC:¯Y‡h“깕~öÓÝ‘v™Ž^ƒÛió‘œr|ç$ÝCâ¹<‡Ä;ñåçæš“3xG©Ù ñý„êML+rT+§–9Îõrš…zš¿õQK¿nÓ ÄM[‹!£Ÿ épqçò<âîìG -=Þz`ÛCyÛÕ‹ß÷”þ¿ϯh¶ñWÏ{%-ý‹8ñ1mÊ[q}³qâ´™ëw#óHt#Îã3-†i¼7 ŸÌóhHtwö"ÖË'xéç;+îc@Ú¢õÆÌé¦xŒ_a€á.zÎåy8ôÇpoÉcm¦ü4ngVï6y6Ñ~A/m\EQZþÞ,gÛ&)^Üį¯›A¶kÛorÛ£½çw2Ïáó8®ÛÅb¿Øÿ8†ýñvÁo ò{…'ó<"ïìnz¢{õ º‡I\øŠx° a³ÎÞñð•Ð–3;/ΣKŠÿ~´u¹ŒVšî9kR… -ïñçÉ<†Vº³oøså´[h>±ßîï­Fâ:‚n sÄ‘üd›Î.z}çò<:OÆž7¢wi‡¦÷ÒXŒ¹d¿¦©¼Ö'ýq[nKVeíÝÚÒ/§'S)¿Òkl*mùê÷üÃÿLm)üÍû’¡þŒLØÓÛ°¶sÌl×’ÖG•­}ËõN^Óîç„¥¬ÉìÛE¶ ·^ ±ÇçW›ž×úÓÌí[^ç~(þ-Þ=ãNofw~ÓZìõz¯L×Ú&+¹õźÐâ—ZZ§)×n´°{bjñÜZΣÁ‘–&{â”O¯Ó×ûT=jÓê͞ß^püözm³«½ï¹gÒâÅÒßîË Ž_íàׇ÷åèÚ®¥Í¥ÝGv¤tË=Ú²òûÛ.#Q°_#šlÈBÙË(e®Q=|mè£øÙ/×YÂ9­k¾7Ýï×úÒ§¶ö‰«>qµm¡¶m)B; fVè®#¯G*K}- -‘}ôÖ¥,.³Í©~jK>ñ³¾Žº6¯Ú\ýUÒNí.£yöSksÃ[\þ–ò¾«øóÓH?Ùmž»Ñ~»m¿?è;fNßp§—z´[÷É7½¼0ÆbÇþhé{Ý6fÞØ–?˜ö%,»ø³÷ͱhç£Obá øÉŸIðQ\ì}{`GñådÇ­ñÂ2o§úüØúç– ^Í¡/ÃÖ—oÓŸÞ'ö‹ŽµÝ˼³æÍƽۘ2ò;l®¼8Á¯«ŸÚ1:™çU¯¯¼a0éÇ« -¤’÷ +1˜,4¶]¨šF‹SðµtÂÍ -s@xͯ}o*üf³UÒƒÕ\åÇåZ\D¡\ÿñË;¹Á|VB·¬º“ß•=úNÊ_®MîO”YŽ!"ܧŽ¶ƒoÝ8}õös™ð„o[*¼ßç9á; V¡ žÒkzŽOzˆ/b¿Ÿ©Ý|ÄÿoØs>eMåÜÁ¸ÏSOÖµ]PÉ—\æÞ«6çò<ȼsi²þˆKõû_þ¦£ž6X{}¹8á[Ø Øù¤µáüXH!…ŽóX_¹l 5)c é±üžÇ©œJ³©ðpdÛ0ÍgÑœº9z2Ï£>kà`Ü»×¹2«›iÙ*›C—ò&QÿL5Í·5ý‡¡³vJçê﷛ϛ²3nËefÞO¨¬zöÁß“yÃlgŽXlëýcvÞöÔØ8Û÷|c³mÚÒKsÄÌ(Ùl·¶Þû”¬¯z±Ã¾¬gÛ¸eúC4Òඳ7?Oæy84úc>¼ñ¨tï…ùÁ‰s5Is½ÝëJ…)m+çÃÁ|üAà.é&ký½õÈÝö´Azb¶o;j¤‡Mo`œEm|è-V0aǨ=—çáP›Ž9”ÖH w·(šo%Äøåv|¹­ã6i¢í­©í#•Û‡3¤höî#–ÛGï·ˆ9{;l‡&y…îÜÔÌùy.Ï£¡ Þ8$ÉngÞÀú Óùã>[Ð!úu=?)zô¦÷|~]ò&MÇ1u\ÞMr†mÁ·?^æj6Gú¬×„(’Nwéj¶ù¬±[+BûݲKbêV:ß2³X뺰\³«úè\Ó´•ät{©ß2©·–ÚmŽ²ª¬[âeÛ:/rÛo+ê±ûôt{V÷Û'ö}]>éÕm—^þÁí®ÞßÚ°ëÊ.¡œ›gÊÙ©:$e,®~ ¤÷M¾òY}I;2­ëLq¶¹ÞÈYŽ¤ÿ¡§ª§Ôk>¸–-\Ž°Ÿ.júJ§1ü`€^Xb9QZq²íbˆŸ/|¢8 b¢q“üŽ˜…õ£îeñIÙÈ6ª¼M‰Õ¯®Çy^/­o­áü¾eã“ÞH·D®œu¶T,‘3˜½˜[¯•©b>•=)W¯B7…·ª»pHsÚQàÈxWlœž„~/ÔSuCl©ÙcøÏîº0„ÝôÙufêþ–ÖÆ©;„OTë¶ÒgQÊgA·¢šw­î27•»Ô·”½C¨÷“ zºÂ/t+šÐ™]?õŸ¨¹Sõt¹¥DO1]-Í÷žŠ=UYsóü0e@Ý¥îxAö4=¼ùk&¦1¢]û¸óó½¯ušpcw§ ¦Ú‰Ÿ/> -©ýà -íôf¡›Êíâ¤^†4¦æ* Í&ãóùÿ…*|—2ó”†:¤øLÑq5*á±ÙÅk'ÍòÐY‡$Š#íä.cÇìì/“´žI·§î[I'—Mò˜›yLR<ÖbÓQ×ÅLaÍ?+g¡nF º!öÊÏ+ñ°Ó÷¡êu¯,˜ î¾—;Ä¡sçó,Ž½Ç ÛííåN˜o§2±ÑVÌÐO­’!¶ºÏv£²I8 ) ñ Ñç"n£µ³S9¹¡~ƒLšqŸ.ÿ¸”iÎ:où~tp†Ï;Ÿ#/sý?¤ù -¿ÿ¼ÐõÏí€Íe·º³…íܺÏ3;F:)æoËhÂ>l&¡¥‰ö‡Ø¤‘Ö74ôyÜÚ‰¯id׃Ø[JÓÔtí,ôÇ“ØvèZã&ÏøáÓÆ‹=ùÔ¾öréZãøÎ:ÍÚ¬ÂÅÜ\¦¡scJ¾NE⊓Ž)Z²SF\Ì…ârª0ËVf2 çJºëÙ~š»Âq]ÓÅFð¥:Óì\t“•VLI»ùb.˜Ì\i^Ù#ýêáõÉý^Mm°´S{—>ÏÒÞ0–v“¥®\†õeŸs\¹•ÜïðP/ËMcÏõ g ZÐêbÆè$M#[MàçJ©ÉV•¶‰¢ÓdºÉz‰±Ùj¶æ–Òâ$z)ö˜bHÿ1{ÚϽÒèç^ »´\n›ñz´äzäg8ÇÑ:=RöX2 ²0çîR)]“íë¦uÝm¶½NÍ aH‘©Ùü.å«øï5cgɳىRµŸ²;bÒ8’5™è¬+ß2¦Sàâ/Šˆ”¦í’ç9Þ?Ùï’´ý“¹&t‡"çt4ü}q² ÏPäûŠ©¨ö]rr¶¬Å&½ÌÂöР9½Û*_Tö2Ë&Q¿Œ¼Täïsô&þZ“¨ü>?‘VÛ'åçÿÅq“² -endstream -endobj -662 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 661 0 R -/Resources 4 0 R -/Annots [ 663 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -663 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 296.373057 101.433071 277.623057 ] -/BS << -/W 0 ->> -/Dest (cb166-1) ->> -endobj -664 0 obj -<< -/Filter /FlateDecode -/Length 4352 ->> -stream -xœí]K$·‘¾×¯¨³Ñ|Dð,tX`mX°0Ø={µgl-²þûþ‚™|dVTUv«5ªï4zº2‚`ðãAvÛ-¾¾rø/“39—éüôÃéÇ“5‰-þÕ›‡ªþ߉ÏÎR2ìJÌ|þA!™Tاx~>á¿Ýã\üùô¿¿:ým[ǽ)%zÇç¿“rJ–Uʺ ¨˜MJž£¢ŠÎ`ˆ¥h*˜Á‰<]ªÌ ’YSÁ ò>+ª 3%.UføäHSÁ W8)*ga‡óÖª:b‰‚WtŽM„Ó£¦óÎÄ\|Qu :—¼¦ ÁÄDŽ¦+&ÆÈYÓláb¦cØÂŽÈj:ØB!'MaKˆÁª:Øâs -š.ÁïE—a ЕUl±Ñ:MW‚á’‰T]Îæ”/uÞ²á‚ÕtÎ6ƒªÃŠÂ$Ťèj\ ðU³ð.(„õt¶€`5.@¼‡Î ИñHK4.`ð®+Êš[—KÔ¸€Á».cúT]1.Áãʺ…—‹±h\Àà]ª qƒwAŸYãp¼ADõ0x×DjMÞu¾X ¼‹¼5.ŒC qâ›qÐUuÅØ’³Æ Þ-y …Í`U— €ä4.‹î~æm9iíª£Ñ^{Mï/ëØ0êÎö´>šíÜìL×ûîuŸÖŸ»qxéþsHMH‹ìÛ’õu˜~úµ\yKû¾þ¿ó»oNÿõn ¾ºy^Uù)xý9`ZÊ-˜ò~êÞ¯Ðyš`ô~‚{nÐ Û6{»©árNw¶åaS›îMù}ûs™2µ³[Fž~µ‡vöxÅŽI×Êm–]³ç{e|s“ÿd9xªò«›<슼£Lt«ë<X±}>„Ö#Hò)4ÒˆÓ¬¾eëL»i¦÷ˆ{Kr}¼z¥¡Ó#ÉyÈÑó=”«óp(¥›œúbdM<ÀOŸ_ý’+ò - -§¤»Œb³—Ýím«óp(¼“€j|µCÚ#òÔE’«qðÃgWЙ_Á‘Çê<:ïä_ }™ŽF?rD*l¸&‰wÐx°Î£¡ÑßÎ+?ý¤¿Ê~䂇#÷Á:‡Æ7οÀHmZ?oé¯ s䇇£öÁ:‡ÌÛ9å—ÅC/Ý÷þR‘þ -*_q‚y°ÎáòÓœa¾)ýÛDzÁ¾ü÷Aë<:Ã3ËŸ›%Òï]éÔ~‡}µÝ)“©+R2šö‹°µŸ;ª‡WœW¬óp½o~~œó%ì߯ rþ¥¸ €Š¼Uæ6*Õy8TÞÉ5iîùwàÓ¹#äM[ùÕy8$ÞÉ/n®9Áç·Šlø~Bõ·štû[;mµÌy.ëe.x,ÔÓ„ø½Zùí˜tÄÑt¶ æÉ‘ww°Î£!ŽîœG¾á›ƒæ™²Â÷Çã;š}þÕëDI+ÿ"N|L»ö6\ßlœ8mæú‹•ù$Žæ±LÓ½(|°ÎÃ!ñÎYä­ýò^ú|£âeH{´^‰œ4åcòéiï¢çX‡CϱßA¿É›ÝOGã>²¶÷Áô:»lóÆEAQ^~^mg?&-_Ü寯‹  -û­íW¹mÊÑŽþÖï`‡Cçí¼î"ûb3üÛ9ì§;×ɯ8+ún܃u­wÎ ?WN»†æ{ñýùÞf%~Òt#t„Ù.!±½‡ÎcusÏ+Ù»vBÓgéJ.&\r‘¿æ©½6'ý“~2–bêÞ»¥?Nƒ“¢ Îç:–o~ó»ßþ÷4–Êßr.ן='„M}[[GÌÛ–²œde¶1.ÏòµìÈ3µ³eK;ƒƒÅg£ÚÛí •]ôÝÞÕ©Ûl¯6ÅaO/C«¼úùcÃìØïÚ¸Ãú=m}®cX}ÓÆaÁfž¦1¤©žÝ–'±õiY.®¦ÅM)™X‚\qµÚÖ9â(},>¬>þÓe;1Èç¿åŽ¡Ëvì:®ÅOÕW7ìH.\³ÃŽ±lü!sä—5£Ø&wMEK>¥í«£Í-ö†¯}}T?óò\qµb‹y)šïÝòsù ÛÐ×9õ뜄Õ'a[\ÇÖpõqVÜ)Ø9ÅÒ_Ë®ø:ìýQÛ’6[ôãi,qø„gý‡EÖ"æfÌ«¿jÙiÜu Ï~jcnxKËÏÚÞ‡+Ú?2-"]?ïÇÏ7æN8ŽîìÒ Û9Ù㦷ÇZì8pÃnr[lÌ\³oˇë÷]¼é“tá“™3Ûس2ž´ô¯ÙIq”mXV1ÞÊó2çÍþÞážÖk¾ÞCoù$c_·õÉ»[ÞhÜsñ¡ÎÀ&†úágÙû:Û8XçUŸê~ô‡Ç§P‹ÉÌX®jÚS—ñ~Kå-L)Â2 W;,‰ Ü´ëð»Ý¦¾§Uí3»·ÛõˆÇñ”vùã×wjS®ŠÅxͪ;õ9šÂ˜;­~MRvÉ"h³ÞÕIà O}Ÿ¿=N9qÁ˜òkfN®CKX/ê¼éÝG¼Äÿo8s¶â9Ùý¢Úcœ§Ï£ßîkŸúë'×]1x,ªÉ¾$Iüý6QÙ$—áZÂx™ÉeŽE®MÛuZ™â -‰!úP/ÿIw߈°Îƒl!;—ÊÅ@7¸Ô¾Éq»}ñ²ŽáöÅmò‹c²+1Žã°$w ‡ciMx呇k\ñ—Õ„§~F£pNn×áƒß®7á$FEf¹‰,³ËÓÅ:xw‹ÜÁYóÌå}&g·»Žeë<4)W`‡ŒH„…•äÖ¨k®ó–¥ìxìk<ò—×¼­Lûú²–i.Ÿö=¯]óÿ–{U÷¯¹^Í­Ê"÷}ï7QDœrI7r\ÿ~¶§mnÜÛ¿±'échy”‹©üñë h®Þ‚ic6ÎË5ÙçH&ÈÜ€-²Üžȵ©sÕÙî|¥f½\üÇ^j½oÜʤrýÜrùô°–ÿ±Nú'WȈÿë!A½ØVqöíaˆŸOr74)b¢qÒpG,Âõ¥ím‘ëMö6M¦ìK‚ªìúrœnÙ5Ÿi£‘úܪÉ]d[¡Po­Z:V„¨Ý¥XFo[År¿v6a}ŠÝɧºp4HsÙÑà¨xWì‚„|)´SwCì©Ùãä>Æîº8„ÝôÙunšþVÖ§i:o ŸNè6ì¥ÏªTnõmM5ïzÛea2ªt)·’}B¨Ï“"z:)¯lkš0™]?͚ܸsõr¥•SDO'µÜÚ÷™J½TUKóü0e@=äîxEö4&ùƒÓ±¡½ÜŠåªÏµÍnü…ðé„Câç'¥4®°Ü 7 ÃÔng;ð2¤)7Wai6™Ü,'ÿ/TÁ]*ÌS_8ê’Û!ÇÓèDÖfo4ËcgÒ<à(²“»\J³³¿\¶Jy!Ý^º{l#\6ÉSiæ IuòØŠ]G] …5ÿt®œ…¶;”Ÿ7âa'÷¥Ê¶wÝwîíqìÜù<‹SŸq'W}v{{»æ›ð©6Ú‹ú¹u2ÄÞöh7:›„Ã0Â}®â¶Z;;Õü¯/Ç"Ó"îÓé/§æ|`/‡&18¹¹zμÜùŸ(ó ¾ÿz¢óÚU‰K÷¶³…ïܺÏ‘LþÎA>(–¿{Є}ÙLBOí±Ë£,74ô8îýÄ×4ªÛAì­¤ë êºvòðá$öºÞ…É3|Cø´óbOd~êÜŒ€½<†689þ‘K6›Ux˜‡ƒÇö˜êyG[¼ÃC½­0­½Ð“œ±4FjA›‡£“4jkž;¥&ÛtÚE§ Èl“õS³)®Õš[ꈳê¥ÔsŠ!ýËìižg¥;‘çY‰e¥Ýñz¶zÄ3œÓ%{.™Yœkw)’¡É.û¦mß-Úž§aÐ0$ŽÌÔŽj|QòUü÷šµ³ÔÙDh¥ÚW=qy\.Œ@M.êß‹²9FpÉ•ÿ‰òt\òâ:·ÏO.OIÚùÉܦÃP69ùË_º ÏP”ûŠ©©öWÁôjŪCz™”ã¡Asöât¨þé—zXY‰úc’­¢ü¥§ Io–?P‘¬ÓßÞñtq|R¿þrÄ#Y -endstream -endobj -665 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 664 0 R -/Resources 4 0 R -/Annots [ 666 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -666 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 217.623057 101.433071 198.873057 ] -/BS << -/W 0 ->> -/Dest (cb169-1) ->> -endobj -667 0 obj -<< -/Filter /FlateDecode -/Length 4405 ->> -stream -xœí]K·¾Ï¯˜³Ó|_@àC€$ˆ $#‡õXk#XsÈßÏÇî&YÝ]=Ó³ZÉ-9ZŒfºŠ"ùñ«"§‡mÎ_ü—Ȩ”r t¾¼;½?i½Æ¿!ÅìbP¿Æ+ú³Ñ•79$~W.ª˜½áüt‹Kžüéô¯Nÿžç1g«rÖøó/o‹ŠœŠ)FíU†J'¨¼W1ZU0 -MÌYRÁ ÉÒZaåä%Ì k“ J0ÃQ4n­Ê0ÃFC’ -f˜ì£ 2v«µ¨ƒ!šÈYAg¼ -èô é¬Q!e›E]„ÎD+éœS!’ñFÒeBðIÒlñYIça‹7DZÒÁr)Jº[\pZÔÁ›¢“t¶XôNt ¶]IÔÁ´‘tÙ)Ÿ‘¨ËÐéÓZgµW>9§%1Ê›NÔaFaBt¶í³¨ƒ-Þi+él!üI:ð„w1%a¶Ú2»vFÒyØbm$Q[0øØ[t `©ÂKØeK Øä%J Ø”Åè$°Ù+ -9J<à´Î‰œ†-ž‚ÄÎÀÂÌu°Åe’¸ÀYØ‚8[,9‰ Ø–€‰ è–t68ð-i$.p \˜©%.p`\—I\à@¹€R–¸Às¸SâÒÅt8°®óÁJ\à@»ŽR¸Àw-qwCNQ[`‰ ÀŽÊ™ä$. ð®3:J\@à]L#+qFU‡Aâ`EÙ”´ÄÞµI“ÄÞµ.@ÔE…9è$. ð®õh‚ä¹Á»Ök+qw-Ù q€¢À?ZŒÀ» /‡°+qü=tÖI\€Â”EX"qïš ÷'Ìi°•2)‰ “Äàxj%.ðà]ãà©%x×ج%.ðà]Ä ^âÀAÀ¿)£]Q—•Î)I\àÁ» %+q¼°Ò L"ê¢ŒÄ c¥‡J\À»pïYâ‚ÞÕÞ9‰ xWÂQ[\² ®ÓV˜ÓV•¶` -IÞÕ#,éÀ»ZÇ,qAï·)qAˆE`“Ä0P! -¶„D*Ç$.YC‡OÔ…k/qAÔxP–¨ƒ-IâÖ*»œ$.ˆ¶8k%.ˆ¶ d¸ÊÑ·¸<€-€‹¸> Ø‚HQâ0™J™Hâ‚èÖcèUI¬Jt-êt&J\#)¸b#qÖR*aÒK\‚W%\’¸f@gHₘa ¦ŠÄpE*YDæ’ÎÀ٠҅Ή ’…-ˆ%.H6a•´ÄðÐXK¢«%é²ÎL$ -ª„Š`š`¥ ¦u°4!qƧ,¶½ÄXü`±‰eŽ¨ƒ-ΓÄ)Ù²ÜL¤[¬¶›e½%.ȶ ⓸ ë J˜,qh:­%.È&a½iIâÌ˲ÞLd§±ÞÄO˜·Ù…²ÞŒd‚-!Š¨ƒ-š²0oÁIXo‚$]€-6“Ä9„²ÞL ÌÀz½¸%Êz3ŠÛà]ŸÁL’¼‹È4H\€ ¬7ÙJk{ âõñ™¬LeÅ™Ä êõð­â–÷Â[EqÏ@ƒ|ËIÜ4€™XY¦ îÀ­Bi´¸m Á¿ˆÇhÅ ãîߢ -€C„ÏL±42cZ¢û¶æèÉÜF²qì—ŸNß<ÀùžúÏéñ«a§¬þCjB|…i`3†Û#ú6h¾CÑ–þ ÂÀçä)FÄÜ4 ÅiÓ­ ÷Wþ×f–Ãð×Cõ®Vˆ(ªG€‹Àkp Ë×¥ÅwfyAƒ5Gð¶i\¶…9Ä•šf‰ÿæ NVŒ{ íÒ8_ͧb1LÖŸß¼;}ó—Wÿëw¯£7§ï§µ÷ß~mÊ»]¼Çñ]»ñùøòãk&G›áË`2“ö™¦4?Néè:kY:7½~\|^”Moa_š>OöÓt 4k -‹¶˜Þže{éqñžæéJy^O:êåÕÏô°ÎÓÚ£ËëÛžß¼:ýáÍTˆF&PQ LBX‡û²|_~Íj°é5üQúþ‡©ßózœê¸·1aãîœv£K»#š|»Dz;]ênã]±`™­—9þÝ\®Ú{¾{Ú¹·>ìÇ""ÑÆpeÒÑ^ãÎ<‡C£½Î†qÑÛ~1 -¬‡:y*²8"Ûè2Ý0b¥­åüÐëmv¦[2WdÈ%Æœn9ú =·Úw¥ -OÃì[ΚYŸ=Œv®Ø8ÍíÚ…Z×ù븫 ì:j÷å9jýu¥9hÑ»KÕ÷†˜âÓ12ÆLÈáï´FQ«oá;2+6fÈ€³ž’o<»D kÃ}hbÜÌ‘Ùм¶ð ŽÜ—çph»1~r´…E¹ÿ| oÞÚã>ÎsËH‘çyËÐì'ÝV;òFYµMó~4v¡=>ÜÐ}yŽ†P{#¦ü¬Ö UËدڹ•ìáÉYT`¦u˜fŸÖplŸŒTûŒxsgžÃ!õF¼¹½‡ =‹˜i…[¨®èsó2ïâa´›m©Û4ãÞ=üœY9‹™tŽÞ@k½&e %¢[hÝ—çph½g¾œû”M#mØH/÷’üz¼ºÒkîÞPÚ™çp(½ŸÞ‹,Æþò9ñÕ¯9#7PÈâIcUÖÉ–ïm®£p_ž£¡Ð݈A%¾Z íˆ<µ¹OùYE2:¹Ÿ#wæ9:oÄ_ }‘ÁÙ^döÊAâ-4îËs84ÞØ¿üT|ôO¿Íl¯r¯çÞ™çph|áøñ ôôWÑ&Õó"ž~™Ïøª|gž£!“®Ç”_Ý»îýµ<½ŒJzÆæÎ<‡Cå§ÙÃ|Q>úÍxú tºû¿ Ú™çpè¼±gù±ùç(ž~èá{§úTèö å²Hf˜‘ì»x?Õñ±½:=c¿rgžÃ!ôƘŸç| ë÷ Tòïà -(Û[·ïÌs4Tú±æ¯Í=¿qîÙ¾#9åÊÏÒ $îÌs8$î¼'ócqÍNÎï™!ñ¡úÊÝ&Ë»äZÌãÜåÝø‹Xxyo•­³‚ä>ºç~JÏöCÆ8Òáâöå9ânìG¾àýA|¤ôx=î_Ñ,㯖w'Jjú»ÈøX¼/s9Ó§q®_ÍÌ{Øã¼rÚÅ4·¼ðÎ<‡Câ½Èkëå¼ôùzÅu ¸º¿~Ës²x¬œ ´ç'^;ó =aßwÐ/rŸ£ùp4nýaë—³{ Š¦ßŸm–³l“/ -¿F¸ßƒ -¼øÝÜ·£íýÖogžÃ¡óz\·ŠÅ¾Øÿz ûévÁ7ùŒ½Ây‡Èûîol½z%º‡I\øŒxßSØtKÞX -9³ñ"Ÿ]Rü÷ÉÖåheß9ï½wgžÃ¡uß/·?;NÛBóŽµøro6?é Ú@g# a´³‹^ßBç¾úƒ FlC9“5h²! eèïeÎÑÜǤ ®ÖÑÆÍNí©¨õSŸÔ12S»æú¡ì4vn7µ-\A3k瀹šæ±ÛÙ#”±¾}lôuXöG³êK=kKè}â¹þí(«þwÖæ©¿†´¬ÝƒŸãýTÛ\qÇ÷~Eg‰qí°o<ªÛhZ¶ß_»Â˜¾âNõh7“%nZy¡ÏÙ†Óû£¦ou3l,9„—ßöö§¾«Xñ©³ö ˜óøéJ¿”ãÄýRmó¬ýIhSÛÔ8±âæqCÖVç;w¬=ÖWøPP½oåÞ©Ì=ýyµïìjN­ú~´á8íßï%s9Èræ%W1ÅÃÇ)ÚùŠ°Õ(xBYìu,Á¯9š_Ú»ïïË$öe]™´“úªbö™>F´`t9mõ¡ êû†¶öx=Ì=Jò¾Œ™¼I윷¶à¸™äÆúb}*\=[í\þ– ˆÞ8YžÈàÒÙb‘c9ÄP -²K•)lÛ&ï8=íeœ¾C7d6qj^û™¹Ú6€“›­` ÏÀè!rÛº–YàÀÓx^æ´ÜÊ¿âú[êðój(ߟÂp §eÖ!)cËSΔ+c“ÏåФ™:tfèlsÞÈ9<ëâ}K5=þB—±Ëi¨ã³1ØÅ”þý0èï0'ÁÖY8U¯q²õ¢‹ŸNåQ$ˆ‰úT¾!.Âé£ne‘iÌPe¬¢£ÊË”Î×£}”ãðÆÖ×Ö”ü¾f+GH"̵õªÌƒ±bAˆœÁ¬Å¥õZ™I\÷”›®B3Ňj3„½@âi{=ãM±qš ýZ¨Yu]l©ÚcÊñÀ­ëB6Óy×6ü5­l8¯ /'Të–Ò'QZ™¯EÕÞE´PeŽ•›Ô×”m@¨“ ºœá׺M̦g£VŽê…©‰Zº\Ó ¢ËIL7•æÛHÅ–*õ¬¹ö|7¥CÝ¥Öñ‚ìÂ\l,ϯasD»úq..kÁ6Ö:1ÜØ•ðr‚‹¡•øéä£Úw®Ð¾B +·‰“îxéÒ˜jWajVY9è´ü?R…oÒÂ<ÃC Rå°â~Õ+)s³‰çÄ塱I=`(ö´¬»LŒ ³¼¿LÒBúBº-uë±™”u“Ç\Í+$ÕÈc.6 uM\(¬öOãJ.ÔÕTמAùi&îvú6UöZY0 ÛÅ¡qçÇ6⦜<Ýìmå2ÌWáepl´è§ZI[ݼ]¯Œ »a ….î4ú4ˆëlmìTž¦S?öI&yÜËéçÓàæ¬ó6ãCp¦tlºÃ/]mªqåÌçj.xsp™ºÎu—|fEâª$í.Z²,#.x¡¸dænÙÌÌH^Iëúb?ñ¡p¥.vÁˆr麎º›åEWÙÐ -–!°ã¼`2¼Ò<³G0úÙÓëƒÇ}29ÔP¤Ú›ô‰K[Ê´ž,uÃe˜_6ŸãÎå¢NÞÞC­,ÇæžkANŸ=´ ÙÇ(“¦žmJày¥Te³J«£ht™®²Vb¬6…)[í–¡ÅIì¥ØbŠ.ý™÷´ç£Ò:ÑóQ «´¥ÜêñZ´äZä9œcoî)[,™Y๛”zJWeëºi^wõ¶gÖ ê†„™êžÍ¯R>‹ÿž3wÆ<‹)UývGLêgÝÃQ“‰Îºáñ…:…¡òšH‰m—ÜçúþÉz—¤îŸðš0ŠœÓÑ”QÊ&> -endobj -669 0 obj -<< -/Filter /FlateDecode -/Length 4531 ->> -stream -xœí]K·¾Ï¯˜³Ó|_€áC€$ˆ1 $‡ i%ÙVäò÷ó»ùèîšžÞÑJÉÑbµÓU|É_Ù=lsÖøùÚà¿DF¥”c óûÓû“VÑkü+)Eý#~£?MQy“Còçw,pQÅìm çÇþ[]ŽÉOÿêôïes¶*ç`?ÿò†UäTL1j/¨2TÚ8A彊Ñú ¨‚QhbÎ’ -føH–¶ª3('/©`Y›U‚Ž¢q[U†6’T0Ãd•Ñ°ÃX­E ÑDÎ -:ãU@§Ig -)Û,ê"t&ZIçœ -‘Œ7’.«‚O’Ž`‹ÏÚH:[¼!Ò’¶KQÒØâ‚Ó¢¶Ø¤‹°Å¢w² K°èJ¢¶è ¤ËNùœˆD]†N§˜¶:«½òÉ9-éŒQØt¢3 -ƒ¢ ³°%hŸElñN[Iç` áGÒ'¼‹) ³ÕòìvÚIça‹µ‘DlÁàK `lÑ1H€¤˜—$°1*Ê–$°É)J”$°)+ŠÑI4`³Wr”xÀi58 [<‰ œ-„™+ê`‹Ë$q³° $.p¶Xr8°--8Ð-él$.pà[Ò&H\à@¸0SK\àÀ¸.’¸Àr¥,qç:p§Ä¤‹é%.p`]烕¸Àv¥ qï:2Zâï:‡œ¢¶À€•3ÉI\@à]gt”¸€À»˜FV〉ƒÄÀŠ²)i‰ ¼k“&‰ ¼k#\€¨‹ -sÐI\@à]ëÑÉsƒw­×VâïZ²AâE´ €wA!^` Vâø{謓¸…)‹°DâÞ5îO˜Ó`+eRxð®I>Q—•‰èqaÞ¢—• !K\àÁ»pTNâÞ}&‰ Àñ -ÕJ\àÁ»ÆÁSK:ð®±YK\àÁ»ˆ¼Ä€ƒ2$.€SFº¢.+S’¸ÀƒwAKVâxa¥˜DÔE ‰ @ÆJ#•¸ €wá޳ļ«½sð®&„=¢¶¸d%.@\¦­0§¬*mÁ’¼« FXÒwµŽYâ‚Þe·)qAˆ,°Iâ¨[‰ B"•c „¬¡CÈ'ꂵ—¸ j<(KÔÁŠ$qk•]ND [œµD [2H\€ˆ@eƒè[\ÀÀE\lA¤(q˜L¥L$qAôë1ôª¤ V¥ºu :%.ˆ‘\±‘¸k)•0é%.Á+—$.€Ð’¸ fØ‚©"q\‘J‘¹¤3°A¶Äˆt¡3Fâ‚da ¢A‰ ’MXe-q<4Ö’èjIGš×™Iâ‚DAq¨(q¦ Vš`JQ[@`|x±í%.Àâ‹M,sDlqž$.HÉòr3I\l±ÚJ\lòz3J\5lAÄ'qAÖAq˜,qh:­%.È&a½iIâÌK^o&‰ ²ÓXob‰'ÌÛì¯7£Ä™`‹Gˆ"ê` ‚¦,Ì[pÖ›`'I`‹Í$qA×›Iâ„Xo"¢·¯7£¸]ÞõÌ$éÀ»ˆLƒÄ¸Àz‘­´¶× ^ŸÉÊÄ+Î$îhP¯‡o· 4¸Þ*Š{äËk$qÓfbe™‚¸k· -¥Ñâ¶ÿ"£ 'L»OãU"|fŠÜÈŒiAˆîÛš£'s’Mûc¿ütúæ%œïù§ÿœÞ~UvÊêø…²°Æ¼ ÙfŒ7øJ•ò+LÛ–[oÉÃFÄÜ4 ÅyÓ„+†»ÍçöÁ,M†Ål³A0SZF‹z±T0+D[ŸœçÙmEáˆ<¢·±^ÌFÉÈk‰¯Zçøßyûኑ˜B½ "Þ6Ã*N4öh¦g4z èß½8¹§]ãp° ú²àaLÐïNß|ÿ‡?ýñ¯?b´^¼=ýã[Þ¡Ñš’Ö¼[Ã15=à— ›?{¬Ù=f”yýÝ?Ï/¾ëáM® ±bÌËz¸hÎÚErq,+žšª+iB¯‚uÞO×ôvþM“ŒÓ:=›f¦¿ôr©÷nÎ[ë -“¬4-ÌMËóß 7“óµ4o»¼¿ëóœÇóõ¦;†nÏëî(Eq‘~.ÊM ½Kü¨3ÉÌ,[4yî®’vh6·ÀÝT›œæîˆÓßRÊ÷i²©Ô£'[Ž ‡Ñ{ÍçËöû¡3\WEžêÑn9$kØ´òæ6-``zÔô­î­ÃÔÞe¯êj}â{: -¤gX°Ý¥?S‡Ñ”o·¯Ü¦¯Võs”±ñ3TMëRoœ~«m¥M¡O‰ -ÙÖ¿iì³]Û°jYÚfinã0­+3üþEaF×| âTë -3òV":â+)6ÿÀ¦OÍs“šÉ-ÂÂíU.[”ý茅φQ©Ö:uM»4Î7W…¨‹ÀûV‚ýó÷ûËÁ–iæ¿ûÚ0c—¬º’kéì1vR~&_{nn•?Pf¹…G>¸žšˆoþ¼ªc"Á¹>ÛGÌÇù³_êèíêoZ¦›yÖQ/¯~žˆp™ç@ß± -mð”n9Þ%E¸ŸÅq?R;X„Yqäo9,OaQ¯'Õã>#¹[©…J#$K|Ç <ĉcÿjGTò¬ÎÄÄ›fG·áßãɼ›ºª´0ŵ¼)?¢çý3,¯wIô`ž‰H? -—ò=¾Ë\ª1Ö†æpèå6·úKSº†Ê¹a˜Y#Vh`ZÎ䚶Í|»”ßb³Ze4÷¾õVªöÅåß þêÍ×úCÄP1”åóâðìŽe¹Ôu«YzuS0¹DBC†Ûv]ýÇqVâ{·;¬Ô'öðµàed¥MX*0Ø!ûͪÂ=FrÓ­ÀÂ.ÖahÊîô>4Žå¹l4FrüdÁ6V±À%œ˜4ÿúéw!3‹ ^Í„á3Íi^Ïé_uµC:7ÿ¾^}^•ýYÄ>ßVV”H:´Eß±ÉXóÜ »ÙVï!°,í×½ÿªÇI둪#ßFeùÊfë´e”Ƶ‹|ÐÃrô}§d…;Øú°D`ߎ‘¹icìùžÒΣm\Ç »htÛøŽcJåîÙ>å¹;4Ò>ÆUoûÕ(Œ‘ -G²ôñ4ÿj·º2baH[Ëyµã_ ÜäÒÀn=úz®µo§ -Ϙf°o=k}ör²sÃÇii×!Ôú·Þb-I¶ÚcyîµqŸCoŒ«b®Åÿ+­×‹*2+.Ì‚³’o<»FÌІ§¡éÚ:åÚÒ y,ÏÝ¡m?füäh[¯EþùÞ¼µgŒûFž[ÇŠcž7šë ‘KíÈʪmz»ìÇzßfPßãÃÃ=˜çÞê¯Ä”ŸÕ -a@Õ:ö«v^ˆJŽðä"*0óJÌ ³Ï -«¸¶ïRoˆ7æ¹;¤^‰7×£÷rFÏ*f*£p Õ}vÊñŽ0ÚͶõ^Ð:ý?ç¡œÕLºŽ¾€Ö3zMªÜÏ»vð`ž»Cë~œù|ìP6´Fz¸çä×û›¡PÚcÍÃ;JóÜJ¯Ä§OEÖÀüÇçÃW¿æŒ”Q†xÒØc÷úæ¹7†+1¨ÄW+¤Ý#O]ܧü¬"ƒ ètOçȃyîWâÎ/†‡>‡Èà‡½Hx´C—Ìswh¼²ù©øèÿžþ27{•‡=÷±H×x,ÏÝ!ñà3™‹kzðñi‘_¨ÞyÚdý”\‹ƒÇ8wý<þ*^?[eë¬ ¹žòYÑbšÆ«^øXž»C╽Ƚõò^ú|½â6Ü<_Ásæ!ã3ˆ|»ë`ž{CO>vúYžs4ŽÆKßF¸ô͂ų‹Œ¢ùhËY·IŠ…o#<݃ -¼úæÜ%nËCŒvô®ßÁSØtk¾°Ú|óûa¨oç{;Ÿn]ÞÐúã|Ô]ôXïù¨ÑäMNÎk½šä -"7Ç’µ3ÖÎfuDÜò‹ï(’ßqáø` E9ò±—¾önßL‡r˜ù´'>@Ì¢+]=ñ(Ïá­<§©_—/“}"­v‚Ô|ÒV=i©|u>LéˉWy’—“æ“•ÆS–Ú‰J"s}eQ«§Ó·†S¨Zù;§µ6Ô¯äÍP¾?…rÄ©)Ç\ë”±üŒs åxlò™UMÚ‘©CgJg›ó…œåí!ï[ªù…"šÏçóeËÐŽsú÷eÐßøØ&î&Œéð]ÄÉÖ‹.~<ñËH){PÌÂù£ne‘© ›ì¼U^§t^éùcn…ó÷þ§Ö×Öp~_³ñ¡œ¤k"WŽ¥œ*„ÈÌVÌ­×ÊÌb~FRn¾ -Í>© {4¦íöŒWÅÆéAè·B=T×Å–ª=|\Yý˜Û˜ófÕô±ëÌ0ü5­Ãpî N¨Ö­¥¢”í¯EÕÞEx_en0*7©¯)Û€P'Aôp„_ëZ4a0›~5>üx¦ -$jérM'ˆNbº¹4ßF*¶T©g͵ç»)ê.µŽd¥fiä7 sD»úq)æà ÛXë4àÆn„'¸ÚˆO> -©}ç -í+ôF¡Êmâ¤;^º4¦ÚU˜šUÆGÇòÿUø&eæ) 5HññÏýªWÂs³‰—4ÊCc’zÀPìi‡î216ÌŽý…hHHϤÛR·[H‡.ä1Wó˜¤y,Ŧ¡®‰™Âjÿ4®…ºêºØ7(?.ÄÝNߦª×­²`¸ûVn‡Æ£8¶7|–w³·•;`¾ -Šc£µ˜¡Ÿj%]luóv½²AØ )tq§ÑÇ"®³µ±¿Ÿ¨~ì“Lò¸§ŸOÅÍauaùøÃà ¿šbŒ¼Ìù¿Hó=~ÿu¢óõ,äÉ[ÝØÂ6n]ˆGOÆ/2JÅüb£*lÓfZh¿‹Mêi}ECóãÖ|M=»îÄ^SšÆ ¦iG¡ï}8ˆmƒ®5nè¿#|Xõb d>tlºÃž.]mäȧhW«p16—©ë\wÉç¡H\qÒîÒ¡%;dÄÅX(.‡ -s·la&r¬¤u=ÛOãP8®k¸Â¾t]GÝÍŽEWYiÅ!°/Æ‚ÉŒ•æ…=‚Ñ7O¯÷ÙäPgKµ7éã(m ci#‘Ò°]òä<ûû'Û]’º2Ö„áP䜎†_í)›ðE¾®Šª¯ý”³e-6éi lušÛg_ÞíV¶5Ë&Q»Œ¼TäW9:z¿*jùx{Ã;l¯Û'åç ¿† -endstream -endobj -670 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 669 0 R -/Resources 4 0 R -/Annots [ 671 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -671 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 698.673057 101.433071 679.923057 ] -/BS << -/W 0 ->> -/Dest (cb172-1) ->> -endobj -672 0 obj -<< -/Filter /FlateDecode -/Length 2760 ->> -stream -xœµšK¯\· Ç÷çSÌ:€R¤^@áE¶¨Ñ5`4‹¢‹d'(® 8]ôë÷Ï3G3C_¿ÆwDêÁ#Q?‘šá áõ‚ñ_Uµ¶’õr}·½ß(”Dø·×8võk¼Kº0i ‰[®éòÎRBi)–|yÚðß]q­þ´}ÿÍöïs¾ÄÐZŽœ.¿þd*•Pj)”UƒŠXUJ¡”˜²£Êðˆ­y*˜‘ŠF}T˜¡­&O34Æê¨*Ì-,ª3baõT0ƒ[*ŽŠ vp$ru0„T%::N!cÒ³§‹rm±¹º—èéDB.ʉ=] 9çT=–Ԉ=]‚-‰UÉÓÁ•Z<]†-’…\l‰µˆ§+°%bvš£«°ÞU]l¡Lìéš„Ôªª«kÐQ-õQ)…TEÈÓ1‡ßW‡…EÊÅÑEØ’)5W[’Pôt[/ON$)µ:»5Úîöt ¶ÄXÔÕÁ,¾G€˜a •ì!;(—<ÄR‚¶¨b• U«GX[ÐRÄÃ@l)hnÅã€CÙlIš=ÃÅÎuu°Ešz,[PÁcl‰* ´Ux‹Çn•{,ðV‰³Çpa&y,WjVä•šÇsìôX €.¶{ñX  ®¤=°+Z³ÇwE™<(¸+‚–®¶À=€ŽA¸ŠÇw…©x,PpÛ(z,ÀªøaöX_ ±VòX àn¬¤ ÜG€«+{P<(¸Á;¹Áݘ(z,Pp7jÌ à(ü!7w䇰€õX€óº( ÐYˆK<$p—Ž?gOƒVkË ¸ËËçêZà‚wö-f9pÎÍcAwqP‰Ç‚îŸÕcp¢F ÜeÁIíéÀ]Ž<$pqCòXwŒÀcηÀ×uu-P«ÕcAw¥è±§p  -’¸ºàHì±0„8ÔcAwq¼7Ü¥$â± ƒ»¤{\l‘= ®ÛÖÙÓVEÂÓ»ÄXaOî•æ± ƒ»vlz,Èűz,€QpôX«†VJöXA‡ÏÕå€ròXP‚d¹:Ø¢E= °MZõXP"l‘=”[2x,@D#úvÓØwqó…-ˆ=€d¡6U%eäc˜UO—c¨¸vu:. JÑ€£˜= — -›Þc,\òX3 cõXPlÁVñX€£(ÔˆÈÜÓ1lAí±‘.tÌ j„-ˆ=ÔX‘efòX€¹$¦ÚÓ)YžY=TÍÁBEØ&È4AJW[€ XK¶“Ç$?H6‘æ¸:Ø"I=Ô-ݬ j…-‘¢Çø¦å›ÅcA#Ø‚ˆÏcA£,LöXŒCGä± qE¾Õcö¥å›ÕcAB¾‰ÏÙ·M²å›ÅcASØ’¢¸:Ø‚ ©9ûLB¾ :yº [bS-gË7«Ç„È7Ñ»WÕòÍâ^€»©LžÜEdš= €|‘­—ÛÀ› -â3_Y-ã¬î½ g«{e@`/N«âÞàk9’{i3‘YÖìÞàX…’ɽ6 ðñ˜>0ávû´^Qe¸CÁ™Y‹=döPD÷#ç˜ÕäÕn÷c¿þ¼}ûßËÏÿÙÞ~³ß”õ#@Øk+â+lƒØ°Ü Ñ7ãñ%#8Ü-ƒaŸS×-mÅÀàqÉfFḳ—Ç'Kaèë}XÃ6œÚ·aëÈH™á¸éê~¸Xú™Mþ’!œ®u¤E£\ q$é©òïßlpÌÊÛç(.æã|Dò«1]Þ¼Û¾ýË«¿ÿõ»×p›7o·üŽ(¥—/Uo–_ó!ûïzÈzvS7Úü4õœ]o{×.µôUŽúo]^tÏõu=twu˜Ïv¥«…‡ŽnïTÏc¶ô…cÒœ¿¡;þ¦xüíýñ|f¦—ÿ¼¼yµýáÍÙáö¨sw8F‚DÈ}ÄG?­É×øèoášHaŸqÍ1…é<ÝZî–h™Ò±D}9îÜ*Ò¬;–¶.ýõy}0”$ÊbL„|uAæX†VùÈ´?¶cëb¯ûyÍÇ„f„Á¾Ü@t„8…Å6‘¯þøç?ým™HÁތرÞö)Ò2LxcoH¾•Í¿îû‡ÛQ'Ù¤t&Üxv_·É»í3«gþo­/«¯oñn7y´ºùöÞû:>ïýÔ¾xÇx?ØbØ"Ú"ßô§þÓ1öbÏÞGZž!õgxy¿”﷼Ƕ¼ßo OF¾o_€àð bkÓ.O#ØVîKÇûdóå-÷¯ÞZÇ7Id—K–XܾfZ -Gý÷û¢¿Û±¨Í¿íŠÛ­/íb„¶é^ü´Ù­¿:bñÅ&<>Òè Àˆw²+ØRB»¯))Ðñ±Î%õ1õ§±ö©7³h Gì%Û·!Zf~ÛÓSàClßœÔ G)SS´!œêZwv8~TÌB‹0= -inŠ£v{Ø2í1uy -‡éëÔñ²ü½n,Ër>'¼nVî¥O®Ôîk{W}vÏv™,Fµ!M½æXë䈮›#|A½kÅbý²j–õÞ„µ;’Žz­×sD×Í­wô–ÆJ•Q«Î¦­Ïü4eººÔ1ñŽlŸ£CZì«àeôgq¶èkdúM|^71ú ~ÚRqj§É -JÝõV¡,ýq¥é/SŠLí˜*lÍ.³œÁþ¿¡" ©‘gÿÀ:\ÊòþYšƒØÞâó$­ò<¨£Þ °–Yw™..eøì:_\É©oеnj¤Ë”-òÒºy©³˜‡× ±!¬ÏÏ`å*¤n†›â4\ùé$žv¦±Uáì}°Ì‹»§ÑïçÁΧU\ÆŠ³]â {G¿‹Ïwáu?Øô^l®_û Siœvs°E8 ¦xbôi÷Ý:èd_L÷s“y'îuûeÛ¹()6|ÈÂöÄyñ忨ó -ïmzù®'Á·s<Ò El=‰×“̾Á®Ÿ(¶o´»pl›EuÁþsuS÷†qŽÇ¸ðZgsš`ï5y”‡v¦9‡‹8×,Ë̤g„×»YÌ×®Í<°oEé‡aÄ®OºU(¬ƒb:™Gòeé%«:th5. QX;Eq°MËNfšC®ƒŒ©7ûu] -±±–ÂFXQ¦Nç1»vÝeûS,UËZX;V^m'{£¿x{}õº&ç¾L:Ð>¤O«t<˜Ið|©ìÅ|.Ž3G.Vè›wÎÐèK–½'#È™[c†z*¬>ºHëlvTHë Úe§AûA1puÙè±t›òѬOËþÄÕ¥2bŠ)ýe鴮ʘĴ®J~¨kýöoDK2 ´ºs™OG³æˆ%«#Ëkë!ÕYSºìql=ÝOÛËò: É32¥Ù,=Ôü"þ}ÉÞ¹µ¹»‰ðjõ×~;Âu^ã V.eÿ% ÕœÁµ/s‹Öåºä³Û<òxKÒïOÖ‘°AE¨°ý¦Ó7á ŠöqÅÒUÿ½§ß¬‘ûHŸ7¼TØíÐþ£žýîn¿$Åb©¢ý†O,è­öÓƒBì^ñÕÞ§ë“ýõ?¢ÿ -endstream -endobj -673 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 672 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -674 0 obj -<< -/Filter /FlateDecode -/Length 4400 ->> -stream -xœí][¯9n~ï_ÑÏ ŒVê,ü 2ÈÀÈ>y°{ì]ǼyÈßÏGUIbU±/çøÌŒ{ìiw© E‘)©ªÆ-þþàðO!gJ©9ÑùòåôõdMŽZ‰ÍEcÿ„OŽgg)›èj*ñü… !›\£ÏéütÂ?»KYüéô§ßþg[ǽ©5yÏýÄ, -&—œmTX,ë‚ŠÑäìcRXÉ ±V1b&OGV†TKÔXƒ¼/ -«@Œ@Ù…#«B Ÿi,ˆájÌ -ËYÈá¼µ*‚X¢àž‹&AéIãygR©¾ª¼ žË^ã…`R&Æ«&¥‹Æ#È«u/B–般ƃ,JÖx ²„¬Êƒ,¾ä ñ2dñÐNUx²ÀºŠÊƒ,6Y§ñj0±"•WÁ³%—#ÏÛhb Áj<çL„m•Â$¥¬ð“ʃ,˜| |‚,6' àA†qIß³¡êI_‚¡BEC_ª¡œƒ¾FC©f ‚uày§A°%RÒ 8ÈBð\•YB% ‚‡,( aAÅSа m Ö¢aAÜ’­N¼%ë’†€ 1­†ˆJ"  ¦T5,ÀÜìÔ° táîYÃ‚Ô 1y `7PIàn g5, àn¨©ò X࣠® ¸œÍpnä5,À¬ØaÒ°¶b|)VÃîúbIÃîúŒ ò² ¸ë#† Enà®ÖkX@À]O>iXC1À«fÀ]@HÔÓÈ€Õ°ñ<4,@cÆ#-Ñ° w]EøS|he\©IÂÜuÓ§òªqWüZ6.¥ªaAî"P "pðY4,ÆDT¯aAH­ñ€»ÎW«aAî"oˆÀŒC aâ›q¦«òª±µ "p°ä5,@6¶IT^60$§aÀØXä¡$à.Â{Õ° wm AÂܵ„´GåA–P¼†ÈkÀƒÛ*>dÕX¤ÐxÀ]ë0økm®$à.‡M Rf‚/@@ƒ,ØkX -™šsÒ° U R>•— ®£†Ù‚Y*²P& X›jÑ° {ȼװ {È‚”AÃd¦:dßêò²À\ÔõAdŠÉL©D䘰ƒV5^ò¦dÀµÊ+๬aAÎdŠ†XK™§×°o8]Ò°b€çHÂ\! \EÄ"S<2sç ’l é‚眆ÅCdƒ_°ÊLVÃDh¬%¡jG–×™EÂBÉpª¨aÜ+M ¥Êƒ,€ 0?¼ØŽ`ñƒÅ&–9*²„H”ây¹Y4,(²xë5,€mòz3kXP-dAƧaAµÉpš¬a`(¼ïq³5mÑHg_Ož7”×UåKêÜ^‰òÖºTÏㇾ.uÁ™¶SA›~£Ãº×úTYŸ]çÕe¥hù<‰÷Q7ýªBÞ+|Wº‡æþ(d Né×ER¥¼[úuÅœöVù>’µãGmôÁ:¯>ï²ßGmôÁ:¯!ëq«ïÞŸàí~:|W2D¥ò :™O3Îï¿œ~ÿã?ýË?ÿûOhóýçÓþÁZD A­Ë|"‡ÿ’µÄŸø|@üýy¹ŽñÝßÿxr•÷äý0/ÅÜ9 ´áCá®÷½µoZzõåÝüèÖï´~wz\zç²0H·Ð¡÷v} ¯eÑEûÄ°´ýʯø\ÖQ]f¿ôa©×ÚËõÁ®è2®ý¶ú«¼MŽ4e²õ¾[ºôÁýÏòÏÐlÝkÖb¾< iEMòUS}Níeí-­Ý$Ù>ì¡×Ûë Ä4íÛs?ÛIø6¥c;M]éþ–Ù_“Ãα´™ìããÙð kF’ØmÀ.¼kz“zÝÏë3M_x§ê)¸ƒžÜ{owŒ]ØÁ¤}üÍÇXÞ;¿‰b¬EʺèBG> õ–ùc|Ù"’@#}ÜTvã^°gë;Ýÿþñ}‹“aär™L¨-Nòmh¾8oh’ЉØúÜ:/Š­kH5žo”ÀxÑ‘çƒek¢­ÅÒ>Î:ê½.ª—.Ä!o)|ÿ®KØý×ÿãßþ(Ã.OG\ÿÒƒ_w—I¸ÚaMÆV¾Åh×ágK;®™É |~»]ÅOL¸ÈJ»ñó»;µa|_^JפºS+×ÊÖ¥Õo!9Ž¹hê6Û-ïS¸¡©€Öß»>0Ziýû£ÐlÞ¦,ôy'cìáÿ®¬Úý'Ái²ÞÕ>ß… å¥|u¤wêóì[‚=íSñð¸B»·í4V17û¨Œ$˜}RÅ)Bò](.«É/ûøq”7IR¸–ø ¾¯¹ò„»N›·_Bj7.7PC*Ç÷Á´û¦náƒu¾e ÷Kà!ß{퇂¶Þ#’ãÅ{>û¸lË z·‘ïÛíec÷Z¿¥?.ϻǭˇ¥­)N Ûng2L5Lû@¦ÖÈ ¾m‡·,1"Q_­*Úd¼£BtǬó½Y"ÔzË;âŒÅ“ßZÊ@«²~ÒòÙÐóºÔÍ‚Äï•ç~^Ëœ<ï·uÚçgåwü âÖdb©—‹vç¹×»byü€ÆbEü|„G›ý=Ë{¬ÎwbySl~Þë†å…ÅŽÅL~œØ•<²§õßân–‹>«ïòÎ:öq8m¿¹¯fÕ¼ù°nî„Ý7)ýi²ß³˜2q‡FJiwñÞ¶˜Çê|o\¹e1¿úlí¢Ÿf¡C–˶LëslZlyËæŶ Þ +Q°,ju> ,ì#×ÆQ¯´ÕÇ´Ëú&ÊÞB“s϶Ðë|wêobÚo™nõÙûëú¶È»±æø[¶Ô1¾ý¸»‡^³X‘˶ªþ^~°Îwg±wò¿W°HÆÏoµÂkùÖµì``úš¶¼RÁðÑÎ.ÏÝô¿³ðãF¡Ž‡×²Š=ŸÇ;{d¸b¥3ï+|ODhGÜ6Ò‡ª|w6úm™¢j }¥úÀiSö>@‹t÷±}\þåöÚV¹<ÀË=]~·ã‚±ƒ³•á=è{ø(/“TîÐgG’‘MdÙü^P_÷ø/çÊwˆ}ƒ—ÿÛyÞñ_qñšvŽåeÇǶߎÿ†ÞÃ^7‹ÇÏ?ê[y›#¼›zŠ{=íú†nV¿9âݼn»Ïë¼õr}Gº•?ìýMûèõ´vXy'—ÏcGŽ7õSÝN?Ï9&¬pVBŽ?&|°ÎwsLXùî¡«O¿Ò1á¶Ã×;&<¶ûœcÂ+R=|Lx¬ÿíÇ„×5õý¾@ûâ˜ðEÚÇ„¯¦}qLxÛN_ù˜~9EçÅcÂm§»Ã™ŸÖçvsDÅù½ %º"èw·È°;ÜI8î†<®{5~ÃÙ^(´gì—Ž"j&w$óè­q+™ßXLX¯Ò…ãÑ ÎI– ΊwÉ.XAŒG¢ÝM²§.ã·Ç Õ¥I¢KÕ91ý½¬Ïb:o/'töÔ'•Êï ëMuíz;hAU5ö’cBhÌ“Bâg*Äloš0™ƒ/fßä²K7$åj/§.'µÜÚZ3•G©2«Ö®ù)Ê4õP†âÚEì6d~½©ðúÏ-™Äc®mvãÄË !†äöͱtœXac7=I ¢ÝA.vÚˤæÒU×ì4~ÿ»@ETFžöÃÑ0)~—ͼš°oòVI’žê¦Gy–êr9›•úrÅ*åtG顱 U¨LÐsíâ1H ðØ’Ý°ºAfëúX)‰¶ î&9S~Ú§œq¸j´£³ä„¹ÇÑî$§O’œÇŒ;~1Ñw´+l¾/-°ÑžÌ¦_z'“ìíˆv³3Aœ‚&yÂèS#woèÄ/[í?§“i÷rúË©…9¢çEgBJŸ·OÓ¸óÿ¡Ìøü÷‰Îì€-qÜÛ~`ë†,#¿•µ¨O’:ÆÔx:5´Ë´½1'´µfwÞ©¡ÑV¾F’3]c¦´¹6*¨eV[ DÙ)uÚ¦Ó(\€f;m´˜»Li­ÖÕÒF\T-å‘SLê_¤¦£œ•¡Ä(g%Êr»=âl)Œ(JsÎstv–¹dQhIÖTš%C§û¦mß=ÚžÅ0h -’ffjgµx(ù"ü{‰ï¨Ï4j¥ú߶;âÊ|5¹|ho··%%`ñ J3±]òì:·÷O®¿‰Kö„é0‚ÍŽÿ?ºO`Ôû ÑTÿèÕªU‡ô<(ÛCæO ºö¢êvBÞ6‰Æeæ¥"¿—>pÒ[øuºÙÞx"µÝìºÙBiÿZžo -endstream -endobj -675 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 674 0 R -/Resources 4 0 R -/Annots [ 676 0 R 677 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -676 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb175-1) ->> -endobj -677 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 156.557453 101.433071 137.807453 ] -/BS << -/W 0 ->> -/Dest (cb178-1) ->> -endobj -678 0 obj -<< -/Filter /FlateDecode -/Length 3228 ->> -stream -xœÕ›K¹ Çïý)ú¼€µ’Hê{1²A ÙCƒÝöì"ð毟?«Jªf÷ŒHÚSEêÁ’¨)uM8{ü¼ø¯pp¥Ôœø|ùpúxò.‹Ç¿¥ÄîfQ¿Â'Ë9xÎNBMEÎT@Ùå*1§óã ÿnç⧟¾;ýs_'œ£«5Å ç_ß«ŠÉå’³CU¡ò •ˆË9J2T)8å|Ϫñ%¾÷]® °ßó9ƒ6ïͺ_Ðýñï÷a«ÛƹãTmL›qIǧåtÄŽˆþ jÕËßÿñ™¬R⢭ª÷ª›·õ -µP7Aê1êÍkX³ô?uˆè¸!ÈGjáݦ_ì±cÅÀ…ù ÏxfoÄ7:ŽÒË{¾!{.Üò“P¶OZ?;yÞ’'9M×›.¼ÛÊ¿º÷u–Ï;ãzâ ¿Ÿxwð[eL÷ÝöûíÐwÞ´û‡ƒŸËá¹7®É‘¹mÜüIu7<;²Í‹ôÀ3ÂYs|ÊóžWçñ¼nvôù®çÑÁãä8‚ÓL¾‘C¬ƒè Ž$‡hÒg¹Ø³ú¹ÑHûzVÔ<öw7:Ú£ß!5îèQö‹š…ßõ˜gÖùæ<†î²ê¿>[Çhxh·å²/³ô‰ÿ¤^{®Ê;w.{Ž-uÚóðä%ËĪó~b¡lº[ÏQo´Õžéa?Ž!ÞðPŽŸî¡Ï«óÍy¨ÜeÚÿ"2Ýë³õÓ«žT'¯{óÿí©ýùŽÏÝVè-r9R៊ÂϬóÍyìùßWðHåç—zá­|ëVvЙ¾å†K^i0ü¸¿iííú?xøœQð´*Ž<¼•Uõýùã6ÈpÃKGÞWŠºÉrÞyßIŸUå[óQú²LÑô…KÓWÛ)_ ¢ß² e:4ì#ùd‘'Fîúˆ±ˆõç84c‹&õõ>*ŒŽkÖñ[›æˆ¥KÛáÛ±xÁeZï–ËphZS·2m³½z]æâ×͵n¼uùj9ußeã¶øúTµlZ?K[ÛõÒNiG[o¶ ûeÝÌ«~×¾l}OöðvПAÚ3\MåÇSZ¾Ý Ë7ü>¢¾xNìH禞õ¥â‰C›º° v8ߨ¹¼8ù±—ÚÞ¥ôúz…~µ¶¾h9Ýlå?.“þá*;uìõ½'¿ˆA_9ŠOúÞbfŸ)Vávé{[ZÁ.»\Ç’$Îo—µ7®§ëe”ö4Z_Z5ý>‚}+DˉüÚ±!DÍ®ÅúôÞ…M¬ïGÛ]ê¦Hj6C8ä¹ìhpT|RÈOB¹ú©»!ŽÜì ú]sº4„ÝôyèÂ4ý­lÌÓtÞ^Nè–ŽÒGSªo,µ¦ÚèFße4U»TZÉ>!ÜçÉ]N†ð…oM3&³ë§YÓï}WaiŽÄ½\må Ñåd–ÛZ“>S¹—*£jm#?L®N¥¼![Æh“f}zZ#žÚå^œtÚ\û2ùM¼^N1|%~> -endobj -680 0 obj -<< -/Filter /FlateDecode -/Length 4362 ->> -stream -xœí\K$· ¾÷¯è³Ë’H½Ã‡I# b`‚vÛ» ‚Ù›ò÷óQUzTû1»¶ãØ3ƒžé"õ (ò#¥ª’;[ü~îð'³39—ù|yúp²&‹ŸZbsQÙßà“ÂÙYN&¸s8¿%“Jð)žŸNø³»œ‹?¾ýìôÏmwö¦”è]8ÿë­°˜LÊ)Ù ° -XÖ‘Â -Á¤äCTXÑ ±1BbÏGV‚\rÐXƒ½Ï -+C âäèÈ*Ã'Ç b¸’Ârr8o­Êƒ –™¼ÂsÁD(=j<ïLÌÅ•—ÀsÉk<"»à4^11Æ5C–P¬Óx²Çl5daÊIãEÈB‘¬Êƒ,>'Òx ²xh§(¼ Y`]YåA­Óx…L(™YåðlNùÈó6˜‰¬ÆsÎØ&©[Ö°€»>!¨¼dàƒ¤aw}À´È ÜõÁz ¸ëÙG `(øcÕl¸  z:Y° ÞƒçIÃ4f<Ò pׄ?ŧVÆå5,À]—1}*¯— qÅo¡eãb,à.iX€»€Ï¬a0Þ ¢z p×"µÆî:_¬†¸‹¼!hXs0 €†ˆoÆY˜®Ê+Æ–œ5,À]À’×°QØØ $QyÉÀœ†cc‘‡jX»ïEÂܵHÂܵŒ´GåAÊ^Ãä5àÁmŸF²j¬Rh<à®u˜aܵ6 "pW¦†1 Ág  Aì5,ˆ™MI)jX‹)ŸÊ‹×AÂdA€,•Y8±†H¬M¡’5,H²÷$Y2hX€ŒÀ‡ì[]@˜‹º>`È‚LQà ™É…YÂ"ÖcЪƋÞä¸Vy<—4,H‰ B±Ó°k)“áôà¤K@ ðkX -d«hX€Pd²Gf®ñdA’­a2]ðœÓ° {È‚lPÂì3V™ÑjX€µ$T­ñØÊ:3kX9I5,€›`¥ ¤Ty0¡aæGÛAÃ,~°ØÄ2GåA -¬aAÎ^–›YÂœ!‹·^Ãئ¬7“†ÅBd|¤ÉÆÁ³VÂâ2Ö›ž5,€_Êz3kXPÈb½‰%žâ·…¢¬7“†…!K@Š¢ò ’¦¢ø-0 ëM “Æ‹ÅÖ° Ä(ëͬaÒ ¬7‘Ñ«[YÖ›IÝ.î†dÒxÀ]d¦QÃ\`½‰ÌV[Û[oHÈÏtf–gVw , 7 ¶ª[Ø‹h•Ô= ð•5’ºi1±²ÌQÝ5@XÓYuÛÀ‘ñ–ݧy‹*ÂbfN2È·`d÷}Í1ŠÑ•bËþØ¿þvúâ5‚ïùoÿ>½û¬î”µ_± N -˜Ælû‚Ù~‚B°“«ÉNcLº ¥¹¡$·%Ëò¹•Å·qcCƒ¼µ¡™Ž¬©YKïÎI\Ql(ë6”'Ê(½'‡8ÊöîfâlCQµ¡Nƒ] íhú½¼xîÿÄs%U—Ÿóñ‹‚²íô1¼×òª“mô6éþÅù^œïæ|Q~ÒùøåÎ7 æE"Ãœëí+yª$ÉüùÕûÓ_ÿæw¿ýÓ7˜«WïNùÒZWŸº°Ögka¸–#>i¡Á9mðË5ç¯þz~õõ•>äÉŽÞ‡4ëãRVf¹àsÁç5®¥t ½-Ý]F¹*F+ûNº=.Ý:§íÏ­}>.'ô>Êsžr“Â…¯>wò­;n]hÁ­ÿãú¿ÑÃÒ³”­¾YèMâ}-+OUà:J)Wi»QIùÚÞ*CSxoãíÚÆåNýдºÊn×zmliŒoS'?C«¼×jk‘óÐHmyß­Ñ„_%Z¯ëhš ¬#²o0;<&Mõì¶|ÕØeE\Ź^8€Ðm’B³©ÅE›u†¾;¶InÝÈãAÇvf×hã÷Óxë,]VKC›¹[ò’·×äµc̽M¾£ŒA'‹–èJÛÍת{¿[u!m½ž-|²6Âlées«“ÖöW}ë\Ûº‚‹gŒ~ø–¬ýÊ{ŒƒâM=ó^M¦ÚOX¼.¢c7úiº©2¿:js´EŠ;z¤³M¯¡µ×ñÎú½¦7%äÓ¹Ïzývµÿf_a+·úˆó7õ÷zì>ê&™›¿¥ÖæQ¢×ÐìÚ.ò[ÚŽm¯ÇÞWœd^CYØ„-ݦºí^›§U7Ã/nê"t1£mWÞÊZõáž=*F?#Zxû8Ú3"]¡a üG’îbÚUMí¢Gkû9ñ²–½l£™ñztz\·¼×mm# y~˜HȲxú"á±&Ç×äýäHxl»%¿?Eä®Quµ[×"õeÑcå7tY£WJ3Eî!z ½nꜽn>²ÚˆßŽ[†ðó@þ›º Ý"Ä°‰{ȯ¢þëÁ¹!{Åš0ãÉ:þð8òË“™î:òÇ õ¯ ^µ²´j[[Ñ| ª7¾ß–»‰ö_N×ä~\ÓÑí5ýýâ} ò,÷§ãý±}G;V纹\“ã“qüØö Ž÷­H»×ÍÏÇëÜ\¶í†pS/~¯—0Ùchó”uy·Õ|tLÇ€®Ÿ0ln³£²³a)ÛmŒGÕ&öñ䎌ÞjíÜÔ] ;ÝùµÙßšÏþúUÝ¥¾á\ä틺?*/Ëøì|$f#X;ï©>·ÎGmR¯{¨ÆËãܯ¡âåñWk‚-Ùò~cÕqëuQM¿tú~µ FžÇ¦eŸõ÷_ÿù˜÷YŜ׀ʗD›NÁt™„«–hl‘!v.8‚%·ÀTVúív=".’Ònx÷ÕÚœëÛC1^“êNýMëÒêßÒ\ û¡‡àu‹ñn$oçGñ–{{i½niAjiÀý~r2$¯Cj㺫U’¹æúœôGi•­Ü`˞£UÎ^–áù¶m†2iùf_’~§CüPÅ&yv?8Ê.©w8ê7Û€¾I¦èZ‚tL@äË"ï6í:­½~9ùdÁÂOgæ;à÷`O¹¡ôƒ``Ž·0оžCÔná¶Éø²V»x·]lØדý\v<¶<û¯ýßÛ]Ü]»c]ò‹µ´ëÿÛ1=î_ŧ[þÕ}'Ù¾%߶“»ÍÉFV“ OlJ rqÛá-ß*òJdó“ø˜o=Xç§æ[%¦[¾õP´MJºHëÿ‹Bm±¿Òiú¡\MóÖòoÏûmúùNÿÞËM¹ÏÁwvvû¬¨ÜÆÃër‰gû®ÛYÊÃføA;{¬ÎOÄΆØÅßÌc?Õx[çáùlÛ6œö›‚#Ÿ7A¶XÛú1Dz|‹›Ëò|‹Ã<ñ:¾òÔ“ùÍ4­ÎÛÁŸ—ñ{kC“¢ä…ÔœëË•7ÍíÑJ?5{s0§[w`«2—µº2yé8i÷Œ¬–yÀ°ì.Èö²W‚²kû5¯—ïúúÙl¶Ÿ¸¼~—öçdûíXÞ% -Îvcüf}Ó-ÌZÝù†u¸<½8× ðn‘;æv|Í®=‘ux)k›Ÿ I9âŠ2ŸÈÉ“¼z-;ño—U@ÖI¶@û¨m×”Ue®© ü–ÕL[r}ËjÝŽk[.5ÃY·bêÖ^Yè¾o“N«‹hBÔþÖê¶Û´íÕÛ¿±EØÇÚSùáëήžra#B“—c°Î‘<ÏÊYުΖص©sUÙî|¥f=<ìC/µž'fåˆy½|9llºX˨“þþä -ÑݯgÿØJÆ"2ìÉO'9û‰2óØ`¿CâúÕö¶ØõýúF»UåÓ]Idbvý:6õ%=[¾úÐF#õC«&ïä²m…¨¾•ºt¬Q3º#YFo[Ér~V6´^Å.Šl¡tâhç²£ÁQñ.€2Ñh§îÙs“ÇÉy ]uq»è³êÜ4ý­,Öþ!âå„niO}R©rjOkªi×ÛN£I¨Ò©¡•ìÂ}ž’<„| ~n[ÓŒÉìüiÖä샅˜›!q/WZ9…t9©åÖÖBŸ©ÔKåQµ4ÍQ†©SîŠWh—éÆW’'AZâÛ<Ìd¹ŸÓçZ69Ö)®;ˆ—B ÈõÁócé0°Â†fz3‘¦v;9Ûa/ƒ*Iüò ®Ùhòæ¸ü] "tª Oý⸛”œþ0®F'⛼UÒLuXÓ€ã4ÊNêr)u›õ…,B)/ ÛKwm¨“Ê&z*M<©[²ëV×ÉaM?+g¢mB »AÝ”Ÿ6ä!gè®lï,ºÉÜCowcÇΧ™œúŒ;9Ê£ËÛÛl¾/5°ñž,¦Ÿ['ƒìmv£³‰8( ò€Ñ§JnÞÚÑIŽ'l_‡“i÷rúû©†9OÁË}’HNN¦š3/wþÊ|Ï?N|þC{cb‰ãÞv´ð[7ä9’É9†ùA²œk؈Ým&¢ç öÙåQ64kèqÜû ¯yT·Ø[I×ÔuîL C‡ÙwÓõŽ&Í„ÄËN‹=‘ùÔ¹{¹¤68¹ã#‡h4©p1—yðh„äóÔ$®¤èéಟ*âbn—S‡eH¶S r^äçy*Húš.¦4B.iðx„Ù¹éF«£˜Š ¦ùbn˜ÝÜiÙÈ£ýÑîõÉ󾊛µC{§>ÍÔ>0¡vÀÓ©T/ãö²Çª·Jšó õ¶hò=êIÎp‘Zðæb¶Ñ‰šGµµ@˜;åFÛtÚE‡ Ðl£õS“)®ÕšZꈳª¥ÔsŠAýû¬é0ÏJWb˜g%ÊJ»-âõl‰zfsNctv”ì¹dVhq®Ý©> -endobj -682 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 250.954475 101.433071 232.204475 ] -/BS << -/W 0 ->> -/Dest (cb181-1) ->> -endobj -683 0 obj -<< -/Filter /FlateDecode -/Length 4573 ->> -stream -xœí]Mܸ½÷¯ès€Õò£ø{1²A0’Cƒ=¶wŒxsÈßÏ£Z¤JTIÍî™±åÍzÐîVI•ÈÇÇ*ŠõYáïÿ"é!Æ<>ž>Ԝ¿1Åâ`Tÿ€Opg­( N'ÝùcØ0„äLðçÇþkyòÇÓßsú÷2>›!%o´;ÿü>«È!† œ JP)m•sCÆyAåõ€KLIRÁ ÈÐZ`¥è$Ì c¢ Š0ÃRÐv­J0ÃM’ -fèä‚ Ò -vh£”¨ƒ!ŠÈA§ÝàQé^Ò=ø˜Lu:Œ¤³vð´Ó’. Þ{%Á—”–t¶8M¤$l!ƒ¤ó°Åz«Dl11XI`‹Aí$Aa ÐElQ^iI—ìàR$u :C\ëŒrƒ‹Ö*I§õà€M+êУÐH>:[¼rIÔÁg•‘t¶þ$xÂÙ£Ð[MîÝVY-él1&¨ƒ-h|‰Œ‡-*x‰Ѓ†ÌK˜J†$0Ñ)J,`b(+Ñ€In Ÿ‚ÄVi茖ˆÀ*ØâÈKL`5l!ô\Q[l"‰ ¬-H qµ°Å•¸À‚m h‘¸À‚nI%-qß’Ò^â Â…™Jâ ƵѓÄ” (%‰ ,8ׂ;%.° ]t÷ qëZçÄ´k)z‰ ,x×’Vx×Zäu°–¸ì8X­ÄÞµZ‰ ¼‹nd$.@«À¡—¸XLŒJâHâ!@Ô…}ÐJ\@à]ãp ÒÈ Þ5N‰ ¼kÈx‰ ”ü£Do¼ -q²;[@°`¼‡ÎX‰ PØ`à–H\àÀ»:aøú4ØjÐ1y‰ xWG4Ÿ¨Kƒ¨q¡ß¢–í}’¸Àw1PY‰ xô%.ÇQļ«-FjIÞÕ&)‰ x~ƒ“¸p4‰ 0¾ Zº¢. *Å(qï‚–ŒÄ…Á$¢. ’–¸d<(ø¡xð.†÷$qï*g­Ä¼«n¨ƒ-6‰ à×@‡n+ôi8«ƒ2` -IÞU-,éÀ»J…$qïæaSâ²ÀD‰ `à/ØH\à# )/qO -:¸|¢Î8ve‰:ØB$.€c=$›¢ÄÁÀkŒÄÁÀ¸ À#’†÷-†°pã‚-ð%.“ 1I\œG<†Z•tÞ 1€®E]„N‰ B C±–¸±ÔÑé%.ÁÙ]’¸f@§Iâ‚` ºŠÄŠ†hà™K: [àdK\O:­%.ˆ¶À”¸ šˆ(Ó+‰ 0B#–DUK:R9ÎŒDòCv%.@7A¤ ¦u°4!qÚ'ÛNâ?6æˆ:ØbI\£Éáf”¸ FØb”‘¸ØÌñf¸ )ØO₤üÝd‰ @ãÐ)%qAÒñ¦!‰ Ð/s¼%.HV!ÞDˆ'ôÛd}Ž7ƒÄ‰`‹ƒ‹"ê` œ¦$ô[pâM°“¤ó°Å$’¸ yŸãÍ(qÜ Ä›ðèÅ)˜ãÍ N€w]3I:ð.E净13†|‘ Ý‚àÝטcNf7’]æÇ~þñôí ¾çÿsúð›q¦¬üi8cj‚…n`šÛÁûÖ¸|ëÑÐz…4ZïÉ“i6Rƒ§I·l$†¿üï¼þ±°†ÿ0žÞÖÓ'Œâãé³sa‹:cįqnY|c–g4X!8Âhë‘Æ&“Ù ƒ_©h‘øw¯OêdÅe´2ó1^"&ãί?ž¾ýó«¿ýåû£×Nÿø­²¾ûFãÛÙË7=LÇ~:ŽÓ±›¾ÓZ¦¦¼@Òø©eNé(4e‡9}9¯3SšË´4ÙᦲÓ}XÚhòù ³/,ËȺbsµQÏzz»¾¶Ež÷³^»é\Ý×úÝ?ϯ_~ÿz ®Ñã¼t8FS$º‚Ǿ,OÁãKÀáë o‚¾|תWËVûò«´Ë /Ýv•YJ9ï,Mm%≵oÅ@9nqÑ9hól¶Jï“šºržrµo ÚÚ1¶Ë­L)Ç -û¨ëËs8Ôí»¥µòx\ÇȦ63:ÌÃel«ãfÛzšµÒ„ˆœÇf4}Àï8¡ðÞüog”×Vë¼ùqß—¨¨mz{³ÜÒkvÜWÎΡ¹î\ƒÖÚ“¸2NgW‘rÀó}ªk8íËs8œîû—+vÔ¬Í&²´}•78–صõ)­1Òúd›£m‚õ°yíÜoú±¾S¿ms}ï.^Í–_h˜×«tæ9šÌ¿pg<[0R‹’Qšµ(ÛÚVÿ°,gŒ€ -‹%àr|X–ѲÞ*|ÔRVƒę̀[QÈ5_’÷˜ÚÓZ–|'DZKÛrýnÏÆÞUwæ9R÷½Â–ÓZ´en°z?Mnm‹–5ù3µŠñBK·­ÈÐý/lô.í¡Ò÷ÊŽ­˜ÛҢʱsÝËo ÑÝKwæ9¯xŠ_t¦ƒñH3*/t%_é5ͬÔêÊ9úWι‰Ø]lt_ ·áåÞ‰QÕÈeÓŒ½1NgžÃ!wßw<îüÝ>ªŸŒ*v--’Wæ~(-ë©E£4Ô¸«¹ý°šuèýíìsRˆƒ¶üµ{÷ý#r·Çåy‡Â}ßr\+‘Q÷fcV›¦ÚÌiü”Njq!†¿3³Y˜­ùÍÒÂeæý¹Ös\õJà|Úx'í\íV$Cl.²{dîËs8´]ñï¹ÇfTŽãƒ=/G>?YF¨c~`~.Ò_›êÌs4„ºûï§wñÉ­3ÜÏÈ?¿ÌÞ±XææÇéLÔÆ]Cl_žÃ!vß¼y;ß[tS‹Þå|®×ø¬Ï}Ý1ÿ°wýogžÃ!ò뽿~ØÞ²Qm îŽ'v:óqÏì4÷rÄÙ¾&èÍýk%7ï½UëUÏä ¿ Ø zLwC¹ü©ºÝç|æsëS'Ž^¬CmŸÜë¼GØÜdïÛ`:ó±û¾jû|­Ôº_yo„Q¸¤cö܃¼ûÑ„¼võø¡áŽ÷uæ9¿¼Ú> ¹BÆŽ¿ù%Pf㶭«Þxóýÿ DÎþa~}qÔDîÚ}óÎ<‡Cämï$WGä·†é#<¹ë«µw…îªkWoùµÏϬz’›¯á9ÖöÄ;ÖAvæ9jâ¯Ï†/Ù>þ¥{@ç=:FZ­îFʼñÿØ36o¿§Ó™çpH¼âŠ7ž0¢s_‘Ù""³}k`^\V*O~ïj³™Ò¥—åÈtÇ;‰:ó ™éÊ}o­6ŸÙîYëÝÝúÓ;#Ÿ"/kÚÓå{«åk”±ñ^ ~Ω­¾ ƒ÷*æ/>g¹õ4„­mñâúîXÙ™çpèë\ÙöéC®¡9–ŸÙz!Û+ß6PxÇ3Ûy‡Â—™ùM÷^6ùBí¿róY–¯ÙÝ@çÏnwæ9:Ÿà;~Q^yÆž³áç®î•4³Þµg›S}ÓŒÒ\G®}KôÓžÁ¡¹œË{E§#Û£ïj’+8[o˜Q¶8ç¿H~B‡+0äÍjm<õ£òþ.8¯þð§?þ•g|ùÞûËMºË+//à_pë/ǹAÆJÑÅé¾¼°béÖ—.íÆÆÎ ri,5¹oùûòÊ ¸ åŒ7ºrZùŒeM¿Çrb ¹§óåð:çÏD‡‹~Q¾›ÎÍìËpì\¹†ïÚ¦ütòã^EzܯNù8h“7´={ln›tÎû#EeI—¦ÓceëóFÎqàO5Õ´3°Ê›æ¢.Û³ƒ)ý§±Ñ?žt¢!צË.žjGSfñã)ïâJ‚˜ƒtŠ³pú©jY¤KÂ*{›†!µ)­Ôô3Õ­+?+W“ó»’-ï®Cª$²ãþ2— Bäôz-ÎW¯=‰óN¸q°Ó‘¯¦8_l†p.xÚ¹À9ãU±¶Š ÝZ¨Øéf±¡bÎ;§Õªó³°šÎ«N³æ/iM`͹'|8á´¶•>ŠÒ¼ÿf)ªÔ®QUf™Q©J]IY„j; ¢‡“ üF•¢ Yõ¬Õò.fa,@¢š.•t‚èá$¦›Jsµ¥BM笩ÔülÊ ukÅ ²±Ž&iÈ[{³>¢lù¹ûÜ¥­Ud¸1+áà C ­Ä'„Ônæ -å -ô¸Ð²r«8ª/³4?8ù…®Ydy¨üÿ…*\•fæhªÊû¸ÍGóIr߬âe%q¹¯¬CR h -sZV]:„ŠY^_:*!}&ÝšºÖØBʪŒÉC*æe’ªä±늺*ÎVê§r%ªbN7‹]…òãB<ÛéjWØËɼfpwµÜYì+w>rq¨-®ó¦|ÕÞZ.Ã|>Œµâ ýXN2‹ª£Ý|2&œ )Ìâ™FGqé­•Æ7ºO?çN&¸§ŸNã0g¬3 ?¼ÕyYîyéó‘æ>ÿ:Ñùû²©Ùe7ª²…©Üºó‘,ïH;Åy‡ò"¬Ý† 1ÚŸÅ:Îi]ACÇa|Msv5{I©+ƒêªåB7×!› -]£-«·#|hj±:2Om›yÀ¾Úrq8ÍÛá«pÀ/‡qÖÙyH>³"q”“ÎC:´dXFðBqÈN˜fËff@ò“ÔªÏöo -›ÏŘ‘í¬£y˜åEÙx, \`ËxÁ¤ùIÓÂÁ軻דÛ}2Ù—¥•Ú«ô‘Kë…ei%> -endobj -685 0 obj -<< -/Filter /FlateDecode -/Length 4204 ->> -stream -xœí\I¯$· ¾÷¯è³ËZH-@àC€$È b`ŒÆíy6‚7Æ9äï磺´T»ºg±=62ïM©…"©”TUîlñó¹ÃŸLÎä\R¤óåÍéíÉšÄÿj‰ÕMeßÄgg)v%f>¿BH&ö)žŸOø³¹‹?ŸþñÙéßë:îìM)Ñ;>ÿøZXLÊ)YVX,ë‚Âb6)yŽ -+:ƒ!–¢± 'ò´g%ˆA%³Æ‚ä}VXbJ.ìYbøäHcA W8),g!‡óÖª<b‰‚WxŽM„Ò£ÆóÎÄ\|Qy <—¼Æ ÁÄDŽÆ+&ÆÈYãdábÆcÈÂŽÈj<ÈB!'!KˆÁª<Èâs -/Aí…—! ¼+«<Èb£u¯Ã%©¼žÍ)ïyÞ²á‚ÕxΆo•‡#Ťð¿|súâ//þþׯ¾†1_>¾ùâÊcÅeÝwøEHv¯$£þòsž÷ãºòÂTnsÝÊÑkk9/×¼ü¿Üfv4‘âBûv´ÃK9žÊuYìõ—ÓRÖuèÕÔþR†—>ºœ~—!­Ëõ¾âºûMŸù¨þ—ÿ<¿|qúÃ˵cÕ¥ÆÕ±$óFz#AãЫò!¾øS¸`)G.(¦íꌳÛõÿ[SóE1•»mžÞÎÆ\tÙ´¿¡÷öÜÞ•z¿HeÆÈtÚòvn#n_¦~_-å¶ý.ò×vým·­¼œzÎën*G2Íéä”KuI¨ýôÁ:Ÿš£bY|ä©][åj±•ïhø–‹å¶À'´n=^{Q÷Ž8õ/@Ž W–²ß*ý$E¾Càý»iVNÞ»+÷´.SAØoúÝxuoÃO@Ýf|çÝðÊСœì;ÏöžW>Vç“óJ:ÆÏ­×m0´[f -+f(V»‰o~Ýno/èô¾=­e|Ìò8¶;!^f‹îÝÝãúJH,‡±“¥úí´Lp…ä´Õù\-õâþÓßæd‹GÏ.‰€ì}.Þˆ€,#¹–ÅÒóºaÈõ~G_Êv«…+M~¹ãȸ—º•V­%mÔ>\ÓÚí¾^î/Z›W­>¢FäØ“¿i£åÅ?{,_zkšK³ïNušöâÐPÓ\-³­–_ž|b¹¯£Y4ßÚµ@ZO³ÿOõìº|ÕâeÑD\TWcgÙX -ò`Á2ö°Œ‹%ôqÕfµÚwûvb]79ÙÝ·#²†šñûi¼ÕJ—Å;H¢ÙÆrº¼9ߒ׎1¯ôvYdpêäI€ˆÐ‹Òv•¹\ëWÙž–¶^Í3aòàÅÖuLm¶ÌÞ_¦1·:iiÑ÷ð³¥-ec¶Œ~j}?çzÍ›_é5ØíØ·3®Ú}yè Äi¼n雯3‘üñ–ßû<-6hrpk{’MÓ}½~ZÊÅÑfE7ÆÔlXe}í5_Z#ß]]ú­.U¿‹Ý'?é:‹f¹å -’ÖXV&¹æ¿—ëÛK‰¾5&~P´•6¸òø‡]EÜU®’G„üÅò••æF¤½™Ïl"rëo•ÜÉ&jÙ‹]eë,â4췞󄦕:‚¼ÖÌÇÍ/HÍ?B~±oç§É/؆[ò~p~±oûêáGqæ ¯øÕÅC½û­n‹5¿•øq¨Úéfg†OÜ‹;n¢ßàÑÀ—i| —<îD·cCùã TtËh«5´áûà~ãûu9mUÙeyXÇÑnuüóDƒHÎÐGˆûvVÞ«žŽä¨9ÿ4(¿oûÿ(ßõ^¶ºù-¢|µÍeÝ.ó‘^’Ûê…'äf§¬Ë{³Ú¼ÝbÕãQ£ëŒ‡®v¶6~Í~ò;ýU?y$íä>Ô_Øéo£·š‡í¥°iÏ/òÌs¸áÀö¬ y¡>l Ï«?tVð`÷zŠâ#p?vÁDfL9ýœ_¦HÛLoÇ0®Mí)d_p³Ã‘ùȳț¿Ùôc¥²ÐÛõ¡Ž¸IJ»üôåÚ”ëü1Þ’êN}Ž¦0l§Õ?Ò\M$¶G÷û ò€|q!iñ¡'îô““ òF’6®»Z bkª*¾—VÉ’I!ûÀ?V){̲LùǾÉeÒòa_Û# ›2Ë£®ÀŸ¨úH¢Áß®“„U‚n%]û¤¦¢ª¼^°é´jôøålqðÀ*þÞñýƒu>‘ƒÒrüví«9Ä­mÞmφµãóíçj™±9ˆlK†éñ€íq}?êŸTÙ¿óöq€Íè|„¿­üÕ£Úý¯fܪÿËÍå}gÇîûX•OÄ{‡ÔXxï;{Äã&{ XG§dûÏõÑ‘ ÁætnÞ`˜Ñ‹L)œ“Ût¸A¯¯—g£"³¼ë‘ÙåéÑånó»EîØxÿ s{bôì6¼®•W±Mòö¢‡)K’çòo©Î¿¾·dê^2àË8³“p4?½SË4•O«¼¾ -ZVx-c¯ê_2ùºZ\žò}å=—hw癵¿å\²®ä¦•Toÿ`ÕÙÇÀm ;S¾=ÅúŽ‰«ïÚ˜óò!‚s$#Ç}IÎzåý”@®™ÎUe»óšõó o{©å‹V^ò”|®Ÿ{˜n–òo«Ñßœê“ö:¯o_ÛJFÁ[òóIÞ¾'…L4örî…¸\ÚÞ¹¾5ÔhY2e[AÎ.—cÿH"ßõÒsÔçVMÞŠ Û -…ú^Àµc…ˆšÑíÉ2zkÜB–/d–»ØE‘ ºGƒ4— ŽŠwÉ.؉È{¢ºdOM'o¼uÕÅAì¢Ïªs“ù[YŸ&s/'t¶Ôg•*ïM·¦šv½í´0 U:•[ÉnêvRH—“Büܶ¦ ÆìüÉjòöÙ•˜›#Q/WZ9…t9©å–Ö¸[*õRyT-MóC”áê!wÅ+´Ë´Çšä“,Ó±¡]®É²EØmmóä7~G¼œbhG~>qRJóÀ -ä!eO S»œíð—AM¹© -S³ÑäÝù{… -îTAžzᨻ”¼7îF'27;y­¤™;ê¦Gi”ÔåRê>;ëËe«”Ðí¥»ÆVÔIe=•&ž€T5Ùu¯ëd°¦ŸŽ•3Ñ6!ÐÝ swåçyÈÉ}ª²íE7¹;÷v9vì|žÉ©[ÜÉË”]ÞÞîäóx©¶dqýÜ:do{´MÄ!@aŒ>Wr›­ä1írL2-â^N?œj˜ó½l“ÅàäÛsæåÎÿE™øý׉Î_µ—Ñ®qÜÛŽ¾cëŠm&¢§ öÙåQ–›7ô8îý„×4ªÛì­¤ëê:w&òÐáDöÝu½ “fø€xÙh±'2j›°¯·¡ N6üä5Æ&næáà6^!ù<5‰;):B:¸ä§Š¸™ÅíÔa’­Ä‡œ;éªùi6E¾¦›)Û0x4ÂìÜt£ÕQLE‡ùfn˜ÜÜiYÉ£ýÞÓëƒí¾ˆÛ j‡öN}ž©}`B퀧SC½ëÛsBÝ)k“wh¨·¦¹z’3¦ÆH-hu3ûèDÍ£ÚR€çN©ÑV¶@Ñá4Ûh½ÅÔdŠKµ¦–:â¬j)õœbP˜5ͳUºy¶JÜ••v[ÄëÙRè ÏîœÆèì(ÙsɬÐâ\»Si” ¶ï›Ö}·h{ž†AC82S;ªñ®ä{áßûÌkÍN„VªýÔÝ—ÇëÛÔäRð¡~‘Ïæ!$UI”§í’w®s¼²ß%iû'sO0‡¡lròmE]„g0Ê}ÆÔTûî¢^­XuH呂›ïÁï²;T?®U7 -ë&Q¿M²T”oéIz³|(Y§¿ "Û@²í’V[(õçhÉ— -endstream -endobj -686 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 685 0 R -/Resources 4 0 R -/Annots [ 687 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -687 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 244.773057 101.433071 226.023057 ] -/BS << -/W 0 ->> -/Dest (cb184-1) ->> -endobj -688 0 obj -<< -/Filter /FlateDecode -/Length 4639 ->> -stream -xœí]ˮ丑ÝçWäÚ@Ó|?€<7Æ7P°†UY]m nÐö¿ïCI$CTHÉÌ{«KåéºÈJ)‚”Bäá‰`HJª«Äß7 -ÿE«DŒ)x{½ýxùé"Epÿ¦«Iý>Á]•´A8•|t׳À’ÓÁ__.ø¯Û¥Å_.þÕåÿÖuÔU‹”¼Vîú÷ï³ÊbÒ1ª•T†Q9'BÐÎ3*¯.1%N3\°ÚnUfا‚VëȨ"Ì06(³U%˜¡ƒ²œ -f¨ä£Rv(-%«ƒ!ÒZ£r£Ñ=§ÓJø˜tbu:4§3Fø`•Sœ. ｋœÎ—¤ât¶8e­ät°Åš8‡-ÆÉê`‹ŽÁpº[4Z'1º[€®Èê`‹ôRqºd„KÑZV— “1Ä­NK'\4Fr:¥„6 «ÃˆB'ùÀè4lñÒ%V[œ‘šÓØbñÇéÀ΄™Ñªóè6Ò(Nç`‹ÖÁ²:Ø‚Îç@{Ø"ƒç(#Hd^â8@‡ lÒ–#°ÑFŽtL†`8ÐÉ ëSàxÀHV [œõ[,F.«ƒ-&YŽ Œ†-(Àq1°E[ÃqÛZ …㺵2)Ž øÖJå9.0 \˜)9.0`\½å¸À€r¥Äqçp'Ǥ‹á8.0`]ã¼æ¸À€vžãÞ5VIŽ ,x×Ôdu°æ¸ì(ŒŠ†ã Þ5JŽ ,xÃHs\€^À¡ç¸X:FÉqïê(-Ǽ«\« cÐp\`Á»Úá8Ï ÞÕNjŽ ,xW[í9.PøG²Ñxâøp¶€`9.€¿‡NŽ p0¡–p\àÀ»*Áý1cl%TLžãÞUÝÇê’P-ÎŒ[´²PÞ'Ž xŽÊp\àÀ» ÏÈq8^À£jŽ xWxjNÞU:IŽ xqƒã¸p -ÇðoBI@—Õ%!SŒ8ð.hIs\/,d“°º $ÅqÈXHÄ¡xð.Ü{â¸Àƒw¥3†ãÞ•a«ƒ-&jŽ ×@‡aËŒi«Bj0§ïJ…ætà])Câ¸Àƒw³Ûä¸À‡,Бã(kŽ |´"…à9.ðIB‡Õy}ÇqA8P«ƒ-6XŽ X‹dRä¸ hØb´æ¸ hØ‚ãD")Dßìô¶.ìüÀÂDŠ€ÉDLÖr\œÇ| ­Êé¼1€®Y]„NŽ B°®Xq\€¹”ˆô€àE—8.€Ð)ËqAH°C…ã¸"5"sN§` ‚lŽ éB§ÇQÃDƒD1Ëô’ãxhÌ%ÑÔœÎÊ<ÏŒDëE9.À0ÁLLÉê` h‚ãôOžl;Ž 0ùÁdÓV[Œ³Ĩót3r\#lÑRs\læùfภIØ‚ˆã‚$½Èa2Ç qè¤ä¸ ©ˆù¦¶`\æùfä¸ ‰ù&¦x̸MÆçùfภYØ⢰:Ø‚ )1㜄ù&؉ÓyØ¢“å¸ yŸç›‘ㄘo"¢gS1Ï7›.ïºfâtà]D¦žãì`¾‰È–›ÛK¯ ˆÏxeÌ3ÎÈf $¨×Á·²) î…· -lÎ@‚|ó‰MÀLÌ,£g³p«P*ɦ $øñ˜ÝpÂœ}¢)*8øÌòE& ‹è¾Î9Z1³SlÎýý‡Ë¯ßÃù^øÇåÓ¯¦LYùS¦Òñ†Nèn‡è[áòGG+1 íd! |¦N6"¤f¤-.I·l$Ü_þwÝn¬,‡áßM§7åôˆ(€ÒéôàZa - GL_§Ü ±øÁ*oh°ÄäÞÖ£ŒI:³ ‡¸RÚUáß¾»¨‹s´î*ãŠùàTL†­v×w?^~ýßßþéþð`ôîÓå/ÿ!¥¿ùFáÛ…ùÛúå{Ù—fþF`.•Y¾oŒÜÏŸ*7d6Á™Kõq)ÿ¡é´^×™>ùíZuܲmíb¹Žb\ÛÿÐuf{Ýü}÷:Ëö_¯ï¾½üîÝ:ˆ9*tìÚƪ¼mo²j58óe¯F€]×îM9ŠÞéåB noK½÷K9*û´>W6sB^"¨s ‘µ|©Ot¥\­§ˆÍÈõpu¾oú •ú7,ÖOVääXSvC‡`¬s:´éCNë9 ´äÔsLKÔл‡°©Ìª -« ºûæø'÷òûy{#_>+nòõ\k—í|üDFÚ÷[KûT4Ê$šÊa9ƒ†¹¡•þÇ꜉î÷êx/­yã½ÔB7\Öy¼ŠÞÛQ¹l9oAÛ†£ -‚oãü·72Þžç¹Ö$ÒØmÐÖ9㼇 æïÚúr]ç5ˆ,Ǩv¼_#µ+4ÔœÇó>ê[vPIb¼aO=Vçl¨ÔÇq!‡GødYŠ?ÖgAªìõ¡mç2+¾ôÝÌåsÛÑ¡½"xñ2Ò&û,±Åªn¢uZHg}ÆÕ!V뜫ÇQåçî»Ê,å8;,Yf&\l:ˆÒz?ÎÆ}†Í6eèuÚ®-_§\cã;~[Âv¹—mÊɸcÔÕ9êŽ#ÈÒ[Ù»~öë:ômömÕoö½§H/-ˆÈuLFÓ'lÇ…ÏÖÿ@æ4~4Z·"¿ËÏô£«¢¶Aîýr˨9ˆ`);„æ¶sZëH¢6ò8m±¢Í嘹‡Ó±:§Ãéq|¹aGµžOø•]_v8æصmÚbd/ç·±©›…°y4ndÆŸ%c§~›îú>ÎQÍ^\¨ŸHÖ9šÌ¸ðÀŸ­©GI(Ez”ú¶¾×?­3Í€ -‹%2Ç¥(ø´>FÏz›Ù£–cuˆÎŒº7 ¹KÒSGZÏ’™™Ömm[nß=ÿlÔãóêÁ:§Cê\cÇi=Ú¦”›:.“{Û guþ,½¢=ÓÓ}/t¿& -›¢K3#”ûÞ˦oF$µ¥G•#çzj.¿ƒDóø\z°Îéx'Rü¢™Â#W^éJ½2jº¬ÔæÊ9ocÈ+çÜEl.âÝWèíxùu÷†vKòŒ£sœÁ:§Cî{ЧÍߣúÕ¨"×Ò#yƒ`‡Úu;õhä|Awuw 6Y‡ïßbN¢PÆïþÎ`³!×Ç©uFÑÅ‚ÓL“xiêiïE9ØxêÞ“÷YûƒnŠ.Ìö|Æ“˜Ø¯íßÄ‹$ ±:ÖÁ]„C÷¨'ÙgâQ«çÒÁ:§Cäxtï~3õ^{3ÂQG÷´¿Þû1[äm²™ú3#•ÄžJ‹$£ÎO6#u¬ÎézçÞøÈ39Yö‘ð åµ=~Ù{bƒñÀ_Çó>oµì ’ä$“nšœßCåXÓ¡òuÏC>Üo÷ zgVôu |™ñ ¾«s6dº;±æ[Î\xºmhvóÖˆ&蘞D9 ‚y”:rÇ{tF4Xçt(½þ\sïÏàuÏ ÷‘k|ëûGÎ<>/¬s:Ç–õ þ÷;Ymú´«_Êq=ÎÌáïΙIf/¿Yz¸dÞßêyŽ»‘@”O»è¤ÏÕîÍdÉEŽzæÁ:§CÛ˜ñ™;p$£ržìm9úç‹“wJâÀü A¸H/+4XçlõÏßOâ“G3ÜoÈ?ÿž£ƒG¬'1a~_]G¥ÝÝׇꜱÇqäÃÈ;|O… àob<4Ëù¹F\³¾õýuOâÃÑç뜑_ïýõÓŽ–ÃÕâžxgg°Îé7øÎNw/‡Í†Ðg‚Þ?ÿ¬äîý£rûÆE¯{ºâ­#€T’û×£òÁ:gCe¸“‡<+§̆ý€wÿ,£¤ãÊ=~ O¼ç=XçtH¼#ž†3þÍGÅ^<<ñ\æ`Ó¡t0n,-håæ “Í³ãe›§z¹ÌÉÀ[3›'¤<|3‡f§«}7ÆÖî™Nõñõ¨ÛðígoÃûÇçãƒuN‡â;9Î/úí×Ë×Ï wOä3ëœ ñN>óQ~|Å? ½ Ø¡z*÷Àqé[u‡ïùÞÚ¹§çSŽ^=‡Ú¿¹7x(’Üäè/Á Ö9bcÕþýZ®w¿òÞ3^¸”#ö<ƒ¼çÑ„ºvÄ¡ñ‰ß"¬s:~ù8tïWøjOÄ›_e&îÛºßÿßAd‹óúQYëîÝ7¬s:D>ö›DìÓùgvÃòaÞ‰<ŒÕú;ŒL†»êú'Œ÷âÚ÷g6#ɵkx‹g{âÏAÖ9jÒ/ٿþ¥GÀ`ž2‘œãèle°ÎéûKžr5²îk•Ï`>‡ö„šÇoc°Îé:ö;•rAÿöè4›Prs7’çÿ#c‰þñ{:ƒuN‡Ä;1á©xãÆŠÄ™ý¯槓˓ÊKÜ»yŠY/åÒgæÈ'~“h°ÎÙ™[öšJî¾´=ò°÷p÷/?¹úyy¨=Íß{]_§;?¬AÏ9Aµ×xÐaEfM“–{¯CpÓµ=blðûnYm"8ô”syµŸèT$‹WTÌÝ-rbÛ¥.Ê‚×ü×cÈ/àñˆD^fÖÄ«’RÈ+³dÈ|ûŸ¿ÿ¯?ÈL¿êóýœý›»iþeŸé—óü¼ŸGå4’UÍó/ÙXüÖ2ƒœböÜ•s·HS²†å]þܬ³O2h¹¬Ÿ?Ó±–íé8±øòå|Ùoçúù]«0ëWÇw˹‰=Ó1¹W®aÓ•?]ü´ÊšVš“> -¥óR´Wo…É}“®ye£(U¥ëÔÔØêºSsZÀ÷§ZjYÓWæeþòOó‚¿dg)ÿÓÔé?^T²"·f€yýM9‰£.;MürÉë¯ZFlAnƒâ,\6e=–U¥`•Ý@¤A¤¾¤qB.›©<¯ñ1ojW®&×w¥Z^ÇÊRÈL+ÃÌ'f„¨éÕVœ¯^ -µˆó¶Q˜eÏWSœ/6CØhiÙvÀVñ®XI„n+”ätM¬m±Gå5ÏjÓù&¬¦Ó¦S¤ûKYHw oœÖôÒVšWÎ,‡*­«e•bTªRWJÖ±µŸÑí¿‘åÐYõ¤×òúc³0 ÙZ.•rŒèvaË-Gsµ§B-[ÕTZ¾™Ò nbmxF6µÑ" yQn2F¤)›k±Ï=PúZF‚½Þ.p1v#~¹¸À”v+¤+УBCŽ[ÅQ6¼4i~#oÞÂÐ,²¼zSþ¦ -W¥™y¦ e+¤ò -lm¯$Í*^7•ûÊ:–keC+KšK…P1KÛKEɔϤ[K×[II“yHżLR•<ÖbUQWÅ™ÂJûT®¤BYŒÀéšØU(¿¬ÄÍNW‡*À^N滫Çmb_¹ó…ŠCíq•—Ó«öÖãÌámrl¶gèÇr’&Ö²z»v2"l†š¸ÑèË$.£µ²S^"¼l¶AÆyÜÛåo—ÉÍiãt†7*¯K#/uý'Ê|‹Ïÿ^ìõe9²ÙkYÙBWn]‰©'Ëk‰ÇAq^[¼ë°!Bm í7±Š­¬+h¨~\kÂ׶U—ØKIUTU-ºÖ†D¬+tµ2¤eÜðÖµb d^Û7ÍaÏ»¦\NcòBvÅ*ìÐËÁnl:Ó\ò•{¹hséÐZM*b‡»ä„©Y¶23’ž¤6}¶ßÒ®0ù\d‡„y×4mn–ºÈ¦« EºCl=iZÙÃýôðzu¿/&û2²´R{•¾Pi½°,­„ÇKÍ´ë×»Õç˜kÞ)ƒ·µP=–!cÏÔ § ZØÕÅ(‘ÆVm)àèIm‘­NZE¥ Èd‘Õ#†b“_ª•f™®8²­jLѤ£-íh¯ÔFt´Wü¦l>nñx5Z25rΡ]l%k,™§µ«Ô¶’¦È¶ç¶ëso{%—a›!¾E¦²Us›’Oñß3cg®Óe"¸RåoÊŽ¨Øð„£¶*m®)‡;Ñ{pˆÍËjIºäá:Çù“m–¤äOè™ÐÂ#ƒÞvLx"ÝWC½,kŸòÕ’d/é±`ÒCæä&;d„Yò”S’¨î†> -endobj -690 0 obj -<< -/Filter /FlateDecode -/Length 4953 ->> -stream -xœÕ]ÉŽ$9r½ÇWÄy€öá¾BH‚A ¤CC‡ª¨ªÙztÐïëÝIšÓ͗Ȫb*‘áf\ÌÆÅ=õ]áçÿ’ÓSJ9wüzûí¦¦èþ•«‹¢þ¿Ñßµrqò:‡äï¿’ÀÆ)fob¸¿ÝðßpÉ“¿Ýþã·ÿ^çÑw3åŒö÷¿~!•³SL1*/¨2TJ[Aåý£ñAP=ás–T0ÃGgÜVa†ËÉK*˜áŒI‚*Á 뢶[U†&j'©`†Î> -*­`‡6J‰:¢œ³FÐi?8=H:£§²É¢.B§£‘tÖN!:íµ¤ËSÁ'Iç`‹ÏJK:[¼vNI:ØâlŠ’.À¬u°Å¤h%]„-ÞÉ‚.Á +‰:Ø¢‚Ò’.ÛÉç䜨ËЩÓVg”Ÿ|²VI:­'lZQ‡…F -QÐؔϢ¶x«Œ¤³°ÅáGÒ'¼) ½ÕPï¶ÊjIça‹1щ:Ø‚Æ—ÀØ¢b(=h"^’8ÀÄ8¹lœD&ÙÉ%—$0)O.F+Ñ€É~r!G‰¬ÒÐ-U°Å» 1Õ°Å¡çŠ:Øb³“¸ÀØ‚X [Œ³X°­Z$.° [§²–¸À‚oÒAâ Â…™Jâ Ƶ)8‰ ,(PÊXp®wJ\`AºèîQâ Öµ>‰ ,h׺$.°à]ë´’¸Àw­ENQ[`‰ ÀŽ“ÕÉJ\àÀ»V«(q Ъp$.V&“’’¸ÀwMRNâÞ5C€¨‹ú •¸ÀwÇ-H#7x×xe$.pà]ãL¸@™À?JŒÀ» /‡°+qÆ{茕¸…Ma‰Ä¼«3†?¡Oƒ­&r¸ÀƒwuBó‰º<é ý^žtYâÞÅ@e%.ðà]Ðg’¸?aD5x𮶩%xW›¬$.ðà]Ä ^âÀaÒ$.Àø6i芺<©œ’ļ Z2`žT“ˆº8HZâñ¤‡J\À»Þ³Ä¼«¼µð®r{Dl±ÉH\€¸:t[¡O#X”SH:ð®ÒhaIÞU*f‰ x—†M‰ B$IÀÀ Q°‘¸ $7åƒÄ!+èò‰º0áÚK\”%ê`‹‹NâÖS¶9I\ l±ÆH\ lAÈ q"‚)kDßâô¶.âüÀÁDŠ€É¦”“¸ ú€ù¼*é‚™R]‹ºŽÄè& ÅZâÌ¥¦„N/q~¢pIâ˜vÄ [ÐU$.ÀP4%ƒÈ\ÒiØ‚ [âDºÐi-qA2°Ñ ÄÉ$Ì2ƒ’¸#4æ’pµ¤sŠæ™Iâ‚äÂD¡¢Äè&˜i‚)ElMH\€ö¡É¶—¸“L61Íu°Åz'qAJ†¦›Iâ‚”`‹QFâ`“æ›Q€` ">‰ ² -…ɀơSJ€æ›ÆI\€~IóÍ$qA¶ -óMLñ„~›m ùf”¸ ;Ø⢈:Ø‚ ) ýœ„ù&ØIÒØb²“¸ ‡@óÍ$q Ì7Ñ‹K‰æ›Q\.ïú f’tà]D¦Aâ\`¾‰ÈVšÛ+¯ˆÏde¢gW ¨×cl— ¸£U× È—æHâ¢ÌÄÌ2qÕÃ*”Z‰Ë -ü‹xÌm8a^}âKTpˆ3S¤›ÌèÑ}›sôdv'Ù¼>ö×?ßþøƒïýÏÿsûú‡²RV4„’Ú!¾B70Íí}kܾ²c,¦Á²§Sµ1w³4ˆpYf#³0àÑ¿ûöËÊV˜JÆ"7fBfÿ˜\#ðš+÷”Ò¦Á˜%»­Oç959"&È÷öE˶2±z»“$[ŸÎóýmÅ$“f„˜ëze#OßÆïõbZ ԋ鼃> {5Ów6Ú6gejjPGA  Cëu´4ô3“ŸÌò V˜À#" Hc³¡´ˆ¹r«Äÿá2]¬˜×éÛ%31Æà›?üzûã¿üôïÿú§ŸÀ_o¿üR.üøƒ¦Ï4z¿|Æù ¦†c÷XÒ}]§7ÐÓŠ³§4n]É[úšŸéjº–O3{>mmZåùÒõÚ/º½{É;eÅõ=Õü§e=˜½ÁŸÖ÷ØìS?þçýÃO·ø°V™ÍäzÌ*ˆ±x-Ë·`ñ÷€`·¬Ío×Pyª9tF+Û¡L¿»Í®º fV§[—Û›w Gÿø[ê624i·¨’^ö´£ ô›ó¼81c?Bçë’Êwì9zÕÐ ¼>Çž§jš³¡M5ÙvtnÐå廌AÛÉN¹©Àéƒ×ò¼Ý!C¿%ü~Ư}\}h ó§]~?ËßkºS\ ²‘a6ø`évÙv`9Âx+?®qÛìô͆=fët ¯ÃýÈùw˜°‡ž–ñR*KRÇ(¼–çåPx*Rë6†¡åÕúslmÎ*­µô~ µr†kãá8?†×[4µzó2þ¦­nƒ=Œã•™Çzýz\ßCnÑ}cïÛ³YpH‡60ÀÓúÌ1R¯åy9¤žD”Õ[yn±M+ŸxxÅÔr#÷m"*†¢q<.õ»yÌ-c¢Z"¶±ž(ØwÈ]f½’¡w“îë:Máa3Ô; º•Áâ›Öã›NF¥aQ¡¦ígÌžÕ */æy5Tš“HrDÝÀ¡­e†ÑÏx«íò›Y—Ûʳ²ühžr­å¿ñÞNFù¡Šènˆk «ÔRŒb-Õ.Ù¤¡C_Új“JKýôÿüOÿÆã-ϱ˜½õÅÐÓÌi}¤~]9d¾&yŒåñRíoø–rL˜¿SÙ¥ÌGm-òR/»¥w¼u» }”]êŠuD^®’XþÐmqÕþ¼±‹÷/¹;qwÿ²”Z, ½tõ‰>˜×ô€!G8BºÇRsXª ¼.Kg³¥óƒK]vi¨¬¹ ª[Þ–,m®Ñ®m9Å;K+–²Â¡tæP¶Cu¯––t½u½™Y[°òPuÈBÙd›ý2»qöÝr¯Õg¶#¥ØNßÕ‚š<×KéŠoȆÉaR»ÑgÉ¿ø·Þ_±!Ê÷W{CÙj9¡÷¢ŽìC§Ñµ‡¹8øxè-¼ÎgzX¹NÝ/å~„^åk¹qIoyšó\õ¯ç6rÛÒÌP¥íY9Å¿_{yÕà×_Ò¶µ//Ùf—¶g¶úZo8ð爅šæk¯¯¯Í÷®+F)]]òõ Gù€ë¿,¾ªePŸø¸ÆhIËî¥Îw|e6¾bý®Ý3ëkô9ukRûùÊŠõUæ›±Z]µ'†'Ýïa…YÖÏ86E Ö>8rA-Ë3{ÓÚ­ýæF¿õU‚ßi}_s[tìôuÕŽsÜV1uš¥÷~ÑùvŒ^éô_°e»Šd^Š^/æyצáw [}³cvòð”ŸNãr¸®]† s#ìV˜Ã¤2¶*üeaÛDgµ8¸[®±yòQ(×ýñ$·Kå„j{Vä÷aÊm'å?ò\ àÇ ù¼>K'@1/ -G^¼´lvROŠ“¥#÷Ò}zÕR[»rç]^uÊMÑ&cýÿW]2èeÉ!´:ƦÏÌˇu“‘›À@ø'ˆÓCdøi= ŽŒÜnƒG:ÕŸéüìPiñèù¥P‰ÌГ)t–ÏÈïZž™º7„÷Ž8P}Ü.ho¿ÃÐ놛ÕÂc²£é7[¼“ÚB_F‡6Û™›É+#>…Ýàôv.kì— „cw î -f“’‚}Cû9Ù§¨‡ -pKÇ— z®m]Ìór¸Mú·—7PÒ²IDŸA†;¶™T4ã²ÑDéÙÑ{6§x\ÑFwpûôFQZìõóçé}Öï2β阹¸Ay1Ï‹à¬"BŸ8Š¿nçÙ¿ËÛ6ÃG2¢î uu#òbž—C›=dµgd´m .;[t6×PõôQ‰ºñqØ€¬òåwÅ®I};Ûºå;•Ï£Øwœ[‹®q=Åç -gH¼–çåèyï{ÀÙpÙ0æm6åX<Ù⻺-4rTEðGÒŽ¶®¿÷‰Íë÷ºƒDµ]/æy9$GzO!¡-:.2µÎó-ˆ”6*9R77>½ÒÈûìزƒJã]©¯åy5T¦ã¸ðhÛú©þ¯å²~¤Ž‡?Ø ~h­ 6 s—ßÛŽí él¯=­Øç˜}òô!:o&å] \B¿–çå°zUþÞmט¥–óyÀ’æÂÕ¦ƒ(mÇÅø`Ì#°ÙÞ!Iî“æ‹(çik`íÀÓÞ“Œí¨•]6gGÕ.æy9ÔGm5ñÁÆÈÁ›„ó`«tÒø¤Y+-ˆ <–Ðô•­%¿7ÿ'6§V:yÞñàæ36Ô=ÈÜA.c'‚åì\J¾Û[±]Ù(ã´ÇŠŽžjMô2š3œ^Ëór8=Ž/7ìÈW—x²  ±ã›½!ty‹‘½U¿MÃ,ì -›‹G@…þçXßÙ¨«÷÷yŽjöâÂôŽõ‹y^ Mù$.<ÏVŒ4¢dD”f-ÊǶ±Õ‡ã‡š/ŒÂË Cž“ýÕƒ4c<0ì÷´Ö×ýYÈY,É{Ìæø<-.‘ߟ³~~^}1ÏË!õd­qà´meÉM§¡Ö¦ý0C¿K«˜ ´´°«ý=¢°]Ú¡ÒçÞjúá3Á'@¹Œêä²uÆ«sœ‹y^¹'»Ð/»~wŒêoF»—³‡ÒWq¨[ûiD£4´y×°±Yu¸2ú÷˜ÓÅ4iëè|Ü r¯åy5ä Ǥkxð©&¦ùP{ÌGc†f‡òqÙþ ˆ+á…ÝÖg Š7O« å±eˆUYÛ‡aÏ–7.¤?/oFŠ­ç=½™.yØ‹–O“œÀ®vÚ¾8殇—õ¬ÏC¡Hz%ºMwtåHoÛ; e¾Ì«0z9ªM`Ya ó518°¤©§¨Øñövü{9Ú^ŽÊ«ùÓ.G»ËÑèåCÓWQý¤`P›Ç4J}´>Oùiwˆ!oå·o÷àë=lšò·[(oÄÓå­¨*€' ½6ýÜDO0Ä|§·ð%e®M§‹³éø—˜³¼lþ·–jyÿ¼¢WÒÒëç—Ó³‹%ýo¥Ñ½éì&òy^©¼+Zq2õ¢‹ßnô®p'ˆë=ˆI¸|U­,§Û3TUö¹Æ))­ŸÔòµ?hEÇÁæ¯Æ×»¡ü¾f£w¸9UÙò³¹bAˆœAoÅt÷jÒ‹˜Þ·ž&»\…f -‡nÂ^ ãi{=ã©X[Å„~+T¬º.6®Ú£éýœÍu¡ ›éÜuš5Mk"kÎ#áã†jí(}¥ô–çZTõ®QMf™Q¹I}MÙĵvD› üAÕ¢³éY«Ñ»2gaª@r-]®éÑã&¦[Jó­¥bK•zÖ\=ßMéP·©9^=ØÈ‘þ€ë#ÊÖ¯k1=W×ÚZ%†³>nbÜFüvóQHí;W(_¡Ç…–•ÛÄIu¼t)ETó7tÍ*£7 Òÿ3Uø&%æ)_´k¢·…ö«^ õÍ&^;‰ËCc'y@»ØÓ2wéf¹¿tRBz"Ý–ºyl%e.cò˜«yDR<ÖbÝP×ÄDaÕ?+¹PU#P]ûå·•¸Ûé[WõªU4ƒ»oåvqhÜùÆűµ¸¦W¿6{[¹ óUø(›ÅýT+éb£Úh×+cÂnH¡‹;¾qí­Ê[–¯½“I#îãö—[æŒõ†žy -VÓ›Ìyä¥ïÿ‹4?á÷¿nîþ§úêÌy7ª±…iܺó‘ŒþîEº(¦¿ƒQ…­Û0¡qŒö»X§žÖW4´qÜÆ×®gWØkJÝT7-úîC&6 ºF[æ | ^lÌ·¶M°çK[oŽžÞ¢—®V«pÁo—©ël’ï¬H\QÒ>¤Cë ˈ ^(.Y…¹[¶2“É+i®'ûo -Ku± FÐ¥í:ׇY^t••»`I[~Á všWšWöF¿»{}s»/&‡ÚHÚ¨½I߸´ÝIáÉR[.Ãú²9¶<öT;o÷P+˲¾g[Ó»F-Üê‚c”IS϶$ð¼RWe«Jë@Ñè2Ue­ÄXm -K¶ê–rÇIôRl1E—þ…{ÚóViNô¼UÂ&-•[G¼-ÙyçØïNõ”-–L‚,ðÜMêzJ[eۺݺî:ÚÞÙm¸nHè‘©êÙü&å»øï=}gÎ3¬DH©êOYÑ©¿lµÓÑ[þ~˜J!€Cý ˆè[.y:ÏñúÉv•¤®ŸðšÐ“³VEM N6á Š|®`EÕ¿'gËJ¼¥ç ,ušS›Õ¡ò§€ÊÚeY$j—‘¦Šô—¿,½‰þ`ITZ~ÿL= -¶^B)?ÿ1ü‡Ò -endstream -endobj -691 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 690 0 R -/Resources 4 0 R -/Annots [ 692 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -692 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 465.123057 101.433071 446.373057 ] -/BS << -/W 0 ->> -/Dest (cb187-1) ->> -endobj -693 0 obj -<< -/Filter /FlateDecode -/Length 4260 ->> -stream -xœí]K䶾÷¯èsË|_@àC€$È"²À"99ŒÇ;6‚Ùëò÷óQ-’%ªÔR÷ììÊvv0;­*>JäÇÅ›Òg…Ÿ¯4þ‹¤‡Sðt~üpúxRCp -ÿƳ‹Qý¿Áµ¢08|tçY`Ã’3ÁŸŸOø¯»äÉŸOÿÍéßó<úl†”¼ÑîüÓû¬";„‚r‚*A¥´TÎ !ç•×n1%I3\ CKU€”¢“T0ƒŒ‰‚* KAÛ¥*Á 4I*˜¡“ ‚J+Ø¡R¢†("kvƒG£{Igôàc2IÔèt0’ÎÚÁÒNKº4xï]”t[\RZÒ9Øâ4‘’t°…l ’ÎÃë­u°ÅÄ`%]€-­“]„-@Wu°Ey¥%]²ƒK‘HÔ%èT q©3Ê .Z«$Öƒ6­¨ÃˆB'ù è lñÊ%Q[œUFÒYØBø‘tà gCŒÂh5yt[eµ¤s°Å˜@¢¶ ó%0¶¨à% -À2/I`B(’HÀD;P¤(±€‰i ¬D&¹| -X¥¡3Z"«`‹#/1Õ°…0rEl±‰$.°¶ ÄÖÂCVâ ¶% Eâ º%•´Ä|KJ{‰ ,f*‰ ,×FOXP. ”$.°à\ À‚t1܃Ĭk7XЮ¥è%.°à]KZI\@à]k‘SÔÁXâ°ã`u´x×j$. ð.†‘‘¸½:‡^â`e01*‰ ¼k¢"‰ ¼k¦QŒA+qwÃ-H37x×8e$. ð®!ã%.Pð½ð.(ÄÉîlÁJ\€ù:c%.@aƒ["qïê„éOÓ`«AÇä%.pà]Ñ}¢. : Å…q‹V´÷IâÞÅDe%.pà]Ðg”¸?`F58𮶘©%xW›¤$.pà]ø NâÀaÐp$.Àü6h芺4¨£Ä¼ Z2`T“ˆº0HZâñ à‡J\àÁ»˜Þ“ļ«œµxð®"¸=¢¶Øh$.€_†­0¦á¬Ê€)$xWiô°¤ï*’ļ›§M‰ |È%.€¼`#q4¤¼Ä>)èàò‰:?àÚI\”%ê` ’¸ŽõlŠ[¬1[à2H\`HÞ·¸<€-€‹¸> ØOQâ0Ù‘ÄÁy¬ÇЪ’Λ!е¨‹Ðé qA4`*Ö`-5D z‰ @ðCv—$.€Ði’¸ $Ø‚¡"q¦¢!xæ’NÃ8ÙÀÓ…Nk‰ ¢-ð%.ˆ&b•é•Ä˜¡±–DSK:Ry%.ˆä‡ì*J\€a‚•&˜RÔÁЄÄ蟼Øv`ñƒÅ&–9¢¶XGÄhòr3J\#l1ÊH\læõf¸ )ØO₤üÝd‰ @ãÐ)%qAÒëMC`\æõf”¸ Y…õ&–x¸MÖçõf¸ lqpQDlÓ”„q NÂzì$éöÓ§¯0ùžøÏéé7c¤¬üh8cj‚…a`ºÛÁûÖ¸}ëAÐãÄœI*[ïÉ“©©A‹SÐ-‰é/ÿ;/?Ì,‡áoÇêm­>a¿TŒ§ÜËË×Þâ³|Bƒs%˜m=ÒØd2;rð+ÍÿîÝ @¬¸Ä@ë%3ó%ÃdÜù݇Ó×~ó·¿|û0z÷túÇo¼Ào¾Òù¯›þšé/è/Ÿ)Lã<-£Èwù $ž÷ãérÄo,“º2 §§)mÉÃt%]ͧ[ô`Ïó¾éµ›t^¾—Ñ6¡¬znž¯´É˜&.m«å>²6óûäm¦Õ7ÿ<¿{súý»9øFô>L:IaEf7ðº/ËKðú0Åòö -L÷ÀLgÙ÷­‹yZedGØÆ®K|×­ Úz³úžæpø9C¼¶Ádcɯ É¥ŸFXÔÂ÷ ì \ÅäÎê lÇ÷ôè-«œÏ5â:ŸõþѲ‚Hæ:3(G>£ç:"÷å9"¯û”Çå’–«+*q–ùˆŠ†1¬¸‹Ü™çhˆ³×ýʵ9b4„­TÊbУ¦ôJÏ[«¾»ôàkxZ­ÜÓ"<¶ù…»#ä;ó•qÈ£rÚ•UØ.dß0»¿Ê(é¸r•ùÃë¼ñ-Ž›•®#q_žÃ!qÃG< güÂGÅ=³8{d½¥ûò¥;ýÆÒ‚Ä|¯8ïaÞ;uµPfðk[6ºY¾"§ôæ+G«5Cˆ’m2,ª=n}èmóü9®úRÔ-øöÕÛPF1©Û×ã;ó Å´ã¼×ç#&ûòõ=È]EãñÌy‡Æxæ­üø‚Ÿ…¿‹Œ?ìP=¦»¡ÜŠBoklDæºó(´G[·äöÊÓ;Ÿ‹Mú„~Ö¤¶žHîÌs8Ä^÷UMÜîÝ/‚¼a.é˜=÷ ï~4!ï»öø¡Äb‘»¸/ÏáøåýPו³@ÆóK ÌÆu[£ñæçÿ2"]ó󗉣&r[ÏÍwæ9"ÝÎøæµÝù;9aúõÛ½2óÕú'ŒB„»êúÆk~m w -z;>ÕÞwÇ>Èy‡šûŸeÏx¦_{vÜ4ú€ŽGÌkOór4Û 4¢Œ—×­’z>\ØŸ•tköÅ^õ§}¼ôê#`gœÒ±˜ãÞÕÊÎ<‡Cìÿ㔳‘µUÖ*wìÁ¼í+eñƽOwæ9B7¾‹s'ÔÞ`ßÙQØ=”yã×82d$zuû3yŽ†D¿áŠ7^0£s_‘Ù""ó¡C}Þ\v*O~ïb³™Ò¥×åHooçÈy‡ÌçÞšùfÂZrk5³»÷ýÔÃü·ÈËžötù»Öóu•Ñï>.<ÿС¼×tðQÅüeÃc–k߆Vkk¼¸†¾;öCîÌs8ôíÜÙéCî¡9–ŸÙ{!ë;ßVPxÇ7¶wæ9 -÷ù‰Ÿkí:_¨å3GVçêwY~Î~¨ŒÎpÇw·wæ9:à |Ç/Ê+Ÿpä¬ø¹‹g%]Ô»Ž,b1Õ‡n–æ:êt峌Á;¼Äy‡Áë^âØnqŠçÚ¹—f kÏâÙ}/.é6qÕG@;†Yàƒ¥[eێ帷X=K?ÇÕ–7¸ºFé# ýê¾ïîع3ÏáP¸ñ-l¶VéŸPÔçbJîmqõ¬×{¨ŽW×F]ùWŽÊéÑTëMÓü—º]çǨ¥=üÉ̵o’ºŽ¾Õ9;Þ¾“ggžÃ!uß)@cÏ +Ú­^Cqûïtó±.q=͉jòØúzúø{ò´Æ}»O4êŸeî#ªkÌ¿©#¾êV¦b^¡ÎG6cᬶN¦Ú—çh¨Œždºþ)o÷Lp¶C[èµU~ëãëýÓáž›®¬Söõü ïm+æ£×Ð]÷v:y08tŽsùä×ètdV˜m&Ù@ÕòØÃrxà9ÿô°ñ^üEæWŽØxL(…|Jg†É›?üée0ÉÛMÌûËæ.=žøÏp” ¦Pë/×y -ãD2¦·©2+D–É%wO!/5m -»”•ÓÓÓã©œÖ_~Dz¦Ïc9SÙ.Lõeæüù(pÑÏÊwSÝÌž± ÇîÁ•{XtåÇ“OœÕã©ãÊÇA›üZ’³§Áæ¾Iç|ÊmT–té:=6¶>¯ä_æò±¦šÞï¢ò‘ïù¸ßËË_ØÅ”þãØéN:ÑÛ?úË»Ô(Ž¦\4ñó)¿‹ƒ1aU²Sœ…ÓGUË"]VÙ#¸3 ©Oi]9+3shN+w“ó»’-Ÿ‘Jª$²ã)¡—Š!rz½ç»WƒžÄù}&q°Ó•¯¦8_l†°Hv­X™—öM›°/—¶Üª±ùPób.øíà26mSò™‰«œ´MéÐ’aqÁ Å%«05Ëfff@òJjÓgû‰w…Íu± æFäKÛtÔ¦Y^t‘wÁ’À¶ü‚LšWšföFß=¼^Üï“ɾŒ€,­Ô^¥Ï\Zo,K+áÉR;^úùesì9_”ÁÛZ¨–eÙسÕÉiC£¹4»àeÒزM ¯”ŠlVi™(*]@¦Š¬–ŠM~ÊVše¼ã(¶R¨>E“þÈ[Úñ^©èx¯øEÚ\n™ñª·d«ä8œC»;ÕRV_2 -2ÏsW)µ”¶È–uÓ¼î2ÛžÙmP3Ä7ÏTµln‘ò.þ»gì\òt‘)Uù£#:¶—9`¢&¬±ãû9UôBùK" —Üœçzüd%)ñ^ºc kUÐùM«² ÏP¤m+ª¼…UΖ”xK·5€j4§Ñ¡ñU{chr ÕË—ŠùÍš6;½1¿,(-†‹ê¾¾‡Yeüù*´² -endstream -endobj -694 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 693 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -695 0 obj -<< -/Filter /FlateDecode -/Length 3206 ->> -stream -xœí[Ë®·ÝÏWÌÚ€h>Š/Àð"@D@€àE…4–l£rùýœêi’Õ3çêå…¾º˜«á)6Y,VÙ¼áìñó"àW“àZëµÈùòþôáä]Íÿ¶‡Â&þŸšÏÁKu9ôÒòù½©ºÚs¬å|=á×]ÑV¿ž~üæôŸã3á]ï%†|þõ­Š$¹Újõ™ˆ:D>$"ÊÙÕs!¢†Ø;A\%Ê£¨B é-3Ô5¨‘¤†ô(êP#Ö L5BÏ•ˆ‚‡!zOePÄ‹¤Hd!»£&‹Á•Öc§² -Y¨‘ÉRr¥JÈɺ+¥äÆd]r÷É2tÉAÄ3t‘Ô*“è’JòT]b«‰É*t‰°N'²]à]Ê ‹/>0YO.÷&Be2ßj{”EŸ]n)y& Áeøf¢2D&©T"‹Ð¥øÜ© ºää#“%è"øa2ðDNµ5­Q£;ù˜,C—«PtÁä3ˆºøZ ‚œòã€X«“…‘@lÉI“ÆX ¶î¤ÖÄh öì¤ôÊx ùY Œ’‡.Y -c‚ ‹ r© º¤.Œ R„.¨À¸ %è%1.H`[·0.H [ñ=0.Hà[ñ¡0.H \¨é$0njE$P.\©3.HàÜîd\@º÷ʸ uS.‘qAí&i…qAï& žq€wS“T]àÀŒ ÀŽ.…–x7_xa`Vü°0.€¯¸Øšg\ àÝؼ0.ðn¬X¨¬:Ä`b\ àݘ1¶rƒwcö‘q€w£Ä¸ŽâÀ?žfà]PHæétÁ2.ÀzYLŒ И‹HKdðnèXþHLƒ­\h½0.ÈàÝÐ0}TÖ]¨°8‰[XÙ…R:ã‚ ÞÅB•dð.è³1.Ç;¬¨‘qA•šÉÀ»!vϸ ƒw‘7dÆp0.Àú悇ëRYw¾·Æ¸ ƒwAK‘qVa瘄ʪƒ#Æ c瑇2.(à],ïqAïúœã‚Þõ‚´‡Ê Kj‘qòȶ$¦‘¬:ÁLÞõ3Ìdà]ïkg\PÀ»ºl2.(UØ@A‡,82.(M\¯µ0.(ÝC†”ÊŠC93.¨@eQt‘*Œ X»žzc\P#tI12.¨º e`\€ŒÀõ€ì›n  Ü…îº Sd\&s­‹0.¨¹`?«2Y‰®UÐ5•5ÈBe\P«8,ÅqöR®!è€à¦KŒ  dAÔ]*Œ °¹‘™3Y€.H² Ó…,Æ-BdƒŒ ZlØeϸ+4ö’05“‰×}fc\Ф8M L°ÓSRtM0.Àüèf;3.Àæ›Mls¨ º¤,Œ Z‹ºÝlŒ Zƒ.ÑGÆðMÝoVÆÝCd|Œ º/NÓdÆ qȼg\ÐCÃ~3 -ãÄ¥î7ã‚ž<ö›Ø⑸í©è~³2.è]2R*ƒ.Hš:‰[pö›`'&+Ð%va\ÐKÑýfc\€4ûMdôôH é~³Òãðnî`&&ï"3-Œ PÀ~™-ÛÛ{o®Èϸ°éŽ³ÑêÍX[é‘÷bµªôÌÀƒ|uD  &v–­ÐS,«O <øù˜}û‹ïùçÿžÞ}³”õ¬A -šÆlÇŽÙ~‚A°=D^[ |Ü™ÞÁ 4=ê‚\Ë=¸Zlàåd`lKÁA=özılnºC^;jÝ z1#1ðõ„Ív¤wpΫîì΂²Ú]ðÉÕ kЫ«efßËéGLôÛƲ&H¥bYÓ C>à|ÁoÎGt.k_s°ºìg—¨¡ŽŽs©ÖɶSdf™õ5v´ã5V·ðæ²fŒ•ûPµ Ue¸#¬ÛçQßÀƒ-øèCGÖ4¼evt]!>Ô¸5ãC µïá\VÝÙ­êC]ƒ^]-ë0û^ž#÷w‰\MÕõßùñ aÙƒuæÞó€|2Èv3¶¾çàûƒ_Ñõüøå ‚Ï*lFl qðìçà{¾çàûÂà£Aöe)çùxÏ÷ ¼ÏO9÷ûzu‚fÛ¥üßʼn´íu€¾¥¯z¤y~õþôíË¿üí¯ÿøûÇWïNÿüNÃð øˆË{ŒÎûÜðÁÞSÞà£ßÃ^¾àƒú"«œãM®Ïn8¾Kýþ_çW/ŸÐGߪO}T…û.·&óÞüO¬»[ó¡ÃæÝ «ˆý²KRôAŒEßåÆÔFovÀ‡ëÀÞíƒÜýý‹ðÝ­çmpedz1F'FiÆmµ!onßïÛæFÝå{=m/—ýù½YgïcÓ}×u¶ïÆ—~S·²ôÏë¸æ³ù ¬-÷Öf½l,kdþþ·ËÅhߦ£ó—]“²«P}#<%˜~•öÑæró/mC-~zl§$=úÖëílÖz½ë–ÿQ=RôOéá—•·Y'aDtÓk6ÅK,´=BvŒmÚ7ܵßÍÌ=Êâ#l/»­üíÿ­nÚÛ‹{—]ë-*¿ìº¼ÝmïtiF¿Ñö˜—]5å£ö•{Xªºyö­íYŽ7Öï° Ð5Ö[Ä=&ï´c$ÙˆÙìão6Ùê˜9iírYÔ8Ÿ‘Å$÷ºÉ}ûäán6üó«ýhp»3鱜é{¸–C3ÇÊû©ãgTùøÁ$9„Þ{<²ÄreæMêPðFDôõªïLØj¥¡¤.1Ìq딦1ÝûnÚ˜—I‡»mS·‡´¼½ÕÓÙÚÜd7÷6ý†oËTY®5¾ß»ÀÖßëÝ•L¸ÚÏ&ìFîÓ;ÇǦòélïÿÂvÄ—æBÔK¢ç"à_}÷~ÖwŽÍ' cêÂfìp~âÉíjí‡Yk¿mëõŽ¾|½]Å5…½þ‡mÒßcuWÆz°ÝŒóÜâ(,øzÒ›‘B`‘µ¨|Vpÿêg[æ5°Ë)$ÍÀîj¦ìüþu-d)¯1Ñèóy<¦o¬@?q”4nO–ðëè½ ;¬·K›K{©LU¿÷ ®ÅÖ] ®? ‡ä ˜Aoº[p”¡OÐÛÓteSukº`¦ÔÕLçÇÀ 2È1Þ…^)ªwÚFSúX-–ŒR}¢yÔœ"sž¤)úø¦“9åfÖôfÀ lÑdÖë£.'Zoo-Ï™ª³V[öaù¥ÊrõÔ¦á v1É^Õëò&F|_°æ)s®}3~@lŸdFâ‚·mÙcí¼¸ÂçázL¦Ý 7¿üe¡Ø–í¦BhLß«êïUä‰*ól_‚L—Ò»«´:ÑØœðÑH/“u„Y H]u¹B­Óg­½B󤾒î¬=-v@É ^ûPOIj’ÇÓë&¬6ì3¹Ò‚~(+_ðÒ3ÏP…³ÎJ0îžg» .“;¯®sƃ^t™úÎvÏð²-lr«ë·ÑÉ‚£Ÿ«ÝêÌ€K1‚^7xDëd'½¼?¾® c+îåôËi[æbʱëÁ] -zoÓf^áü?Ôy‰Ï¿Orþû8È»­ãÑO¶ˆ“[°]Éô–ûLXoýp†£Ú_ph«nÞ0×ñ _ËzÜ/b5ÃdÐ0¥̈ŽÓucHÆ2ù#àåΊ3‘ù­s³ì[1Á¡›¤WL†V(Øá Ø–,­%ùlšDI«®%R‰æAl£(šûÒì ¦:¤ídš^õ;Iû2“Fh1-™¬eÖ6=°m¦ -Ràd ¶a ¶Ó~Ї(ýÕáõ›ç}W¹ŒPtRûD¯StGÓV,Çâ\sÒY #x—…f[ÉÄ^šIÎ -•ZÈ¡`}Ô m=¶WȶSØ¡Ó±PLºæ6[¬C§²?6̲¸Q+Õ™S,ôkélge1ÛY)uµÝ±âÍl)Í([w®kt~Õœ¹d#X±OOTVÍ4°Ç¾åØ÷XmÏf²)+3õë±üPó«øïkb‡³Zãg; m]­ÃB-¡¦˜¶¿–ô­pˆè…÷*Í—|ñ3_{±Ëö„ép’’¯Aÿî•«p… Z`šËëžéË ðäEú2#lø´½Ù‰f±êVQÿÎ1iÒÛôÏ3ªâå†é±Ë›ÃÊöóÝWó2 -endstream -endobj -696 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 695 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -697 0 obj -<< -/Filter /FlateDecode -/Length 3917 ->> -stream -xœí\K¯\· Þϯ˜u+’H½€À‹mQ£)ÀhEöÔNP\pºèßïGÍ‘Ä3ù/»p‹Ø÷zDêAQäGJGgÂÑãçEÀŸÊÁÕÚJæãéÃáãÁ»’<þõ»Bgÿ€ß’ŽÁsq)´\Óñƒ¨¸ÒR,ùxwÀŸ‹¢®~wøñ›Ã?÷mÂ1ºÖr éøË;a1¹RKñÉ`5°| ƒ•’+%¦l°rp˜bk b¤Â‘¯Ybp«ÉbA Ž±¬ -1ˆK kVƒ±¶X#´T Vð#DïMñÌ ^H.CéÙâÅàrm±™¼^(Ñâ¹\8¤`ñšË9§jñ²¤æƒÅK%foñ S-/CÊäMd‰µÅ+%B;ÍàUÈëª&²øìƒÅkäR«Ì&¯çk©×¼è“K•È[¼\‚m’ɃGa‘r1x²dŸšÉƒ,‰|´xY?8‘¨Ôjxkï&OÁâ%Èca“Y°øÄ Y|ÉÀƒœà’…±Ç-²±’ãÊÕBX›ãRÈ‚Ø’ãÜŠ…äx1X@@²$ÎP€, Ï5y…[X@² ‚…D%2YX@@[†µXX@€[ö-XX@À[ö![X@\ˆé-, .ÕÌ ¦Ô,, `.;-, €.ܽXX@@]J9ZX@€]âš-, à.qð0p—-Md[Xtt*YXÀÀ] -¾XXÀÀ]¸Q´°«ê`‡ÙÂØŠ‹µz ¸«g ¸ B€É+>H0p7&LÁŠÜÀݘ|´°€»‘c¶°†â€?ÞÌ€»€d§kaâ=x‘,,@g."-±° wCCø3|håBmÙ‚Ü Ëgòš 7üZv!çfaAî"P‘… ¸ ø¬ã"j´° w!R[<ànˆÍ[X€»È’…0XX€ø悇隼æ|«Õ‚Ü,E …¯@“W )XX0vy¨…¸‹ðÞ,,ÈÀ]Ÿˆ,,ÈÀ]ÏH{Ld¡-,@^ÜÖði$«ÎG …Åîú€¶xÀ]ïK³° w%lZX‹bµ°:dÁÑ‚\ÙµR²…¹yðò™¼ìPNBd™<ÈÂ…-,@bíµjaA‰…b´° DÈ‚”ÁÂd®dßæö²À\ÌýCdŠÉ\mÌ””±ƒV-^Ž®ÀµÉ«à…baA)슃…ØK¹ -§·°ï$]²°b€ØÂ‚Ò \Å„"W#2s‹ ’l é‚‚…5BdƒÔX±ËÌÞÂDhì%¡j‹Ç^ö™Õ‚ÊÙIªhaÜ;M ¥Éƒ,€ °>²ÙN`óƒÍ&¶9&²Pb j²Ý¬Ô -Y¢À6e¿Y,,h² ã³° ùì$M¶°0ž÷´P±ßŒlaüRö›Õ‚FûMlñ ¿m”e¿Y,,h YR“Y45ÃoIØo,^†,±±…-gÙoV f`¿‰ŒÞ<¨²ß,æqp75 “Åî"3Í €ý&2[koＩ ?³™UvœÕ<1ð€Þ„Øjx`/¢U1Ï <ÀWöHæ¡ÄÄβfóÔaÌàÍcüE>ÆW˜p>}ÒGTæP3k‘I6¸#»Ÿ{ŽUnT;ŸýòÓáÛ7¾ÇŸþuxÿM?)?bIœ0ÕŽ «ýá…`{ˆ¼6+òÈ™é™Ó£.À5_û©E'žŠŒ,èÄbïötìêj§«árÍ­¶’MQOj&Š|wÀf;Ò rJ³îNóêw‘×LîuMz µ´cé÷tø ýQ÷±´ P)kÒé.l/ønh!KYÚZê€à²]¢†ØaØ/5VZÖZ¯Zdkø;¥F=]¥tMXl*º£"·'ËîyÔŧ+â΄yoBšŽägË.HØ4LÈÛ&ä• UÔ¾$§¼¬e§‰Ú„²iB“º&½†ZÚ±ô{úê¸_Äq%S—ÇëÈjí¬9|°ò¦“i½iÝu¾¯Î÷+s¾,ÿÊñúÃœO ¬g¬±·ì¯Î÷Õù¾:ßÏt²§¥œ7ò«ã}u¼_™ã=%åĦÐgyPN£¥³¸Å»¾iÄG9|HÔÂØU>§Íý;Q9Z‰Ûq~°÷¥‚ë'¼7ì{}¤lÊúä6Ÿ]V¦ä¨d»qc3…|¨òƒÒ=jí¯…L!?^ȇ*F!¯¤~óú€ì·¾ðcÇ\ûó*¹FRäÌýøúÃáÛW¿ûÃïÿüVçõûÃ_¿“ÓZüüöëÞÇ÷Þ§è=¿Ù~O(ùüòoÇׯ¡æ±«¨¬?À?©„HU†ÜòòEønûÌÛˆõLKaû?oÿ:$ãz® gòüöL‡Î{Yè¼õ%“8K¼Õ9m4ðùýª;úæ²ÕÙúIò7Þû3!{:mmOK¾^ÎK¾!Oÿ\ž ­v©-ÿZQRJ¯Cª1›5§m´¼ “uÿ°A€7aôO›ÄI¤¯ç™Jáï×ýd’‡r1溟¡±.Oîš¹OŽoÉá×\ºÆÇüNg[û3d“ RÙsÌÍè»[ÖÕ™V´Eܲ†–Ð6Ú{ÕgÛäÝ|) ùë¢I]ßCÿ›LÂá>ý‘¯sŒ†ÜCO¿}ݱ‰&Ê;j$O­’çE¸9`ËÎ7¹|p1àÙì6€ë&½Õ6úýýF¤E)£PŒ~Óû—´F¹±“ó-©hœ¶‰uYí%¤¡¹Jè³_†å”éMñ;Çct-²O¯\¾gk›Ú5íógêO¦å)Ý3´/÷³ ¼\nÎôö²zÀAŠŸOû\#<®2àñ~;MM­Æ­±7”‘ !×ð—Îø(-¦Ü\ƒ7Þ¶—Ú÷§©‰£Õþ™Z”ÛDýRìCÞ>ô’ó -‚SÃƤ§‡¡ßq/Á·‡ øqm¾4/y ¹ZRŒX ó0º•[]ç.rY·Éµ¸‹A{ ºÃñwsq$ÆX0 G¶ù”­É#”3öŸ÷Ø‘ó…liÛßF“>Fï5xßߨ;äÜÈŸãË'xMK÷yÍôˆ²2á¾£Ô^ÓÖ­{M5<nÒ’ìc÷Þç1IÞÙà;òGAî#Ûü¯yŒ\1þ¿@ÞGl‰“\o9ÇöÀ™…:M˜©Þç9QØÑõžñ¹'YíáÛÚóíNÞmô­ÍJq·öZþmìtzüIƒÜ¨^jíV¡¥g&YIw¡A‘JN'È+… Ëg-÷žJddÌ´óáçJ\÷Ó5÷f“í<‡ûä(é–þSO%®ûž§[{™kï[Œs¬~ò0ÆnË¢,9ü8©hÚz/-÷–ÕÞ°Ø“ê{[—é5zÜ9Ö½zn—º¸ï$dô+ãhYtV§9z¾ZÎ1×±žÂóúðæù¡Ÿg‡ik;Ng€g?lwÿJÂD“¤*€ýPÕUÂX¬ò@¹¾x8©¯î©í4º”—~©#ÂE+rOöVxŽïÎÉí<†š"¦OySK;×v ÝL,7ËòÖ¯ÃÉt3©'VÒCü¶,ÝÔÚ™çÁ¡rý¼\¯»È¶DñͶì§ýÒÏþ“Ÿ‡zCž9µóüÎs¸ZʇÜï|‡þÞÏÕ…(/3Ãnå}‹£Ü3¯žx> ]Ùáx£eú㬵½aíå¥+¹p~ýZ¶úû¢¢³ËÃûÛ¾“±­O—仃¼ Ë™y‚ÈBÜ>úÙ‡Wí„lI»]ÔDþá·+øH~rþÓ˜´O£™ÜRÆ%Ž’øÁy`ƒˆ–9\“eöÞ…,oWG[)OQä€kW‡¬ë®WÃɼ"¦k¢WÃ-rä!O7P¦êò"Nѵê‚ZþQ7µœ÷O K—Ô;“*ï1Ž®†v£Ÿ4RBµIM£æ\žëdä¹ìñ…]3sòÕªÉÛ gb†Ä³^õ Òé`ÖÛzKs¥Ê¬UWÓ64¿DY¦Nu*Þ T‚Vä+”x÷dÉ%æZûªì&^O„¾"÷gñ×µÓ -Ÿ†éi"©~'¹úe/‹ZêP\sÐä.½ü=CEšTAžþ!ð4)yf•Ö ⛓¼W’¦ç‰:li pYu•ºB)Ófµ¾BõF}ÝY{jlGU*SôÒ†xR<öä0­n’†~&Vj¢B`¸ENÓ”ïvä%gš®šü,eîiö»Èybç&—¹âA^nšòÎ~•Íâ©6¾$‹é×1È"G?£ÝL—`…E^0z×ÉÃ[':É6ŒËɬˆ{:ü|èa.RŠr„š)È»º:ó -Ç£Î+üþãÀÇïÇ%’s~¢EœØº#ëH&ßìPI–ozÄé6ŠYÁþ"‡ºê¦a 3ŽÇ¨ðšWs¿€}Ô AÃäjbZ:Tä8M7RšI÷OZœ‰Ì§®Í -Øç"ÉÉó8y­hH…‚žŠuñh…ä£ê%©ºB:¸UCt§(ªÛ’l'¦¤dª^äg½$c©‚J#¤H‹Ç+Ìê®­ÏBUA -Lº ;æ m;y ¡Ÿí^Ÿ¼î›Èyx€P'´Oê¦Î‰ užM¥^ÌûâŒ9ÔŸ ç]š}‘ò=šIÎr•Zð® mTQëj¶UHzP´Ý #PL¸ÍÚì± ™òÖl¨¥Ï¸šZ*3§XÔŸµ¦“^•©Ä¤W%_Õ•~GÄ›ÙÍ(is.kv~Õœ¹d5hY·žT^5iЮÇæýØ#ÚÕ4x ’WfêW³tUóYø÷ß1oœYµÆO? u½N‰@Í¡P¤þ Y¾æ aù’ƒÂU—<¹ÍsßæÓ#a9ùä»ÎlîÀh3TWã{ÐìfÍ›Szšn¾—jÞ ýËnúÈ~H4‹E¶ŠòÝV$Io•¯ä(þÆ}A9’c—Óî¥ÿü©0 -endstream -endobj -698 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 697 0 R -/Resources 4 0 R -/Annots [ 699 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -699 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 593.554475 101.433071 574.804475 ] -/BS << -/W 0 ->> -/Dest (cb190-1) ->> -endobj -700 0 obj -<< -/Filter /FlateDecode -/Length 4143 ->> -stream -xœí\K·¾Ï¯˜sÑE²ø $A„8ˆ!>9¬&’`@Î!?_±›î®™}H¶cK^¯vºŠb=¾*rºÛž ?/,þÉlMÎ%E>_ÞޟȤ@ø¯¶Ø\Tö7øMál‰“ ¶ÄÎï„à“I%¸Ï÷'ü³»œ›ßŸ¾ýÝéßÛ>öìL)ÑÙpþñ°Ø›”S¢ ° -Xd½Â -Á¤äBTXÑ,±1BbÇGV‚\rÐXƒË -+C ÏÉú#«@ —,k,ˆaKH -Ëä°ŽHåAböNáÙ`"”5ž³&æâŠÊKàÙä4ž÷&&¶Áj¼bbŒ!k<†,¡Õx²ËL²°ÏIãEÈâ£'•Y\N^ã%Èâ ¢ð2dwe•Y(’ÕxÅ›P2³Ê+àQNùÈsLÈޓƳÖø¦Wyˆ()&…ç K¤PTd žœÆó…ñ£ñ€Á§œ•huÝž¼Õx²8—XåA_C! ¥¨A"È.iàR2\k à²7œ9k(àr1œ’×`À•`8–¤á€' ž³x‚,£†ÞBFäª<Èâ kXàdA ¼‡,Ž½†hËð <à–©X <ð–ÉF <b’†ˆësd < ®T4,ðÀ\ìÔ°ÀtîIÃÔõ!: <`×sŽxà®gK0p×{ôTy¬aÐÑx›½† Üõ–’† ÜE9 `U?ŒÀWŒË™4,`à®ËÄ0p×%¤•— bÐkXÀÀ]°-sw] §aw»¨aÅH­€»€ —«aò=xÎkX€ÁŒCY¢aAîÚ‚ô§Ä4ÐÊØ\¢†¸k3̧òŠ± WâZ66Æ¢aAî"Qy pð™5,ÆdT§aAîZL­ñ€»ÖÒ° wQ7 àƢаùÍX‚몼b¨ä¬aAî–œ†Ȇ2Då%G²Œ ¡Õ° w‘Þ‹†¸KÁ{ "p—eʃ,>; P×€‡°UbŪ!¤ÐxÀ]²°°ÆaAîJÚÔ° &!¸¬a4¨‚†1³))E b!ðPò©¼hp4,HBd©<ȉ5,@amŠ/YÃ‚ä ‹wNÂä J P˜bQ}«ÛÈwQ÷ YP)jX$3¹0kXBÄ~ ZÕxÑ™œ×*/ƒg“†)±A*¶`/e2‚^ü‘rIÈže R, ŠLv¨Ì5ž…,(²5,@¥ žµdYP jX]Æ.3’†ÈÐØKBÕIö™YÂÌÑH©¨aÂ;M ¥Êƒ,€ `Ùl °ùÁfÛ•Y|` rv²ÝÌä Y9 à›²ßL‚,¨ø4,(”ÉÆÁ#Ò° ØŒý¦c —²ßÌOØob‹§ÄmñQö›IÂÂ% DQyESQ☄ý&ÐIãEÈâ -kXPb”ýfÖ°eö›¨èÕ#,ûͤwC2i<à.*Ó¨a.°ßDe«íí Àê3™eÇ™ÕôäVõÈ€€½ÈVI=3 €¯ì‘ÔCˆ‰eŽê©Ò*˜–Ôcþ¢ã&,§OóU„;$äÌœd‘aÁ¨îûžc4óWš-çc?~úâÉ÷üýNoWOÊÚøF LÃÚ®ÀÚïNP¶‡¨kãD¾9£2Ý‘=`ºµ¸Æ=±žZTâå4‘±-:XñØû-»Á\éÓt¨k[ëI¶‰z™V2‘ïOØ,`Gº#‡0Úöéf"qy¬ä~¢ŽE©†v4ý^NßÂÐïç1†6* iM‚õ …óYªÎ.bËT†­-²Ëzv‰âˆvkk˜ZŒ=›h²²6ÿý¤Çy½“ÖgruÙiI÷¡4”á¶dÙ>·¶øt n|h·>4ÓQ55oéÓYÉ+Še݇òäC­÷äGÛ>ÝLœ}(ª>Ô©cÑcª¡M¿—Ï‘û‹D®”êòßùøAAÙvúÞéy5È6z›tÿ9ø>ß'|QþKçã‡'ß,ð´âYÏþ|Ÿƒïsð=1øÔ {ZÉy% ?ÞçÀûÄï)%'6…Æs”oÊY&Ã"n"S7\oÉ™rl»Êçô¹½•³u¸œû}_j½5õ¨‚7ó‹}/9UYŸÜç£Ëä ÎÙ˜Oóº¢ -ùPã¥{”í«ÇÞ߿:A9õŽ*ü-l˜sý.HnÑHrž}~õîôÅË?þùOû õöôÝ—DÂ@P²,ßÉàÿ;¢àðˆø ~óò¹òìÂã$ô¯þq~õòÊœrÛDŸS¦qqCpÁï¿2Õ:<H!-ôÖN¦t­íÛU”¸Lk  ßöb\Nþí\”/ñÏMŠy±ó¢]þê…ýRf]ÿÆõo£‡evi[¥|½Ð›ÔúÚVØÆàuŒ¾’Ö/Ž>2Oh+ŽÓ8;-Ô~~êC«æâVþE›úÚ긼[Û,Kz‚¦y¯iY]›YF¶eÕ~[µš­×´¥u‰B·ûÂK+mÕP÷™2úÐkX”'ëM²TM5_Ë‹+Óe]i\—7kæs¡û²ï2-þ+V‘ñì?ãD/ߧÈ=;Çqºy+Þ’Ã;º&µT½(±¤È&÷nEb‹2v ÷°Æ§=|òÊÉ£ëßÔ-ï×ÚüU]Ö¿ièž.=/òU9_¯mn@mØ@í‚V [Ÿ6nx½®Vjúy;ì!s.16t½I¹·³!“ô±î¦ÎâAgWô#óÉØ×øuÞ7k,)()ko~¢!¤µcŽŠì²RÆä¥]ÓN~ZsÒ͵–¸[ë‚/#ææøÿëZø^» ÍûâåËØàq…‹|A…Rœ+N¥ÄSû<«ÞY+ -Àz1‘“oRÉ*™x_VXn³.ªé—Ö‡.¯|Ñi½óK•ñ——ÿë×s•!&-)µ„ÔÜb¥¿^Mpu:XŠÜQ³›n¬e”jøžâð÷ö˜Î“Ü°ÿÐƼÒ -ø´9×4¹+Ò4o“%ïhnê×Ɖƒ×ǺÇíýh½NÏë7®•&ÛvüvׯÍcç¡%ëõo™tµk³h›ûJ°ì¤#[”ÑÄÆYÎÌÉãúüÒA2äΊ‹z°ëŠyxkþnV;T?ª¾ÅuíÅ}_Of´ï>|ýã–ü÷h.{ÙÍwôIîÆ«õfrü´¡tÅ=åÆ4[·v^îõ„²Óƒþ¸>ÿ?±>G§cø¯a~¾PâI&ºë®Ówç¢yµ¢.›QRwån-ëÚ&§’©•oú6äXæË-÷EnnÝMZ!çJÉ"÷í®®+Ua)>äîìó!‡ ?Eåb¾åõRü Fw“íúw0µSßø6™ÂΣÑc×¾ªo>bo/·*‡Pä‘”‡ÎêßÐäü•«4}ßmeïãŒjuµÝ¥u¼Ëlà Ózê>\‰~6Àw«ÞºœÝ?$š¯ó>þÁHLVN;'4yÞÁÈqœù¬±É^ån&o'[òêÕ†·äM”®ÉûÁ(DZ?­”äöëÿM ¬6ê2†•æöñ·õÝÛ)‰÷ºÛÂ\×Û¯ê`åH‡zÀ” Ò²K\­x¡uG¾¢ÂŒz¯m\ÍqjÛÐ}úJâj¤4OÙÔ¿[įm“í>êáýã5œi¯á›9jéç>¼÷­®âiåyÐÄ*·s“<A!7ÇyÚ¡½<ûpEŽÎ9DZ?­œSh¿þßdΡ1æµCû?+ÜÎ5ÅíuÖk©°ŽÕll‡ mv·n»ÒªŽîú­q¥äžÔ¥k¾ØçõËâ›ë -y·®è¿YŸŒHá,_ÖË“i9Ø<=hÑ·¸6y`G{|,£Ýfp¸‰{\€!å•(>c?-|’§ˆ´-˜„¼{³ØÕÅäûvI’~M˜â"=‰®‰Ó…a²ÙÝzby³º­ÐÒÂþíb¡»ƒ¼ÆoÍê|ë÷ýÕœi„Yÿ†ëõ5„¶†ƒ)ߟb}"ÎÖ§¢I¶õN^›rŽl¼Ø¦œå)¼Lžm3­Ê¶ç+=ëËfÞ÷VëûgHI—Ç——ÓLkû÷Õèï‘ÙÄ–ƒë»"¨’ÜaO¾?É»BX!3DþYˆëGêc±íuA£]NÖË=I»–>Z?ŽâANJ–.´ÕHÿкÉ3\L­‘¯O1-+DôŒöH–Õ“±+YÞ·’_¯b%Ä&3ˆc@žÛŽGÇÉ(l'b8išn7y¬<ŸÛU±‹>«ÎNæom±r"^N˜Öï©÷*UÞòІjÚuÔi~ªtjh-»A¸ÛI!ÉMkâ jC3ŒÙù“ÕäYÙ…˜›#qoWZ;…t9©íÖÑB·Tê­òèZšæ‡(ÃÕ}îŠWh—©ÀNò©)FÈ·[²ÔkÝÖ”'¿qâå„Ãr½QñØ: ¬ Ð\o&úiÜNÎ4üePSnªBh6šŽ Ó2îåôé¦9烓/Ò¢·ò&“¹ò²çÿ¢ÍKüþëÄç¯Û¶KwÔÑÂulÝçL&ï½Ê$Ë{°±‡ÍDt<Áþ Û<Ú†æ =;7á5î4€½µ´AmçÎÄ0t8‘]w]gý¤™pƒxÙi±2j›‘°—Kß'7wÈC×M*\ÌËÁeÏ}ÕÁ<ÌaØ{JVÞ«‹pFy˜1 ÕÞ«w+¤.éi -¸úÖõ [_Xo‹¨‡DýR¾€sòæO/Eo––%ºòÄ·os6G(õçÉÐy -endstream -endobj -701 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 700 0 R -/Resources 4 0 R -/Annots [ 702 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -702 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 527.554475 101.433071 508.804475 ] -/BS << -/W 0 ->> -/Dest (cb193-1) ->> -endobj -703 0 obj -<< -/Filter /FlateDecode -/Length 4059 ->> -stream -xœí\KoǾï¯Øs·«»«_@àC€$ˆ1 $‡ j#Ú¨rùûùj¦_3[Ü]R”D;Aq§ªÕÕÕ_=vfì‘ðó•Å™­É¹¤ÈÇÓûÇ™ÿ–›‹…ý=~S8Zâd‚-1‡ã{!ødR .ÅãÃÿí.ç懿þêð¯m{t¦”èl8þôNXìMÊ)QPX,²^a…`Rr!*¬h –XŠÆ‚!±ãsV‚\rÐXƒË -+C ÏÉúsV.YÖXÖ–%Èa‘ʃ Äì³ÁD(=j; ×€‡c«œi«†BãwÉb‡5p—( "pWܦ†1 Áe  Aì4,ˆ™MI)jX ‡OåEƒë aA" KåAN¬akS|É$Y¼s$Y2hX€ˆÀ‹è[M ÌEͲ RÔ°HfraÖ° …ˆ| ZÕxÑ™œ×*/ƒg“†)±+¶ —2‡^ü‘pIÈže R,8*À™ì™k< YdkX€H£·¶¾ZÒî¬ o{Ö&¬g¬ž/?]ßOó´>w»¾Í’G[Ïæ*Û2Þi>£óY›â†[TŸfÕ/]’Ñ^ä\<Γ~ôVþL·ÛÝig’Ngçq’-žÍyÔ#¥qNçq¢—o•äÎ¥óqÚN/²ÅEƒ—äþ19hàͲÃÕº–ª Œ"›ÜÁ‰],ÊØ-"\0ÍΖ:¬§[ß}§YZ¬×Te㊉Ӿ,}ëºg¬lòªó)Üæ–9µu1/ê6í×Úõ$¬^éSô¼Üž{ºAö\í-®ô¥Í]íZ\3Íeëºê<¶Ž Xí}Ú¸‚ËÚ©ÚSÓÏýØ™³íQ—1TšÛŸ§A“v-~zDwåLwÕß…ŸÝ×} -–›l"=…™_õ1b¼ß5/>goÃü®³e˜4E#2þ¥uÊ DÛu:®c6›Kûê‚açå¹#ÌËWuלõ}¾t¢Æ·OEnv¤×‘^º`ºîe*¦Ê˜Ÿªdú3Nœ`ô&戸öˆÍ’™_Kçoìó¥yÈ[äþ!ì’{•Óç,Šú¼úùìëf)˜ÂËW`7çï7öy5f‹ikúùÿâ§â™å–KD±6ûÏXüÜNz)Mê5“ br”ÜtÙLoëóÚõDö’µ.ÅϽ5íJ:kz¹Íg/M}‰…Ðdí“ôÆ>¯ÄB‡Ø.^²Ð/‡¯¸šbº„²/_ÝNx aå^èj‹ÙHåšùÞÔå•XoÇ×Lé–hàÙØúÜò©Ütr‘Ao*Ÿö|èÓ•P%˜]Úç–Kµ~÷ÃÆ­}|œóbÕíåÐœfU.»ÚÊâÝð  ¦ÄiÿÊJwÿ&\ך,óÝÕ-9³±ÿ‚Íõ5„¶†³­üpˆËã`vy$˜b6ÖÉ;CŽ‘—½)Gy-“gÛ¶Î.ʶÇGz.oZùÐ[Õ—¯<-Ïâ­of™.jû˦¿‡›g›c_^”@ fØ“ò¢ VÈÌ#:¸BbýH},¶=Øh´"àdʾ%âKªGD"AçúÑ…¶éZ7y€‰©5òË#<ëÄ -=£='ËêÉØJ–—dãëU좄Ødq ÈsÛ1àèx•l=MÄpN¤iºAvÜä±r[MW]Ä.ú¬:;mkëÒ´—ˆ§¦õ{êƒJ•W´¡švušŸ„*Z˾!Ü÷I! -ñ+jC36³ó§]“EWbn†Ä½]iíÒé ¶«£…¾S©·Ê£kiš¢ S÷¹+^¡¦¨=ÉÛ“¦3B¾}Ü’%Pë{My²wF<àbøŒüpIiVH!ûœè§q;9Ó°—AM¹© -G³Ñä1;ù…ŠÐ©‚<ËËݤäÖ¡q5&‘³ÙÉ[%ÍôØQ‡5 XN£í¤.›R·ÙY_6“Ò^@··îÛP'•MôTšxR<¶dÛ­®“š~:VÎDjB`ºAÝ”6ä!gèG5PŸ,ÚÉÜCwcÇ·™œúŽ[yî¹ËÛÇl¾O‹cã=YL?·IÙQ÷vc²‰8( ò€Ñ‡…ÜNkG'y—Sû8™æqO‡‹›s>8ù®&z+¯ñ˜#/{üÚ|‹ßøø]{ntõãŽ:Z¸Ž­òìÉä¥OùF²¼ªû±™ˆŽ'Ød›GÛЬ¡ûqç&¼æÑ°·–¶#¨íÜ™†'²ë¦ë¬Ÿ4.O;-ö@æc÷f8ìõÒ·ÅÉ÷ùòÄq“ -órp™Ï—|œ†Ä•4.\vSG\̃ârš° É6bŠAΓtÕ‹ü7oçnÞö8-ƒ‡ qD¦4º…³–Ï¿眵Ϯ¡µj?KuÄæñ¦8j¶É;¿¼<“rŒÀ–÷%ÎS¹äÉ}.×OΫ$­~2Ï„í0ì=%+¯AÕEx£\gLCµW¤êÝ -©Kzš”òЀ9:«-ïÁ[¾aZŠDý2Iª(¯½ôôfy[W"« ÃíwSBY~þ }/n¹ -endstream -endobj -704 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 703 0 R -/Resources 4 0 R -/Annots [ 705 0 R 706 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -705 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb195-1) ->> -endobj -706 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 427.781993 101.433071 409.031993 ] -/BS << -/W 0 ->> -/Dest (cb198-1) ->> -endobj -707 0 obj -<< -/Filter /FlateDecode -/Length 4164 ->> -stream -xœí\K·¾Ï¯˜³ÓE²ø$A„8ˆ!99¬ÆZÁ*€œCþ~¾b7ÝS;3»ZÙ‹$ZìjºŠb±øÕcºÛ ?_[üÉlMÎ%E>ž>>Ȥ@øW[l.*û{ü¦p´ÄÉ[bÇBðɤ\ŠÇ‡þì.ç懿}uøç¶=:SJt6þ ,ö&å”((¬Y¯°B0)¹V´K,EcAŒØñ9+A .9h,ˆÁÎe…•!†çdý9«@ —,k,ˆaKH -Ëä°ŽHåAböNáÙ`"”5ž³&æâŠÊKàÙä4ž÷&&¶Áj¼bbŒ!k<†,¡Õx²ËL²°ÏIãEÈâ£'•Y\N^ã%Èâ ¢ð2due•Y(’ÕxÅ›P2³Ê+àQNùœç(˜½'g­ °M¯òp¢°I1)<Y"…¢ò Kðä4ž‡,Œœ>嬜V'§Û“·/@ç«<È‚Í×ÀEÈB)j€d—4 p).Ž5pÙÎœ5p¹NÉk0àJ0KÒpÀ“ÏY ­j¼èLN€k•—Á³I”ØÀ[ K™ŒC¯aÞH¸¤aÄϲ†©@ àŠLvˆÌ5ž…,²5,@¤ žµdY jX]F–IÃxhä’PµÆc’<3kX9 5,À1A¦ ¤Ty0¡aöG’í a’$›HsTdñ5,ÈÙIº™5,Ȳ8rÀ6%ßL‚,ˆø4,(„ÉÆÁ#Ò° ØŒ|Ó±†8—’of Š'ä›Hñ”s[|”|3iXP²„(*² h*ʹ&!ß:i¼Y\a JŒ’of f ßDD¯–²ä›I-wC2i<à."Ó¨a.o"²Õr{ð†„øLgfÉ8³Z1 @o€oUKì…·JjÍ€¾’#©Eˆ‰Ì2Gµj· -¦%µl@À_Äc|† Kõi.QE˜C‚ÏÌIYp,Ñ}Ï9F3ÿH³¥>öó‡oîà|?þëpÿU­”µ ã÷%±rD\Áv®LŽk1 ñ;ÎùžÑEDHeˆhŠkÉMD„#†³-ÇþÁn†¼"±E(S×Åó´È,6ÊGUÒ§vyqIq²×S)ež×UÆk¯JçåßñüÃ!£›…¼Öøe…œL h›×yo6ÏÛú¼¼}NóÞl ·õyqY£œ ¸¿nØük¿”…&`ÝÍB^kü¥,9Ú2ï°6$׈)%€×,ôÆ>/¾ë󼳎Îe}rŸ—’Õw£sR~Aò[+F^\9"J@%×/€&QŸØå%$%ã$—Šhå‹“Øä›Æ¿}{@²N¿|ÃÕ/­Ýt£aèÖÑñíÇÃ7zó×?÷=¦}{x÷¨ŽËûµÅg>-ÿ»ÐC\éï¿ýûñí› ³!Ê¢"%ˆíl2ùeŒI¼Xi—‡tv‘geÈ»!+—1EH+-¯×qK߈’w4Y/Æb^û„Açû­~xâµv½ŸËä÷“,ZŸƒoÃ:×:ßM}íXƒuË^üîíÖ:³|=L„K@(hYÂï‹}[—gô ÚqA7Ò´„ÌX5dQfÈÛ j -옷aí•~ܴ̀¹e2l’ý àûíæuþÎ »Ñh·´àwkXe ´;¼qû§Okh<':ÎCŽÏ; ºaŠcJ±Æ òEˆuv K/Yæ}^iJE-CµV5Í_#^Çq˜yt×Í£ç¢Ý¸ª5§ÆÆl(cÓSÕç›ßÿñ™ôé`²á½ ‘Mä’5¬Ÿ“Ì/_–.×AxB¿¯ë\œÎ˜ÔÉ÷„E*ò»I«oüá“›[ÌÓ‘—ú¬‹ñšIßÖçsâÈ/<8J—,[<±•2WZ~åºïþh`/¾@>»»×f¾˜f†ipý¢öa,%¾nš·õy=¦YäÆÌÖÄøÌ4ÿÛËNÑGƒhÕfÿ –¶“^*ȽŽ«9yÊè”êíS—¿´º­Ïk+Ä/Y¢øÎ^8KÒV«úáz›_²\õ2ò>Áš“M—¬ùåË\Û /Y2p°Yev F¹bÈ·uymvŒÓvÉŽ?Û&ž[ÂÊrç[.ò(ÙM%¬5ñþR%,Ž#Ak vOžæÄ»µß_Úx]7a$NuŒL›â–è7T¯2m -J£¸8{¡‰wsÑKîÝŠ×t3ëí†ÂÕ¦ôí·ë®×´ÓE;luQÇ CϽ¸QF)¦xšöÑn÷¼áÃå"W–ûE7Øð¼"×ù8­ÐÑôx¹“K|LØ÷¼"×ùØ7¹Ö‚KµÅ©ÐUçµ4Ê´WŠ^‹Ìû?­Eæ8=>ÿYùVÕ]±ûõégfùõ&×­€ÕÊÆ{9z;Ò(èÌŘÆãõ³V¬k…¨iýççåâƒÛ­ñ)Řz³•{êÃX7Ý…qcŸ_;Iè.­È“ÞÊ“ÔªK»”^)ÁÈÍj6ïv“\,Á¬9åËÜÂ@/^ -p¾í·@¬2VÓÛýÖõØN•Œ°>ìÉy±+dæ]]! qýH},¶=Xk´`9™²o è£õãˆè—.´ÕHÿкÉ'L­‘¯\,+DôŒöœ,«'cW²¼"¿^Å.JˆMfÇ€<·ŽŽWÉÖÓD çDš¦dÇM+vÕÅAì¢Ïª³Óö·¶.MÛy‰x:`Z¿§>¨Ty$½ Õ´ë¨Óü$TéÔÐZö á¾O -étPˆ_Sš±™?íš<Ø·s3$îíJk§NµÝ:Zè;•z«<º–¦ù!Ê0uŸ»âÚiÊz’¼íf:#äÛÇ-Y‚æ¾×R”Z·`ÝA<ê]{òÃ!$¥uXA¡™ÞLôÓ¸œiØË ",[U…£ÙhòX”ü] "tª Oý`¹›”ÔÙÆÕ˜DÎf'o•4ÓcGÖ4`9¶“ºlJÝfg}ÙLJ{ÝÞºklCT6ÑSiâ HuðØ’m·ºNkúéX9© é9tS~؇œ¡Õ@}²h's}ÜAŽ;frê;nå9Õ.ow²ùF> -endobj -709 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb201-1) ->> -endobj -710 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 446.531993 101.433071 427.781993 ] -/BS << -/W 0 ->> -/Dest (cb204-1) ->> -endobj -711 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 110.390928 101.433071 91.640928 ] -/BS << -/W 0 ->> -/Dest (cb207-1) ->> -endobj -712 0 obj -<< -/Filter /FlateDecode -/Length 4039 ->> -stream -xœå\K·¾Ï¯˜³Ñ|É"`ø bÄA ÉÁÈa5–l«rùûùª›¯ž®yìj% °«®â£X,~õèîqG‹ŸWÿ19Ã\r¢ãéýáÃÁš-þ--6 ûüæxt–²‰®$ŽÇ÷BÙä}NÇÇþ;»œ›?þùÕá?Û>îèM)É»xüõ­°(˜Ì9Û¨° -XÖ…£ÉÙǤ°’3Xb) bÄLžö¬ 1¨pÔXƒ¼g…Å#PvaÏ*ÃgG b¸³Ârr8o­Êƒ –(x…ç¢IPzÒxÞ™ÄÅ•—ÁsÙk¼LÊä¢ÓxŤ”"k<‚,±X§ñ"d‰ŽÈj<ÈB³ÆK%¤`UdñœƒÆËÅC;Eá1du±Êƒ,6Y§ñJ0±0‘Ê+àYμçyMä¬ÆsÎDØfPy8Qؤ”ž‡,ÉÆ¢ò K Ök¼Y?8CfVN«—Ólp/Bï3©<È‚Í×À'ÈbsÒ 'È.iàs6Tè¼lpƒ†ÜõKÐ<7p×Gë5, à®'Ÿ4,€¡àU£à. $êádÀjXž`0ã–hX»®Àý)ghe—¤aAî:Æö©¼b\†Æ•s -—RÑ° wᨂ†¸ ød €ñÕkX».ÀSk<à®óÅjX»ˆ¢†0ãhXÿfœ…骼blaÖ° wK^ÃxacH¢ò²!9 ÆÆ"Õ° wáÞ‹† ¸kc$à®%„=*²ö ®ÇV9ÓVõ@ -ܵ;¬ñ€»Öæ¢aAîŠÛÔ° e!xÖ°DÁ^ÂÄdJÎIÂT,xùT^2¸Žd Bd©<ÈB™4,@`mJ(¬aAö%x¯aAö!ƒ†ˆLqˆ¾Õô²À\Ôü€ "E €d† ‘†9&äcЪÆKÞp\«<Ïe r&Wì4,@.e‡^ü‘pIÈž# r,8*ÀöˆÌ5žƒ,²5,@¤ žs°‡,ˆ5,`ÏÈ2“Õ°¹$T­ñÈJžÉ0%#¡¢†8&È4”*²&4,ÀþH²5,@òƒdiŽÊƒ,!’†Ì^ÒMÖ°€²xë5,€mJ¾™5,(² âÓ° Ød$LÖ°0žµÇÈ7=iX€s)ù&kXP‚E¾‰O9·%$É7³†… KDˆ¢ò ‚¦¢œ[`òM “ÆKÅÒ° ¤$ù&kX€0ù&"zµ$À’ofµ\ÜȤñ€»ˆL“†¸@¾‰ÈVËí-€7fÄg:“%ãdµb`½¾U-X`/¼UVkà+9’Z4€˜È,9©U¸U0UËø‹xŒv˜°VŸæU‚9døLβȂcAˆî{Î1š… ÍÖúد?¾~€ó=þüßû¯–JYûq0þ@Ik¤gFÊ.Øoà•YÆ£¥š„G$„€Ïé#Bä2„t€ÅZt!áŠán˱p[‘!±ÈìÌ,+£Í¼Hö*$UÖ'÷yqYƒÔtØ–Ræy}Q…¼Õø¦tAþ÷nIpîw y«ñË -9¬ ÈÈz÷^ ½³Ï‹ïú<ï½zgŸ—•ådÀr¼cóo5þT*îön!o5~A!÷û‡×¤kÞöû¯Æål™Á ðuž¯ß¾þîOùóßÀ^½~wøñD# bÃ{Õ¿o¾}徑 ®×ÏÑÕ¿©þmôh-ñÚFo©ö…n–뽶%£ô¿§•ÖÇÏŸ×ñ—þÒ®Ô¿iŒßÇ£I¦i¾è'9OÓX<Ö²ôoc‹Lüí¿Ž¯¿»K³eÖìó„[ÅõÅÔI»BD¨P…8m…êmy«Ì6Çr§9ýP€ûé2OúÙ7ØÜ3¥õ6v«`’>§ª”Tµ‘f5Èy D¢QªBlJ–9VÅ®ríÇIA¢þ¥²¼gYcÛà´èäš)_’ÃŽµ,ÝÖ':÷²Oªlr‡!Yò©(c‹l2~äµÿ0öÉ0Ë:þbXïê\u^ô¡‡að ÏNúwU÷}ßëg[ÇœF<éó·ù–±º Ö6“í-ã•«ºåóõŸÏ%*ßýá®{ßxT?oÝ ->ýð¿ÙÊ>l½þnl¼®‰½ë¬îÏÂóÍþ¯­Snm×¹ž“¡ïÙŽÿøzqa„~rÛÒÀ±"ôŽ˜`×ldÑÀŽÉ…<µÏ³œqõÆKë5¡xÉ[‘ŒØ–vî„Ú¬«jú¥ ±Ë+·áì¼]üÉ_¿ûÇß¾Ÿý‰˜RlðÖ`p¥Oð·nÁÅé¢Ù"õ˳éÖƒ·Ž²TCü½>¦GªÌYkc> iÅ0Û17>ó€yš·ÉÂg4Y±95/4èôn«!šx­]ïçÆ:×·¯÷y;ø.Ö¹ê86½¯kXÚ´ñÏåÒÚÛ ÆŸÉ¤Âf¥,ȼ”¸®ÿ}}~kãò2K-”šñw5V•»iëÚu5¾UÌìÍVåfvÝ443L[}¸â"þú‡ß±‰–bJZŸ×ÇÃ- ½«Ëc TÇP†{Q]u5¨‡®Üž“ˆtª?•ä8Òs5ûðâ˜ßÔ k 4žáR0¹Öäö~‘ig“.^é‚ÃÆÁh»,ŸòR~¾jwöù˜ÔïSøíPâ5ËØ-`—6T‹øév;ÁK÷ÿgÔ씂tx·mÛÆiϘçeä}‚5SH׬¹[j®iA¡w·æ²†À‹ó”oΖL¦”ˆ`ålÂk–LÉ5«d¢Å(7 ù¾._šSN×ìø£mBµ†;ŠQ'„§rt_åô‰k,o§³UÇh©Vë7§l]­dÑÒ³MŠz¹ÍFÞMz½í³¯·TÚ¼®Ô£ù{O³âSºkí¦´ÒsE¶§–_\©ûÚøS½i¤êÊ>vÖìÎöU÷€§šÕ>/[²‰¹Èó­®<¯d³çi%›$Ïçêrر–ç•löcÎ’ìW¬ú<ï»›35íÎV›ÔuÎ×ÛäßÔL'ýµ²#U»i¥šM½uò]mÚ´2ÉzŽ†].å¦ÓXóR汶—³´35R”õŒ¸¶7§×ÖÔbÒrÅ™ÿv¥­)ÇU=ÆÉÖÔdèh‘ãm]³‚¯Kd}ÎW÷ùª,ÅÉò”rT–Ãàƒ<Õ#A¹;}+º½³Ïoðôp g˜‚·zFþÒå¨ít/SŽRÆü]—£.3yy, ñó‘ÊÄ¥Pz˘ïëó[ó7f#b[¯gnk -} yk‡.ôk&ä§í²}Ù¦ÏUªŠçùa‹Ó­žOŽXn¿†Æ[âEr|Üq¸`š‰£å.°<ØPT¨7Ló¾>_Ži"E ˜¶¦¾—Ò®ÏZüŽÃ³ c,7šàÞ9|ÆÂØvÒkå¦ÒÌÓÛ Ïû”n˜ô}¾´‚üÃ5Ë_¼ J?ck;שׂXºf]/_¨ÚNxͲä‘Õj%ýIfºu›èÎ>_še¢«˜ù‰ÜÝ°š¾?Ô‡1s„°1ÊCKOÏvvµßlrCËû'AÛ3VGwöˆØÖ|‹<6™åõ.e–,._2^ÿv…HW+-è‘ …T³Î2UÚJmÓŒ~Ê{æ^3ÄV[@š²º²Ò}¯jLЛFµ¢e‡Ë|õàLöfü+Yk_ClkØmå‡CZÂwË‹XV /ojŒNö¦åÁ¶\Û:·(Û/ô\ÞoÿÐ[ÕWÞ­¼'o@¬ïÃOµý‡eÓß\!#ú_ÊsËë©v!#rˆçäǃ¼žL -gÆßIbýhûXäzÉ°ÑNÀ’lÊyKT[?Žº¢œÞõ£m5Ò?¶nòØ8ÙÖ(,N¯+DôLnO–ÕÑ*Y^ñfêUê¢ÄÔdq HsÛ1àèx“삈qO´Ótƒì©Éãä• ®º4ˆ]ôYunÚþÖÖçi;¯OLΩ*U^,mC5ízÛiaªtjl-û†Pß'…t:(ÄW¶ MØÌΟvM^ÏY‰Ü ‰z»ÒÚ)¤ÓAmWG‹}§roÅ£kiš¢ SܯÐNSí=ËwVLgÁoû0“¥üÚ÷ZnÖ-GwO‡Hý$òã!f¥uXac3½™¦q;™í°—AÍÜT…£Ùhòrƒü¿BEìTAžåƒ£nRr·w\IälvòVI3=uÔ!MŽòh;©ËåÜmvÖ—c«´Ðí­»Æ6ÔIe=—&ž€T-Ùu«ëd°¦ŸŽ•3Ñ6!0Ý ÇnÊò3ö£mŸ,¹ÉÜcwSÇÎÇ™œûŽ;yÛ¬ËÛÇl¾O‹c£s²˜>·IÙÛîíÆdqPä£ ¹ÖŽNò íã8dšÇ=~9,n·è¥4‚“—§çÈËÿ‡6ßá÷ß:~ßÞÖYý¸·-|ÇÖ yödòÄ$ßI–¯ÞhÄ~l&¢§ öÙñh›5t?îý„×4ºÛì­¥ëê:w&ơÉì»éz&ÍÄ+ÄÓ™{ ó±{3özÚ⤤,ïy5©p1/—^½ïUäÔN€P;´wêãLí j<–Ë´½ì>',u¤vx‡†úXa:{¡9ãhŒÐ‚6³NTÝjƒ8OJ¶™´9Š ÙFë#æ&SªÝšZ–³ª¥ÜcŠAýeÖtœw¥+1λ’vmeÜæñz´zgsÎcuv´ì±$+´4÷îT-C£íç¦íÜÍÛ§eÐ$ÈÔŽnq×òYø÷œ³£¾0¥µj?KuÄñx¿Žš\>,_Yf9%`É·Ndâ©\òä>×ë'û*I«ŸÌ3a; …`³“/ŸÓEx£ÜfLCµ/¦Ó»«.éi -¸ø¢°þzÛòíCK©n)õË,©¢|ÙX —å;R²uúƒWTÓ¦„²üüD%¨ -endstream -endobj -713 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 712 0 R -/Resources 4 0 R -/Annots [ 714 0 R 715 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -714 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 657.273057 101.433071 638.523057 ] -/BS << -/W 0 ->> -/Dest (cb208-1) ->> -endobj -715 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 306.131993 101.433071 287.381993 ] -/BS << -/W 0 ->> -/Dest (cb211-1) ->> -endobj -716 0 obj -<< -/Filter /FlateDecode -/Length 3488 ->> -stream -xœÍ[KÇ ¾Ï¯˜s•‹EÖ 0|â „ää°K6‚U9‡üý|¬îzô wg%9ˆ´XÍ4Y¯Y¬du/=~^þ+B®”š“œ/NOÞåèñ¯µ8\4õøÍñL^²‹TS‰ç*àìr!§óã ÿ]]®ÍOûÍé_Ç>t®Ö(žy§*a—KÎ>ª -•'6T1ºœCL†*‘Ã-Öj©#f r«Ê€!µDKB1T0X2ñ­ªFÈ$– -0¨Æl¨ÈïM€x†Ž¢K0z²t\*5TS—¡£,³KY(’¥«.¥‹¥`‰Õ“¥‹ÀIÄ[:`.ÙÒ%`áÄÞÔK(™-]–ëTCW€ÞUL°øäÉÒUv±SW¡ó%—[]ðÑÅÂì-‘‹ðM6uØQX¤” ]–äc5uÀÙKÇÀ"ø±tà‰È¹c·ÝÝì™,]–²˜:`Áâ[ °øœ, -ÀrÊK„œÔ  „ÂNŠ‹B©Nrf‹BNRÍ°'èYDÀX¢$‹ ˜€E°sM°p‹ 8 X\À ,AØâÛ -¼ÅâÝŠ¯dqƒoÅS²¸€A¸€é-.`0.—$0(®T-.`p.ƒ;-.`.¶{¶¸€ÁºS°¸€A»,%Y\Àà]òx—=M°À-.;:¦Âx—Ég‹ ¼‹m,.Àª:øa²¸¾âB)Þâï†âÅâ`ê²Ãd‹ ¼"nÁŠÜàÝ}°¸@À»AB²¸ŽâÀ?ÞÌÀ» h§À‚µ¸ñºÀ`0–X\Á»TþŒ= ¶rTj²¸ ‚w©`ùL]u”aqcßÂÊŽRªDð.[\Á» Ïbq8Þ!¢‹ "x—‘ÚÒw)ToqAï"oˆÀ!°¸ñÍ‘‡ëšºê|-Åâ‚Þ-‹ …/`S—‰,.;<Ôâ‚ÞEx¯$ð®Ì$ð®¤=¦X¸‹ ×@‡mkìi$«Î0…¥ïz -[:ð®÷¹Z\À»6-.HY¡X\€Yp°¸ q5çdqAª:¤|¦.9\G‹ ²‡ ‚²L°H‹ X»ÊµX\°pä,H,.@Fà*!û6Ë`»˜õ 2E‹ Àd®T‹ rL¨Ç`UK—‚+tmê -t”-.ÈYB1Y\€ZÊlz‹ @ðNÓ%‹ :‹ rl‹ Š\ ÈÌ- ’l‹ éBGdqA À‚lÐâ‚ -ªÌä-.@„F- S[:ñZg‹ Š$§©¢ÅØ&¨4Á”¦X@`}´ØŽ øA±‰2ÇÔ G±¸ ” åf±¸ ` >X\ßÔz3[\P=° 㳸 úä4M¶¸4÷T*¨7ƒX\€}©õf±¸ ²G½‰ÏØ·•“Ö›Ùâ‚*À‘¢˜:`AÒT} NB½ v²t XB‹ jJZo‹ f ÞDFo ­7³y\ÞÌdéÀ»ÈL“Ÿ@½‰ÌÖªí=ˆ7fäg¶²hÅYÌꈭæ‘÷"ZeóÌÀƒ|µF2 •eIæ©Â*”äÍcþE>&7œ°>­GT î3KÖ›¬Ø‚ì~Ô³?Ñl;ûå§Ó7¾çŸþ}zÿ›vRÖÎÏ’´°ÈõØë ¾rmù»Wô­f¡ ›²}´¦ý³Ë£÷R¶¶p|/o79ìÓ®oä{[y7Ç} y¿}ö~€Ó~©A G‚8%ü>ìãÝisÀ»cSÝuŸ6Vï×ð|÷ó›×/²t]-­Æƒ?\+nÌaÄ;ˆËÔ7#¦¥ïbØ>G»ŽËœýSøǧuÚÏ¿ÅBËb¤e\=ÄÓEÒ>—Ý(i·FZÍ û%¿#ïvà}£.ҾЮÛqÀMȱÚ9ÞÍ8íyÇ“šMžÃ‘òS8ü¼—¶Ð‡Ðu2±éynòR5ÆVl:¾ÞŸöŸŽ¿8}ÝÆoŽõ~ŸëaŸ—®yÃ9ìO»í÷õŠ»=¯ûÞÌ™æ=ÝlËÑm[–ëûíøu|Ë~݇e÷•õ6cÞ2ï©ß‡u›oÎõþŸ¦_¶}s™÷¬ý»}Ǹq—…ë}1exô{Ýï+n×ÍF—¬š¾ Íùú¾¦ðœ-ƒ¿¶eëÝÖŸú|²­Ój»&·Û M%ð½¹þÏâÓ£æ>Ëþ}üîM ‰<“ =ÇÊÔv®Éšp¢î)No|¹„ÑOíóY É=]ÐJ÷븭ŒîúŠJ÷&¤JŸu3͸$Žoa'ËÑbêŸ^ÿõÏ߯1U—)vJïÔ¿»Í¤üm žœE€¯zBv5ÝF6Û([tìŸÏPŒ¡t‡_Xc>L´ê(}Ž˜{à¹Êò2oÇR®dc#õè;åòþh!Yt½ÝèGó>·v;ÞèónêçfÚuK_š÷Ð7ì3£ÊNµ0Üü’ªÕÓóÎü²>ÿogxYOë(€åÌÇDíè -c ËÑ%&=ѯ»PX–·.®€e¢w† ¾=.ßÐ_¹äpËEÓQæÁk\¶X ßÃÃ×澶kêÈšZéÿpä³ÜuÍöùz\“²À|d»æÝ]ýu¸ïªóc9GE§Ö0#1ëøBfí4ì¿ÝSâê×4ŸJ½oS[}ô\õ!ÏÕ¤-ž=ê±^ÝÕzˆ\}ºã‚/ìó%…óÿ"âëãâgE€©jÖ'O9fx·"ŽfáÔ*œöÚ¯.‡\uoÓz©áF½½×dý ª9wZj®ºÉÃ8‹Xˆ6ùqÆÐk·6ßþ)–ºø0þ35帇Øïá»ë¥üxJí©µ7|*Ž‚¾yNâX×a¿è3êKGÍØt~¢g{¡ôãhµ¿cêõµ}丽€º\ìí?¶Eÿp"Í…û9Y{Ì71öc¼?žô}@1Ä"ó°íŽX…ûW?Ægw]vQdW¯[búýë<àÓ½¹} ±ßö½›>§ßq{R±MlÑ3Ñ­XïÞ;ÚÅúNeq¼_¥tY‡p(kÛ9àìxWLìa¼úeº)Òñ>ƒ¦KS8 ¯¦£eù{Û—å|Nx9aZ¾–>šR}“«Õ­üñªiì-Ç‚ÈX'Ct9ÂW¾-XÌ¡_VMŸ‡oÂÒIF»ÚÛ¢ËÉl·ÇJåѪ̮µ[~B™®ÎeÞ]–Cð¬/‰/{Äsÿzë¡éXkšÓoÂðrBˆ‘ñã)f£uœ\ácw½UÈ˸C\üô—)Í¥› -[³Ëôi¢þ¿QERežö…d¸”¾0¯æ$º7‡øh¤Užëˆe’<Û.梜‡Ï®öBú`´WÒ­‡ÅÒÅd‹<×OIjÇQLÃë†X)¬Ûgpå*ô¦›â8\ùñ ž8ãتÑÉ-îǸSœw>®âí ®ˬ¥¢þukÒ[ô²'û'Ùóá¥ýü|øà -endstream -endobj -717 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 716 0 R -/Resources 4 0 R -/Annots [ 718 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -718 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 642.273057 101.433071 623.523057 ] -/BS << -/W 0 ->> -/Dest (cb214-1) ->> -endobj -719 0 obj -<< -/Filter /FlateDecode -/Length 4874 ->> -stream -xœí]K$Ém¾×¯¨³€MŃñ„=°/$Á ¬ƒáCOí´£GÀÈÿ}ŒŒ3“õèž‘Õ°f=UIƃÁ ¿ £¢¢íÙàç‹ÿ2Ù%ç’"/ŸO_NfIÁà_-±y¨ìŸñ›ÂÙJK°%æpþÌŸ–T‚Kñür»GYüåôÇ_þ²­cÏn)%:ÎýÄ,òKÊ)™ ° -XÆz…Â’’ QaE»`ˆ¥h,ˆ9:²Ä ’ƒÆ‚ä\VXbxJÖYb¸dIcA [BRXÖ@ëŒQyÄy§ðlX"”5ž³KÌÅ•—À³Éi<ȫñÊc Yãd ÅX K°DFãAò9i¼Y|ôFåA—“×x ²8h§(¼ Y`]YåAÕxÅ/¡d"•WÀ39å#Ï™°„ì½ÑxÖ.¶éU< -““Âs%šPTd Þ8ç! áGã'‚O9+ÞêØ»½ñVãÈâ\"•Y0ù¸YLŠÀƒÆ% \J G¸ìÊ”5p¹,”’×`À•°P,IÃo,xÎj@à d 5$ð²`u1H¡ñ€»Æb†5pטT4,ˆÀ]^65,ˆ‰ .kXDÁN˜i))E b1à!äSyqÁsа  KåAJ¤aë¥ø’5,H²xç4,H² dаÁR,¢o5=€,05? È‚HQà ْ ‘†)DäcЪƋnÉ p­ò2x6iX-XŠ­†È¥– §×°¿p¸¤aÄÏ’†©@¸Š†XŠ–ì™k< YdkX€H Š‰ ‡ÉÆÁ3FÂb3òMGÀ/9ßÌoo"ÅSü¶øÈùfÒ° d QTdAÐT¿&!ß:i¼Y\! JŒœof f ßDD¯n dÎ7“º]Ü Ȥñ€»ˆL£†x@¾‰ÈVËí €7$Äg:3sÆ™Õè X[Õ-ìÅj•Ô=ðåIÝ4€˜È,sTw °¬‚iºm`€¿ˆÇè€ ëî“Ü¢Š0‡„53'd[¢û‘sÌbþJ±uì¯:ýú ‹ïùOÿ}zþUÝ)ë?l0Ùv³ýù… =D\ùäŒÈtGö€é^à÷ĺkQ‰—“ #Ê:X¶Ø—-Y]®tÑE¬ÙJ Ùõ"F"È/'$ ÈHwäFÙÙ$ÆÙî$Ï‘¼êôìjjGÓïåôGLôÙÆÔ&@%aYãªwa{ÖTÛ@ žÊTæT[,.më%Øívª1Ó<×r†Ä$kÝ¿5Êá -¥KrµX1Ĥ›P’ %¸-™³ç^ïÄ MòÖ„$ÁO7–ÑåeS1!£›&”QzOqZËèN¥ EÕ„uzv5µ£é÷òÝqÿ.ŽË‘:ÿ;ß( +µ3ÇðYwÈ«N&õ&uÿÝù¾;ß?˜óEþ—ÎÇ7¯p>!°±PÄÖ²¿;ßwçûî|¯t>ÕÉ^r^qÈïŽ÷ÝñþÁï5!'’ÂÅSäʉ÷]Ã*n2KMéìÊâ¢ã å–U¾¥ÎíL”·Ö] roô¼Ôz»Ô -Úô,ò^ã|Te}uo$ëÔQ†?Oâ}Ô‡õú`o®WÙï£z}°Î7—•?«ò)’Ýͧ*ä½Âw¥{ȧŽB&žÓC¿ÞF‘ë+Â>Zé -}Üøû§'xJ=]‡×B Q®Ÿ òqÄŸmœ?|>ýú§ù×ßþÛϘ­ϧÿø1Â@`cë±cÜ'cB6†ðLüú¼¾†ôãž?üt²°3Næý0…7Xà ìËùÌ]n{ùñû›öžZy¥Û^c{íô& —…sú¸Ò¡ûú| ·²•ßÛt»>.ø5‚ž·}C¼µ~§‹öGÛ,ד(cš¦ì¬SË^f»UÖ8å”òWY×qÙë˜Ê*ϘìƒÛ7¡çÝxÆØÍÔeq–éÒf;6¢ìÖeÛûömŽBlÖó¼¶g9¶=ÜÄGšŽíT]týÆ:Ž[r$wM3ÇÂúãã¹pÿñ¶Mð±ÞÞ—åçês—öš„/¥Û|ënêÇôsc<Âœ_ͺo¹.¦©“×ûùM°úžÿÔ1—iÛlvTm«Ï×/·ÇKý¹cZÇÏ,æÆ®óv¶Üýô5í_×ë-=ѧߌC7û¡¼ëÇ5[”8ßãþP³ ?òÞD‹/5?ã¯Øä³Ëg‹&©"ym7åt-áX*ÃxÑ‘ãC8f ¦dCû,ÄRïuUÍx´> ysæï:8¿&%¿ûéßÿð{™”°Y´T.=toK¡ú: W;,q1…cî:\Ã9êcj]œ´Õ,Úû.G~Þ>Ã䚘ȑ–±TÛàÓ¸Éúl“šŽi†RõJ°x͈BÝ”ª))e·XO)Æ;Fô`wcD–žS(.¾Úˆ¨çG´ŸÄ«;Ã'7LAn°íxcL®¯}=wôa8—­aÕ:a'2~ƦÕù4ùœÅ×¾Z;l"£®mãìò¼ÖÈ[Þ~³^ÏÝGc~úñqW߆b°Nw•¶^…»‰5£¯'z^zÌûø+*…ƒï:­vtÅÅb=çWÝY8i¬G`oºØƒu¾f£èoái‘ _÷4óÔ#«­õÌ]ˆ¶ûñ$ ö²-3èÝâÄnžÝ^¶[e·¶N\ž×Xc±·¬qXZšbµ~i2úÌjá<-¥Þ­ÛvxËo[¬Vø ºÉî®%>Xç½Ybòö–%Ö¼æ²æ'ݼ×i]#ÿ¹¬ùË‚—ÚïeKÓÊr›•&úéØ=pÒm-z¬''ò2œ³Y¡ç¾ÚèBþš§5v¯å> -™\{¯ÛS=¥¼Xêo̽àáÁ:ïÄž¦Øü¥‡1„o¿¿ìÞ‡­Þß²–Ê´æEeÚÁ@¬±·¼m£–÷zÙºæËx§îßìP·ÉèÌÛc–7Åî -‚ʼnFžg˜ -Ÿç¾mqÕyw—o"Øk¬àQ د±Ýâ6‘ÙóÑ´tÐ>Í6Ânö7k·ˆ>Gtxi–—¯ËDYY÷«ûŒ«oúÕm²¼«óÞl2›Û(Øí¥ÇSiûz˜‹¸}­z÷íS?åõ`—Wⶃ_ôç§c,8êìdÝgR Š¯ÈºîHŠ÷—é¯×?eÔÑ0ÏØŒ\@ˆÔ¦Ü±¼ë¼;Ë»Ï íîÖ‘í~îgLiSË•Bj{rM³_lg‘2OeD~>ÖÐǸë:ÙfØŽAëëš‘ÚÃkíƒuÞuÝŽînY˜ýÒ/¯°€ÿï1¨ᯰ€ƒ%w‹|R2Š]Œ £ÀØÊÝ+Û¯kòµ8£·³&µ©kV+¢=C‹³”‰îYícuÞÕÞŽ÷8t/’ûšÿï²/ù*kQô!£¾nµWr®}_{ë¦{V)ã=þª4¦<ݳÊÇê¼7«,·cÄpmgCZ敬bM§}¸ºÕìqµ¿;£û˜ôJÛ|9Sõž~ÊÀ¶•¸‹aéJûfYtk+bÏŽOˆç\/3¸imÖywÖv'.ÜGû=3îÖ!²_÷53a•lc‡7÷,q“¤ërj¹ó´¸TÛÚdÀ]W~7ŽË±Ícʺ½ÌǶïåæ¯&Ûµý"âG¾þ B¼s>XçÝYî˜óÓŠ#t_o)¤¬ž_Ý–ÀÀƒå߈Eÿ¯­Ý‰z£Í}Þ½óîG²¤ò†xóÁ:ïÎb‹7¿Ö¢FªâÆÿcÏèíÈHh¿î¨äËñc K¨fvÏ2«óÞ,Z¸ ¦)4·h(é‡L\­0eºtH­:=ìè} ~n×µ£ÛrspÿÍûÿöæøs»b&Ì\|ÅW6‹k† Þ-rÇäŽ÷Ûôïì®CÙ~r&ùniŸÏ–U_Çtís{>ËŸØŽïÀÄöI®8ÍZc|VC;9ìúçý5Û\Mq|“"t$XU^?ûï'KŸ×)gºßr0ó”J4‡Ó⵿v’¼ü'ŽGûý«gsZ¹´,¼Žá0•_N±^-fëõ’&æÅ:¾úiá¶S9óufÙx²}êlU¶=_©Yoíþ2Jµ‹¼ ßíÉ÷º­·|‹‡VþKôÏ'[haýׯ½ÔKwM%g×&ùåħI!ÍïÎÜ!3±½5£-²ã«8v°ò·;w%}XL{;¿¯ÃÖ·.ôÑpýЫñeXdz!_¯ƒZ;Vˆ¨í‘Ì£7‹md¾¸:/¾=Å! -ÂÒ2ˆ³A’egƒ³â]²õFÑhDw“ì¨Ëcù¢Ã¡º8‰Ct©:+¦¿—uILç-âå„nýžú¢RùºÜÞT×®3ƒæ…PePC/9&„Æ<)$þúïøƒéM&sðŬñ¥ƒ+1wC¢Q®ôr -érR˵Ö˜©4JåYµtÍOQ¦©û<¯Ð.â;m‰oâ>b|»%ó×±Æ\›,ìƈ—–:ëW¾¥ÃÄ -ºéI¢ír6Ó^&5å®*¸f§ñ•müÿ -aPyêKäøÚÅù4;aßä­’$=Ô!M–Ò,+ÔeS6+õ…¨A)Ï ;Jm¨Be‚žJAj€Ç–l‡Õ 2CX×ÏÀJI4]t7Éa˜òˆ<å ÃUƒE+Ì=Œv'9ì|‘ä4fÜòšCÞÑ®°ùN¼Ô…öd6ýÜ;™dgÆj7;Ä)@a’'Œ¾Tr÷ÖNüwúÛédÚŠ{9ýùT—9çƒãSÝÑ[¾ZF^öü?(ó~ÿëDçß÷» -ÖuÜ™n`ë†,W2þùA2ÿANn#ˆŽìO²Í³lèÖ0Öqç^Ó¬n&°÷’v ¨\I S‡‚ì†é:ë…f âe§ÅÈ|íÜÌ{}ô}pèÆóí•]*<Èáà1OžŸKòY4‰'.:—tpɉŠxâQtX¦d1Ù e'Cõ,?É©ðÜ—xa?úÉ£¹Ìʦ;­ŽBAìåƒl˜¬ì´läQ„~³{}õ¼7‘c÷¦hÔIcê<êëcÜ>Ž5Ç×#÷Ýy§†F[^øžAÎtZÐæAÚ¨ æY­²Sê´M§}¡pšé´Ñbê2ÅV­«¥Ž8«ZJ#¦˜Ô?KM9+C‰AÎJ<”åvûŠ7¢%?  Í9ÍÑ™YrÄ’Y¡EY{Pi–ôv웶}÷Õö,†AS8#S3«…CÉ7áß[|G½pC+ÕêîˆÍóÖ^,Ôd“w¾þ!&“c†ߥŸ(‹í’W×y륱²'LÇBÞ›dùOjé"¼€Qî3DSýÏméÕŠQ‡ô:\½þX½ÅÖ¿©R÷-ë&ÑxLœ*òŸPòôfþËÉ\¹.…ÚoÞl¡ÔŸÿûmÙ< -endstream -endobj -720 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 719 0 R -/Resources 4 0 R -/Annots [ 721 0 R 722 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -721 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 488.554475 101.433071 469.804475 ] -/BS << -/W 0 ->> -/Dest (cb217-1) ->> -endobj -722 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 427.607453 101.433071 408.857453 ] -/BS << -/W 0 ->> -/Dest (cb218-1) ->> -endobj -723 0 obj -<< -/Filter /FlateDecode -/Length 4751 ->> -stream -xœå]K$Ém¾×¯¨³€MÅû:°-,à ìÇžÚ F¯€•þûþf$++»§%—ìiôT%&ƒüHF>Z_~¾Óø/9½¤”cp×ÛÏ—_.j‰^á_i±9(ìðýU+¯sHþú3l\bö&†ëëÿM‡¼ùëå?~uùÓ¶¾š%ç`´¿þù ±œ]bŠQy•ÁRÚ -,ï—+觘³Ä‚>:ãö¬1\N^bA gLX bXµÝ³2Ä0Q;‰1töQ`i9´QJäAåœ5Oû%@éA⽄”My<ijv Ñi¯%^^B>I<Y|VZâyÈâµsJâAgS”x²Ø`•Èƒ,&E+ñ"d1ÐNx ²Àº’ȃ,*(-ñ²]|NΉ¼ žJ1íyFùÅ'k•ÄÓzñ°M+òàQX¤ž,Aù,ò ‹·ÊH< Y~$pÂÛ˜’à­†¼Û*«%ž‡,ÆD'ò _B ‹ŠA‚xÐB¸$a€‰qqÙ8 L²‹K.I(`R^\ŒV‚“ýâBŽX¥Á3Z« ‹wAB«!‹ƒçŠ<Èb³“°ÀÈ‚X YŒ³X ­ƒµHX`·Ne-aÞ:¥ƒ„€ 1•„ˆkSpX@.L)KX`¹Ø)aèÂÝ£„¨k}0XÀ®u)HX`»Öi%aîZ‹ž"²À€%,:.V'+aîZ­¢„¸ 72`UØa°¶²˜””„¸k’r8உ"/.ðA+aîS"7p×xe$,pÀ]ãL°†²”˜ w!^N VÂÄ{ðŒ•°ƒ-i‰„¸«3ŸàÓ@«E§$,ðÀ]°|"//:Bã‚ßBË‹!KXà»TVÂÜ|& €ñ "ª‘°ÀwµE¤–xÀ]m²’°Àw‘7x `‹F aâÛ¢LWäåEå”$,ðÀ]À’‘°QxQ H"òâCÒŒ…p™¢„@²%eç$,ˆ> ƒV%^0KŠ€k‘—ÀÓQ‚Ý‚P¬%,@-µ$8½„ø…Ò% xÚIX3d«HX€P´$ƒÌ\âiÈ‚$[Âdºài-aA2Ù „É$T™AIX€Zª–xNQ™$,H.,”*JX7A¥ ¤y0!aÖ‡Šm/aŠ›(sDd±ÞIX’¡r3IXd1ÊHXÛ¤z3JXdAÆ'aAVa¡4YÂÀ8xJIXuB½iœ„ðKª7“„Ù*Ô›(ñ¿Í6P½%,Ȳx¤("² iÊ‚ß“Po$^€,&; rTo& f ÞDF/n $ª7£¸]ÜõÈ$ñ€»ÈLƒ„8@½‰ÌVªí€×Gäg23QÅ™Äèõˆ­â–ö"ZEqÏ@|©F7 &*ËÄ]„U0µ· ðù˜ÛaºûÄ·¨Ì!"f¦H'™áÙ}¯9F3{§Ùº?öç?\~ý‚à{ýÃ_._UvÊÚF‚PZ;äWp“±ÜÙ·Æé[ÈâM ’½©1MóKë6‰…€Gÿ®û/Y!* ‹Þ¨„UÿQSâµN ì)£;”Á¨ EÉ!ë›û<9"'È×þE˲ñy‡’$YßÜçƒde:‚ó¡hFŠù½žëóñzeóžÖë¹>.kBñ±Êmç…|ÔøcjÌ›ý÷ó–%µñ’¬'û|°È¶ãO¦%(n‚P‹è– ßÓ.%TLâ7vù@iäÙml6”— Ø ¢„ÊxãütAˆªR¬W?ú!™²FÊaüõÓÏ—_ÿË÷ÿþ¯¿ÿö÷éëåÇPÊ«ß|§ñénë§×ì{åù´=Få}íWy.ÔϯõÓMãÖ¾Fíi½í ‰•¯cj=Úø¼{7§ŸèiÌl[iä*á÷ëz¾ÞÔvq:§¿… vèT«ßüçõÓ÷—ú´5ÀR¤­(YN…6{®Ë·Øì_ÃTs>2Uw öb’u©ü [*¦Þ¶Ì´äÅ ùxuœ6F[®íò€þ™™ÇÜ·™ÚøŸj{¿•·¸Wcö1âösv¯~na2#ß—Õ<ɤ6ŸîœyÑõ¶p(evɹöu²Ï³˜6‡`XVÎLlåšU©íêl¬+³UóÓjÞ¦Õæ ðŒÌdIue¬ôËmw¨¹7Oh²½TyÌèÚ9½ƒÚm;GéÓæslüæUŸ÷ºÑæŽUÚa©cVÉPñwl•çú»»÷e& ¨î^-Úñn²âz«¹Ë)§-oǪ‡·È×qïýxÖ1Ÿ×™ŠÂ¾cOïdŸg³Bû œ²üÝ^ÜTH» ÅÊN\´Ø`å\/JÕÀ{ª’7V?›]é;È÷=»¼ÌK yS•ÓÆñÝ|ä‹òùܵT–+ÒH£üòdŸ§³ÔùåKÝDÓÿC»0÷<Ó³s,r¼ŒLâ]»2AÖç)}G¾y²ÏÓYçƒ|ó®_ïóþzÜ¥žÞþ¿[ø ¹aŽK¹éäÑes]žÎþì ~ÃUŒac]Çý7’./dY]º~ÈîYrÎÑCtÚ¤"Ý÷ÿü»ßþ“®ì²P^éÇÌí»BŽkº…L¹_· ’rmëiWçs³ÖõxG¯mû5 ÇÆbíFîMW³š:f96[¹Öê‘W•c®ÒϯÖ:n Yùý¼ª¬®åÔEߧ¸‚äº2Û±‡WmuÓÚ};² -Ð^˜Yžßø¥MÿeôWŸ×6\§½b:L«ŽTµ,ê)~n^Ñ–ž­çfëzû@sT9Ȇ~Ú,ÝFMêíÇ)çÞÖ&”ó;’æ{r¨q.´v[©5Ó^6zd3(„Æ.ëpk5Ëzž$c³¢^³«ÒöKÕE•©¬[c†,k”`c´ãÚG}­tvN[?bv=÷íöÔì­Éq¨[?Ÿÿê“c¾"û]?l:®sª•ÆýËd_ê¹y6v½r¥õtOôª ˜¼®ŽÍt²õîûU¶pOï‡z‹³ÞvëóÀ.úúøY×s9ZßÁÛ¹†­F ß.çù㊡,#­Ç‘Œ%JÕ9Ú­a-¸£³¼³µy~·ŽYäÓ{ß)z«Ç}½\•éså¿0›ý2ä/<½·Ïbõ\¶~sÇÊvmšŽÃðÙÙ6|“‡¯ÿ_hþßò™Î¯zºk ßàãïòÐéÛª »jk#ÄY¦§–ßņvÜp¯agëÖ×q²÷æ£GúœÇ¤×÷ãС>²›í¦Ú2­M§sCÏ)[n¡§WXèh’¼ãædŸwÝvÿÅ‹ïòZ·$ïábñRB„p+h +–•ë"Ü0‡Eez xšðÇi;£l‡A{sñ$–I¢mÄè—ì±þA,Œ$C)Îz'™»gDIé%åòØ€KæÜÍ 'û<Ñ¡ZG|¼ÙˆÄ;ŽÉ(·Ä¬2r÷íÄcú;Úmùß¹ÏQÞQ]%Ñ (trÊÈ®Rã•où‹-NÈuã¾.£W£dz Á4i±£{.©îB¯/‚/h‚ßc;×çIöš†§åxäiê¥þÚ­…Ï×Çùbó®ònOt¾æ2[ñy;ÊHãì¨ÛH9ÛzÅÙQÍ]‹ý$1þ—›x²ÇŠNÙP¶C®wçî—=ÙçÙlˆe>°¡ù ”fCVz>`¾“™¡Íº#0öùSóCW~²±ÝÕìi>>6¥ ß:îFÖ£½ïƒ~¥š™î¯óv/w©–ïÜ%ÜkuúšâÉ>Ob…ìAe“† ufÕo)ÔA0…;%7·ݦ>G—~¦Ûz6—©§Fº[4s¸M¦ûIJ7ÅêƒòÑcÕ¼§•$¯{î¾ÛßÃ&Ìmÿ”~{âõª§gŒ·Ñ$äFzõ–UåH/•¸KhÏ„ríGêN{‹|¤˜‘^ͨ´i1¨î=•em{ u?©í”xÔö¾ª~çªé{Ú,ç j·ïXæ«{’¥Œ`{R}ü¶ÏÁäÙìg庌åvKùË%”¤èò’,€ü†Þ¢y n¡­¢˜¯ôR–¤¬ÓmétQ¶¾ÞéYÞ=úKoU_Gªè eôvšõ]¥ì ¶ÿ¥,úÏM%¹ZÑ`}u *däc~&¿^¨†vÙ¹q%晈õ«êc9Ý/ì4Ú  —<·DÜTõë¸úCÁtýj|;êï[7z¥‡S­‘-/µX'ˆèôžLg¯]ÉôúÍ´Øzº(>4™A:Þv 8:>$k«ÑM7ÈÆ5y4½®©«. b«N³åomMdËyD¼]0­©¯"•^ú׆jÚ5ªÓ,*wªo-û‚¸¾Névˆß©6´Ãbv>[5zuÒJLÍ\o—[;t»ˆíêh¾¯Tì­Òèš›æ‡(ÃÔiãõ>íÆ®FzŸ0ó„wÓÖ“éâ[_k•˜Ý˜ñvAˆq;òëÅG¡µX¡|3=N´lÜNNjØË RŽ¼~ƒk6½x†þ_¡Âw*!Où¢]7)zyÔ8“ovòVIœ:ê8IÚÅÑ–©KÇØm–ëK'%´'Ðí­»Æ6T¦2F¹‰G ÕÁcKÖÝê:™ ¬é§c%'ª&¦dßMùuCrúîª^õÉ‚fæîû¸ƒ:v¾rrì+®éM`]Þ>.³ùF¼•Àæf2™~j“ ²Q=ÚÉqP䣯…ܼµ£SyH­~N&EÜÛå—æŒõ†öƒÕôbKžyéë£Í÷øý¯‹»þ¾½IiãFu´0[7dÉè5Èé$™^‹ÜˆÝmÑ8ûƒ¬Óhë›5ô8n Ãk7º«ì­¥îª;—ýÐ!#›nºF[¦@¼MZì‰Ì·®ÍØë¡m'‡i,½ƒ«I…~:8LƒgGH¾²!qDMGH×Ö|P² ól#&$Ÿ¤«žäw|),ÍÅXA‡vðܳ|èF+gÁš ¶ü€ì4Ÿ4oä„~·{}óºW‘Có¢vhïÔWNí'FÔx2Ֆð=ì1Ç– Üæ¼CC},Ë|Ïö$g¸ÆH-Üæ€Û(£¦Ñ­6ð|R×h›I[ èpšj´>bl2…Ú­©¥œqµ{N1¨äšö|Uº=_•°kK㶈׳%Û ÏÍ9Ž³S£eÏ%“@ ¼w§ºÑÒ6Ú~n·»EÛ+; 7 #3U£›ßµ|þ½ÇwÖ>ÓN„Ôªý”ÝÆ»¨ŽÖØòç$T -âèÀÑ%¶]òæ>Çû'û]’¶ÂgÂr,ÎZ5ýaY„W0òcªýѹ[Vâ)½MÂöЀ9µÛ*o†/{–e“¨F*éAXJz½¿:*-ßëêïv ¥üüÿeˆ -endstream -endobj -724 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 723 0 R -/Resources 4 0 R -/Annots [ 725 0 R 726 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -725 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 303.873057 101.433071 285.123057 ] -/BS << -/W 0 ->> -/Dest (cb221-1) ->> -endobj -726 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 242.926036 101.433071 224.176036 ] -/BS << -/W 0 ->> -/Dest (cb222-1) ->> -endobj -727 0 obj -<< -/Filter /FlateDecode -/Length 4359 ->> -stream -xœí]K$· ¾÷¯èsËzP/ ð!@d1°HFëÞÁ8€Cþ~>ªôª*vwÍì:éëÁìt‘zPù‘R©esÖøùÂàŸDF¥”c óåÇÓO'­¢×ø¯”X=ö7øþl4EåMÉŸd‚‹*foc8?ŸðÏæq.þ|úë¯NÿX×1g«rÖøóϘENÅ£ö+ƒ¥XÞ«­+…!æ,± †diÏŠƒrò bµI`%ˆá(·geˆa£!‰1LöQ` 9ŒÕZäAMä¬À3^(=H"?“™‰WœIÜ1Ѐ^Ø*nh`/¢U÷ 4À—×Hâ¦ÄÄÊ2q×aL£Åm üE>F;LXvŸæ-ªsˆˆ™)ò 3Ü‚Ý÷5Ç(æ®[öÇ~þþôå;ßó÷ÿ<=ýªì”µƒ¡”&äWp›1ÝÙ·Áð,ÛÛ"${Qaî6æ!–Öm6 ÿ;ï?¬d…¨,,jc%xõ÷Fâµt ì)­–ÁXXŽ’CÖ×¹+rDNÏýƒ‘et4õ;”$Éúâ:ŸHÖIGp>,š‘b¾@¯Çê|z½NýÖë±:Ÿ\Ö€ÅÄiZ÷+ -y¯ð§uªÑ/â¢Ô/%)ï–þÄbº1‡¬öâœÞ"‡`dN -\N¢&Y_Xå -¬•åÜ: ŒË–s¬"Y;Sáß¼=!,U)–7ýqÙ±Ašaýùí§/ÿøæ/úúØÜÛ§Ó·¿Öˆ#_}aøï;ü¦å³GðqùÌûò>Ô2ïëß¼§¡ª¦V¾¶Ùí´^·¶¯Ý賕÷zÝŸy?ÊÑS-cëó¦¯Æïåúü<¶.ûwƒÖÆ:÷Éczm{+ÙÃf iÝ箿iãoç·oN¿}»6ϲB]Ì‹k(ݱècU>Æ¢ CÎù¦!¿Ð0n\Ÿ·icã«ÉÝLå©ý´™ø­ñoú½jʾԡl|Ìݶ à7rÍ`¢¿M˜ßòuˆe£¡Ì™öM>XçÑŒØØÛpüðòê™ü€ßËd5RÛa-Siÿ2BG·:'[ ¡b¶­gI0ì!gÐÇ=á”òÙ^ÝP¤²Y'Ë‹ÑÛöz¬ÎÃÙ+ÝDÝÃhô„Û†Éng"¢¶³I1zýÙf7Ñaëc+›±5Õ¡ÌVqâu;§!wï÷;As“,¾öu7U»‚®S{ØZÕy8k½“ì¾Ô²>Lè¹E´§MÝVï@²û9:ïòf#5Xf>ä{Öy¬ÎÃYç ö?e+kê³Ò·ùx4YY=¦?N;7%26•Ñ¼ùÝ~ÿçi4&.½?z6¾²‰>¢uT¹$K¸”õœÕ|×luyÞÑkYÖÊX¬Á…×û‰Ÿêç\Ë=vJ?~±å.“Þ·UÊ^†üE®0dêe¨Ò‹®)7ÌÊý¶ÝÕ_?ecõ¹Œ¡ê§CÃ-McˆS=½.O,kµªha–Éi~ÇáøŒ[•ÉÕyòœ¦E‡EÇï÷íÇ/€øѾ]ǵè©èê–.]“C±¬ôÁsddãÃfA“†ìÛ.özYì¤ÈYÇ[Ú4-û]ú*e?T]T™š]u[C–n{­­->Uú4¦µýO6+Øñ2ßÍ.›7uë·ã/:Lëþ$ªý…kz®ý¢ŽAÃþyô½.mðJƒmÖÞÏvüO ïš<¥Žæq[ÿŠÛF¥Ì/ýÞÏá­ñ3ú0TmY mÒR®ôiö¾Þl°Ùc¯Ýþ»ZÆë©KÞuCOdvz2ÕÖ§X°µ¡WæÒS‘çݧ}ý«G;M=.6ßÀ8xÖsìÇïÓò×q»ø–«Ï2¸÷ë oWs‡%×]Ǽ"k÷Ç›ºÚáûõœAʬÞÇ -ÊYÇ©÷ý}4Ý…á‹[Ûð »&^³ïæ×~ŽÇqèé—ðñŽ{¹ÙëM½ïãJZbC³!ï¦9|{¼ÔžžÕ±6~Azè¤ÇZûÀ‘öïéõõØrSg™6:³5ÏØÝò™íº -cUÁ•—•üe]B2yçM×±:¯zÁù T¾ËëH%ïË₪À¾_/¦ŠY°y¸ié±LÂÕsP:óËM‡ßNKú 6 Ú‹hâRL´ ½ÊóÄÅ—d(-‘‘’ÏkFÄÇPS.¯i)YeÅîÑÁ:cDÁeLL&¼ØˆÄ]ÄÛÆd5©˜uÆZcÝñʘþgöt^aäÓ.ÄÕzÂ[õy×Bt•ÀGýM"meW©qÈ·|lŠ-NÈëÜ}Üç/¡d>î½é´ØÑ5ƒTwá/ŠÁŒ¾·ÿu°Îƒì OËñ–§éwõ×­-|ì®Lh×uïýÓÑ/…\>}ÃŽºÄ‘³µõY·£š»ûIbü·üš({Ìè¦Ã[6ƒëëIiOçû¦ ¬óh6±ˆ¾aCù66ä„÷Ý&.{´Y½wÌ˪ïcq=Zòêã!’ß:ª3¿s›À´¿n/wY_ÙÉ)5‹òüõ[„‘pï-þÁ:b…ãv7sª1ô]Ý÷v›¿Tµ™ë>yl{ãKø”o4õÄÛÄã2ûvÝW÷Šf ùÞI¶Äd:¶>åw°ÎÃY¢=„‡Ÿ÷½ ƒèxŸyø|ß±:gËþ&ª~>á÷:Ÿz„~)Lèzð„ßÁ:gÅw2ÔÏ'ü®"ñãœðKS^zôÌÔÁ:f¯ùv.ûù„ߦMó™oˆHÚ‘iSgŠ²ÍùJÍrâO½T½QóuI|UÆrqâôPËÿT&ýÇ“á·ÖzqŒå3]Èɶ‡A~>ñkfÈDãPä2ëGÝÛ"ÓÏX6ÚøUÞ–t^éúqÄäýæå£õm4\ß·j|¿éVÈ•oØ/ DÔ fOæÑke*Ù sõ)tQ|h2ƒ8¤¹ìhpT¼K6NOD¿'ê©»A¶Ôä1|wLW]Ä.ú¬:3M+kã4·ˆ—ºu[ê³HåÈZSM»Vwš›„Êê[É>!ÔçI ]Nñ Ýš&LfçO³Æ÷¸,ÄÔ ‰z¹ÜÊ ¤ËI,W[ó}¦b/•FÕÜ4?D¦Îç“®Ó.ÓaåÈ—›N>‚eƒmó0“ù> -endobj -729 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 453.873057 101.433071 435.123057 ] -/BS << -/W 0 ->> -/Dest (cb225-1) ->> -endobj -730 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 392.926036 101.433071 374.176036 ] -/BS << -/W 0 ->> -/Dest (cb226-1) ->> -endobj -731 0 obj -<< -/Filter /FlateDecode -/Length 4799 ->> -stream -xœÝ]KìH±Þׯ¨5Ò˜|?¤Ñ,1ÄHGÜÅ‹î:§A¨i`qÿþý"°v¹»g˜‚ÓêSåˆ|DFF|‘¶³õUáç+ÿ’ÓSJ9w½}ùᢦèþ•‹‹Âþ¿Ñ_µrqò:‡ä¯ßÁÆ)fob¸¾^ðßê’½üÏ/.ÿXÖÑW3åŒö×~!–³SL1*/°2XJ[åý£ñA`=aˆ9K,ˆá£3nËŠÃåä%ÄpÆ$• †uQÛ-+C µ“XCg–VC¥DQÎY#ð´Ÿ”$žÑSHÙd‘ÁÓÑHh%,pÀ]ã1iå„¸kœ ÀP&à£à. ÄËádÀJX€õ‘—'¡qÁo¡åI‡%,ðÀ],TVÂÜ|& €ñVT#aîj‹•ZâwµÉJÂÜEÜà%,€9L€„Xß&­`º"/O*§$aî–Œ„X…'•€$"/N0$-aÀxRˆC%,À],ïY‚ÜUÞZ pW9„="²Ød$,@\ÜVði«“2@ -‰ÜU3,ñ€»JÅ,aAîÒ²)aAˆD0IÂ8! -6„ä¦c° dB>‘&\{ ¢Á²DdqÑIX€ÀzÊ6' ¢,Ö ¢,$,@D0eè[L ÌEÌdA¤(alJÙ9 ¢ÈÇ U‰Ì”"àZä%ðt”° F7a)Ö —šœ^ÂüDá’„<í$,ˆ²ÀU$,ÀR4%ƒÈ\âiÈ‚ [ÂDºài-aA2Ñ „É$d™AIX€¹$T-ñœ¢<3IX\˜(T”°n‚LH)ò `BÂÌ%Û^Â$?H6‘æˆ<Èb½“° %Céf’° %Èb”‘°¶Iùf”° +È‚ˆO‚¬ÂDa²„€qð”’° ë„|Ó8 à—”o& ²UÈ7‘â ~›m |3JXdñQDdAД¿&!ß:I¼YLvä(ßL Ì@¾‰ˆ^ÜH”oFq»¸ë3Iâw™ p|‘­”Û+¯ˆÏdf¢Œ3‰; -Ð뱶Š[ -Ø‹Õ*Š{ -àK9’¸i1‘Y¦ î`YS+qÛ@¹ &Ì»O|‹*À"ÖÌináÝ÷œc³;Åæý±þõòË',¾×¿þëòò‹²SÖ~4Œßº@‰5åZ´í‚ù^M¥=‡ Á¶¡ˆ$„€ï©CBÄ<„ԀźéFBb)Ær›¯ý‹^Š ‰If`¦ŒÌ-úEª 1W6ˆ²¾¹Î$ëБC|†ÑÛy½ž¬ó£ë•÷{V¯'ëüè²z`ºC.«Ü²_QÈ{…ïJgéßuûåž) -ý"ÀBŠg >EaOVú…Þů>]tÕwÙ¿—ÌR£…¨V›týôýå—ßþæw¿ýÓw˜»O/—ÿýk*DƒøH ¾ùJ]¿GŠôèi¦y]?Cýlt¯”KsY8rÏ3:*×z-‹.Êo«Oå]¬4³ìÓ½àû­ò,ãûÑGéÚzb²©¹í.{+{ã(ò…!—¹õSäµøþ—ë§oOé;s}“ŠÕ3Té˜h¬ù"fUWQ‰pûfî,Ô^ož¬Ð!zÁ²VÛ·UppôQUFêü¼m'XŠËnä¦2ô¦ÎPTs$Gˆ{r¨1Rw©ÞДˆ²Ñ®tPˆ$´]Ì‘ÚÊUÎ:ÞÒ¦ž§¾™B)û¥ê¢™ØËrŠ]²P›EÎÖF»®uÔK¥³1-Í{˜ö¦n7§fnMŽCݦõø×®b›ìÕ=¬­ãñjeÆÍ„g×>­Ç¦ÅlTWû´u|­NR‚r¬²„7êrwtgÔFwM礛6?áxÎèŽY³*K×Å'nõ32[ÇüÒÖ=Ò¼ɨõè9ì<—Jh³ÚFéS¯müPgf£³Z¯Ï•«ò<×¹zöFr4Ù OÏ<W¶ÁìgøÁÎÜ3=•~žVøäë§ípfÛ<³[™0â ãiéÃïËüi©mºƒ -™í­~ÆÊS•ggŸ4qæ0Ÿ0Ñ<Í´"fòWl,c}s}‰\úþX‡ÿ“Û“oº -liåu´Áaß0œÏ÷ŽÝ7_ocè|·Å©s~¿²_)cÎC͆ýó°o™Î?õë—C]m0ÛÕ±¶vúÚÇçµÚw›ßsrœÓëû1çhœÖص߸ÚÃó¶¾ÿúS œíHñèödIEè.»Ž6!PÒi* ·âÁö[ë¼+}©±õdh¿ãl6´?¥&¯rBx¿¸]ëuVM¿ÔÖwyéѤF•ˆû÷ßþùà7Mw¶Ý­E»u ±,Òž'a·Ã&•éNŪÃ9\ªÑ¼š—7m6‹ú½ÉÑ®_–×Xj«˜ÈžDÛpŠ6"1ÿAÌ5$C)κŒí‘£½»\²/—̤­‹!Ü1¢“uƈÝÐ1éðf#r-¥qëIÜíØÐÄe•{/;^“iëWKÁ½ÎmiX¥Ž_É£™ŒÏÌؤ:__ûÚWm‡L¤×Õuœ_óxë F^SßÃz-ý5l™ùé›7¸J‚ûê䔑]¥®W¾Å_l-hë„œ÷mó*zz#Ó}ÒU§ÅŽv\Œnc7w¡» èÇÅ;.v²ÎGöD~ -OóÆyšzª‘ÔƒÐæq}#aeQ,ÛïÖú²,Û¬nl4ÔO¡?SÛ°u3ÃÄUù-®,¶õÝ,\­¬·Ê4¢È•…û¥¬gtÐÛXÉ26ZV{Þg<݃Þ÷™îqħ-?í>Sãïâ+IŒuŒfŸ¢^uxè/Ù4Û÷t'Y%CwPŽýå\Gó— Â‘¿” 궴QkešDç¡JÏ´ns¦eãÅú{[Ò¤²Ôf¡±~ºm›Õg\ÚsÙ %ë$ÐÓœ•w:“¿dëqÎ0J¹g&“©ßE{ -´Ö°á¯CS÷Bœ“uÄž†ØVF:m÷êóê»_êý=+>“ þåaû†ò² Ž—ë²%2áQ™ÜéUÆ’©¿3²zW”cd£;™ ,Í°ËtCöØâÎÕy8‹ó‡ö+8këU²YÜ"~|ÙZ˜'wÚ—ÑÆfµå[q{ {«–—öeó¬,¯ûá>ÃìÅ‹~e› ï@ÁsuÎ&Ó1 -6{YEtís/ÚjŸm?°ÜÞ>7v¹ŠZý*÷éôvý´h{•¬ë|#¡Ëû}·z{²ÎûÎìûmøk§¯ô£ÕŽØŒîžçèÊöÓ±å«óh–ã¹®ÝÕ:BˆôáÚ”2úŽÒÎ_SÙì[Y$ßMèeØ.B_CŸ·q!Õ5¼M¿ƒKœé|‰HçàXLŽtÂËÞ“Äô6 =Cªëdô ©¹-ßä+ E&õmZÓž@.S^×ß©þ¦d{»¯<ÜÞÈ{™Í‘覿}­ÆÓýAmÞ¦-ýÕ7mË 3ìmËÞ~{óɳxS3W3+cØLå—PN+ÒåÄ:Ò¤ i{ n¢Gmc¾Ò IIY§ÛÔé¢l}Ý©Yþ¡—ªg+:.ŽŠšfµüeÒ¿¿èì&Òy㾜㩠-9™v1ȯz[Ì dçÆkûwÈD¬_Uo«ó°¤Ý˜qÊë’ÖOª~GУÔóWãÛh¨¾oÕè|§Z![N˜™;ˆ¨ô–L£W“®d: 7M¶^…. -…8t¼ìhpT¼KÖV1¢ßënkòh:;­«. b«N³éoeMdÓyD¼]Э]S_E*ÀÙšjÚ5ªÓ,*wªo%û„¸>Oévˆ_©Ö´Ãdv>›5:Çl&¦fH®—Ë­œ@º]Ärµ5ßg*öRiTÍMóC”aê6uÅ ´;N#ÒáÞÌG”m_—d:&¢ÏµJÌn̆x»`‰qòëÅG¡´X¡|3=N´¬ÝNNjØË ÆÔT×l4:ŠþŸ¡Âw*!Où¢]7):Ém\NÈ7;y©$Nuœ¤íâ(ËÔ¥cì6Ëõ…ÀS(O ÛKw-¨LeŒs@ªƒÇ’¬»Õu2AXÓOÇJNTMt7Ⱦ›òë‚<äôÝU½êÍÌÝ÷v9tì|åäØg\ÓKp]ÞÞ.³ùF¼•…Í­Édú©u2ÈFõÕntƈC0€Â }-äæ­è¨ñöu8™´âÞ.»”eÎXoèmØ`52Ë#/}ý?”ù¿¿¸ëÚ±fó:nTG Ó±uAæ+IžN’éŒòFìnÈÆ1ØdFY߬¡¯ãÆ0¼v£ºÀÞJꎠºs9Ñ2²é¦k´ešñÄÛJ‹=ùèÜŒ{¾´mpèÆÒxM*\ðáà2 žKò•5‰+*:–tpaqÁÅ%ë0Éb’AòNºêI~ǧÂR_ì‚…tiÏe–7Ýhe¬B`Ë/xÃNóNóBAèw»×‡ç½ŠšµC{§¾rjQ;àÉT[.Ãò²¯9¶¼ªÜœwh¨·e™ïÙä ס…[\peÔ4ªÕžwêmÑi[(:\€¦­·›L¡Vkj)#N¢–b)õo\ÓžÏJW¢ç³6e©Ý¶âõhÉöÈssŽctj”ì±dh×îT7JÚFÛöí–}·ÕöʆᆠaD¦jTó›’ï¿÷øŽx&ŸTªý”ÝÆA N<ŒÖØò·]T -âèxîèÛ.ysãý“í.IÛ?á=a:&g­ŠšþJ,Â+ù>ƒ5Õþ‚\-+qHoS€°=4`n{‚bù3 e?²lõËH©"ýUKAo¢Ãä£ÒòŠ®þ>/¶PÊÏÿ{ç=X -endstream -endobj -732 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 731 0 R -/Resources 4 0 R -/Annots [ 733 0 R 734 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -733 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 582.273057 101.433071 563.523057 ] -/BS << -/W 0 ->> -/Dest (cb229-1) ->> -endobj -734 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 521.326036 101.433071 502.576036 ] -/BS << -/W 0 ->> -/Dest (cb230-1) ->> -endobj -735 0 obj -<< -/Filter /FlateDecode -/Length 4812 ->> -stream -xœí]K$¹¾ç¯È³ ëA½€…¼†ë…h؇Áªsºªº ”±Û…êÌ õ (ò©PDÙ³ÁÏ7ÿe²KÎ%E:_~:ý|2K -ÿj‰ÝEe‡ßÎÖPZ‚-1‡óOLðiI%¸Ï/'ü7]Êâ/§¿üêô·}{vK)ÑÙpþå ³È/)§d‚Â*`ëVKJ.D…í‚!–¢± FHäèÈJƒJ bsYaeˆá)Ydˆá’%1l IaY9¬3FåACä³a‰PzÔxÎ.1WT^Ï&§ñ¼_b"¬Æ+KŒ1dG%c5^€,ÁYÈç¤ñ"dñÑ•Y\N^ã%Èâ ¢ð2due•YL4Vã¿„’‰T^Ïä”å¬x«cïöÆ[ ‹s‰TdÁäkà"d1)jZ—4 p)-Ti à²_(SÖPÀå²PJ^ƒWÂB±$ ¼±à9«7%PÔÀ[ÈBð\•Y|! ¼ƒ,( a÷őװÀm Ö¢aÜ’)Vü%c£†€ 1†ˆës$ < ¦T4,ðÀ\ìÔ°ÀtáîIÃÔõ!: <`×SŽxà®'k4, à®÷¨©ò Xàãâmöp×[“4, à.ÜÈiX€Y]`‡QÃØÊâr6p×eCp×%,*/-ðA¯aw]À´•¸ë‚qpב‹ÀPàQ£à. $èádÀjX€õ<ç5,@c‹CX¢aAîÚ‚åOñi Õbs‰à®Í˜>•W› qÅo¡åÅÆX4,À],T^ÂÜ|f €ñ VT§aAîZ•Zãw­+FÂÜEÜ4,€9,€†Xßk`º*¯,¦ä¬aAî–œ†X…“$*/-0$«aÀx1ˆC5,ˆÀ],ïEÂÜ5Á{ "pוY|v ®n«ø4‚ÕÅ8 …Æî‹ÖxÀ]cRÑ° wyÙÔ° &&¸¬a\; b¦¥¤5,ˆÅ€‡OåÅ×AÂd@€,•Y(‘†¬—âKÖ° 9ÈâÓ° 9È‚AÃDK±ˆ¾Õô²À\Ôü€ "E €dK.D¤‘A«/º%'ÀµÊËàÙ¤aAJ´`)¶ —Z2œ^ÃüÂá’†Vçýõ*ú}X¯ÕywYSÑì É~Åš÷ -¿¯S~3£ù¡_xN=c¼&죕ÞYhߨð$°£øšZ&b¹—C*!ò+«¼£ÀfqiG”ñÅqd‚å9%t& ÿöÓ ‹Ô&Åzÿ£_ -ñ+[.œ?ýtúõ}ûçÿþãw°ÀOϧïÿÃzþÍ7ŸÁ­Ÿô„ïiO qûÜèÔ>óFûO ¡ÑVîyßN«güú‰Õ§þ+ä˜ú`~k§·öeæ~ªq_§-íëô~Ð]öã·î7ÿsþôíéwŸö†Q3Åj«¶X›c¼cKUù[úW˜P)·Lh6'§ª©’§¶™ËgxæB_&õ¿Ë”ộ̥µûy/Wk‡å¶O£âM`2呇ÖßÎ3?ã÷²š{¥¥•V¯Ÿ6Úçõ·×å:F7)¾ûµHð<‰T8½iSÖùhFeÝm`Úf­j‘¶Ï8€¡Î ÓÊ:Ö:`ñÈ¥ÁŸ­$kª Ö¬vAÙîl©laÕšØ -6‹gúì!$xÝ3¤LÒzó±=Õ›ÂÖWó€'Q׊±\8àS‡«~XÊ÷VËë|8k¤Û÷/° v}ÕZþÏ0-‰¤X¤œý^_`\³ºZvnOZ꼤N2³uwZ˜ê\[ÞçåºY¥Ô¥2·¾/7ðrgÄ›{.[îYècu>œ…Þäf í³’ÄêæïÏJ·R7YÀ¶ÂÑį3UÞMÖÀüJc6e+k&‹p¯“¯ãÞ+ëɨc×^_W¬p„uÁÐR!ï.N>VçÃYáXp -ñû,4<œR‚‡ý0…ú—É"”l‡•^©©À[R’W¦>2¸f•7Y! /uìM›œ>ïîY‘/éã¹f©NÄŠ|` -!B¼_>Xç£Yª»_^±ÔÝjZ„åNYÇ¿W|wÝ3ƒc•ãiDÝ«®$Ú½­ÖÄÑIŸà¨{C¼ù`gwâÍ«~}ŒûìIKÔ¶Odlxù¿náW,pĆ%-u“×ß3À‡ª|8û»³-øVïßÙX×q¿¡ÄÒ•…-«K×/Å=>0­·.Wé¾ýÏ?üþOBººËÂqe=Û¾‚Ãr»…L±_· –r-xWçs³Öõú@ßÊ£‚ÑV­[#—ÑoÇÒ(ãÊýg­·þ.Çrvk“˜ÿ¼–_Wþ­¼Yi½Þ˜•ªý‡Ôí¥º¿ošëz‹­';FÏZ!ÑWÍ5¾Û—þ¹×r+W5ìÇwû($G$Ú4c¶ª¹½ÍÞl܆wcLpÎâù¼ö6F¿Í\`íçU»ÜžýáØNô|˜ÌÛ©ãð›<±Žó†dý59ÌKq³ì¶Lê(œŽ†€;JÛÕ.-“YÇÉ2®VºÎ¯Ùd¯e¿lºhVý¼Ÿ¯Õ’GvTålm´ë­ŽyÞèbL{ïžu¨Ûm£ÙN“ã¦ný<þoyé*»cZ÷Jf\énòBðÀM¿é(Óﺖn¶–ÅXÝ^'!Lz¢U†ÕGVÄ»?·7uf]õ¹5¿ìæ[~÷eè¨kà„Ĉmüñ•vpÇþº„¶®¯rß²£?lmpÙ5V0ÛNÄÀ*{»¡Wô–TSÚªýÞÏá­ñXÛäÙvÀ½ŒÌE›´–«}Ú£vû²bhëçóÆÚʳ­áÂíÊ£4Í{•ï¦®Š¦«ÿwó/ôTåyšð5ÎBßA¬EÍ70ž ¬ù³k~ËAÙ>ÓÆ3_<>]ZùL㵈±Ú=­4éÏU® ³ëÚJÝ|Vd=º®Â»Á®]ÜǯÇ#‰c5Øì¹ê´é?ží+\Daø­æ# Ú;Óém¼G¼G<é[†o4ÿ ŸÇ|/ôùÃíñöyi˜¸µñå\…ÉšŸ?ÖþM½°ÿºþïëñ6ŽÝ”#—IŽ5ÞÛ¯-æ™sµÈOúz8‡Ž³Ég°·“µë¼é@Ï;¦i¡ËëÊ’CÀ ¦iu‰™·Ú†»ÉÏ: W;,q1…0˜:ü~Ú¸©ýqÐ^&ª ¡j1A»óÕP3”ê¬WÔ«F„¡çRÏ#Qvâx°Î‡1¢ÄÿØ”m|µ©g1n“3´¤b -ò‘}Ç;cú7ÚWúš½«õ®Ümêc~Ò÷NTWIÁ-üÀ¦qº«lëUh±ŸX3Úz¢çÂÇ\“º,üxÓÔiµ£+.–1oîø“¹·©ö`²«6<­¸[žfÚ‰ cŽ§®ÜïwÀ´=zÅŠvwûç»W—cyy·’nÕ»;Mó¹<µ9y‚yËE«;|ÿæû‡Ýîùnšâµ­.Gð>Œë¡ÿ+úŒkVçù1L¸qºwwìÁ:ÄR‡ØüØçuKýëü - |¹ùªÈÝQ9™žMõ ¯!÷aGIAm h 9Ù©Ã[¨³5j?XçƒøBGmˆ|ËêÂeÝ èÈâušF—sßk¸¬{ . ^Ú~/{šV–Û¬4ÑÏá¼ØD­wOØG?¯¹ýž×ý¦Nò×}¨´æ¹µÜg!“Û¾«öcèA32/"4u/Ð~°Î±§!6?6#Þn{¸?LßÃ^ïo‰;çCÊ°ƒ~/y>m¥œ§™ËÖøXæFàñeo_sßøM±ö•Ó«˜äŽFž¥~°Î‡³8º‰`¯±‚G-àÚéÕ[' -dT ³µNû2Ú8¬¶âN \q{q»•×NÖÊ3ˆ¢îW÷W/Þõ«Ûdx ->VçÃÙdº‚Í^¦SÀt%âìs'Nôµ;aÚçÁ.¯œü;øÅxJînì¢çËð×CD{çä_±¹°”Duô¶å=VçÃYÞíxn>ã>?µñU3¦´©e¨!¯<ët-š-rwÞ¦•{Y} gNeÝןãïÖõÝöDx -˜ˆø9Ø,0ï&u·È :>ŽÞì<ÛéaÚ}ªUØ~¿cÊÁPJâ·'\K´øv!‡Øv»ÍÃ!¶»ìoõÕð—Õ¼ÝVu-AÛn»V53n ~1ýö_MÖÚm³gÓsý؈[pÑn¥×þ¶Ûìý6^žÚo·ç„<»[¹e 3ëSùó)Ö7Øú6(áFŽ_yŽ´p&’Ê™ß>’'Û¦ÎVeÛó•šõ%›?÷RÛ{7 ¿Š‹_ò¾”S\l宓þÓÉZXÿõ¼R}Gž©äìÚÅ ¿œø–)d¢qè陉ÛWÓÛ"ÛÏP5Ú8™–2—DRi¶¯ã gšëW€hõC«Æï® Ó -ùúö†µc…ˆšÑÉS©—Ê£jiš¢ S÷¹+^¡]ÄaÄÄ/Î>b|ûº'óù¶>×& »qâå„%†ä—SHJé0°Â„fz’èE»œÍ°—Aåg¹×opÍFã7¬ðÿ+T„Neä©_,u“â·$«Ñ ûf'ï•$é±£i°”FY¡.›R·Y©/äPJyÝ^ºklG*ôTšx R<ödÛ­®“š~:VJ¢iB »AÝ”_vä!gè®Zß;±£æz»ƒ;v¾Hrê3nù•W]ÞÞ®°ùF¼Ô…f2›~n ²3}µ â  0ÈF_*¹ykG§ú,×öu8™¶â^N?žê2ç|p|Ë:zËop”‘—=ÿe¾ÅïÿžèüÇöÊ uw¦£…ëغ#Ë•Œß÷›$óû±» :°?È6²¡YC_ÇxM£ºÀÞJÚŽ ¶s%1  -²ë¦ë¬š 7ˆ—I‹=ùÚ¹ özéÛàÐç—M5©p!‡ƒË> -endobj -737 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 382.623057 101.433071 363.873057 ] -/BS << -/W 0 ->> -/Dest (cb233-1) ->> -endobj -738 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 321.676036 101.433071 302.926036 ] -/BS << -/W 0 ->> -/Dest (cb234-1) ->> -endobj -739 0 obj -<< -/Filter /FlateDecode -/Length 4837 ->> -stream -xœå]K-7ÞŸ_qÖH1~?$” "@Dº‚b1sr„&HŸÏn?ªÝÕ§{æÞ“ÉÜ9]åGµýù«*wG]%¾¾Pø'Z%bLÁÛëíÛËw)‚“ø¯”X]õ×ø ©䣻~›&ˆœþúzÁ?Ó%-þzùóÏ.ÿ\×QW-RòZ¹ë¿>f•5"ĤcT *© £rN„ gT^ ÜbJœ -f¸`µÝªÌ°):N3¬Ö‘QE˜alPf«J0Ce9ÌPÉF¥$ìPZJVC¤µF3:å„Ç {N§•ð1éÄêt*hNgŒðÁ*§8]Þ{9…-.IÅélqÊZÉé`‹51p:[Œ7’ÕÁƒát¶hŒNbt¶]‘ÕÁé¥âtÉ—¢µ¬.A'cˆ[–N¸hŒätJ lV‡…IòÑiØâ¥K¬¶8#5§3°Åâ‹Ó'œ 12«UçÕm¤QœÎÁ­ƒeu°“Ï1€ö°EÏQVȼÄq€Aؤ-G:a£ 蘄 Áp4 “Ö§Àñ€‘ -:­8"0¶8ë9&0 -¶X¬\V[L² [P€ãc`‹¶†ã¶µ@ ÇtkeRð­•Ês\`@¸0Sr\`À¸&zËqåJ‰ãÎ5àNŽ HË=p\`ÀºÆyÍqí=Ǽk¬’Xð®1¨Éê` ÌqØQ Ǽk” Xð.–‘渳*€CÏq°"tŒ’ã ÞÕQZŽ ,xW¸VÖ á¸À‚wµÃ-pž¼«ÔXð®¶Ús\ ðd£ð.(ÄñálÁr\6 1¡–p\àÀ»*Áý1kl%TLžãÞUÓÇê’P#ά[Œ²PÞ'Ž xŽÊp\àÀ» ÏÈq8^À£jŽ xWxjNÞU:IŽ xqƒã¸p -ÇðoBI@—Õ%!SŒ8ð.hIs\/,d“°º $ÅqÈXHÄ¡xð.Ü{â¸Àƒw¥3†ãÞ•a«ƒ-&jŽ ×@‡eˬi«Bj0§ïJ…ætà])Câ¸Àƒw³Ûä¸À‡,Бã(kŽ |´"…à9.ðIB‡ÕykÇqA8P«ƒ-6XŽ X‹dRä¸ hØb´æ¸ hØ‚ãD")Dßlz[6?°°‘"Ç`2“µç‘aT9×"Ð5«‹Ð©ÀqAVÀ+Ž K‰ˆEÏq^äp‰ã˜²„[°T8.€+Q#2çt -¶ È渑.tJq\5lA4ÈqAÔY¦—ÀC#—ÄPs:+sž9.ˆÖ‹*r\€e‚LLÉê` h‚ãÌON¶ÇH~l"Íau°Å8ËqAŒ:§›‘ã‚a‹–šã`3ç›ã‚$a ">Ž ’ô"‡É€Æ¡“’イ"òMm9.ÀºÌùfä¸ ‰|)³n“ñ9ß $ [BV[4%fÝ‚“o‚8‡-:YŽ ’÷9ߌ Ì@¾‰ˆžÝˆ9ß ìvx×%0§ï"2õàù&"[.·— ^Ÿñʘ3ÎÈîHP¯ƒoe· $¸Þ*°{ä›s$vÓf"³ŒžÝ5€[…RIvÛ@‚Ù ',»Ot‹Ê>3†|“ ËÂ"ºï9Ç(fvŠ-ûcÿúÛåçOp¾×¿ýûòò³²SÖ¾„RÚ"¾Â2Ð Óí}+ܾñ‹cÎ$•-„ï©“i©@‹uÓ- ÷—ÿ»n?¬,‡áÙtÔF^äó^@œdíLTZ·HŠ‘èì3‡Éo®shr@„®ýƒâmCEûcÅÙúæ:ŸÉÖ1F á4RhœçÇõdÏ>®´ß³ãz²Îç²Õôå’rÑ2pàä”Y) -h§öÆ*ŸqåNz”1Igo -ŠD$íªð/?\@¬ÕŠeϾ_óß)8Jí®¾½üüw_ýé¿ÿãôáåò—_H0á—_(üt±þ ËOûŒÏºÊ\•Ýêõ7¤^˜t­hÿK'×rÛÊ×þtÎ9žÆµuLÿ­îÇ\xùœÛÎßÖWÝÓ°³×k÷Dê´þ7÷”† M§ßؾE®–ßµóeÝoïS±TòË¿^?|uùÕ‡5K6µ²V6Z{€ÝsU>»ßdSº Ù6”–Lk"Cú²…X~@R¦Ø®§8Ë7SBt&vLSïÿy ™UC¯\íË8±S¯ß -f<ˆ²á,ghÛHæ'L`ÖçD30y²Î£Yþ=T6ØEæD~+¢i²gBªS¹‚>»ž±Ãmmø56È¥ä¨Fù²z0Ê,ÈR!çiõs“Uýç³emfÐYÞ^A›3ƒûh;WçáÐfïs`˜P&×ÐÝššÜØ[gBm¹aæ›#$Ò ÷ÃØÉ!²#Ÿá¾^W®mWt5)2VfºÛ¶Íå§îNßCÃä¡É>ETλROÇOè©Ž¨ç5߯rÑwö8Y;vP8â>ë´Îúx´[~²Îáð`ÿò§ô¼†AÀ*‡ïŠaÚ=ã͈×LyaW-{3wQv®Îáì ÆãffÞ9Ÿs¿½g/ôYÍ;b½{Þ˜òÈ&ê|?«]ýéa|¿—™ÿhF¦<æˆÉlˆBüQ¦p²Îáè~7#EÓÙ¢Ïȼ’r¼¢>׬19/å9f¯ðêÓ(Wžâež{®OõÑɪÏ^ï¶ ¾ÈÂ"+×Õã–úϤnÜç&+ßþþÍÉ:†*{°wמÖ?ÕÜëiñžÏµ\,-3cVgÃ-ó“-’nâ‚&K³‹‰i»›—}žl^z$¶:»“|²Îáñ`ïî{@ÐÞ«P»oJÌ9*ƒH:û«·"&/Ißf {póënón åx7ížô:{~öØÓn̼kÔû¾ÝáK²÷–áBG¥ÝBÏÕy8„Þåf„Îo6>bò³Ý½/=! z¸½\ôèé]o÷ÆĔӮ7}*÷û:ï½±Þê°é¾Îdö{z'ë< -bÁ)ÊßìÅMY·›PPvâ¹ÅŠ+ç|‘ËÞ“•¼1ûYíJï î{v{É*Õy5U;MŸõ c_àïg©N¾ý=›“u ©î ¾ÜAêÊ›þ„vaöV&}Î[ìx‘Ä»veN½Y»ƒÎwÄ›'ë<:âÍÝu½W¯èÏ™åTÞþß¾ƒÀ¦ ʯÚ=9Wåáðwüâ{Ÿb Œõ1î¿ä—­K"#«[×/Éojåü2JÇbÝW¿þíoþH¬+»,9®$o᪫µSÜ×Q‘-\ʺ¼£óܺ\oäµìÈΖ6FV¶”±~ù†ÆšÙYsd¬J?O—¹úSŽv¨ >ïŽSšÇ)¯9ƒ6´Ë¾uÉBóÏœ™Ú|¬"l6·ú3T¬:|0zYŸYŸeÙ?dþÔO‹¬ØŸˆý•G˽¾¬×éÖŸñ¿cÌxß»æŠeg“òĽñŠþÖmüXÓ3v\ó;k¥ñC‹[º¾Ž×.V>:/¦ç†y÷<0æÌh—óÁdœ¶<¿Çíºñb½×¦ï~UŽ1ië¡­á{ã9·4®ïç©»ã‘OØ\ã¦a‘ø€6¦›_tF¢ëM9 Õ©‚‰à~Óù\w(ð×ÇY&ų Jq!ÌëžÅíú/“°ÛaòB¦|ÜÙÔá_¦-‹²Åí‡ìÍ › -±ØH£ë0ÿžM~8 ”źèíw-bŠFæ½h}uD)¢òoûÂ}0iiEŒׯ;^éG´£òüËØáúu=(8Œ³sù¶èT$Ç -uŒ9€äö¢v4ÊUM‡¦¬×-šÌ€›xÕÀA -ùÌ,nÕ–çã)7V¬¾­Ã ÎÒíŒæžjHZ´ô£†™-4Ê?M ;^d)E÷4—¸:/7éH鯦*…=H¨ÚÛoá ±gæ¦ -±r›©üîâËùoªœ*}JçC¯ފ=†tÍgÎEi¬jS§Ê`«ëNÍr´úw½T=m]æXóá{ËQì䢖ÿ®Lú·•¬ðm_¤œŒ,‹ôæfñë%»Nˈ­›+â,¬eo˪¾WÓd7oi. r“õãØÐÉŒ·|Ô®ÝM®ïZµ|b™•­)gv-3BÔôj+Îw/…ªâ|ºx¦^ùnŠóÍfGƒ–– ŽŠ‡be$º­P’î†XÛfʧQö¡óCØM§C§Èô·²:é¼'¼]Э™¥¯¬4ŸiÜšj£«e—bTêR×Jö ±}žÑí¿­i‹Éìz2kùdÈEl/—Z9Ft»°åjk®ÏTè¥â¨šÚÈSÔMìÏÈndÓ3ä?—@Öˆ4íãZœ÷ãú\ËHp£7ÂÛ.Ænį˜Ònp…t zThH»]åÀËæ×E—OXšM–ÏÕËÿ.Táº43Où l‡T>s\NòÚìâõ Q¹ï¬c¹P6Œ²d¸T³t¼T”LùLº½t±•” ‘‡ÔÌË$ÕÉc-Vu]œ)¬OçJ*”Ít7Ä®Cùu%vº¾TìyEàîz»Cì;w¾Rqè3®òA§ÝÞÞ.Á|ÞŠc³³8C?¶N†XËîíFgD8 ) ñ Ñ×"n«µ³S99 ~‹Œó¸·Ëß/ÅÍiãtN ¼QùÜny©ëPæ+|ÿãb¯¿oE.~\ËκsëJL=Yþ+ñ¤8ÿÕ‡&숵%´?Ä*Ž²®¡¡ûq­ _ÛQ]bo%UgPÕµTèƱîÐÕÊ‘qw„·i{ ó©s3öriÚÍ¡“mVá‚Þ.ãЙᒯ¤I\å¢Ã¥Ck5©ˆ Ú(.I‡iX¶23’vÒ‡>ÛoéT˜Ü¹ aD¾4Cg‡›¥M7Y¹ R!°¡´a«h§iecô»—×'Ï{5Ù·¥Ú»ô•Jûei'<^jÊ¥__vŸc®ù¢-Þ1B½-CÖžéAÎX#´°« ŠQ"£Z-àh§¶ÉV6GÑé2Ùd½ÅÐlòµZ–rÇ‘¥ÐcŠ!ý;iGg¥¢£³â7es»ÍãõhÉôÈQ8‡qwr”ì±dddžÖîR;Jš&Ûöm×}7o{%·a‡!~D¦rTs›’ïâ¿÷¬¥Î´Á•j_ewDÅq´2µUÁhSþZ–ŒÞƒClþƒÁF²]òæ:÷÷O¶»$mÿ„ö„éÖTþ»g¼ ¯P¤ciªýM4¾Z’ì-½m˜í¡Asr³;TþðMy‰§lõËSÅüw®LzcþóA*þ —vÚ€Ym¡”¯ÿÜ,V« -endstream -endobj -740 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 739 0 R -/Resources 4 0 R -/Annots [ 741 0 R 742 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -741 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 172.623057 101.433071 153.873057 ] -/BS << -/W 0 ->> -/Dest (cb237-1) ->> -endobj -742 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 111.676036 101.433071 92.926036 ] -/BS << -/W 0 ->> -/Dest (cb238-1) ->> -endobj -743 0 obj -<< -/Filter /FlateDecode -/Length 4534 ->> -stream -xœå\K䶾÷¯ès+|_@àC€$ˆ‘1°HF»íÁ8€Cþ~¾¢D²$U«5³kc‚ì`vZU|‹?KjÙ«ÁÏÿe²SÎ%EºÞ~¸üx1S -ÿj‰ÕEUß®ÖPš‚-1‡ë,ðiJ%¸¯Ïü·¹”ÅŸ/ÿÕå_ë:öê¦R¢³áúÓGV‘ŸRNÉEU 2Ö+ª¦”\ˆŠ*Ú C,ESÁŒÈÑ^•`•4Ì ç²¢Ê0ÃS²~¯*0Ã%Kš -fØ’¢²vXgŒªƒ!†È;EgÃáô¨éœb.®¨ºMNÓy?ÅD6XMW¦cÈšŽ`K(Æjº[‚%2š¶ÏIÓEØâ£7ª¶¸œ¼¦K°ÅÁ;EÑeØteU[L4VÓ?…’‰T]Îä”÷:g²÷FÓY;`Ó«:¬(LRLŠÎÁ–hBQu°%xã4‡-„Mž>嬬VÇ«Ûo5]€-Î%Ru°“¯1€‹°Å¤¨QVÐļ¤q€Ki¢âH#—ýD™²Æ.—‰Rò ¸&Š%i<à…ÎY¼-¢ÆÞÂÂÊUu°ÅÒ¸À;Ø‚x[y <Ø–€ <è–L±xð-5.ð \˜i4.ð`\Ÿ#i\àA¹€RѸÀƒs=¸SãÒÅrOx°®Ñi\àA»žrÔ¸Àƒw=Y£qw½GMU[` ÀŽ“·Ùk\@à]oMÒ¸€À»XFNãÌêF €•Éål4. ð®Ë†4. ð®KØT]š°½ÆÞuCÐvnð® Æi\@à]G.j\ Là£Fà]PHÐÃØ‚Õ¸û=tÎk\€Æ&‡°Dã‚ÞµÛŸ²¦ÁV“Í%j\À»6cúT]™l‚Ç•u /O6Æ¢qAïb£òð.è3k\ŽŸ°£: x×zìÔš¼k]1ð.↠qà0Y`›¬tU]™LÉYã‚Þ-9 ° O&ƒIT]š$«qÈx2ˆC5.ˆà]lïEã‚Þ5Á{ "x×ÂU[|v ®ËVYÓV'ãÀš¼k,fXÓwIEã‚ÞåmS゘Xà²Æ0pBì4.ˆ™¦’RÔ¸ B>U'\ ’ €²Tl¡D °žŠ/Yã‚ä`‹wNã‚ä` B LÅ"úV°pQÏ[)j\&›r!Ò¸ …ˆó¼ªé¢›r]«º M¤D¶b«qÎRSƢ׸?q¸¤q̀ΒÆ©À, °MÙ!2×t¶ ÈÖ¸‘.tÖj\lA4¨qAv§Ìh4.À³$\­éÈð93k\)N*j\€e‚“&˜RÕÁЄÆ˜>l pøÁaÇU[| rv|ÜÌä [œq›|ÞL[ñi\PLœ8LÖ¸41›qÞt¤qÖ%Ÿ7³ÆÅœ7qÄSÖmñ‘Ï›Iã‚B°% DQu°ASQÖ-8 çM°“¦‹°ÅÒ¸ ÄÈçͬq œ7Ñ«)Ìçͤ¦ À»¡€™4x‘iÔ¸8o"²ÕÎöÄâ3]™ùęՌõì­jÊÀ€{±[%5g`@¾|FR“0'ËÕ¬¶U(­QÓü‹xŒvœ0gŸdŠ* {fN<È‚eAˆîû™cówŠÍù±Ÿ¾»üú=6ßëwÿ¾<ýªfÊÚE€PKðŒeà -¦; ú¶¾8`VË`ØKÊr§© £,hpI²±QØîøßuÿae) ýzÝ-0¥õkH5òaéÏk&hÄSäGféY['¸ÇÇ[ù0öÅušœ¸”kÿ`¹Tö+§roë‹ë|&[‡°{á$Ÿ÷ëÉ:ŸÝ¯²ß³~=Yç³ÛÊQhÎceˆ~ƒ¾ªþ¹Ö>¨Né1Ž ¼©4u®Îg4yO¸¿}wAd1ßÕˆW‰L79Ä Ø@ÞýpùõW¿ÿãþú5æêÝÓå›ß`»ËÆ„øEpEøLàùsâ³gçëÀ:–?q™/ÿq}÷•ìÓq‚­ðQvÝ'wc¿‹ÿî]õœïžKŒ^ᜇW,@‰`ZX…³_XåS|½¸CÀñã›|qîaÇè˜×7~§ÖùìŠ~i}è›&Ä"”s¡Nß¾úÛ_þ,¦Á¼_~ý—_X\Ómþâü·É6Þà–Ïi£kÃÒF^·Ñ¯íR·ÍHÓ] Ùà@Ô’f€„0÷²B_vKO®Öì„c ˜ÑM‡G²|4Ÿñ€Ðs2ˆ¤x¾!t²Î›Ãl9ÀÑ CÕóyŽ‰†37°a¿˜â \¶zO‹~ƒ±†É{ýɶ­ùôvW¶nqÆŽêчÑ~ÿë÷vóýGët:ã¢ßW4¶æQx²ÎAá0 Ñb±þ-ØÌ2šüæ/-Þdd¥å7*HØÎbCÀ‚X*âs«C:Zi]—7e>ô‡u · rÝ‚*Ú Ê wÛ„®·ßêYaû¥²ÎG1žp€D×¹-pv.çši:Fâ¹:o‰tŠé½²÷5ﾄ3ÌiVÌà©rÏî3n6È”<Ô¸Ïé¨núíJ‘ܽãIÉm'9øl{+Û?•¿u,‡Á†&g)=Âò¹:oËñU_Š#Ìõ9ñ›66ka5¿›ù#É~y3÷[üß‹Cµ=üAÙ—®)—^gs_ [^ØÆÖ’OÌFN‚]5TÜÃØà\7‡âê'0Ì«gò£ØÏí@òªí¸¶i[ˆSÙ½)»…DÈ.¦Q˜8ÀÎhί„Gl~j…¨xõ".Å°˜ì8~ˆ×“uÞ^ýq,{š^ÀpÛ²ãLe”Ÿ)~s±ì™hMgW/b×Óh=WçÍ¡õA¼ûRd}ì¹e´§MÝVïD¼û;ºîMž´>#µøÂÌÇG ΓuÞ:D°¿:WhúRÍq–É1š~)2žd=?m]V3ž5kÁÙŒ0z¶ïçL§ë#Zï -#–453ÊekªýCÃê|½“/eÙ+üÌ\véâ­›©)üZuÜÇ“YÒöë#û1×á2ó.³¶£¶'íŸsµgç¥ã¾iã -óÚéý›Å6;ìá1Ö~{Î[î¨kß´h­_–Å_ëÜÑzÌ=Ê3Ãß=K}Ûe¤å¸’â*#­ß™jÙNôül ??½o§ŽÁ/öÄ:æ;ÐÊ=;ÌK[óœYr»û¬»ågúÉcömW<ßæè¢Ú¹ŒwÆG‹Žç¾jÙ‹/›:ÛüÆa˱ˆ6ÚõRÇ<-r1¦õús½«ÛqÒpÔì8ô­ÛŽ»ÖØžïf¨ë ò¼^[..vö55—›÷8‰Ýe-Ûø¼ùRpÂ|ÂYôO¢Nó4Ö¢\‡‹-ñžßýF;¿mçç.úü„e¿¿-œt0¿u_nþŽ-Ÿ7ÇAÜƬcLÇúÚÖÖÛhíè£f¸ýÈÜñYÜúl×?ÍmVûì~íT¿-×}¾¨qù¢¿” Ã!,:;ë(mð!0·„‹e} Þߟýw~8ÜËÚ>voÛ¯µ3¸o«s»¬)mŒÌo¼Æ]˜o»§ùoåþ~sÀmù›YtÌnÎd°že¼?1»÷,;òSÜqs(b\·½¯:—Ó÷yGVb'´=BâãÎZiüбÇ\UÿÝãèOà€>–Òð|è«Óò˜CµÑÌøê~úöx¼ý‘ˆÆ‹ —r]Ø—blum‘ð÷Éöùõõyº·7í²íø](}·Ã'Sø»›¿GìJwe/d¢óE¦óÔGùæ?êÏ)@©‹õN°wD)ñ·êcT”Ýd=¥€èd·¢&kS¶ñÅ R³zÇ`r†¦TLAl¿îx¦ÿ™Ë+@.²wë)w%Öwô,‚ºT²‹Ö¸_ðq»u§GOKå`ÇrÉßçwáÁ;Yçä£úJË1­4~ÚnD¬k$¯ÐiÄJôkdõòáÕÌËfE=‰~äê¡u¹9š]²¿ô“‚¢.G°>Œëó~¼ƒÈº<{ á€9œ¬óF9Ì.ö‘ÿ÷(;ϲŻ#–ýüÏ£®;<|¢9¤†ÍÀØæ¹n“3wã ¢Ú¶ûâ”D„¦Å'ë¼< ³K:ŒýòûíæsXûý51¢šÞÙ~³ÉnàÎ4•mIltfù8ntòî7t¡†ë‡V¿VL¦òõ‹µsÇŠ5£Ý‹yôf²‹8ÔÇür»)!6›! ’,;Š­7BöB#ºbGÍ˯Œè®‹CØM—®³bú[Y—Ät otë·ÒgUÊ/jM5ï:Óe^Uº4´’}B¨Ï“"º]á¦5M˜Ì®³Æ¯o˜…¹‰z¹ÒÊ)¢ÛE-·´úL¥^*ª¥y~˜2 îsw¼"»‰‡¿ÓP¬ãÛǵ˜ï5÷¹6YàÆí„· ¶Ú‰Ÿ/!)¥Ãà -ô¤Ð‹v»8›—!M¹¹ -K³ÉøËïüÿL¡K™yêKRü‹q5:áµÙÅk'Iyì¬Cš,¥QV¸Ë¦Ô1+ý…hS)ϤÛKw­¤ÂeBžJ3Iª“ÇZl;꺘)¬ù§s¥šfºâСü¼;C_ªÁô΢p½Ý!Ž;Ÿ¥8õ·ü6’nooW`¾ ouc£­˜¡Ÿ['CìLßíFgB8 ) ñ Ñç*n«µ³¿a±}‹LÛqo—ï/u›s>8NyGoùåZ2ò²×ÿ ÌWøýç…®nos˜÷qg:[¸Î­+±ÜÉøUŒù¤˜_ÍØ„}Ù¡#AûCló(ú>îœàkÕÍ öVÒvµ]+…aøPˆ]‡®³^x&o/ö@æSçflØó¥oƒC7žßҬ….óÐù±%_E“¸â¢cK‡–œ¨ˆ Ù(.E‡eX¶2“);é®gûIN…ç¾Ä…#øÒmV6Ýdu¢B`//dÃde§eebô«—×'Ïûbrl+€¥Ú»ôYJûÀXÚ O—úz×—}Ïñõ~D[¼ÃC½-/ÖžïAÎX#´ Õ…ĨæQm)d§Ôd«NÛFÑé2Ód½ÅÔlŠKµæ–:â¬z)õ˜bH¿—žrVºƒœ•¸+Ëí¶¯GK¾@AÂ9Ñ™Q²Ç’Y‘EY»Ki”ôM¶ï›Ö}·Ýö*†AÃ8"S3ª…]ÉWñßkÖŽú - ­Tû©Ù›Çû°Q“MÞùúJk“c‡¿•0Qé’×9Οì³$-"{ÂtLä½I–_N®›ð Ey¬Mµ—ëÕŠQ‡ô2(é¡AsûžÔ·ÓÖÔdMõËÄGE~µç 7ó;4“Ñß]Ñ¿¯N«Jýù/Axýe -endstream -endobj -744 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 743 0 R -/Resources 4 0 R -/Annots [ 745 0 R 746 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -745 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 327.123057 101.433071 308.373057 ] -/BS << -/W 0 ->> -/Dest (cb241-1) ->> -endobj -746 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 266.176036 101.433071 247.426036 ] -/BS << -/W 0 ->> -/Dest (cb242-1) ->> -endobj -747 0 obj -<< -/Filter /FlateDecode -/Length 4792 ->> -stream -xœå]M$¹q½×¯¨³€Mñ#ø{0`^X†XÁ‡îši Ƭ•þû~d&ÉHfdeV÷¬TZM£§+#øI>¾ˆ`f³õUáë;ÿ"é)Æ<]o?]~¾¨)8…¥ÄꢨÄwpW­(LN'Ýõ§,°a -É™à¯_/øo¸äÅ¿^~ÿ›Ëÿ¬ëè«™RòF»ëŸ¿dÙ)Ä”T *¥­ rn -Á8/¨¼žp‹)I*˜áڪ̠¤‚dLTfX -ÚnU f˜ IRÁ \TZÁm”u0DY#è´›<ÝK:£'“I¢.@§ƒ‘tÖN>vZÒ¥É{#Øâ’Ò’ÎÁ§‰”¤ƒ-dct¶Xo•¨ƒ-&+él1$è"lº¢¨ƒ-Ê+-é’\ŠD¢.A§bˆ[QnrÑZ%é´ž°iEV&ÉAg`‹W.‰:Øâ¬2’Η¤O8bV«É«Û*«%ƒ-Æu°“/1€ñ°E/QVДyIâÂDÉD&Ú‰"E‰LL…`%0ÉMäSxÀ* ÑX[y‰ ¬†-„•+ê`‹M$q5°$.°¶²X°--XÐ-©¤%.°à[RÚK\`A¸0SI\`Á¸6z’¸À‚r¥$qçZp§Ä¤‹å$.°`]뼑¸À‚v-E/qïZÒJâïZ‹š¢¶À€'«£•¸€À»V« qw±ŒŒÄ˜Õ 8ô+“‰QI\@à]I\@à]àD]˜°­ÄÞ5· ynð®qÊH\@à]CÆK\ Là%Fà]Pˆ“ÃØ‚•¸þ:c%.@c“AX"qïê÷'¬i°Õ¤cò8𮎘>Q—&0âºÅ(OÚû$qïÂQY‰ xô%.ÇOð¨FâÞÕžZÒwµIJâÞEÜà$.&@âø·I+@WÔ¥I¥%.pà]Ð’‘¸^xRL"ê i‰ @Æ“B*qï½'‰ )èò‰:?áÚI\”%ê` ’¸õ”lŠ[¬1[2H\€ˆ`JÑ·˜ÀÀE̶ R”¸L6ÅD$qApùFUÒy3źu:$.&¸b-qr©)bÑK\‚Ÿr¸$qÌ€N“Ä!Á,‰ àŠ¦h™K: [dK\€H:­%.ˆ¶ ”¸ šˆ,Ó+‰ à¡‘Kb¨%©œgF‰ "ù)‡Š`™ ÓSŠ:Øš¸ó““m'q’$›HsDl±Ž$.ˆÑät3J\#l1ÊH\læ|3H\lAÄ'qAR~Êa²Ä qè”’¸ éˆ|ÓÄX—9ߌ$«o"ÅÖm²>ç›Aâ‚D°Å!Du°ASÖ-8 ù&ØIÒyØbI\¼Ïùf”¸aòMDôâ–@Ìùf· À».™$x‘©—¸È7ÙJ¹½ñº€øLVÆœqFqÇ@z|«¸e À½ðVAÜ3P ßœ#‰›0™eôâ®Ü*”Z‰Û -ü‹xŒ6œ0ï>ñ-*8øÌòM&, BtßrŽ^Ìî›÷ÇþüÇËo_à|¯üßËÛoÊNYýÒJiB|…e`¦Û!úÖ¸}‹¦1îªü+ÂÀ÷ÔÉF„ÔÔ ÅeÓ- ÷—ÿ]·V–Ãðl:j#/òy/ F6÷&*­’bä&ûÌnòÃuMˆÒµ}в­}¨x¿}¬$[®ó­lµmZS.Zº‘;R^=q‚v@ƒU¾!r'ˆb<ÊØd2ëc)#^W´*üŸ. €ÅŠyo¹]2ó‡hºq×O?]~ûo?üç¿ÿîGŒÓ§·ËþA!Ç·ùþ;Ïô6ÿtqù©y½¶r9zÁ÷m‘a™:?VKyˆÊ7¥^®¶QÛ.ú¥½vy“}ém87ØEÌ–Øí¨uÝ ›mˆû¶9V–×ýpŸˆ‚´úý¯ë§.ÿôi ³Ó˜åt*)€ÌsU>‚Ì_)Ýd -ƒÖ?7á×?Ë cÀÁ(âÏ (i ÈÖÞ¸(ê5ÀîÂZÖê ¶6Ýú§©‹a§ïZoÏÖ²È û|답ɇñÑê{vùYFÒíÉøîNÖy6à!Ÿ¼‡¼6ºq˜Í×o0cB›œ6š¼Òcm—†z·a–õB_"3]òöK™F«®ÛÑÚbu oÓ­ïA¾×tYzØßž¬ót袻¼v mÜ0ËŸ@À°þGÊ3j@ÀÉ‘/ #×°:¾®v§-/šÛ/y/È¨í¼­û•VÛ.jYȧh2š"ÑjÏÕy:ÔÞG: -ãŠ÷5Ë,Óz–³|3+L×¼œ:©ã;í–¾¨#Jœ}ó(Z„ñà!_Em8‡ÌÝt„JîåÍ)Ly8Bå¹:O‡Êû1bå OpdîÄ`…kªì•ñê«é­·?œÑ1&Ýi{Å,a*«‡X¼–‚Ç°´ǾÛmF±´7?Šˆeûø.ÚNÖy6´™ƒ¸pŒökZ\ÑÁR_ó‘™ÐB¶1ðÍWYAØ·SBäçIqé¸% ùjÒl¬ìp·m›%Æäuk¬Jýyæçú-Ù¦ÍrYü˜_¸‚CðG1çÉ:O‡Üƒ˜óËÌ-4G - ÞóÃm1Ü ÿN,ú—F»aõZ›cÞ=¬î3Y’yG¼y²ÎÓ!ö\¼ùQDµ8Tä_ñʨíðHhô;b¹ƒL?&7¹³#dž«ótȼs– „öѶá !ûày«fñ%Ï–6™U•»A^=ðÛ¼±­ò÷›Zí Ž1ð/Þÿ/ŒF«zs²Î³¡ÑÞIÊ8‡ ãp¯·y¼2ÎöÐÖ_á<+úk¡|cà ¯níãOtNÖy:´Ä¡wF~õðí…ÍaÎ ïÞ‰çǺ|/öóR~Ü·dÙ͇ŸOѲKõ²óœŠN"ìqãÉ:O‡°ƒ¸‘ïb†ïäHùëj÷hç‰ÝÞ®R™Í#>sàefPú¥ó6íp5_ «½Ø—¿ôþë*{üç´™’Š&¿u•çê<*ö)?º;} ƒ‡r,cø(Š6¨žŸy¡cŒÊÎãûÕs.¾¢âΧh‡ŒBbϨ™”#vËOÖy6ÒÁþå¯éyô6Ïáß»b„vÏx`êñš-¿Ä¡ç§.wQv®ÎÓ¡ì Æ{¢÷dîycÎ#›¨?Êý¬võ‡çñí^Fþ㙹ï1©Çdâ¤-”)œ¬ót(:xÑ#?pP™]ö¯äƒ¯èo5kBÎËyNØÇ+¼úÒË•§x™ç^—§zéÔ¢Ï^ï6#¾ÈÂ,+׋Ç-õ_YÝx‡›âãïÞœ¬ót¨:Ø»«Oë_–Üëeñ–ÏÕ\,Í3cZgÃ-ã“-–nâ†&âÙÅÀƒ¼ÝÍû>¯k^ZF£c±ÕÙä“už î`ïî@ÐîkÍ{oJŒ9ª€ÈÕ;„ü­ˆÁKò·øÜøÆÛ¸ÛÂ9þ±w ·»,ãn̸kÔú¾íó¥c{où—ðLÔÆ!ô\§CèýXnDèøfS}ÇúhVvߥ^<Ü^.zôônõ²þÞ[j@„y̾Æ{Ö[½6Ü×™ŒÂ½cOïd§CáA,8Dù›½¸!+v -ÊN<·Xqå˜/JÙÀ{²’³ŸÕ®ôù¾g³—­R“WÓb§ ý³yì òýì"5>þžÍÉ:O‡Ôƒør©+oú+Ú…Ù[™ü9o±ã¥GïÚ•9õf­ŒNÿŽxódgC§?ˆ7w×õ6>\½¥?f"œSylxû{Gø{l˜ÂT~­õè1ȹ*O‡¿ã·ßû£c¬qûÅïl]š2²šuí’ýV´O”—Ó&ë~øçý—ÿà¿oæÞ4{ W¿VžrB†Ø¯!#[9—uyWçµ¢u¾ÞÈ—²ý¹ô+¶(¡÷YÚRsÝíËÙ†bGÞ= -½RÏÍ(íoƒ,ut倫e±t±Yv…yÎ y>¦ù:–ë=ª×üƒÝ¡^l–QŽS–¹×~éÒ¯úrùŒ ›Ï8\ú²ËŒ¸ü~_œÛÈ}êÏÛv¼Í€äCæ¶í”Qxé£ûîÙãžˈ—™¹ud”7KV³µ-6脶gdö6×Hcø²ŒÁbK >yŒ‚ÒbŸgõ«ì!×ô6rÙ™/k6¶Èë}‡ûúº[$iTã}ß»Ÿù]Éýû)œ²ØÓ~ËB mÒ\®Ø§çúužæ,®_—1ªuü<ö7¥Œ«<6žWÖ¬Û¬ÔžR†aÇU¿ÇjÄÆ™>óû#Ã<Ê.œY«¤¥¾™õkŒÞ½ïÇ`-Ú7nÆ~ÎaòÏœ×P>¨÷coËÏ°èԢËŸ&Ìú,34¯Qó2ËŠm‰ÝײV .Þ:†ÊÚsK9ß×öˆ W×7Ÿûu Þ†y¯úÊ=áîXù£¹ÿ´{NÓ÷îµcÇY6NŸïß/Õëå¾i¹×æuÝUê6—uCl¼Û¿;n^Ýÿãq¼Ï?÷ì(ç-­±NK?Œß«ãÌäÔä­+¿‚ïó‡\phž¬ó®ãW¾aˆéš½ž¦è¨[>4"ÃBxa¯¸Ë«yv;L~R)b8tø‡!é,›”¾ËqëDþ¸Y,q.Žì¤6{‡E&k{^R=窇ssò¤t ¢É|V¹WÀ”RÈÇ{I‘táÒ/3ïê…#ò ™Ûš_‹ïÕóӶƥ‹ß¨>´¬áÊÃ_ºÿÊ?­gkoÙI6 ·õ·|–|’YüÕèÏZû•Û™=+ÿ–\²ÜÃ÷ãTþ|ñå¨:]Ž+U fmòyæH“¦ì–Bºæãñ¢²¤ëÔé2ØúºS³œÿs+µ ¯òY±ùœÀùÔxv±”ÿ¹LúOÙA/5H/‡8«"Ž¦^tñ×KæÄD=Ò?gáòQµ¶H·Ä¡Ên ¤0¥±$–½Z>öì"sÁüѸz7¹¾«Õòáj¤j![Ž›;„¨éõVœï^MzçƒÐãd—+ßLq¾Ú aoxÙÞ`¯x(ÖV1¡Û -뮋 U{t>8³ ïÂf::ͦ¿–5Mç=áí‚ní(ý*Jóñ˵©:ºF5™eF¥&uµd›jó$ˆnAøªM&³éÙ¬åC,ga¬@¢V.Õr‚èvË-­¹6S¡•Š½jª#ßMéP·± ¼ »± <ä¿ìÀÖˆ²õãZœ“É6×È©:nÌFx»ÀÅÐFüõâ‚PÚu®P®B -k·‰£êxéÒüÓü K³Êò€ùÿ™*\“fæ)45Håc<ûUï$¯Í&^—ûÆ:$€¦Ð˲áÒ!4ÌòñÒQ å3é¶ÒmÄVR6dLR5/“T#µX7Ô5q¦°:>+¹PU#Ð]»å¯+q·Óµ¥êTëÌkw×Úíb߸ó+‡6ã:ŸÉÚìmí2ÌWá­86Åú±vÒÅF5o×;cÂnH¡‹;~-âºZ;•£*–}‘I÷vùÓ¥¸9cÉA³·:1Î#/}ý?”ùßÿ}¡ëïê™–³7ª±…iܺsO–ÿ E<)Π¢ -Û²aBCŒö»XÇ^ÖU44?n ãkêÕU'öZR7ÕMË…®!›]£-wGxF±2›î°çK[oÝØ|jµ -üvp»Îv—|eMâ*í.Z2¬".x£¸d¦nÙÊÌ HÞIúl?ñ©°¹/vÁˆ|i»Žº›åMWY¹ V!°å¼aÒ¼Ó´²G0úÝËëÃó¾˜ìë -ÈÒFíMú•KÛei#B­-ËÖžmAN_=´ ÕÇ(“Æ^m)àx§Te«N«£ht™ª²Öb¨6ù¥Z–rÇQ¥ÐbŠ.ýiÇg¥ ¢ã³â7es»ÕãµhɶÈq8‡~wª—l±ddž×nRê%m•mû¦ußÕÛ^ÙmP7Ä÷ÈTõjnSò]ü÷žµ3×v"¤Rõ«ìŽèØO†£&¬±å{©è=8„òßfÙvÉÃuîïŸlwIêþ ï Ó1‘µ*èü'Úd¾B‘Ž¬©úçÛäjI‰·ôØÛCæÔfw¨üžòl¹lµËSÅü'¹lzcþK"AiùÁký%X·ÚB)_ÿùxõ -endstream -endobj -748 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 747 0 R -/Resources 4 0 R -/Annots [ 749 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -749 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 131.373057 101.433071 112.623057 ] -/BS << -/W 0 ->> -/Dest (cb245-1) ->> -endobj -750 0 obj -<< -/Filter /FlateDecode -/Length 4803 ->> -stream -xœÝ]KäȾç¯È³‘ãýsX`mx`;@c÷°ØCuN— £ÆÀØÿ} Ń’(¥*kÆ“ë.TgŠŒƒÁøH†¤(}UøùJã¿äô”RŽÁ]o?\~¼¨)z…¥Ä⢰¿ÃoôW­\œ¼Î!ùëD°qŠÙ›®oü·ºäÅß.ÿó«Ë_—uôÕL9£ýõo_ˆåìSŒÊ ¬ –ÒV`y?Åh|XAObÎ bøèŒÛ²"Äp9y‰1œ1I`%ˆa]ÔvËÊÃDí$ÄÐÙG¥äÐF)‘A”sÖ<í§¥‰gôR6YäEðt4ÏÚ)D§½–xy -!ø$ñdñYi‰ç!‹×Î)‰YœMQâÈbƒU"²˜­Ä‹Å@;Yà%ÈëJ"²¨ ´ÄËvò99'ò2x*Å´åå'Ÿ¬UOëÉÃ6­ÈÊÂ$…(ð d Êg‘Y¼UFâYÈâð#ñ€ÞÆ”„Õjhu[eµÄóŘèDdÁäK`dQ1H€4.I`bœ\6N“ìä’K -˜”'£•`Àd?¹£„ViðŒ–€À*Èâ]ÀjÈâ°rEd±ÙIX` dA ¬…,ÆY ,ÐÖÁZ$,°€[§²–°ÀoÒA À…˜J ĵ)8 , ¦”%,°À\ ì”°Àt±Ü£„¨k}0XÀ®u)HX`»Öi%aîZ‹š"²À€%,:NV'+aîZ­¢„¸‹ed$,À¬N°Ã ale2)) p×$å$,pÀ]áD^œ°­„¸k<† ynà®ñÊHXà€»Æ™ a eþ(1îB¼@¬„ð÷à+a›  ">“™‰2Î$î(@¯‡o· °Þ*Š{ -àK9’¸i1‘Y¦ îÀ­‚©•¸m €¿ˆÇÜæÝ'¾E`>3EdƲpˆî{Î1ŠÙbóþØßþtùõ œïõO¿¼þªì”µ ã·.PbM¹m»`¾WSiÏ!ÃD°mÈ‘„ð‘:$DÌCH X¬›n$$\1Üm¾ö/z)2$&™5‚™22·è©‚Æ\Ù Êúî:?‘¬CGñB"Doçõz²ÎO®WÞïY½ž¬ó“Ëê鹬rË~E!ï¾+¥×í—{B¦(ô‹ )ž%ø…=Yé'z ÿñ邤è¾ËþÕ¸d–-DµÚ¤ë§.¿þö7¿ûí}‡¹ûôzù߯áS!ÄGJðÍWúëúýF‘>=Í4¯ëg¨Ÿî•ri.‹E Üç™•ë ½–Eå—®}®Ÿ­8ó<µaGŸT¯´K}¾0Ô¶~){[ÖmßKY&›7£Œ¶¬¼cœûþæÿ®Ÿ¾=¥ñÌ5NJv¯ËÁÒuéä¥ -Õ¡]×¥ãt6J²õ׳ÔëÒG 6!{QxµåÉWŸéƒM¾^ÊI´2æ[Ub¨Ú \m´¾â28ìª7ÛÇGmÍmù~ÛN°—}ÖM;ªê£ÈŠ¾ŽäqOŽjl.®ôHÆfhÜ¢l´ß”Ö -m—…Fmå*goiSÏÆÞæµ”ýRuá‡-q£¦ùj²P›EÎÖF»®uÔë˜ÿ6¦åÂe6²®ÛP[`MŽCݦõø—¶7·ÙôÝÇâgù,t`Ñ— ¤ç­ ³íí­ƒ;k@X£Z¿c~š¬ªÚI•ÅEÖ~«“ŽtdÔFG àã WÇÞ9—wl¨Ï¥¯úh¸t` t±µAe麬µ[ýŒl Åc¾6‡ú1ýŒ‡æðh3™Lý.ÚS  § Žt îØÓÉ:ObOCl«£[¿_}÷K½?âEyèYð0;huÆ6õ²RÞÊe‹·ç‘NÙ1Yaj•Ñ¨Ç£•‡"##Ýmhdi†]6÷¼èÉ:OgqþÁÞcg-`íA»—æ1ÙëÖ¤سӾŒ66ÞÖ1Y˜Çíqá­Z^ڗͳ²¼î‡û ó*^ô+ÛdxÏÕy:›LÇ(Øì¥åqù¹mµÏ¢w[o -Ÿ»tK›ô«|¢ÓÛõË@˜îI[•¬ëŠ#¡Ëû}·z{².¢R]íV­dZéG«4±Ý{ÏÑ•-cË;WçÙ,/Çs]»+?BˆôáÚ”r•ŽÒn÷©lö ‚­,’gè½ ËÌ»ý¼ ©®ámúåä±ÊÖG¤vÚמ¬ótÖuÝY¸¿šåïßa«õ¿Æ „¿Ã6–Ü,òEÈ(V17câY:ÇÃw´_|ò^œÑÚYG“âÎÀŽÕ²hO¹Éh—œ»gµçê<ÕGˆkºÉ}$ÆÿEv$ße-‚>xÔ׬v'çZ÷µ¶nwÏ*y¼GOJcÊã=«!®Ï“@º]âWª5í0™ÏfNA›‰©’ëår+'n±\mÍ÷™Š½TUsÓüe˜ºM]ñíÆŽâˆt48[#ʶ¯K2ÅÐçZ%f7fC¼]àb܆üvñQ(íV(ßL-k·““ö2¨15Uai6!EÿÏPá;•§|Ñ®›7®F'´6;y©$Nuœ¤íâ(ËÔ¥cì6Ëõ…ÀS(O ÛKw-¨LeŒs@ªƒÇ’¬»Õu2AXÓOÇJNTMt7Ⱦ›òÛ‚<äô}©zÕ; š™»ïírèØùÆɱϸ¦Cýº¼½]fóx+ŽÍ­Édú©u2ÈFuo7:cÄ!@aŒ¾r[­è òöu,2ÉãÞ.¾7g¬7ô†i°šÎ¨å‘—¾þe¾Åï_.îú‡v(ÚìÇêha:¶.Èܓщæé$™N8oľlÑ8ûƒ¬Ó(ë›5t?n Ãk7ª«ì­¤îª;—ýÐ!#›nºF[¦@¼­´Ø™ÎÍpØó¥mƒC7–ŽÓkRá‚—iðìpÉWÖ$®¨èpéà:Ã*â‚7ŠKÖa’-Ä$ƒätÕ“üŽO…¥¾Ø #èÒžn–7Ýhe¬B`Ë/xÃNóNóBA臗ׇ罊Ú - j‡öN}ãÔ>0¢vÀ“©¶\†åe÷9¶¼þÛïÐPo˲µg{3–Æ-Üâ‚Û(£¦Q­ð¼S×h‹N›£èpšj´Þbl2…Z­©¥Œ8‰ZŠ=¦Ô?sM{>+]‰žÏJØ”¥v›ÇëÑ’íçæÇèÔ(ÙcÉ$Яݩn”´¶íÛ-ûnÞöʆᆠaD¦jTó›’áß#kG<ÑO*Õ~ÊîˆNãÑ@ç%FklùË0*… qt¸wt‰m—¼»ÎñþÉv—¤íŸðž0“³VEMãGá Œ|ŸÁšjÿG®–•8¤÷)@Ø0·=±ü‘‡²Y6‰úe¤T‘þ¦‹¥ 7ÑQôQiùÆvã*,¶PÊÏ?v;I< -endstream -endobj -751 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 750 0 R -/Resources 4 0 R -/Annots [ 752 0 R 753 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -752 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 582.273057 101.433071 563.523057 ] -/BS << -/W 0 ->> -/Dest (cb246-1) ->> -endobj -753 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 521.326036 101.433071 502.576036 ] -/BS << -/W 0 ->> -/Dest (cb247-1) ->> -endobj -754 0 obj -<< -/Filter /FlateDecode -/Length 4851 ->> -stream -xœå][¯ä¸~¯_QÏÆÑ…º‹<,°d°YìÍC°§kú$Xœ 0ÉÃþýý([m³\®Ó=Á Òê*“ºPù‰”e·½üýÎâŸLvʹ¤H×ÛO—Ÿ/fJÁàO-±º¨ìðIáj ¥)Øs¸þÄŸ¦T‚KñúvÁ?›KYüíò‡_]þ²®c¯n*%:®ýÂ,òSÊ)™ ° -XÆz…”’ QaE;aˆ¥h,ˆ9ڳĠ’ƒÆ‚ä\VXbxJÖïYb¸dIcA [BRXÖ@ëŒQyÄy§ðl˜"”5ž³SÌÅ•—À³Éi<律È«ñÊc Yãd ÅX K°DFãAò9i¼Y|ôFåA—“×x ²8h§(¼ Y`]YåAÕxÅO¡d"•WÀ39å=Ï™0…ì½ÑxÖN¶éU< -““Âs%šPTd Þ8ç! á¯ÆNŸrV¼Õ±w{ã­Æ ŹD*²`ò5p²˜5€MŒK¸”&*Ž4pÙO”)k(àr™(%¯Á€+a¢X’†ÞXðœÕ€ÀÈ(jHà-d!x®Êƒ,¾†ÞAаÀ{ÈâÈkXà¶kÑ°ÀnÉ«aÞ’±QÃÀ…˜FÃÄõ9’† S*x`®vjXàºp÷¤aêú†°ë)G ³†Àø +ªÓ° w­ÇJ­ñ€»Ö£aAî"nÀ&‹@ìo“50]•W&SrÖ° wKNì“É@•—&’Õ°`<Ä¡Dà.–÷¢aAîšà½†¸kaʃ,>; ×€·U|ÁêdBãwÅ k<à®1©hX»¼ljX\Ö°Nˆ‚†1ÓTRŠÄbÀCȧòâ„ë aA2 @–ʃ,”HÃÖSñ%kXdñÎiXdAÈ a"‚©XDßjzY`.j~@‘¢†@²)" RˆÈÇ UÝ”àZåeðlÒ° %š°[ KMN¯a~âpIÈž% R,p °MÙ!2×x² ÈÖ°‘.xÖjXdA4¨aAvYf4`…F. Uk<2œgf 2ʼnCE à&È4”*²&4,Àüp²4,@òƒdiŽÊƒ,>†9;N7³†9Cgœ†°MÎ7“†Å@D|'“5,ŒƒgŒ†Åf䛎4,€_r¾™5,(Þ ßDŠ§ømñ‘óͤaA!È¢¨<È‚ ©(~ LB¾ tÒx²¸B”9ßÌ Ì@¾‰ˆ^ÝÈœo&u»¸ -Iãw™F p|‘­–ÛoHˆÏtfæŒ3«;а¶ª[Ø‹Õ*©{àË9’ºi1‘Yæ¨î`YÓuÛÀÑæÝ'¹Ea kfN<È· D÷=çÅübóþØ_ÿtùõ ßëŸþvyýUÝ)k-„Zš_Á \ÁtDßÃ÷Iyª¢A²§ -s·© ±,€pÙfc±°àñŸëþÇJVˆÊ¢62¡ÈÙ?2%^sÇÀžÚ:! FFàx•²>]ç¡È 1A¹öV—uèHö+”¤Èúto$ëÐV6$©!æy½ž¬óÍõ*û=«×“u¾½¬…A4{C²_@±*äƒÂßÖ©F¿QѾ_˦hõ¬cÓó[;½Ý°.³í§Ê×uúØÒºNïÑm=~ë~ó?×Oß_þíÓÚ0j¦X ƒØX¬Í1>°¥sU¾Æ–~ *åÈ„¶fâäT5UòÔ6sùŒ¯Ã\èËFýßdÊðÛlÌ¥µûy-Wk‡å¶/£âMc>(<´~:Ï,üŒÏm6÷JK3­^¿,´Ïó§×å:F7)¾ûµHð<‰T8=´©“u>šQYw LˬU-Òò0Ô™aZ™gKH¯³¿¹4ø[+ š*ˆ5«Ý€ lwk©laÕšØ -6‹gúÖCHðºgH™¤õæ}{ª7…¥¯æ/¢®c¹pÀ§W% ý°”­–'ë|8k¤cŒû,¨]ßµÖ°î3l–DR,RÎ~¯/0®Y]-»mOZêvIÝÈÌÖÝiaSçÞò¾]®›UJ]:!sëûv€—#8#ÞÜsÙºðÈBÏÕùpzÈm-´ÏJ«›<+ÝJÝÆ–Ž6ü:SEàÝƘ_éqÌæ. leÍÆ"ÜsòuÜ{²žŒ:¶ãZë뎎°.š*ä=ÄÉsu>œ>ˆ7!~Ÿ…†‡›” Ça?nBýÛÆ"”l…•¼RS÷¤$O¦>2¸g•·±B^êØ›9}¿Ý«"_ÒÇsÏRˆùÀB„ø(¾l[ù·ü"ï­yãR.KÏ^gJ§Ô쥚ë¼ß“6Ì~Óµg–›v“ÌgE¦á8´Ø´[Ëlëø1Ú‰‹ÑË‘sÃ;-$äJ¢žY—¯š^lÒÆE-q¥.žÏt/úðËBä>–™á™ýqßNô|àÕîÛ1˸æ1×qÈAÖß“ÃŒ±¬ôÁ–á–lk/®Ž†€MJÛÕ[–=Ì*ç2ÞÚæ‚—m~jÙ/‹.™š­ôyC–nO­­}½.t1¦µ÷ ;Tlsžïfck9†'AægºU[‡sá·úZõ¹•ñuæU$Pæ¦ÖqB×Ûú9é&Æ-Û<«“<ô²åÕz©ùñº?F’•|·¹‡óÿ:l¥Î:ÔmÐtÛæÌ žˆçéà˜£Z6 Œ«>í…Ý·6…ÿ¡xmWŒI›[k¥¯ê5íôzϧÛXŒÀËEþ¦«^G]äZÐÖ'ýúžéÒ| ÆŒK\¶ípßÑWÙé+še§jÌQgj±¦Î¯ýŒ‡çðh<ÖŽ>æˆFfc¢MšËÕ>­Ùa®¶Øç–~>/ü—aÇÝö‘žÂní˜oÙYûþ.Ëùzªòé¶FÂÎ’Ð_XÖÆÊØà#Gó¾ ó^ -¹y-¨×aÙ_Y0¤~Ç9ž¨ô¼”§¹¬ƒ\þpÝûµ¢ˆ1,ëuïƧ÷ÑßùˆÒ™LÞÐ!-Qd:êï¹Hó”,ÄâS(TîÈâÚüÆ[û Ÿ]4»Ò|мÎÑ~Í‘žÆ|ýxÕ1¼ ßkþÉ÷Å›?Úµ?—ÚuÃÜe ßãB3ÆÚ×ÀŠ#‡úÚ¯%'åx¤×÷ã䑼є¼s~`VëP‹‘·ùôa‡|ñ—6ùŒäèxàdwû†©èòR™rXbÔÔ¿.aÛ­¥vÇ‹dzž„»–8™Â­l:üãf3°Þ<ŠƒöôÖƒºÉ Û?¿0ÿQÝVÐ ¥:ë„æž%>Ú_ê7ÊîÜÁ “u>Œ%χ÷R¶ñi#RÏ÷“Ãz–Š)È_ׯŒéh¯òkö×îÖ»s³ùEßS]%%7ñCÀÆ鮲¬W¡Å–b-hë·¾w²ß›ày ?2·é´ÚÑ=+©¹KðîÜ9©“u>ÈNm÷´ŒI9ð4óbNÜ 4_}¿Ë¼ˆ¾­Ûoô݉íOÅZÝ~ÇsÙQtiðÎŽñïugä¡.ôã¢üT×lüÜ[ðÁ><.zªÊ±Ø!µOGû´•œG­œòjuDJ#“h;µ–¬§¢UV£Íz˱„œì¦Ã#Ä*ÆwôáÇ:MvæÑ­¥“u>ÈüwÄâÇßæ¿ææ·µ‡{¯Ó4º }9<ßpYðÒò¹­iZYn³ÒD?»ów›sx=îà|‚ŠÏùf…žç½œNò×=ž4çxµÜg!“;B“âr‘u¡©Gpr²Î±§!6ùÃXÓ/Ÿ7¿ÃZïvçmÊ°ƒ¾mO¯)瓶ekl(ãbcÆÙ¢ÛÚþ¾æ>ü»âÌ;§KhtölúÉ:Îââ!‚=cg-àÞià£8d׉L¥Ó¾Œ6v«­¸k*WÜžEÜËË÷e[éu¿ºÏ8{ñ㘊Ÿ(~ÏÕùp6YŽQ°ÙËæTuû¾{Vœ¬Èiõï]Þ9I¹ó‹ð`™Ììev\íÖldÚèçþ“:#8#¦’¨î>xTç\¥f{Ö‡tÛǶÂ|Õ¤)mj‰dÉ;më[â£\%ƒ­ŒØÊé˨8Æ+ë>ÿhD7°–‡ìSÀL„À/9ÉÁfñÌ~7ª‡E˜Ðþ ÿö¬ìÕnžO^g[… 8ñk»,¥$~!Ž\‹ïÄq”m—»õîÚmŽÚ낲DÀ¬æ宥k9ÚrW³ªÙ˜qí‹éw°j¾Öþžë§lÄT4»;Õµ¿å.¶< ±j¿Ýò´»} ¡a7•?_b}¹Š­/Ø2W8~ç5ÒÄÉH*W~¡K6žl›:[•m¯wjÖ÷–þÜK-¯25üv3~³ÍüžSq±”ÿ¹NúO[hbý×£`õµƒ¦’³kƒüvá;¤‰Æy²d&.?Mo‹l?žÖh7 ešÊ¶$òJ³ügØ8ÙœEã¨Z5~™VÈ×bÌ+DÔŒvOæÑ›É.d~ugžür»(!6™A ’,;’ù¡øA {¢Ý ²£&åW=uÕÅAì¢KÕY1ý­¬Kb:ˆ· ºõ[ê›J嶦švé4/„*ZÉ>!ÔçI!Ý. -ñ;Óš&Lfç‹Yã×.ÍÄÜ ‰z¹ÒÊ)¤ÛE-·´úL¥^*ª¥i~ˆ2LÝç®x…vç<¿‹XøB ×æA’ù8`Ÿk“…ݸñvÁC;òÛ%$¥tXaB3=Iô¢ÝNÎfØË òãñó/¸f£ñKkøß*B§2òÔ–ºIñ‹§ÆÕè„}³“×J’ôØQ‡4 XJ£¬P—M©Û¬ÔÒ(¥<ƒn/Ý5¶¢ -• z*M<©k²íV×É aM?+%Ñ4!ÐÝ ‡nÊo+ò3tW ¦w­0÷ÐÛäرóM’SŸqËoëòöv…Í7â­.l´%³éçÖÉ ;ÓW»Ñ™ Á -ƒ<`ô­’›·vtªÇ-?‡“i+îíòçK]朎ïØFoù¥˜2ò²×ÿC™ïñùß ]ßÞÂ4¯ãÎt´p[Wd¹’ñ+”óI2¿R¹»Û¢#ûƒló(š5ôuÜ9×4ª›ì­¤íj;WÃС »nºÎz¡™p@¼m´Ø™¯›±`Ï—¾ Ýx~W“ -r8¸ÌƒçÇ’|M⊋Ž%\r¢".d£¸–!ÙJL6HÙIW=ËOr*<÷%.DÁ—~ðh,³²éF«£E{y!&+;-+y¡ßí^_=ï‹È±yS;´wꛤö1µžNõõ2®/ûšãëíôæ¼CC½-/|Ï÷ g¸Æ-hu!mTP󨶲Sj´U§m¡èpši´Þbj2Å¥ZSKqVµ”zL1¨–šrVºƒœ•¸+Ëí¶¯GK¾@Ašs£3£d%³B‹²v§Ò(émß7­ûn«íU ƒ† qD¦fT »’ï¿÷øÎ\g³¡•jëîˆÍã½…X¨É&ï|ý¯(LŽBü6áDYl—<]çxÿd¿KÒöOdO˜Ž‰¼7Éò*¢‹ðFyÌMµÿpD¯VŒ:¤ç l ˜3»Ý¡úVùºY7‰úeâT‘ÿ ÏAoæw_'cõGúhÙFI«-”ú÷ÿ®Á -endstream -endobj -755 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 754 0 R -/Resources 4 0 R -/Annots [ 756 0 R 757 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -756 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 367.623057 101.433071 348.873057 ] -/BS << -/W 0 ->> -/Dest (cb250-1) ->> -endobj -757 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 306.676036 101.433071 287.926036 ] -/BS << -/W 0 ->> -/Dest (cb251-1) ->> -endobj -758 0 obj -<< -/Filter /FlateDecode -/Length 4867 ->> -stream -xœå]K$¹q¾×¯¨³€Mñ|†dà Ëðû øÐ]3-Áè5°òÁß™|D2£ª²zfµ¥õööte‘äÇ‘Ùl}VøúNãŸHz‰1Oç˧ŸNj Ná¿RbsQÔ?à;¸³V§“îücØ°„äLðç÷þ™.yñ÷ÓüæôßÛ:úl–”¼Ñîü×/YEv 1åU‚Ji+¨œ[B0Î *¯ÜbJ’ -f¸@†öª3(E'©`U„–‚¶{U‚&h’T0C'•V°C¥D QDÖ:íA÷’ÎèÅÇd’¨ Ðé`$µ‹¤–tiñÞ»(鶸¤´¤s°Åi"%é` Ù$‡-Ö[%ê`‹‰ÁJº[ F' º[€®(ê`‹òJKºd—"‘¨KЩâ^g”[\´VI:­lZQ‡…IòAÐØâ•K¢¶8«Œ¤³°…ð%éÀΆ…Õjòê¶ÊjIç`‹1DlÁäK `.û6óXñ¾z¬Jýyåçö-Ù¦Íä2'2?\džàïùë<rï8œ_VþhÈã;ÞG‘BÂîùÕm1Ü!ÿ†#ú·F»aõz›“Ó=¯î­íWûoó`§Cì1ókÕýP‘7~Å+£µÃ=¡yßÃG™†ùÉ-®Àì2Öy6dšÛ>g‰@è:Úvœ!D³ùvmOl÷Áƨ¯‡:ë~µ½÷Þ&«>ÇñÊXU›ÛšãØ/åùZ¬÷ õÍ1uó˜Â\Ã’ªØ§ªÒœJ¬Æ­Žwwðî8øÜßÀmñ1Ú<ù‘½2va‡G¯jfƒáK­÷²ú&²~<ÿ”ïg}—øúýh=úè¿…¤„6ëZ,}ê='t¼k6Tûy­ú—±&Ö}>¾9Ni7Nº®‹0áƒaèÖZÛîÀûõÿøîËsuýxu» OÝ5cöÖøÄ÷g.·™Ç\öbÖ˜?ÿÌy2+¿•kWs—š/¸TUy¬åi-k`¿õ[®(÷U÷¬‚“·©²¯8Õ÷Ƕ.gœ¸¶Ïq^»‚õ¶Æûüz6NZï7Çn·'| /ô{N[Þ/å_«%öbãôùöýR»nÜVïuƒm=ðÜl.ëƒØxßmÿæ8íxþÞøœnÚÓŒõ¶1¾o¾Ò—¥|«-Ç!äÃIu°ÎêíÀì`¡ð C2×í5i‰ÎÊŬl ®e{±,ÐY'áj‡É/*åÞ¦ÿ4%iJRßÙÃ!¡ü‰ØH£ë0ÿ^ ÷$ ”Åzű½ -"ÜzLѪœ}7Ç^Ù8Xçi@¤U>Q‡¨ýÃ(_¼¸&£h I%2SÏ8ýe‘~™÷7;`¨g‡v.Ÿ=Žì(¥ŽÒ»Eî€rðR;欧ƒb¶+MæCÏm<!…|N˜´n‹ãñeuF´k6;+Ü)Ž«^_åèŽGlÓ½Nu6ªóÙœÁüÓ6åMõqLìÙfçeÎTç®ðsL{ûÍböl¹T!Vîa7•?|9óN—sO•‹6ù`ô³§%ûj!ó9{QYÒmêtl}¾R³'ÿS/UO˜WùÐÙ|ààzü<»¨å*“þãI'Zòø—,P9 Z1ÎÍâ÷SÞt~»é|è4›þVÖ6·„—ºµ³ô]”æsœ[Smtê2ËŒJ]êZÉ>!ÔçI]N‚ð;Õš&Lf׳Y˧a®ÂØ€D½\jåÑå$–«­¹>S¡—Š£jj#?LP·±¼ »°oÈ"‚­eÛÇ­8g û\«ÈpcvÂË [ íÄï'„Ònp…r z\hY»]ÕÀËæWd×OXšM–ÏÌÿ®Táº43Où ©C*Ÿ:®F'ymvñv¸ÜwÖ!i4…Q– —¡c–—ŽJ(ŸI·—î#¶‘²!còšy™¤:ylź£®‹3…µñé\É…ªî†Øu(¿oÄÃN×—ªS½3¯Ü]owˆ}çÎw.}Æu>ܵÛÛÛe˜oÂKÙØhgèÇÖÉÕw»ÑÃ@ -CˆŽÏŠß•Íí¶¯{K¶;@ŽÃ9Œ»S£d÷%£ ó¼v—Ò(i›lß7mûn»í™Ý CüðLÕ¨æv%?ÄY;k)!•j_%;¢ã8N5é`-!LEïÁ!”ÿÈC ÈÒ%×¹?ÙgIZþ„÷„éXÈZtþ[o² ïP¤û -ÖTû;prµ¤Ä[zl„ôР9µË•?öS^\*I¢~r¨˜ÿ¶—ÍNoÌ’$(-¿ÕC57)”òõÁˆH -endstream -endobj -759 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 758 0 R -/Resources 4 0 R -/Annots [ 760 0 R 761 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -760 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 157.623057 101.433071 138.873057 ] -/BS << -/W 0 ->> -/Dest (cb254-1) ->> -endobj -761 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 96.676036 101.433071 77.926036 ] -/BS << -/W 0 ->> -/Dest (cb255-1) ->> -endobj -762 0 obj -<< -/Filter /FlateDecode -/Length 4921 ->> -stream -xœå]]ì¸q}ï_ÑÏVæGñ 0öÁ€dYà"y0òÐÓwÇF0`‡üýR"Y¢J-ÍŒ×n¯ï o·ªHªDžª¢Ôl}UøûFã¿HzŠ1O×û—Ÿ.j -Ná_)±:(êïñ -Éé䣻þ˜6L!9üõí‚ÿ†C^üíòŸ¿ºüϺŽ¾š)%o´»þù‡¬";…‚r‚*A¥´TÎM!ç•×.1%I3\ C[U€”¢“T0ƒŒ‰‚* KAÛ­*Á 4I*˜¡“ ‚J+Ø¡R¢†("kv“G§{Igôäc2IÔèt0’ÎÚÉÒNKº4yï]”t[\RZÒ9Øâ4‘’t°…l ’ÎÃë­u°ÅÄ`%]€-½“]„-@Wu°Ey¥%]²“K‘HÔ%èT q«3ÊM.Z«$Ö“6­¨ÃŒÂ ù è lñÊ%Q[œUFÒYØBø“tà gCŒÂl5yv[eµ¤s°Å˜@¢¶`ð%0¶¨à% -À š2/I`B˜(’HÀD;Q¤(±€‰i¢¬D&¹‰| -X¥¡3Z"«`‹#/1Õ°…0sEl±‰$.°¶ €ÄÖÂCVâ ¶% Eâ º%•´Ä|KJ{‰ ,f*‰ ,×FOXP. ”$.°à\ À‚t1݃Ĭk7XЮ¥è%.°à]KZI\@à]kQSÔÁXâ°ãdu´x×j$. ð.¦‘‘¸£:‡^â`e21*‰ ¼k¢"‰ ¼k\€¨ æ •¸€À»Æá$Ï Þ5N‰ ¼kÈx‰ ” ü£Äh¼ -qr8[@°ÀßCg¬Ähl2K$.pà]àþ„9 ¶štL^âÞÕÃ'êÒ¤z\˜·èåI{Ÿ$.pà]8*+qï‚>£Äàø ÕH\àÀ»ÚÂSK:ð®6II\àÀ»ˆœÄ€Ã¤H\ÿ6i芺4©£Ä¼ Z2À O*‚ID]˜$-qÈxRˆC%.ðà]¸÷$qï*g­Ä¼«a¨ƒ-6‰ ×@‡i+Ìi«“2` -IÞU#,éÀ»J…$qïf·)qY`¢Ä0pBl$.𑦂—¸À'B>Qç';‰ ‚‚À²Dl¡@ °ž’MQâ‚``‹5Fâ‚`` B‰ LI#úÓظˆùÁDŠ€É¦˜ˆ$.Î#C¯J:o¦@×¢.B§ƒÄ!ÐW¬%.@.5ELz‰ @ðS—$.€Ði’¸ $Ø‚©"q\Ñ "sI§a ‚l‰ éB§µÄÑÀDƒD‘ez%q<4rItµ¤#•óÌ(qA$?åPQâLdš`JQ[@`|r²í$.@òƒdiŽ¨ƒ-Ö‘Ä1šœnF‰ b„-F‰ €Íœo‰ ’‚-ˆø$.HÊO9L–¸4R$‘o’¸ó2ç›Qâ‚dòM¤x¼MÖç|3H\¶8„(¢¶ hJ¼'!ß;I:[L"‰ ’÷9ߌ Ì@¾‰ˆ^\ˆ9ß ârx×%0“¤ï"2õàù&"[)·W ^ŸÉʘ3Î(®(P¯ƒo— ¸Þ*ˆk -ä›s$qÑf"³Œ^\5€[…R+qÙ@цæÕ'¾D凟C¾È„iAˆî[ÎÑ‹ÙbóúØŸÿxùõ Î÷úÇÿ½¼þª¬”Õ?¡”&àÓÀ$ ·Cô­qùÖ#Ë~9sT6ö} J6!¤n¢).KnÙD8¿üïºý°²f¿>;\˜púÿJ¶–þ š¹íöß~¹€_æµMŸÛFjçór&™[F_~¼üú»ú—þ÷ï‹/¯—?ü J¹¼@±„Ïwg29bÊk ó±Ëº,Íe¾ý¯ë—ïø9MN³Sh×ç̧Ñ_çâ¿ûRú̶ñ ˆ’J—QUL†Ü1q‚v€Ä;«|¦¯—.Æ% ˆÁõ!Ñ7™ô1“quŠ6ýNõäsW´Cm]DƒÐ+Ãð¯ßýÇ¿ýž ƒº¡ÔürîÛo4dÎ,ïa~'Žãüžë_ËZµì}yOì³Ü®[ôÙ6e×í4Ý"wzkoÓÙµMcûíXoëZ3ﮟd fh,ˆ2ä&v*;‡ »u¿ÓyF/Ÿî¡×{Æ1®ž*uÔ:µM§¶Þ¼rÝX–nŒ;õâùn®øË0È÷M]bܼ貼Ù~__[Ñ}àšµÙa0×ÙÈæ¦dŽ¼ëÉ:O‡8ÿÁÞƒ‚³=hEÜÊC¿nÖ¼ö Ù*û¡·±ñ¶Äla·Öu÷yqß6ÇÊòºŸ>§Ÿgñê¼2&ÃXð\§ÃdzÌ‚/ C46 £­ú^ú=3§–ß7¸¤5&[{㼨ǷÎ0Í“Ö:ƒ­›¨•1!¥ýs×z{¶®¢R½àV 6 ý³—kØ›aHðùv:@ÞÉ:φ<û8žk½;ø‘ÌHŸ1¡M)Ë<ÌaîÃ(/>wDdfLÞ~)scÌêºc\˜ëÞ¦[_ƒ|­;èê‘Úi_{²ÎÓ¡ëqt÷ mÜ0Ê_߀aþT‚ðw `ƒäŠÈ›Q 17×”¶¼hÞÙ~ñÉ{qFmgŒ&…Ù¶‹Zí)šŒ¦Ht„Úsužµ#Ä‘‡Ž"¹ÏÄø )ÌËIQ¡“ê0¾+ù’a\}Û}ó^´ýÁ£¾amê™#ºé•<ÞË÷ 1äGKÓ'ë<*LjãÊ[ëIŽÌ¬pM•½¨íê ë#?zûÃcÒ¶WüÈr¦2{ˆÅ«aÉ!x K;qì‡m‘ÑFlÍ.?YcyJà!ÚNÖy6´ÑA\8Fû53®è`Ù¯ùÌHh!Ûø扫¬ ìÛ)!rŒó¤¸TZZeÀµ¯ìp÷m›%Æäuk™—eÝËô—dÛÞú±ø1?W‡px÷äd§CîAÌùÃÌ-4ŸG - ÞóÓm1Ü ÿA,ú×F»aõZ›cÞ=Ìî3Y} Þpgûd§CëAú çW÷ßnl´XsnøðJ<¿¯8Öåk±_—òãº%Ën>}Š–UªÛÎ}*:‰°Ä'ë<ÂâF¾Š=x¾’#>ÛÀWvîØí­*•Ñ<â£1®ÏÅh¥žsbÊÕZìí¯½þºƒÊÿ9mÎ=!v²ÎÓ¡ò`ò³«ÓyêEET -÷ÀÏ<Ó1F -ee‡ñýê>ŸQqgS´CF¡g÷¨9÷ ÷É:φB°~ùKº_#=ÁsøΡÝ3Ø÷xÍ–ïêêòPóc”«ót(;ˆñžè9™GÞ˜óÈ&êòyV«úÃýøv-#ÿñŒÌ<ö˜¾ÇdyñD[ -þ(S8YçéPtðD¢z~à 2ºì^É%^Ñ©Qr^ÎsÂ:^áÕ[/Wîâež{Yîê¦S‹>{½ûŒø" ³¬×o™¼Ì¯V7>à¦ðþgoNÖy:T¬ÝÕ»õ·%÷ºÍ=Þò¹š‹¥yrìQël¸e¼³ÅrÂM¼ÃÐD<»x·»yÞçåïÍKËh ,¶:»’|²Î³¡1¬Ýý Ú}²yïI‰1G¹z†?1xIþ4_ƒŸxW[8Ç¿ïYÃí*˸3®µsß÷ù2°µ·¼×‚‰Ú¸#„ž«ót}ËŸlªÏXÊî³Ô‹‡ÛËEîÞ­ž×ß{ªB ˆ0ﳯñÞ;ë­ž®ëLF>°¦w²ÎÓ¡ð ÜùîgãÃ!+V -ÊNÜ·Xqå˜/JÙÀG²’wf?«Ué½ï˜¾lQÈïJš<›;Ëw—ÏæU°/È׳‹ÔðþçlNÖy:¤Ä—ßR>Z+ûûŠïög&¿Ï[ì¸õHâC«2§ž¬•Ñ?ož¬ólèŒñæî¼ÞƇ«§ôíîÀcÃû?:ÂwØcÃ&o|rG·AÎUy:ü?…øÑ»cߊ»'¤)#«Y×Ù^ -yo-¯­6QÜK¡¬²ä¸’=…;ߟ­\³ì¥°ì³@Ë -»Ïº²5ÍKEè|¼‘GÕ¶­éX/ŸõfÕK³,ïÝP÷y°¾·Uö{`6åoý7yè6–wÏϳìq¢Û’âÝö‡zunÆ|¶d9³îW•¯”Xd®,ŸO몽юÏýf¹zÉo¬‡ë¹b—åžR÷Íüz(o‡Æw¸7Rmç ÞŽ·y?¸¼çð¶b»]l›Ÿ)|dG4{v,}Iu©¦3Kö³µ-ï=í+„¶³m†µ¹FgïãyŽÊÈ›Ço@^EV­_e¯]V¸vi#—yµfmùåºÃc}]UÚÙ.%o•¶¾ðG4?T¹A…|ƒÚ×1”Ð&ÍåŠz®_jN÷ú±²¬ŽŸ;¿èoKW oþ\tzÖQ`MKûãÀlöq‡™M‡±Ž*Ýd»å]õrcéÞ/4sYÙÅÍèËÙF~Ï™™¯Ê±ë;™”Lå¾èh‘Ç¥<ÍeÍmÞ)¥Ø•˜]Ël)×ðÚQÙžÝPêÀ÷Í¡õ -ú÷ËVqÁ¡×œË[uF§#Ûy®ùíÃ"~z»O]Ýïíšÿö·RC“ù7"l¼¸ãò¶Š{Ûå¡Èݨ—a*Ý{_wcÁ¸ž—¿K™JHºcµ ;uœÖ®-nͳ9¶,í˜F†Œd=w³æ¶Ì«ûë­ý -=fÏjž¤%¸+×°ÊŸ.¾lªË6Ñ*/:˜ü;WOSFYH×¼-)‚Òuètél}Ý©Y~}ã§VjùA•÷èÎû³Î¿ÖÁ–ò?•Aÿþ—&_=nÙ<_1èÛâ·KþñÄDÝmˆ³pù¨Z[¤[Pe÷KÞ+%­«Û²P!ï“44®^M®ïjµ¼©%©ZÈ–mç BÔôz+ÎW¯&½ˆóPÄÉ.G¾™â|µÂÞ ñ²½Á^ñP¬­bB·*vº.6TíÑyÃâÖu¾ ›é¼ë4þZÖ6œ„÷ NkGé›(ÍÛÞצjïÕd–•šÔÕ’m@¨“ º_á7ª6M̦g£–7ž…±‰Z¹TË ¢ûE,·´æÚH…V*öª©ö|7¥CÝÆÖñ‚ìÎÂéQ‡Íeëǵ8Gmm¬hwܘð~‹¡øíâ‚PÚu®P®B -k·‰£êxéÒüXÁü S³ÊòÖ«ùÿ™*\“fæ)45Håí“ûQ?Iž›M¼î$.÷uHêM¡—eÝ¥Ch˜åý¥£ÊgÒm¥[­¤¬Ë˜<¤j^&©Fk±n¨kâLaµWr¡ªFàt]ì”ßVân§kS`¯'óšÁݵv»Ø7î|ãâÐF\ç½°›½­]†ù*¼ÇF£8C?Ö“t±QÍÛõ“1a7 ¤ÐÅFߊ¸ÎÖÆNù÷}êÇ>É${¿üéRÜœ±Î$|ðVçŸvà‘—¾þÊ|‡×_èúûº—ðìÇjla·®ÄÜ“åŠ'Åù‡ª°M&4Äh¿‹uìe]ECóãÆ0¾¦^]ub¯%ucPÝ´\èz2±iÐ5Ú²žq„÷¡[ óÙ±é{>´õâp›w¡®Vá€_c×Ùî’¯¬Iå¢Ý¥CK†UÄo‡ì„©[¶23’Ÿ¤u}¶ŸøPØ|.vÀˆ|h»Žº›åMWY¹ -V!°å¼aÒü¤ie`ô‡§×§Ç}1Ù×¥Ú›ôKÛ…ei#> -endobj -764 0 obj -<< -/Filter /FlateDecode -/Length 4865 ->> -stream -xœÝ]K丑¾ç¯È³‘ù¾cìÅÖ а‹=TewÙ0jïÁß)‘ I¡GfõxÒÓ…ê’"ø’Á/R2õUáçÿ"é!Æ<]o?\~¼¨!8…¥Ä즰¿ÇopW­( N'Ýõ‡L°aÉ™à¯ïü·¸åÅß/þÕåÿæuôÕ )y£Ýõï_2‹ìbÊ ¬–ÒV`97„`œX^bJ b¸@†Ö¬1(E'± V„–‚¶kV‚&h’XC'–VC¥DQDÖ<íI÷ÏèÁÇd’È àé`$žµƒ¤–xiðÞ»(ñ²¸¤´ÄsÅi"%ñ Ù$ž‡,Ö[%ò ‹‰ÁJ¼Y f' ¼Y ]QäAå•–xÉ.E"‘—ÀS1Ä5Ï(7¸h­’xZºiEvÉg ‹W.‰<Èâ¬2ÏBÂÄN8bv«É»Û*«%žƒ,Æy‹/!€ñE/AvÐqIÂÂ@É&Ú"E LL…`%0É äSpÀ* žÑXYy ¬†,„+ò ‹M$a5$,°²²X -A[$,°€[RIKX`·¤´—°Àp!¦’°Àqmô$aäB•’„˜kX€.¶{°Àu­óF ص½„¸kI+ ¸k-jŠ<È–°è8X­„ܵZ ¸‹md$,ÀªÐC/ate01* ¸k¢" ¸kL€È ö •°€€»Æa’å„Ü5d¼„P”ø£Do¸ q²;Y°ÀÞƒg¬„hl0pK$,pÀ]`þ„= ´tL^ÂÜÕË'òÒ f\Ø·˜åA{Ÿ$,pÀ]*+aî>£„ÀøÕHXà€»ÚÂRK<à®6IIXà€»ðœ„P‡AðömÐ -ª+òÒ RŒ8à.`ÉHX+<¨$ya€"i ƃ‚*aî¼' )ðàò‰Ç›Q¸ˆ7áÑ‹)˜ãÍ ¦ €».™$pž©—°7ˆ7áÙJ±½ðºÿLfÆqF1c ½¶UL(`/¬Us -à›c$1i1YF/f `VÁÔJL(à/ü1Za˜}â)*u°™1äA&l ‚wßbŽ^ÌnócÿËå×/0¾×¿üÿåíW%SV4”ß’/5pÚ'“°ÞÀ«¡´Gˆ0ál›l€²„ð‘:Yˆº°8%ݲ0Å0·éÚ.ô\dHœeÖpfÊÈhÖ/Bµ²^”õî:_IÖ>Gp°à38xoççõd¯>¯¼ß³óz²ÎW—5ç]VѼ_Qȣ‡ÒÙüﺾ8’°¦ë~=\]†OIس•¾¢Ðk øí§ ,â˜÷W¦›0 ö À÷é‡Ë¯¿ûýþÇ¿Çj}z»üÏo”¢ü’‚»€¿áà˜’õ™èŒo¾àÉ÷ô6Õßúé:×MýÚpznç†ß4ýõ‹öÕx]ÊÆ‘†ÈF7•›Úz‘QO×·é~ê«ÐüD÷lŒùIÄÛ·ÿ{ýôÝÆœ%>gyšœëÓÓ¦dNé&Ó^»¸´3MU¬ÙTÕ©MOÃAì<gJ)ÿ:õ§ÉövõçýáR½›ÚšÆPùus׎ɜé¥\Ø›®|¹˜¯“rÍëÞ<æyÚžÇ]yášÍå54õ3©giÿóØÆï>•ín›aBdlÐülŽBƒ+<Ï,<¢÷Öyt'DÀˆ%b¼ƒM&{Õp•TB”´‚ ª½ŽSÓnµuM^8õ03ª Æ}÷§ÿþCü‰Ü·ßèŒ ·ñoQŸ¬Fvº÷ø;.Âf‡p!UÊù•E‡¹5µ“U2£EF‘JÕbº®rÔû·ù½ U,dÃÍM¸k`ý½ˆ—’¢”Íêû&jØö²­DƹR±„àJÿôþ@‰NÖy%‚;è/ à¾[‰ÈOtZ.âfÇF!ÖL*ù´èx¦Lf‰ڮëô¦8·¹b•:n!f2¾2e“ê|é|í¦¾¦vŠù½Í2Î*ϽJþ›wëM2;ÃƑؘ_¾=¿Uì˜e!eä­2Ù+7Ù.b¶ šoËñ¿Úœµ­1ù™SÊÙÝE§E6¶˜Eà^· „v1?(:Øb'ë|Ä“û)v¦qo§©—êÐ͵e¶»˜–˜4otþæ»`tç4#•«ýW-ä)!ë?­™…Š"SJ/;k1öƳsYšl~q_wçû#é½ýÑt?t—µìG¾?Òä½UwXØ4¤MÕ‹÷öéPõÜå\·Š&çxv÷ÆÉ:϶7ÚÎÞ°9耱6¡ë„µ2M¢s·$ïÆ2(Z°ñÂô{›Ó¤²¹ÍBcý´½bú¬³çš ¯Ž=G ÄèLþL/å>Oå^™Lfº–õ‰LÃM_"4uäÎœ¬ó$úÔÅv~׫±Óïçŵ›Ïû#Ö»Ä%RK]jÚ¦Só6Jy+—-^÷ÀT‰øæ˜Zñ[=îE=äј ól^aJ9e¼¯qçê<ÆÅ]»G ÎjÀÒ‚V›Yæ·µ†I>q£}ém¬¬-1Y˜ÅmþêmÒ¼¸-›ceyÝ÷éÇ]<ëWÖÉô -ž«ól:éÔ> -V}©qN˜ÿÝò¶êß2ïvŒg¤¿+½¤¹NºEœÓèõþ¥#L³¤µÎBÖ•·ÊÒvßÍCÝuæ•êIoÕB¦Åüh%£¡ë¾‡ÈžJªiWóNÖy:ÍÛ÷çÚì.ìHF¤¯˜Ð¦½Æ.·Å*×ÌëB#yæ •aƒfC_×~a®kx›n>y¬ÚÕ=µÓ¶öd§Ó®}ïnOÚ -,sZŸïЀÅþ_bPqÂïЀ•&W|"Š…À½ÀÕ˜¤ÈþÎö‹MÞò3j;KoRÊ•mi-óö FS$:ÒÚsužNk÷=Ä%yrññ–Lé]Ú"Ì÷ú9©#Í\j7i%÷÷òÛXXòp¤•çê<›Vú}q™yk3É5sÃ+XSi¯j•lmêµµ?\Ñ¥OºÑö YÌTv15L1÷aiÃ}XYÛ<ËÙåwLc,ïKîjÛÉ:O§m~áÒÛ¯‘qÕýš¬„¢Þiâ,*ÛrJ¹ôó$¿TÊ Í"à:Wv1ŽÛºÍâcòºµÌë”÷2ýW’m+¿ã™ÿ˜?aƒà|ΓužNs|Î/#~´Ð|\SH°žn‹aàJów|ѵ¶V¯µ¹Œ»—O™NDIþód§ÓØsþæG5ªù¡"nü‚wFmGxºAnh&ó“\Q³#ÍeËOÖy:-<È_þ’ž×HocðþÑ#´{ÆÇî¯Ùrj‰?³«eçê<–øxOôžÌž5æ8²òú£ÜÏ,«¿xßƲÄ?‘™}‹»OF!žûHÏÉ:O§Eo$aæTV—=Á+ñ „+úk­šórœòxW_z¹ò/ãÜëôT/0žšøÙêMp-´0ÒÊýdqKýWV7î`SºÿÝ›“užM«ÒAî®>­™b¯—qÆ[pë3ÞùÓôùÓ½z:Ç'º·|ê×÷ÅÞÐôÌ(©~ÜQ¬j0!D^‚ü™5§¦·FÆ©+Ÿ¯Ç"½õȳUâU?#gº.íĪS9Ï“ëçÈu:£aÖ~=~‰ÉSÏÝicpu «¥üñâËI—ºœv¬|´É_‡põ4d@ éšO׌ʒ®K§ËdëëFÍò%?¶RÓ÷J¨|Ôt>ftüÒ v3•ÿ±,úhÈóŸb<^r4õ¦“ß/ùÌÈ3}’œ‰Ó¥jm‘®í  CZ–´nPÓejç¹—ÆÕÑäú®VËg3’ª…l9pìX ¢¦×kr½ôDÎߣ;Ýù& -\ÑÔˆ½Aâe{ƒ½â!Y[ňnMT¬»N6TåÑùÜÝ6u¾›è|ê4[þZÖ¶œ{ÄÛÝÚ%õ]¤æÓÛkSuvj4Ë„Jêjɶ ÔÖI Ý.ñU›&,fã³UËgàŽÄX‰Z¹TË ¤ÛE,7µæÚJ…V*öª©Î|¥«ºmâZ™£‰òð=¢l½œ“}^ºÖ*2½1+âíC+òûÅ¡´ëX¡\U=N´¬ÝFŽªëK§æœðx…­YiùÑüÿ®Q3ò” MM¥ò)Àý®w’÷f#Ï'‰Ó}C’f@SèeÙtéšÎòùÒQ å3è¶ÒmÆfT6eŒR/ƒT9Y7­kä au~Vr¢ªB »NvM•ßgä.§k[Õ©Ö™×LÝ]k·“}ÃÎwNmÅu>Ò¹ÉÛÚe:_‰·bØhIΪk'lT³v½3Fì‚:¹Ãè{!×ÝÚÐ)MM½ì›L²¸·Ë_/ÅÌëL>“Ì[¿¡€{^úú”ù¿»ÐõõHÜÑŽÕÐÂ4l‘¹%ËßgO’óAp•Ø¶ #b°ßÉ:ö²®jC³ãÆ0¼¦^]u`¯%uCPݸœèú2²iªk´e3ãvˆ·Å,6Gæ£kÓ öxkëàÐ͇)W©pǃÛØy¶›ä+kw¹h7éà’aqÃÅ-ë0uÉfbf…ä´©Ïò_ -›ûb7ÌÈ·¶ó¨›YÞt¥•Q°"p-¿á “榙<‚Ðo¯¯û$²¯; S´7ê;§¶ej<™jË­Ÿß6›cËquóöjmY¶÷lsrúÖè®Ín¸Ž2jìÕ¦ŽwJ•6ë´Š ©Jk-†*“ŸªÕi)#Žâ,…æStê_ùL;¾*m_¿*›Û­¯yK¶9@Ž«sè£S½dó%£@ó¼v£R/i+mÝ7Íû®ÖöʆA]ß=SÕ«¹Uɇð#žç,•ª?%;¢c?D†št°Æ–ïTÑ{`å¯v Yºäî:ûù“u–¤æOxOXŽ¬UAçox”Ex#3XSõÛåjI‰Cºo„ôP‡¹õéÛå+¾J³$‰ÚmÈ¡bþF?›Þ˜¿ˆ((ù4îþJñ,…R~þ GÃ[„ -endstream -endobj -765 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 764 0 R -/Resources 4 0 R -/Annots [ 766 0 R 767 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -766 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 713.673057 101.433071 694.923057 ] -/BS << -/W 0 ->> -/Dest (cb258-1) ->> -endobj -767 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 652.726036 101.433071 633.976036 ] -/BS << -/W 0 ->> -/Dest (cb259-1) ->> -endobj -768 0 obj -<< -/Filter /FlateDecode -/Length 4841 ->> -stream -xœí]K$Ém¾×¯¨³€MŃñ  ؆–áöÁð¡§vF‚1k`åƒÿ¾?Fƃ™Ézu·V-a§ÑS•d< ÆG223Úž ~¾³ø/“]r.)ÒùòÓéç“YR0øWKl.*ûü¦p¶†Òl‰9œb‚OK*Á¥xþv»KYüÛé?~súŸm{vK)ÑÙpþÓf‘_RNÉ…UÀ2Ö+¬–”\ˆ -+ÚC,EcAŒÈÑ‘• •4Ä ç²ÂÊÃS²þÈ*Ã%K bØ’²rXgŒÊƒ †È;…gáô¨ñœ]b.®¨¼žMNãy¿ÄD6XW–cÈ K(Æj¼Y‚%2²ÏIãEÈâ£7*²¸œ¼ÆKÅA;EáeÈëÊ*²˜h¬Æ+~ %©¼žÉ)y΄%dïƳv °M¯ò°¢0I1)<Y¢ EåA–àÓx²~4p"ø”³²Z¯no¼Õx²8—HåAL¾†.B“¢XA ã’†.¥…Š# \ö eÊ -¸\JÉk0àJX(–¤á€7•\ ’!²Td¡D °^Š/YÃ‚ä ‹wNÂä B ,Å"úVÓÈsQó‚,ˆ5,’-¹iXBD>­j¼è–œ×*/ƒg“†)ÑWl5,@.µd,z ð ‡K@ ð,iX -dÁRÑ°®hÉ‘¹Æ³A¶†ˆtÁ³VÃ‚ì ¢A ²ËÈ2£Ñ°¹$T­ñÈpž™5,È5,À2A¦ ¤Ty0¡a懓í a’$›HsTdñ4,ÈÙqº™5,Ȳ8ã4,€mr¾™4,(² âÓ° ˜¸p˜¬a`r¾™4,(YB•Y4eÝ“o4^„,®†%FÎ7³†3o"¢W·2ç›IÝ.î†dÒxÀ]D¦QÃ\ ßDd«åöÀâ3™9ãÌêŽôøVuËÀ{á­’ºg`¾œ#©›™eŽê®Ü*˜Ö¨Ûø‹xŒ˜°î>É-ªsHð™9ñ –!º9Ç,æ¯[÷Çþô‡Óo_à|ÏøßÓ×ßÔ²þc ÔÒ„ø -ËÀLw@ôm1|VÉ Ø3e¹ÓT¦P0Ø6ÙX(¸;þw>~ÙH -AYTÔF9÷ç0Ý´~<µuBŒ|À±œ¢>]ç®È A9/V—uªHö;u¤Éútw’uê(`>‘2#À|\¯Öyw½Ê~ÕëƒuÞ]V±Þж_UÈ{…ßwQÍ~û¸C¿@/Ì©g„ׄ}´Ò; íÇŒž^(„T “Ø…å\¨„ÈOVyGÍâ8ÎŽ(ã‹ã¸Î%t& ÿý§\T“b½û1.…øˆ”-BΟ~:ýö_¾ÿ÷ýý°ÀO_OÿùwÑÙï¾³ø¤¯ëgˆë'ürÃF ­Ì¥]#è!jß{ý<ëÑ—y.VfýÞW/ãÀç{›v[ŸLå{}Á²õzèŒÚè³C«#ä´¡õÕÚ¡Q×ÎqÖúq+o/ˆ1V9^xì¿û¯ó§ïOÿðikT5ǬFU°zLü3|¨Æ[¬ðÏa|¥Ü2>ž€·“Ú•º7’1vo`CÁ#haá€ÑF7.…'²¨àY—«tßÿã?ÿÓ¿ éyÖÞl˜=#YC¼Ï;0ÛaÛ¥†Y°”kYx:˜c7Õõú@oeÝF++¾®Ÿ£žÛöÍ|^j•gÖ>V-M¹*/oeòµöx™òµïcIë8ý½¬ZHÍQª™5ëbkõ ÓzqsáUÍÑÊÚ¹ðÂnŠëõ†Ÿ[›b´æ3­Ûí U-As¦Ù2¹uQÊ”A«çû|M~ºf¹­¦}¶–íDÏI0ßh9¶S5ï›l±Ê~K$Wä0ÍJRÓS³°ª#·‚‘"ßp‹†%JÛUÏ—i¡·¶ÙÀÍ4Ù§Õ^·Xž».Ëê DýºÕ1_]Œi»b¦åê{jßc—ã¦nÃA·hÃ}å•°··ik¾Ï“¯Û„ýQÊq³ßt«_rŒ2kÿŽéŸ×ë=½ÊH+Ý¿¬óæ[ùZ–Öò½ÍŠbìð:ÿem‹—Lm#¶¾z9Ôµe—GåóácÊõ”ÞDnß·oõ-]ëû2=ómþt&ôpWgqÕ-{¶w—ëÖÕ›ìÿuö—ž³_nÝı²Ç±ŠõáˆÇÝ_ ß$F÷hDø÷½\¥—é¿k;{í¾‹é­mjòÔþ¨ù1áSªO ->>wMÖöó[·ôèí^tǯÝ…ž€¬c¹åk¢ÓÇ{RÓâ±(|™YÇq‹_Ûº!#ÏÇ-k<ßú¨végÒtEG‡XåÐ?­mVù¬9ÄÝÆ‚óEM¦Ïÿ2mxDÒÝžm³Ñ´³6–mÜ¡Ç-ÜuM²S³áØå+±F-«Æ7uuˆk‚´evœ¶cì1i·¡:Þ¯MV×ô#lþ/½ÞŸ×çM½â2]÷¦n^ü³ý³ý³ý³ýuÅlþ³¹îî’Àçî+CßSþðJl0|ƒÜ/IÓÿ\ÍéßóŒø¯l}ÒˆõšÏ«þ µ«íÛˆ‡˜ìj¬Ô¯{ØcÉÆ{1fê¤ûÓ³ÜÒç¾ý{z}}\vSüÌÀÖn¨õ#bÞ®ÓýÆ7ú[¢¯·Ôøv›|vùÎÖ÷ƒu^uîw½Ã·Ð’C@H«n{×yOŶ0Û‹ Úu®vXâb -?¸ëpݾ÷cÊ -öô¶»ºÁ®Ú?÷Yæ?ª[êš¡ô ]msðš…h—\ê]DÊn±žRŒ÷nã=VçÃQHq±6eŸ6¢qŒö“xµcghIÅ”XvoŒÉ™¿š›to¹·tµ^¿+âÄ8äÍý^”ºT¢M ¿daœ¾Tš¿ -=?¾ û ý>ÄqŸŸ_”(üHò®ÓjGW–?BÔ–‹·ü`«)þN?XçƒÜ¤+-†tk¥™™]^¿]>,º¯FÃÂͬ;¬í²µFÚÝ«3/Â/;ž«ÀmÛ¼ýíüýÀÝJz–JÞ°åa§iÆuíH[>ä÷ŠÓRJÈÉî:¼eÇÉùn“¦6Ù™{·Ú¬óÑì˜Þ¾aÇ>¯Y†KÓ&¼×i]†œmÔlå²f . ^j¿—-M+Û3ÙÏxœÂí>wö\ïÏ¿´L++ô¼fMƒ.ä¯ÙTR[¹ÏB&×¾ëöDy„ˆE‰ÐÔ½ÐãÁ:Äž¦ØÑߌ@|ûýq÷=lõþO,Ã׊•eÚÁÀÞ^ÇlÛ.íËÖˆAFKŒÛo/[ûc3xmÄóªèÃ]A°4ÑÈó Ság’o[Ücu>œÅå›öŒ89c3rY8Õm¡ÛN>VçÃYÞíxnhwçG‘ÞỤ̾†•~Ù¶_ˈì~øÐÏǸë:ÙfØŽAëµÇróÓ¾öÁ:κnGw·,aÌÀ~ÿéÇ',`·þ÷Tƒð',à`ÉÝ"_”Œb#È(P}Ø}‡‹îÉö«O¾gôvöѤ¶¯uÍjE´gh©o(Ü{«áÁ:ÎjoGˆ{ú[{õà9kQô!£¾nµWr®}_{ë¦{V)ã=~ÝSžîYåcu>šU–Û1â~çmhRZ敬bM§}6ÇÝÁ0g~ïíïÎè>&½ÒöEÎTWOf˶•¸‹aéJûjYtk+bÏŽ1ȹ¾ÓÚ¬óá¬íN\¸öÇ;ÏfwžìÙ™°J¶±Ã›{–¸É -Òu9Õýó]œ§Å¥ÚÞÐ&îºò»q\ŽmÖSÖíe>·}/75Ù®íï?òvpñ^Ìù`g¹wbÎ/+~ŒнÝRHñžonK`àÁòoÄ¢¿´µ;Qo´¹Ï»w«û‘,©¼"Þ|°Î‡³ØÇâÍ·ZÔˆCUÜø^½ íýŽšA^±L?>ú~÷ƒu>šeZs;è¬)]7·h(é‡L\­0eºtH­:=ìèÝm·ëÚãrspÿÙûsü¡“’f.>¦*›Å©+Ãï¹crÇ3Zúyg»;cb{ç¾0'>xÑÁ²Jâ#…®Ý·ç÷:ùŽ­mÏQÖçw/ëàþ\~ñY í~×ï÷×ls5ÅþVrŸ¢?³¿¾mlæó‰e¥»öêxF±}ß¿wSûkïäÔÇÆÄ;£ýþ\«gó>GiYxÃa*>Åz<–­G$šàø ås¤…ol§ræ#¹²ñdûÔÙªl{¾R³ž<ýó(Õ£6|>%ŸM¶žT-.ZùŸë¤ÿt²…Ö}Ѻk*9»~1ÉßNüÌ$)d¢ù¶ö2ÛW3Ú";^þî´ €5-e_҇Ŵ¯ó q~paýêB ×½èD¦òõH£µc…ˆšÑÉòµ7ÕµëÌ y!TÔÐKŽ ¡1O -érRˆß™Þ4a2_Ìœ·s7$åJ/§.'µ\k-Œ™J£TžUK×üeš:¿°vv§($>M^¬ãû×-™_Þsm²°w ^Np1t ;…¤”+Lè¦'‰^´;ÈÙL{™Ô”»ª°4;ãÿW¨ƒÊÈS¿X&ÅGΫ٠¯ÍAÞ*IÒã@Ò4`)ͲB]6¥a³R_ˆ”ò º£ôÐ؆*T&è©tñ¤xlÉvXÝ 3„uý ¬”DÓ…@w“†)Û§œa,Õ`FgÑ -s£ÝIŽ;¿Ir3ÎçôAL?…Íwâ¥:6Ú“Ùôsïd’ù£3Aœ‚&yÂè·Jî«u Ÿmß¿ÎE¦yÜËé§ê朎Ÿ Þò±Æ2ò²çÿC™ïñûß':ÿ¾Ÿ£·úqgZ¸­²ôd|~~̇âwâX6‚èHÀþ$Û<ˆn Ã;'ðšfu3½—´AíàJb˜:d7L×Y/4n/;-Ž@æ­s3özéûàÐç»T¸ÃÁež> -endobj -770 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 483.873057 101.433071 465.123057 ] -/BS << -/W 0 ->> -/Dest (cb262-1) ->> -endobj -771 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 422.926036 101.433071 404.176036 ] -/BS << -/W 0 ->> -/Dest (cb263-1) ->> -endobj -772 0 obj -<< -/Filter /FlateDecode -/Length 3605 ->> -stream -xœå\Ë®·ÝÏWÌÚ€i>ªø/$A„8ˆ!^YHcËFp@Î"¿ŸS=M²º§æ¡+Û¸I4Í°ŠjòðT§û†£ÇëË€ÿ*Wk+™Ž§‡ï -{ü[jl -‹ú5Þ…ÁSqZ®|ü ‚T\iK>>ðß®¨«?¾ýâðÏm›pŒ®µú^T”\©¥x6T *’¡bv¥DΆ*‡KlÍRÁ .éRU`µÊ– -fPŒÕPU˜‘¨„t©j0#–@– -f„ÆÅP;BôÞÔÁO”¢¡ ì2&=[º\®-6SW  %Zº”\.8XºærÎ\-Án>X:†-ˆ¼¥ƒ-”j±t¶¤œ¼©ƒ-±–dé -l‰˜fè*lºª©ƒ->û`éZrÜ*‘©kÐùZê¥.zv\Sò–.ÇÀf2uØQX¤\ ]„-Ùs3u°…“–.ÁÂËÒ'8•ZÝew'Ÿ‚¥cØc!S[°øÄ [|É`9á%‹b)ŽZ$‹bMŽ*U‹bmŽJI ÄÆŽr+$ ‹Á"‚äa S¶˜ ØBع¦¶¤F¤[PÁâ‚”`K¤dqAÛÐbqAÝ’oÁ₾%²Å „ 3½Å Œ›j&‹ (Pj$pnwZ\@ºØîÅâ‚ÖMœ£Å ´›¨f‹ x7Qðx7%´4u°¶¸ìèR¨Éâï¦à‹ÅÞÅ6Š`Up˜-.V\¬Õ[\@àÝX=Y\@àÝXàL]q؃ÉâïFÆ%Xž¼ÙG‹ ¼)f‹ þñf4Þ…°À¬Åð÷ÐÅdq:sa‰Å Þ îÏØÓ`+jË0x7T,Ÿ©k.̸±o1Ë.äÜ,.`ð.U²¸€Á» Ïjq8ÞÁ£F‹ ¼<µ¥ï†Ø¼Å ÞEÜÀ. °¸þÍ蚺æ|«Õâï‚–¢ÅðÂÎW0‰©+@ -€ŒGjqAï½7‹ 2x×sJdð®'„=¦¶¤-.@\¶­±§¬:Á–¼ëVØÒw½/Íâ‚ Þ·iqA."ˆÕâèG‹ r%×JÉäæ¡CÈgê²C™-.(e™:ØB…,.@`íZjÕâ‚aKŠÑâ‚a B‹ ¸}›él\Ìü€` "E‹ Àd®6"‹ -gäc˜UK—£«tmê*t¡X\P -9¸â`qr)W±é-.Á; —,.€Ð²¸ 4Ø‚­bq\‘«‘¹¥ °A¶Åˆt¡ Áâ‚a ¢A‹ j¬È2³·¸¹$¦ÚÒ‘—<³Z\P); -.À6A¦ ¦4u°4aqÖG’m¶¸É’M¤9¦¶$&‹ j’nV‹ j…-ÑG‹ €MÉ7‹ÅÍÃD|4Ÿ„ɀơóÞâ‚*òÍH`_J¾Y-.hÉ#ßDŠgìÛ–²ä›Åâ‚F°…¢˜:Ø‚ ©ûœ„|ìdé2l‰,.h9K¾Y-.@˜|½y$P%ß,æqx—˜ÉÒw™f‹ P@¾‰ÈÖÊí=ˆ— â3[Y%ã¬æ‰õ2|«ydàÁ½ðVÅ<3ð _É‘ÌC˜‰Ì²fóÔnÊàÍcþE}ÒGTp(ð™µÈE6l Bt?rŽY-]©v>ûé‡ÃWoá|?üëðþ‹å¤¬¿„¥6!¾Â6ˆ Ë͈¾.?ÁŽ‹i°ì“*Ë°¥M³ˆp=f³àðäßñòËÆV˜úz7qüöy\l1 ºÉºV$¬Ëi 2õ›üŒË ð¯uR‹ÂG"IO›Ê¿}s4W+Χž£¨Ì‡‡DúK‘o>¾úÓ«¿þù›×Λ÷‡¿ýÆ{ö_ðI§ó'õ}ÕqÝ–QÅ3¯íVåõóýúI»~׶Èb/d£î[Õ•×>C˜u¸]ö}1&ïäuŽ /ëü¯x¿?_/ǵ^Ù]Ó¯aCšsü×?¾yuøÝ›-—8t ¤ ®Èç;˜}¬Éç`ö—€*’ÚP¥Ó¾@r]*~«–JMo_fYò†º¿µŸÞG_®íò@þNÁc߶Ãuø»µ>oí]¶W™}Ž>Êös¿½ÆµåŒï·gx -¤6Ÿô¼äœ½BبÝÁ׃m^ÀëÜDØ;…’¼]UÖà·«³AWS«Æ»Õ<íV[“Â=2Š;$­+ƒÒï'iÓ¢Ö»a٠ݶ·«=qKtýD>Hí´ciÓÇ#ÕßUï.ç&Ä+¨LƒÂvó5JÐw•µyq¨¤›¼7fô{…8^WÂp ŠŠZ­[hع§Ñ.|>Š.Pù~ÛFê¿k·³gÙY»0ßmù~ìˆïv;ª®nö!;® p„ô×#œÄÜFácm^ -oŠ·Vé×å‹ŸaGÞçì£ß‡<ð ×ÒrHÎÒ›({¬Í‹CÙÏZ™²•í=óÞSî½îsc½[ÞXóÈEÈ_íq;ò¶Í¸¶²m3ÆÑéX¼í1ãŒÉ¨TgXò½<áÁ6/ Eñv·GJÔ«¥"ñ‘ؾ[“A‹WÂϵjF«yNgšWßÎz!¯<'°œßCçW½x½Óñ‹¬œeKyõ¸Kûwªm½ÎMQÅTž˜<ØæÅ¡êvÖWm™EZ?³Êçz.ÖÎ+ ±GosÁ-iÇs*'¼ˆwšHg;Ôýî‘*ûïòÒWШb«ÆŽ—ÄókóâÐxçàî@P/_E+oÇä}Žj R¯þh¯8NŸàXpãö^ug³ ›w§'£Í5¿÷ػӘý©Ñûtƒ/ÕÑ›üÈkˆ|¡µyq½Ëí:V¥(ïfägWϾ⫇»–‹¾Û¡Aô‹<ÏÕ¼ˆ)wGÞ¤²‡O±oðÞ'¶ÓQÇþºÉ(Ò3ÎôlóÒP˜îÄ‚»(ÿâ,n—X§ ÊøÑbÕû|ÑÊž“•|bö³9•¾‚@}î9ìU»4ÊnZíLe~ï ûŠ}=W‘ªbE¹q!B¾_>ØæÅ!õN|y©oú?t -smg²ºÆÅŽ·3’xÖ©L¶çó!}F¼ù`›‡Î;ñæÕ}}ŽÕÓH´NPtlxúGøÎØ°—cn|ïgÇš¼8üÝ9üŒ_1&ÆÆ¿^ïb) ƒ˜å.ÂÊ¡ª›bÆÌÞ­rg&/o¡é·¥嵟ª¼ÎQ>¢Ky|-Õ#BjEîø’©yõû?þá/jj q™±žáéTÇŒ7¶TÊçòTÒyJB[ë°LMß -k [ªç©“z²-åSú’úôÞã¥(uóù½ôµ~_ú©}K¬ãÉa®´—ã©rÖoúçuleÏÒ«kà~ Kùñ—»Ãr»ÏÕ…(¸39‰ZJ;Ê“Õ' -}éÂ2Ùáx¥åò`àÇQk}VÐËãrëèùABUXë\ýÃ!4r2ÿôós=~×Ø SütçºÈbñÅ"\¿úÑ…^qÈN ‹âÚ¾fbçׯmtž¸ܯFÚso&÷Û‘ï•ÒrÇÙy`Cˆ–9\Šåê½ «Xž«.­¥óÓ” õTÇIJeŽVi‘‡}Õñ©ÝŠ³¬@_k_nâ…ðt€‹¡ ñÓ‹Q›'WxîÐÓ¤úâê'^¦T~ø9ÃÖì2¹+Tþ?S©0Ïò%Ѐ”ÜÙ=KsÙ›C¼$-σuÈš@eÖUÓJ˜Õóª7ê éŽÚcÆ6R5eJ^Z7OHjÇVê†X(¬ÏÏàJ-ôÝ 7Å< ü´O;ylU€½–ƒ‚;~§8î|Òâ2V<ÈmúÃÞѯÂ|žÇF{±@¿öA¦8úáíæ`J8 )Lñ¤Ñ§EÜwë`§å—äõëÜd–Ç=~<,n.&Ž _r -òÔ™Ž¼Âñߨó -ïèøM¿ÍùìÇ£l·nÄÚ“É3ÊõA±<³Ü…cÛ(a$EûSê¬Ë ÃǨøšfs?‰½× ƒAÃÐj!Ï9Tâ8 CR3Ã7„§Ý,Ž@æs×f:ìs1õ‹Ã0InïV¡ /Å:uiºä£ê%©:]:´UCt§(ªÛ´lc¦R2¦^ì'½IÆRFH1MM7«»î²å*T„ÀItÇô mcaô³·×g¯ûjrî;@¤ƒÚ‡ôIKÇ…‰tž-MK1o‹Ã礣úæ34úJjï¥äÌ­1C Ú4F•´ÎfkÖƒR—míŽbÐd¾ËF¥Û”×f}Z–+®æ,•SLéz¦Y¯Ê˜DÖ«’/êJ¿Ýãh)ˆ5œË¼:?kŽX²²¬[)Íš©Ë.ǦíØÝÛÕeÐ4$ÏÈÔÏf|QóYü÷œ½sn³;‰°jõ×r:ê|0ŽšBI1-ëÅלÁ!$ëªê¸ä“ÛÜ>?¹<%éç'z$,‡£”| òW{lž h÷ª«þ}ìfÍ›—ôipõ «K…œ-¶a9Ž[‰F±Hª(¥%IÐ[åáòâƒy\4žØž†-¯ÿ-·l -endstream -endobj -773 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 772 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -774 0 obj -<< -/Filter /FlateDecode -/Length 4008 ->> -stream -xœí\K¹ ¾÷¯èóÖêA½€ÅH‚ ì!ÈaܶwŒxsÈßÏGuIbU±{º=cä°3ƒžé"YE‘)ÕÃ-~ß8ü)äL)5':ž>¾¬ÉÑâ§I¬ûg|r<:KÙDWS‰ÇÏLÙä}NÇÇþl¥øãá—ïÿ^ŸãŽÞÔš¼‹Çß?2‹‚É%gV˺ °b49û˜VrC¬UcA˜ÉÓž•¡Õ5Ô ï‹Â*P#PvaϪPÃgG j¸³Ârz8o­Êƒ"–(x…ç¢I0zÒxÞ™Tª¯*/ƒç²×x!˜”ÉE§ñªI)Å¢ñºÄjÆ‹Ð%:"«ñ  …’5^‚.!«ò ‹/9h¼ ]<¬S^.ð®¢ò ‹MÖi¼L¬…HåUðlÉeÏó6šXB°Ï9á›Aå!¢0I)+<]’UåA—¬×xº~5p"†\Š­ž£;Øà4^„.ÞgRyГ¯!€OÐÅæ¤A"È0.iàs6T=i àK0T¨h(àK5”sÐ`À×h(Õ¬á@°<ï4 ºDJ]‘«ò K¨¤aAðЄ]< Жà-À-Ùê4,À[².iX¸PÓjX€¸¡$Ò° ráJUÃ‚Ì ÀN @áž5,@ݓװ v•¤aAîrVÃ3UtkXt4Á• awƒ³YÃî"Œ¼†˜U?LÀWŒ/ÅjX@À]_,iX@À]Ÿ‘T^6ˆÁ aw}Ä´Ì ÜõÑz ¸ëÉ' à(øcÕj¸ ‰z9]° ߃烆hÌx”%D஫HJL­Œ+5iX»®`úT^5.ÃâJÜÂÊÆ¥T5,ˆÀ]$ª aAî>‹†ÀxƒŒê5,ˆÀ]©5p×ùj5,ˆÀ]Ô Qøƒq(4,@~3ÎÂuU^5¶–¢aAî–¼†ÈÂÆ ‰ÊËŽä4,‹:TÂÜEz¯$à®!hX€»–Pö¨<èŠ×°u x[%¦Q¬ë¸kfXãw­ÍUÂÜå´©aAÊLðEÃ(hP{ R!SsN¤jÁCɧò’ÁqÔ° [" KåAʤa -kSC-d]‚÷d]P2hX€ŠÀT‡ê[]@¸‹º> è‚JQà ™)•HÂÖc°ªÆKÞ” ¸Vy<—5,È™ R±Ó°k)Sôà —K@ ðiX+tA¨hX€TdŠGe®ñtA‘­a*]ðœÓ° xè‚jPÂâ V™ÉjX€ µ$L­ñÈò:³hXP(.5,@˜`¥ ¤TyÐ0¡aæ‡ÛQÃ,~°ØÄ2GåA—IÂR}×vÊú/ûFä Lc¶}Ål>À X¢®M‚ürAeº!Àt—¸¦-±íZ4âé ÈX–{ì㚎Õ`itÑêÚ.-tÔ“‰ ?°XÀŠtCŽqÊŽî$‘f»“”TÔ9èÙÕ´ŽfßÓkäþ_"—Kuþ9î¿((»²ÎÃg= /ÙÊnÂö¯Á÷|°àKü“û/wŸTXŒXbåÙ¯Á÷|¯Áwgð©Av_Éy! _ï5ðþ`w{ɹ_ïÿôîÍÚM5ø_É•v9€¯ÒgÞÒ<¾û|øþíŸÿú—¿ÿŒõã»O‡ü`­+ø8|ˆ·åù‚¶µž?8öéL#|¡¼È€N8/B.V|?áÓh?þóøîí=øjúЃ»æ.ÚiøDO9wÑMLç¦\ÅdûÞÌC¬‰M Ä7 -xŸøz­¥·ìÊoÜs`r€~áE·üOËÿNçÁ±,kBïÏôf„¬ÐÙ6’O¢ÞnžÆ‚­6$ß=À†ëz´vÙ ~i÷“hû4Ûkr~=†Öïiámúç6úÄŇ…&t?÷kÓÖÚÝb‘fïMã¸îݾçšnmùfŒÄžmÒ¢FZõ0¤Âð£ÐûOgjÖ@Ÿîþx‹›o£Ø·s¶Ð¢[lú]Ñ#x{I;ÇÝBcñœföqE7¾&Yò©*m7Ï=-mŠ8ií×9û݆͎+¯\ì#¼ñìmÓÓ(vœº·ïçs»çó93 -´Ø÷¥{¾ôú©‡»nwÚÚ†aªëÑtø8£†m³ÕUÚjí‹ÞÒg·Ð÷T›M¶l¢®Ë„7c>Gõ™~“î3[y?†³þWm™¶¶TõzXt_ôhíÖEŸ‡9ÇMv[“ï©¡ûW—MgDn©äAŒMÎE·GZÆsZü³ëõIè±`M÷¹FßøòÖ6]~ëÓ´d‰æÇ^ŽïªËÎŽ7Øaè¥Ø|ëw+qÓñ¦éZ…ýîˆÍ{pàyp͆ðƆ·âÓ܇¥ÿKLôÜÓuèþ²èÓÏíú½´ÂÇå˜D>°·gYâk¿O×4qÖ#³Šš¢}ïÖû°ö®^y#r]3ÌYDzžHÂûòú¼—ÉòÄô dù};÷eùèè’ÏÎòû¶_¯¡Â@à,ô“™)^ÈzÃ^yñ™÷—üh‹ªWm¶ãÙwã_=;¶ñ~XGvïo…÷ ’»=*#V™îé¨L÷Gä¨Ì{žè–î5ÊÈaûê~Ž^ ²’Q*#³·íoXÁ\l÷vÖ­ _1ßúˆ±oç>ÄHíîÓoƒû¶Ÿ…-:ôˆÞÔ!suiWõe‹Ê*ltÅבzÕ†e;Î{róèg‹bä´ú¶õ&Òôz¼ouÜ‚H«zž&_Î÷¹¾2?;ñ4õšo\HœÞ¼ò¾‰0/_#äÄû¯Ïø};÷E|±á’ÏŽø}Ûß¼F¸2§OçûµtWî¾jc¿µÃ·ÊñŽQŸŽ°2½ù%vǺ¤.ô2s쨀DÎßo½îghìnõÛDãn¤Ëù)¯bØâ5çÝÇ;,\¶¾´gÙw /¼°ŠÄ¡cÂO›Ï]Åê½±/€ûvºï7}Zl\Õ#–Kz<7öm÷ -ïbls¿ïE%Ð=ë$=ðï³›}«ìêž$³eÓw³š?c±]­ÜŸ°qÞÚûï™™w úNOßmXá#-ý‹Ýì1Ž*„›ñrƒe·{‘E!œw‡Õ9Øk‚‰Ís÷øª ëΆ -öv¿6xXæ?êþ»­»O®Ö—;TÜ"â×ûãnç¯ïàˆÔ]ÜE¯!_®ÙÑ!kl ÙÕ Y(zùjÛõKhai³9yé ± V*.®ÜýéÝr'i{ÄÞcäÇ6°H/â.äå&ÕD®ßǪܳ¼ô¾¿Ãõ§wÒ¨h’߀âÉPÍ|‹½vq³]ÌüÈš÷Ê&r¬1‡#«/¾èã4Y÷Ç‘gÜh»Žv‰©¾oñélZ¦û‘ֱ߱]ú¡˜8#}n´ßcHè#ñ²!ö1ì¦òË!µÇE\{dЦbœçw -ö’\üˆ -jMr}ê\3¶;^8³½‰áËZ^Î`ùyM~Vçüæq°Èi“þe™Ô ƒö µmäâûÁ$?øAzRÈD³ºx‚ÌÄå«m‘ÅJ§.ðûdˆÆ._gEbÿêc Ÿûiü€Ù.Ú-þçŽ"ÎLnOæÑ[ã2¿Œ ˜°¥¡JL]ggƒ$egƒóÄ'É.XAŒ{¢ÝM²§®ã‡×†éÒ$ե霘þ.볘ÎkÄÓ݆-õQ¥ò#н©n]o-¥ê Æ.9&„Æ<)$¾£cG|c{Ó„É|1kü Ù™Xº#Ñ«]N!ªÜÒZ3•‡T™§Önù©ÊtõP†áÚITý™ß®"bËWßçA’¹Xsm‹ð¿#žH1´#·»xöÒqb…Ýõ$1ˆv¹Øé/“Šâq1B³Óø1þ{†Š8¨Œ<í‹£áRü(Ý<šplòÚH’žêfGyÊ -s¹œ‡ÏJ{¹byÝ!=,¶¢ -“ z®]=©k²^7È aÝ>+%Ñv%ÐÝ$ÇáÊ+òÔ3ŽP…³÷Î’îG»“œv>Jr3îø¹È¡ïhWø|'žZb£-™]¿ôN&ÙÛ‘ífg‚8(Lò„ÑÇFîÑ:ЉßõÒ¿Î Ó2îéðÛ¡¥9¢¯|Ÿgpü˜¿¬¼Üñ¿y‹Ï¿tü[¿ïóœÇ½hᶮÈ2“ñKaÊd~IL'Ž°DOö'Ù•)»7Œ<î½Àkš§Û ì]Ò uƒ+‰qÚPýp]ï‚°L¼B¨’:ÆÔx:5´Ã´>9'ù ï´Ðh+ˆØ £È™¡1K ZHÔ2O[¢ì”:mÕiO.@³6ZÌ]§´œÖÍÒF\T+åQSLêoÒÒQÎÊ0b”³’v²ÜnÏx£Z -£ŠÒó’£–, --ɳ•¦dè´}ß´î»gÛ£MEÒ¬Lí<-î$¿ -ÿ¾&vÔ»©5©þÛvG\™Ob#Q“ËÁ‡ör=[R†¿%SÛ%wŸóµÏËžßW‚ÍŽ_“¨«ðF}š!šê¯PÔO«VÒ}¸øH»zï»kïÉj7Í·M¢q˜y©È¯Å \ô~›O¶î…§óÍ.¬¶PÚïÿºy -endstream -endobj -775 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 774 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -776 0 obj -<< -/Filter /FlateDecode -/Length 5464 ->> -stream -xœå][ì¸q~ï_ÑÏV楊`±# ÛÈɃ‘‡9íÁ¬uò÷ó[¢(©Ôb÷ÌwÏΈd‘%²øÕ…Ù³Á¿ï,þ“È)åè|ùùôËÉ ‘ þWJ,JöOø‰|¶†âÀ6‡ÄçŸ%ÁÇ!fv1œßOøÏê±-þ~úßœþ¶¤±g7äœåóß_%‹üSŒ†•¬Œ,c½’Å<Äè8(YÁxÅœµ,°Á‘m³"Ø œXËä\R²Øð­ßfe°á¢%- lØÌQɲ|XgŒšF ‘wJžå! Óƒ–çìRvY͋ȳÑiyÞ!’e«åå!„ÀIË#ðÂÙX-Á ["£åò)jy¼øàš^\Š^Ë‹àÅ¡w²’—À ¤+©yàÅcµ¼ìΉHÍËÈ3)¦mž3ƒ×m·ÿÓ—ðåÛ ç¦¡ ü8sþòóé·?þË¿þîß~B_ÞNúBOÆp2ððsÁßQ¬$üjƒðÃ<¦ûkžýóÿyþòcÛ–3â.mxÙ–Toüµø?AW•˜Ž˜³D?®]å¬Ð¤b,Àe1%æZ{÷n’‡:wìS8™°Zðbðì <¦.ìsC›Žæ©ÕkÔG {dwÙí¿ÿñßÿø‡¦Û¥ké+~Òø÷+~P AM°»ÝÃ’®é4 ÕÛu($ŸÃ5ÂvýûkÓ߯ES¨p1aà)u°÷iÚ¶¿ï&ù6ýMS«×þ®Öse×Æ[nÄ ’Ž’Nå¾³2—ëo¶«tÓÃø¼×©°¯&76Gy³è:qÙ -߈Ë~ L[Ï·ë"ùÈúŒážù†?Z†vÔ†»]‡2â÷¸v+g‰jQ±*•8vH/ÄØÈb]lè­™yqiGœbq{Å;§›E?Kœü—‚Ϧ,o˜ 3戳Nšç(ب ælœØ_\°Ì£€½-ÜJðxõÛ-Ÿ ê5—n‹º`È&VlvŠ¦“Å""J¬Ðó«.Žeµz'ñ£ßGóV3¿b×¢Yx‚ªÒðã i¿»Ñ`ÙÈŸZa© -fŒƒa„‹³É!+uöˆŒ)‚ËïTzž¬Œ¥`¯‘ÔðŽ¸@F”0|xnÙ{‰Ü–Šç•yöV5Q f§[¼–HÃ!¨ß.úY î ÞGmY›Í]82:ižÔe5‘9„äu+!.Á¸ü]ó{ÙH¯µ ±+kR¶ý˯¨p^Ž”MƸÂÀp~ïÍŠ #KÐò£‹½÷†É~;ûÛE?M왇œÄzá# PQÎy@4O(ö*³‘vœÏ•h¤Y̦)1‰U…ÿQ‹£+1‚¯GbäJPr¹b§pð:·Z½®•RäVàÚJ%$ÅÁ+mM"K/+w ÉÛ¸ Óäɳ—H«2UQ†ß7zujgjW܂⬔îô[òÊ䟀À¬øœÚô;<¥ýv'>g°ÚLâ$kže틽H(e‰qÞž3}4O£Ö}†j›õ©ò禓Ý< w"ü¢‘¢yÞ¦M<f!kÔ=­g‚ù- Á -}y+:šÀ³µ¸ÃÁ$H¼¤ý:)”Ý°”:_®q¬–‰+!6Kaö¯%¢3Oâ·ý ½Ñš+7¬ÄÐÖ,®&Öêy_ê¸1a> „rS×ÄSc}óŠïʧìýº(ï¬N`2aðIbøgò$ëEâ;ÜžÀ4O3É™!ë„IÖƒQQÜ-÷â—8úZÅ= U ój~ $7eªÁ6 žoè×}2þ^ØÚ|Ü6/;YM€ÂgÙRYè¾-l}4Ï#l‹0Ù=«Æ þ?ÎÊgªB”á¹tø£-D› _–ÝÚ©á~ŠlSRèõ+Ë>)NLuGëlyˆAú.ýÊ+ëá_„=¾ÿ6:©@¤>¥9 ϲ/{ǬñÈì¤yž)-û¼K̺þ8°¬ï3—Ýkn©ï3•Ö_Æ7ê6wxMÁ_ÍËæ}IX´ÂÂ_W‘}8€&Û:£Z*›woCÉó C„|ðAW«“K¥wOŸ.$g—1ný¬eŒ`PsÊð>úìNšç[ÆN&|–óš{C·OtïïYV|ÿþž-}±sŽ éÆ–Úᡱô:ãÌÎع1ÀVêìZª™Mòm Ÿ½T3¯.Þè[K5Öì.£”<׸#ݲñ–×±•£%’ö}×Ë/;ñÂÃÊ2®ŠrÕnÞËY~r²JvÀzuÌY¶é®ü|ÞþŒì|Ãnÿ¾“æið?ÔU,úomø¬`ÊdïtM¶k·üßì‚å“MèVÓ}$Ï3LQv AÇúv†é]”Îü}Û"è¤yžNð„ÄX};Ë瘔ËFQ´sÄi[WB›ý–-=¯T¯ y±`Ö½«r‡Ï”ñjPêìQÆrq‚SI‰ÏUÆrLù˜Ó­ØSÆê4„*‚kfD¾Û@í¤yši¨@P§›Ûk6š~=@;¶6K•Ê±…ª®Ú4 ˜yûäúZ«¨o*l‚ç‰ZvXöÙÌ$ÛDsòÙjõܲÖ߻ѬÍlÛ<^[’{¥¼Í‰÷8> gH§chC…¾omI&¶u&¨}ÿØÞXÆ\c£ŽÃÝ{7tC'z 6 »3É™Ë$W¥ÁGÍóÀG¹ÞÀ±Ñµx)ÿI[Z궖µ–äyŠìѯ·Ù”á}Õá¢ÝÖò-®Ë6˜}Ì`Œ²—}›Áˆ£t D}4Ï#DQÎÙ é}kÊÎáÅšò' Ä7ÝëÔ½%Ê…H.yØPNî9p&nöí¤y‹ÕP§ï{úGÌ|÷²5:êìõÍ îœÜ‚ÁY®ˆêßqÚIó4—œ{1rËÞÿ…™[ۻܰ`§xWcq}³­ÔJôì9’ÛŸÜ|³†^Ël¶«¶ôÇv¡¬µÂxsuOë€(—aÞ8…¾Ë.ll¸° çX¤RçËh¼éö^ò,‡Žcôp|I®(·ÀÜžð}4Ï3áYÎuy¹/õ&R¸krܦUŸ·P¹L†7éöÕ3Òy'ßáF¿Ù\vÅ­ˆg -rƒF ÎìŒå£Sj}$Ï#QÕ‰õ+ó–ôERS -ƒÙÊv™Þ]ã4OÓùr•Ë™³vr|lpšèæ’ -º¹X•è^WØÖ{ßÑŒ-½Š3Ý›¶ãgŽ¤*ý´‡KñNè'‚È@ý=ÄS³ukKoߦŸþm[ -ñŠØè -/Þôár ÉNoy#ØÓr è‚Õ) €F­Ç;·“5Á:EŠÛÇÔlhÔšâzßµ¦pCge C +÷æuŸ1í¤yàtr&Öúø€Öú<à\0qsYhíAðJק¨;<î#°^â¸1™¨qüÉK9-lÚê[ÊéšÔÛºãCê¡”:¿Ýç7tžTMì}¿ïXi|¶}>;VAÆ·\AoŽø:<Ö+×CfȤ&PÔîp§n'ÍóÀ”\ÀçÈ„]Ÿr¬wÙȽ§9¶Ô÷æØÒß{¬w‡ƒûC­í¸­óeåî¬_üªÇz?¨öx“‡z8NŸlA\Ñ(w`woKé¤yžÉCÙ`vv:óþ­Á‡¸3 ëvë5ê‰î¢Ôù¶,[ñ¢f0Z³ñª½nCùÎɬ-ý!d´VÄC­7îƶõ¾`Í)‘¾ï>FbÇùä…ÊŠÜ(Pç -©-;W8&[ošDÞ&š¦¹9ÙÑÄ•/¤Ô® sbe½í:Û ÿTÖÅf8o%^NhÖ¯SßÕTùÎÖTÕÔ»ÎÔ4ß0•k*O%ë€P'%érR¿3SÕ0ºlÍoFM¾VrML“ Q-—§rJÒ外kã:R±–J3ižz~feuŸjÇ+i¥ÆÔ(ŸðlæˆÜ>C›,×ôÖ±6©‘·I¼œ bh“ü~⨔æ+ O¢×&ú¦ÞšœÌ,/sª¸–׿05§4ùÖƒü÷ -\SyÊ–ªHɪûü47"s³&/;©MuHëKq.Ût—±ÊlÛ_6¥¼€n-]{l‘ÚtY“.7lתCe²­RW“¦þ©XÙ&š‰ 47'så÷EòÌ'ש*‹ècb°¸s­wN;ßÛäXGÜÊÇw*¿µÞFæ§ÄKQl´NÑOS#s²¸“øÔƚę1€Âœ<Ãè{IžfkE'¹€vúsždšÆ½œþz*j¶¸.x+ß’k-/{þ”ù?ÿu¢ó¦—\õ¸3-\ÅÖEr«ÉäË£©3YîÉžë´i5°?'Û4—åIªw®ÁkšÉÍ ìSI[ÔÖÜ6‘ç>l’]]ùÎÅÜ3|#ñ²êÅjÈ|tlf…}}ôÓËÉR¸|öfâ -íëx¹mºæùY%Ÿ›*ñ$Eg•Ž\r !ÚJñØ4˜gÎlŠ@¶Ô®þ© -Ù¹Ñ>4f„<ú9f5ÛV=¥•·hŠÀöíC[1ٶѼàGaúáéõáqYÓ Ô -í5õ½M­/&©ðôT_Ãò±ê_vZL“wî¡Z—o枯FÎ<5fÓ‚­Œ6©i& pÛ(Mi‹F'EQáifJ«5Ɖ§0’MÝRÞ8©½«M1§þµíinG¥v"·£6e¥ÞIãUkÉWˆ[qŽóÛ™¹dµ%“’ZêšJsI?¥mÛ¦eÛ“¶=7¯A3#a¶LÍLÆ›’áß#sGýV”VjúW¢#6ÍŸû‚¢–Kœ/_p7)`ÉG8#¥&\r7ÍíøÉ6J2ÅOÚ–0yo¢…¼í°ðŽŒ|œÑTõ>~)M'ËF}¥û:@ Í0·ý²Wù3þ7‰êcWQ¾½.1¾”䓱ÑX5\TÂ@A~/B(åßÿs0ƒ -endstream -endobj -777 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 776 0 R -/Resources 4 0 R -/Annots [ 778 0 R 779 0 R 780 0 R 781 0 R 782 0 R 783 0 R 784 0 R 785 0 R 786 0 R 787 0 R 788 0 R 789 0 R 790 0 R 791 0 R 792 0 R 793 0 R 794 0 R 795 0 R 796 0 R 797 0 R 798 0 R 799 0 R 800 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -778 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 766.923057 101.433071 748.173057 ] -/BS << -/W 0 ->> -/Dest (cb266-1) ->> -endobj -779 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 747.976036 99.933071 729.226036 ] -/BS << -/W 0 ->> -/Dest (cb266-2) ->> -endobj -780 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 729.029014 99.933071 710.279014 ] -/BS << -/W 0 ->> -/Dest (cb266-3) ->> -endobj -781 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 710.081993 99.933071 691.331993 ] -/BS << -/W 0 ->> -/Dest (cb266-4) ->> -endobj -782 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 691.134971 99.933071 672.384971 ] -/BS << -/W 0 ->> -/Dest (cb266-5) ->> -endobj -783 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.187950 99.933071 653.437950 ] -/BS << -/W 0 ->> -/Dest (cb266-6) ->> -endobj -784 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.240928 99.933071 634.490928 ] -/BS << -/W 0 ->> -/Dest (cb266-7) ->> -endobj -785 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.293907 99.933071 615.543907 ] -/BS << -/W 0 ->> -/Dest (cb266-8) ->> -endobj -786 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.346885 99.933071 596.596885 ] -/BS << -/W 0 ->> -/Dest (cb266-9) ->> -endobj -787 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.399864 99.933071 577.649864 ] -/BS << -/W 0 ->> -/Dest (cb266-10) ->> -endobj -788 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.452842 99.933071 558.702842 ] -/BS << -/W 0 ->> -/Dest (cb266-11) ->> -endobj -789 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 482.717735 99.933071 463.967735 ] -/BS << -/W 0 ->> -/Dest (cb266-12) ->> -endobj -790 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 463.770714 99.933071 445.020714 ] -/BS << -/W 0 ->> -/Dest (cb266-13) ->> -endobj -791 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 444.823692 99.933071 426.073692 ] -/BS << -/W 0 ->> -/Dest (cb266-14) ->> -endobj -792 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 425.876671 99.933071 407.126671 ] -/BS << -/W 0 ->> -/Dest (cb266-15) ->> -endobj -793 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 406.929649 99.933071 388.179649 ] -/BS << -/W 0 ->> -/Dest (cb266-16) ->> -endobj -794 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 387.982628 99.933071 369.232628 ] -/BS << -/W 0 ->> -/Dest (cb266-17) ->> -endobj -795 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 350.088585 99.933071 331.338585 ] -/BS << -/W 0 ->> -/Dest (cb266-18) ->> -endobj -796 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 331.141563 99.933071 312.391563 ] -/BS << -/W 0 ->> -/Dest (cb266-19) ->> -endobj -797 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 198.512413 99.933071 179.762413 ] -/BS << -/W 0 ->> -/Dest (cb266-20) ->> -endobj -798 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 179.565391 99.933071 160.815391 ] -/BS << -/W 0 ->> -/Dest (cb266-21) ->> -endobj -799 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 160.618370 99.933071 141.868370 ] -/BS << -/W 0 ->> -/Dest (cb266-22) ->> -endobj -800 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 103.777305 99.933071 85.027305 ] -/BS << -/W 0 ->> -/Dest (cb266-23) ->> -endobj -801 0 obj -<< -/Filter /FlateDecode -/Length 3653 ->> -stream -xœÍ\訃 Ýë+´`zXE²@0‹I#d#YYØŠ=ƒà:€'‹ü~[]–x%]ÛƒØöU“õ8Íb’Õ-‡#áçÛ€Š„¥”š“O´d%üY[ì.Võø›õHò¢¡¦¢Ç&à¼äª1§ãÓÿ\\ÎÍŸûæðï}ŸpŒK­)=þòÎTÂK.9“:ª -vTªKÎQ“£JaÁ-Öê©C³D¹VeÀZÔS†ÄXU –øZU#æ ž -0BÕì¨GˆD®@H„££ º$=yº–Tj¬®.CrôtÌKÊ4xºº¤”´x:­<‹òtÀ"\²§KÀ‰ÉÕK,™=]–ëTGW€ÞU\°P¢àé*/Z‹ˆ««ÐQÉåZI-ÌäéBX¾É®; -‹”²£‹À’H««eŠžŽEðãéÀʹg·FÛÝL<KŒY\°`ñ=ˆ X('°ƒã%b΋Ô( Ä‹) ÄRÉ™=ˆUI5{<À ‹Á#&`QIpÁÎuuÀÂU<.à,hàq3°Da l+ð t+TƒÇ ¾ -Éãá&y\À`\.I<.`P.\©z\Àà\wz\À ]l÷ìqƒuYSô¸€A»,%y\Àà]–@x—=]°À=.;. -{\ à]”=.ð.¶Qô¸«ºÀ“Çð•%–Bx7 ¼3B€«Ë ö {\ àݨ¸/rƒw£Rô¸@À»Qbò¸Ž²€ÈÍÀ» õÓ`Áz\€x]d 0Ø‘–x\ àÝPþœ= ¶ZB©Éãåsuu wö-¬¼„”ªÇ -ÞE b ¼ ú,€ãDÔèq‚w#R{:ðnˆ•<.Pð.òõ¸î°$ ¾-ຮ®.TKñ¸@Á» ¥èq¢ðBLâêòG -€ŒBêqAï"¼W x—”Ùã‚Þ%AÚãꀅKô¸y tضΞF²ºPSx:ð.¬°§ïåêqAïZØô¸ eÄâq.È‚£Ç©ÈRsN¤JÐ!åsuiÁµz\ e¹:`‘, ±^*×âqAŽÀÂ1z\#° eð¸ÁR²o·<¸‹[° Sô¸L¶”*âqAÖ„z Võt).%ƒ®]].d r–¡8x\€Zj)Øô€àK—<. è‚x\+°`«x\€P´”ˆÌÜÓ`A’íq2]èBð¸ D`A6èqA‰Uf" ¡QKÂÔžNÈêÌâqA‘´Xªèq¶ *M0¥«ЄÇX+¶Õã?(6Qæ¸:`a J‰Vn J–HÑãø¦Õ›Ùã‚JÀ‚ŒÏã‚Ji±4ÙãÐ8tDÔPPoFñ¸ûÒêÍâqAeB½‰ÏÙ·•“Õ›Ùã‚*À¢HQ\° iªÎ¾'¡Þ;yº,±ŠÇ5%«7‹ÇH3Po"£wŠÕ›Ù=.ïj3y:ð.2Óäq.Po"³õj{ñjF~æ+‹UœÅ=1 P¯"¶ºGîE´Êî™|­Fr •eIî©Â*”Ücÿ"“+N8Ÿ>ÍGT î3K¶›¬Ø‚ì¾×£?Óì|>öËO‡ïÞ øúÏáý7ëIYû p~–d…µÚ‰Ë ºZÖáäˆD R06„ø)} D®d-n‡n¡á¶û‡°‡ Ć9 ™YïLæyQ),'ë‹û|!¬ÃFŒ1 5 @ŠØ=»>Øç‹Ûužw2’ƒõÅ}¾ç6äå"‚ŸPPP­5‚QÍššÞ\ÄǺ|5‹ˆÚzA_E’÷ÅWñÎ*‘Uª©^€X—©nËã/ ê ÕŽ2,-ù›?ÖåëYÅx‘>asÝ6{He¡ÕjÝ$«Ùó¶#âö;l;Æ_†„¸^W:Z1Ÿy-„o/ÃC]¾žeÈö L+Ew^h®bÅV%ÜŽHp»ég˜g7‹=â,Áèñ. ÛM¿Tâ;¦³ƒÛ¼&Ü5/k’Í÷>ÔåëK×¢=²ƒÓâ»Ø§%FÓ.ßOð`fìd+P©Áë¯[Ì4—×íwÃyõ -Ý,’¶™Òqªcö,SQš ^ýþøËdƒ(6¾m7 -6·Ýäe‹ã¦Kç6ÚÚÄóv ÿôÓ3†k s´B$2ÊÏ*ºÚìóÿf/íxíGS*ìºV0óĽk]¹Û;üÝØÍbrgºmÙ».ï—Îœ»k´ :ïûöŒzko¸ºìí÷·•ÕNÍ -åzq»{GÈ íñwÒ êðÝps7åÉåòöysIÖóµnî(ï×û=ßØÔÈ -&²=µŸt]—ç\Éls?{ͼ>à¸í²õùœ²û×ð\ |ËséÍôf¤E=ÑOût©2õ¿¨÷Z[½ˆõ=åzË ÈPì ûy/ì–7ÂÓ–wL^¸î¾ÍûÊŠãÚ‘rW-pŒý„·<s4oâòXÂ÷X—¯ÎÿªÜò¿›ëí®t]"MsöËù 5…Jr×=”ÁŽA¶ßµ–îý¼áÒÍg¬íÊXo›¯`Êý\có©z¤Ær­¯âõ:M‘àrî6^mÖ(R®ñY»ÃŒ/îÇ[}ø´éèö¼ç=°ùú#&×ÙäëʾéqggŽ. y³L·vš¬ª5½µ_“.\xͶSétµKg¬µØÉé´KýX3vïn<"·¼eó¦æ›÷®ÌxºÆqö´s»õ39ÌžÝ3Ã`UmëýÌîÝîØØ9lL&;¿ú¾½ik½´ÇŠ/6_ÜæÉãz½÷)èÜž®q}î}ÍsŒ]>Ýï4OßÓ6¦ž}¶Ï³­S=úü¸=ÉËV«Ú›EC™ ö˜s·Ésý±•¥ÇpQîC7†´WøÖ"B‰Ñ‰>¸ã»st#T˜"žŒ|7sU‡Üu˜õì2ÛVkÄùîÜμúLä› ¼?»·É× -*MK½}n[v^Îøf£“ÓØN»ñuÚil?Õé´ÝÃÕR~<¤õ Ž°¾ÅG¨SC´×üI‹Häí­‘B,¡-]XŽÏô\¿ñ±·Ú¾/Aö -¥½>sþ2Åt±µÿ¸.úD -ä?-6¬ï6Ó*.±] ñÓÁÞmG,2̱ ·ÔÇ’ÐãU“Hå¥^¶DšBÛÇÔ,w9ŒÚîÆúkëfç}B­¯OÝÏ;BôLáZlwOKØÄöýÄÛUêP45ÌŽen;ïŠÓ$Ôk!MÓ ±.·¶±¬}Í!ìÐgÓ…iù[Û˜§å¼%<0-_JŸ\©fm¨fÝH]ƨڥÚZö‘¾NŽètp„ßRZ°˜]?­š½Ûu–æHÒÛÕÖÎn»m4í+•{«2ºÖfùe¸:—nxGvš¿l_xšöqû¸[ÒךÊä7ñJx: ÄÈ•øé Ùi­ƒ+H›ëÍBžÆíâBÃ_†4—f*lÍ&³7cìß3Uh—ó¬‚t—²·ÛÆÕ˜Äöfï4ËSgñ,$¶“¹BÎÝgg{…BN{#ÝÞº[l'L6ÉsmðŒ¤:yìÅ¡{]…5ût®œ…Ô@`º!ÖîÊO;ñÀ©}«*õÉR˜Ü]û¸Cœ:w>ÍâÜW<Ø«Šowòù&<­M.Åæú¥M2Äö4®¹OŸl` …!4ú´ŠÛníìd_¿jÇ&ó"îéðóa s‘5Úñhâ`oÞÏ™W8þm^áï¿rü¡½êuŽã‘:[Äέ;ñÉì{ZåA±}o« û¶™„Q&ÚâPF[mÞÐãxŒ_ËèNƒØ[ËÐ4tí,ÔaÃI»ëÆÀ“eô†ðtaÅžÈ|îÚŒ€}¾ävsö¸Þ^l¨p1ß.ËÐñÉÇiH\YÓÒ¡•8uÄÅ<(.§ ë@¶ƒi9OÒMoøe^ -¶¹¦‹)°K:avºÉÖ»˜š æùbX¨X‰úe¶RѾ©Î–ôû‚]¦àŸ÷Û1P²£”ÝÊúó?ŽŒ;ä -endstream -endobj -802 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 801 0 R -/Resources 4 0 R -/Annots [ 803 0 R 804 0 R 805 0 R 806 0 R 807 0 R 808 0 R 809 0 R 810 0 R 811 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -803 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb266-24) ->> -endobj -804 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb266-25) ->> -endobj -805 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb266-26) ->> -endobj -806 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb266-27) ->> -endobj -807 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb266-28) ->> -endobj -808 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb266-29) ->> -endobj -809 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb266-30) ->> -endobj -810 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb266-31) ->> -endobj -811 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 605.596885 101.433071 586.846885 ] -/BS << -/W 0 ->> -/Dest (cb267-1) ->> -endobj -812 0 obj -<< -/Filter /FlateDecode -/Length 4594 ->> -stream -xœí]K$· ¾÷¯ès+¢D½Ã‡I# b`‘‚fÛÁl€Mùûù¨.=ªŠýOìE²»ž.RŠ"?Rìª2-þ~Aø'3™œKŠ|<}8|z«ò ‹ËÉk¼Y´S^†,°®¬ò ‹–4^ñ&”̬ò -x6§¼ç9LÈÞ[GdlÓ«å¬x«ïöÖ“Æ Å¹Ä*²`ó5p²Ø5€Á% \J†‹c \ö†3g \.†Sò ¸ Ç’4ð–Às¤·%pÔÀdax®Êƒ,¾°†ÞA4аÀ{ÈâØkXචkÑ°ÀnÙÒ°ÀoÙRÔ°Àp!¦Õ°Àq}Ž¬a䔊†˜ëx€.Ü=iXàº>D§aìzÎQÃÜõLVÃîzž*²À€5,:OÙkXÀÀ]O6iXÀÀ]¸‘Ó°»j`‡QÃØŠq9[ ¸ë²e ¸ëB€ÊK>è5,`à® X‚¹».X§aw»¨a Ŭš w!AO VÃÄ{ðœ×°ƒ‡´DÂܥ‚ð§ø4ÐÊP.QÂܥŒíSyÅP‚Æ¿…– ÅX4,À]*¯aAî>³†Àxƒˆê4,À]òˆÔ¸K®X pyCаæ` €†ˆo†,LWåcKÎà.`ÉiX€(ll’¨¼d`H¤aÀØXä¡Dà.Â{Ñ° wmð^ÂܵŒ´GåAŸ†ÈkÀƒÛ*>dÕX¤ÐxÀ]KØaܵ6 "pW¦†1 Áe  Aì4,ˆ™MI)jX‹)ŸÊ‹×AÂdA€,•Y8±†H¬Mñ%kXdñÎiXdAÊ a2SÙ·z<€,0õ|À™¢†@2“ ³†)DœÇ UÉ p­ò2x”4,H‰ B1iX€³”Épz ðFÒ% xĤYà* ™ì™k<‚,H²5,@¦ ‘†ÙAdƒd—qÊŒVÃDhœ%¡jÇVΙYÂÌÑHª¨aÜ'M ¥Êƒ,€ °?rØàðƒÃ&Ž9*²øÀäì丙5,Ȳ8ë4,€mÊy3iXP,dAƧaA±ÑHš¬a`íˆ+äµ Ít$?ÍXút$aS1!«›L(£õ–â°–>ÝLœM(ª&Ô©cÑcª¡M¿§ÏŽû³8®dêòç¸ÿ €ì¬±†ºC^t²Yo³î?;ßgçû?s¾(Òqÿá盞W<)bmÙŸï³ó}v¾Ou²ÇRÎ ùÙñ>;Þÿ™ã=’râPhJñ!øBíTùš>×O¢RZw˱ÐÏ¥äÉÔJ¯æ „s¯u>ª²>ÜçÍe•ï -}ŠL«y]Q…¼Õø¦twíý^ÈW¿[È[ßVÈam™àe˼ÃÚäþ¥œmŽª…ÞÙçÍw}žwèH“õá>o.ka¹Ë†ƒµwlþ­Æo¸ùûjä¯Þà¾õ–?'¢æ\¿¬”{ˆ’|ár|÷áð˯ó»ßþé,üÝóá¯_ZK?„Ÿz¯ þÃOpÖrZ®#>£ ãwÀï€v|ÂoðÃiÓçùÌ“¶õ·´_ýíøîë•~›áãr2H¨ûDÎgõ,ÝW_ЗMÂé3/3Û3­JDÓg»üþö,…´‰ùýÒf¡aßêJ{ûxæ·ß•æÚ2~k¡qY®ý¤™²¬þyÑÜÓò{ÑhÕäfÌ*oÖ±h»Êr¿ËV‡ö½°Ëî¹úüö»L¼øÄ2ÑÕñ8oÆ;ûî°çÙ·~ý®F ß¹ÄÆ/_LœvJÎõ;x É(¦¨õhŸW…Ö%X'wI`½˜ÈÉ·ÊÖ[²åm#n³žUÓ/ɇ.oÎró®óç€öû¯ÿüÇ?L¿PÇ¡Aéò»Á{Z®Ÿ;´^œ¸Dc‹Üg´™ø Ë8OcŽ6vã¿)ízÕ÷yá¹Ü<É)¡ÏŠy®×6kêüÓ…57]¤iÌ2Ö6n#÷·SûÎþuÖ[á<ŽoQÑixþêFodYÙ#Î…K;r£põ\Ã[Súk[ß’ SÈÙè¯ØļWwH…ÐcàKÁ’6æSƒÈõþlíº¶ m®8”‚SqÍ¡‘À‘“õ7Áá¾>?78ty™`)˜–=’» xmô>Oy_^;SWì4FsÊÖÖ>uLîÙ¹H­Â<¹£.rjVîD–÷ëx¸UzÞµÏkäžð"w_n&­ùõ…8‚qÛ¶³ƒ±'Pn˜Ê}~Ì!è¿NG¥+#®'É\¸·² W­ŠöYû¸ ½…§ bOë±ìÆíÔÕoCE?i=O£ÿôëzÀ;$@\ñŽnùid- îÞ1g^¹êlïp‡äd¼žðšg„HåÎ^$NÁÞðŒ;û|jžR¸æ?™õ¨vsÇQ8:‚>btåBåãBm¡íO§¾ðªšAëiš«Íû^Y×t^h¡ôáåL–ï¯ìÀö§­h§¤¶Þov?Ž•ÎU–®vBÛhµž”±2×úÑ$¹Ýôi»‡o[1‰ò@Ó -[^W1ÙóXÅ$Q¸$‡ky]Åd?öÿNÅ$ùíÚ>劉´©s.£ßø¯J²Bkú ;}>\%Iò°ßjŒGª$†‹¤Üzw•äÎ>?÷A¨oœëMÕ’¬'~«*ÉW äaØœYj^{yoV ¼TR¶Ië}ÏìQÉ$yœcßÿ® -„|G/àË·xõ]áà´Ù˦»IÈ`uèÛÒ³<´]Hnô…î8±q9ÐeK¹Ñ?;øNæ¨éþ¾ê…ƒ:²¦ýWVo¦Š–2æÓ”D](l}NRù¹·êƒÔI‡:†©fÊV@ÍwBÝ}}~n¨òÊÓt–<%½æ³Ë&“_EÆ3M2WgÇuÔÛ-k'ìÓÔ®Í1›Ì—ná“õE×2nÍ®Ê,?O·œÄÉÇàbܨ÷Þ"+¶§9Ä®ÿ%^j%Þ×Íl+ñîûßYâM­Ä{A‚e×n[߉Íõ–_Ç  Î !2×û äö«Løìo9ï}}>çžÛÈv)õìò”¦¶šï0ŠÙX„)ï6“Üe‚$\’Í…”Þ÷ÌžƒaŽ‚Ö?<-®} gIʼnuº K¤ZýnŒéå•2¸H¯ÑŠãX_ -!°ð­8©@Ë·›Zÿð~Úï–“¶ØycܧTœ¿¡)7ƒ6ržx_ÎãCéÛnü-˜w ¿1faƒõÊC¯¯Ò%‹uøì|Ðú?×[­c›#O…¹GHº>)Õy>•ü~‘±žôZ¹Vžô]àP^E¢°|Bïìó©•kKô×ô|ËT+ûm f“·mOƒÛÀµùjlûEÏ^LƒOþ«’tèšY½ý7›76õÍò¤o -GÉ.äM 8ÃäéÁánH7›Ü°›¦›ý]‰»§R×êÃòŠ?@”än%ÉSñ—t'U1qÍvןTê}«•³ÁÔzøRƒvMçtvã -sÖŽzðwçvdý·;ŸÏ¹i…ß^©œ\>î+hu¾§eßN£¸?,sOò´ -__ChkØmåÇC¬ox ú–‹dœ¼ðÙxÙ›r”·Jdë¹ßMUÙt¼Ð³¾<ñco%ÿ‚dåKòzºµóÅÒþcÝôB@¨ø+¥óúî3[É÷°%¿šX!3úû ²—¶%•ú ít”›ì7-=vù8jþ‚Gv‰õm5Ò?´nòN¶­‘¯OåŸ'VˆèiO–Õ[C YÞ˜_®by{éÄ1 ÏmÇ€£ãM2y;Þh§éÙq“‡ä}3]uq»è³êhÚþÖÖ¥i;¯OLë·Ô•*o-kC5í:Ûi~ªtjh-û†pß'…$Oaìˆ_Ø64c3;Ú5y÷Ë™˜›!qoWZ;…t:¨í–ÑBß©Ô[åѵ4ÍQ†©ûܯÐNÓ÷bI^ˆ:ùˆõíãš,_©ô½¶y²·#ž1¼#×'oö­ÃÀ -šéÍD?ÛÉÙ{Ô”›ªàš&oÎÏP:U§~ î&%o¿WcñÍN^+i¦ÇŽ:¬i€8¶“º(¥n³³¾([¥½€noÝ5¶¢N*›è©4ñ¤:x¬ÉÔ­®“š~:VÎDÛ„Àtƒº)¿¬ÈCÎÐ]5Ø>Y¤ÉÜCwcÇΗ™œúŽ“¼Ê¨ËÛÇl¾O5°ñ–,¦ŸÛ$ƒ,gÞf>}²‰8( ò€Ñ—JnÞÚÑI^ÏÚ>'Ó"îéðá†9œ¬œ”@¢'y3ßœyÑñßhó5~þ~àãÚ#cç8îlG ×±uEž#™¼Ç5ßI–÷º6bw›‰èx‚ýA¦<Ú†f =Ž;7á5îv{kIA©sgb:œÈ®›®#?i&\!ž6Zì‰ÌÝ›°Ï—¾-NJ#ò¡&.æåà2ž!ù8 ‰+i:B:¸ì¦Ž¸˜Åå4a’­Äƒœ'éªùyÞ -)uÍS!—~ðx„ÙyèF««˜š öóÅ<0Ó×ë'—ßÝ5Ï„í0ì½M$ÿg]„0ÊmÆ4Tû¿èÝŠU—ô˜”òЀ¹Ý¡T_m]‹µHÔ/“åMö^’Þ,/àMö¢R’›‹âª„Rÿþo¶© -endstream -endobj -813 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 812 0 R -/Resources 4 0 R -/Annots [ 814 0 R 815 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -814 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 563.554475 101.433071 544.804475 ] -/BS << -/W 0 ->> -/Dest (cb270-1) ->> -endobj -815 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 231.360432 101.433071 212.610432 ] -/BS << -/W 0 ->> -/Dest (cb273-1) ->> -endobj -816 0 obj -<< -/Filter /FlateDecode -/Length 4418 ->> -stream -xœí\K·¾Ï¯˜³·IVñ>H‚qBr0rX­-Á*€œCþ~¾b7Ý];Ó3ZYr­vgºŠb±êc±ØÝölðó¥ÅŸÄvJ)ÇÀçÇw§÷'3Eoð¯”X]öwøþl ÇÉÛ’?¿Å)fïb8?ðgs9:ýý‹Ó¿ÖuìÙM9gýù—…Å4Å£ñ -+ƒe,),ï§ -+Ø CÌYcA Ùñž!çä5Ä`ç’ÂJƒ8ZÚ³2ÄpѲƂ6û¨°¬Ö£ò ˆa&§ð¬Ÿ”4ž³SHÙe•Á³Ñi<¢)D¶Þj¼<…|Òx Y|6VãyÈâ-³Ñx…)E 2*²¸IãEÈâ ¬ðdu%•YL0Vãeš|NÌ*/ƒgRL{ž3~ò‰Èh`?­j¼à¦×*/g£†1ò„¥ØjX€½Ô”àôà' —4,€àYÖ° fÈWÑ°KÑ”"sg! ‚l é‚g­†ÉADƒ$—°Ë FìÐØKBÕì3“†‰Ã$¡¢†pì4”*²&4,ÀüÈfÛkX€Í6›Øæ¨<ÈBž5,HÉÉv3iXdqÆiXÛ”ýfÔ° È‚ˆOÂlÂ$a²†€qðŒÑ° Û„ý¦c à—²ßLd2Øob‹§øm¦ ûͨaAfÈ⢨<È‚ )+~ LÂ~è¤ñdq™5,È!È~3iX€0ûMDôjJ É~3ªéà®Ï@&ÜEd4,Àö›ˆlµ½½ðúˆøLg&Ùq&5c`½k«š20À^¬VQÍ€¯ì‘Ô¤ÄÄÎ25k€eLkÔ´þ"ã&ÌÙ§1E`kfŠ2È ·`D÷mÏÑ‹Ñ3ÅæüØ/?¾zÀâ{þéߧ·_”LYý±JiF|7pÓí}[ Ÿ6˜E2vKYé4æ.” .I6 -Ëü;￬$… "*jcdïOøj–~<¥u. /ì1àÛ]Ô›ë\9""ÈçöÅê²vývi²Þ\çÅeezÈ9˜ûk…_vò›ÞòZáe¡´¸¥ß£z°Î‹ÏúØïQ =XçÅe•EÚ`•NþÀä_+ü±,{ý„¼Rø……¤Ú/vaPº@ b0l`±å€)‘è ém5^P\X˜ìOÊPvÏa‘ÆNÜðªðï^Ÿ°´/ŖFíÒ’o&‹PÍùóëw§¯þüÍßþòíw°·×oOß¿BÐgæ__iqíÝò™–O0}œ¿;)Ë_ÿãüú›Óï_÷µUÉ“p› írpór®p©HòÍþôÇ¿Ž’,=°ƒ¾ËäÿLãG‘jøn–Ïð™æ²€Ão–2 M4ƒ˜£—¯#C[uôKû¥­…Æyi'ìË•þx#úõ¾·_Úzúªý¾QÆõÐÇQû*×Û:<÷Áiž•CÓÀã4|ÿêm½ÙØCè#¾ƒ´$ŸËì4ÉyÑpêTí‡Þ¾yƒº<ØÙ0ÒRŸ¹ÒðýíÜžýaßN Ùß•3„];el‹ü¥­pIWŽõT9L‹Ìt_±ºÙÏÙä,)v!+m›Eÿ~écÔYµøâ9òæO3Œ¥|]O\Ûùü {ªÖ9zWïÇý¸è¸ŽÕÏeË÷ÖþE½ÑvlÅSÝ"Ó ¿tý™·‹¬µ\­ë»ü£g•1p·éí¸lmciSdš”)}†¹ÎÖ)Š»[é°ú‹(nl½ò}õúªË‹:ô[úE‡M&^ü`iÏÚ‹íe»ioö×nã?a=X­™$†Kè qc­K©ä•.®³ëÜ[}Œ•UõbgÔ¥•ìðƾÂëòÙàt¹~‹Ïy2ží8ì$w¾éx†‚¾ppZ·]yž6PNk¾xP_l–ö~Ê·Eoá_–—Ê6‰%ݶ—׿ýúJm/ùŽd¢VûHïAЬ$ßöõ˨øš’âñIŒäy}8xÜÌeÕ¿Yë›`¥éëÒ³±g+i™;tÇ‘±GñöyK¹RanŽ‰ƒ¦ûCºpM¼MšöWöæ{»Ò¦ÅQ -.hm> ÁQ|ê‚ÏI"¿3̯}b[g†ýg ŽÝ”r"€ˆ—c‡CPw¬Î§†º.¯—3Ę°DhP·—Ãjeì»gúuY©·S¶|šÇ¡\íc4™W·Ná‡É:¯¢k·fWd–߇kNâä«w!lÔ{ÐM=¦§:Ä®þUÓëD6'gïöä<ñÖ8ŽƒDˆS†zN‚eÖ*n¶6›ë-¿´aŸqÞ&ì0%ŸCÑOÉbFèšó«óù8/ðœT`õ8¥ªm£æF`¡ ƒeŠÜ¦“C&hå€Ìš”­RûHïÉOŒÍ‘×êû‡Åõ/·áŒ›b6YÖ:]†e¥jt].Gr .â=ZqÊ-< ÷h¶4eTqZ}ÿf˜ï“ÖµóJ»Ž ²£+šr#h#æ Çbò¹El»ö·`Þ€üJ›™'ŒWŽ(ïÒ%‹u &y­þÃí鳦=¦îÄØÉÍ‘Á¿š8siž×q›ºÝNêé}ºAnEÌrÓϦӒ {f«Çœ+Ê­½V–®@èÁ:’Tý;>¹½î’ZB…º+nToÛî· WZ{hó¦Ø­¿Õ±oé«ò†/YU³˜Ø“(5©Ó¬jL*$ÓÓ£E²OÑn:¼dQ°äjGsôǪ|nöä™/ÚÓèòÉy¹Ù/ë,ß–œ¯–ðÿäü‹$çaÁÃ4Ü›œ_2ö‘õ-Ôœúô‰ûÀqJ+L¸/q¿oç¶Ä}Hôœ¦å¾Äý¾íÿÄ}4Û±ý–÷4ŒUö 5é^}ãåùuè¶:ì ÿi™nJäGÖëöoIäGl²Ë¸‡ùë|ê r[†¡ -lÈ=»õñùëŽ?ÿDþ^Þ[ùÏŒöp"_ÿÖDþóúþø‰ü;t7$òïÒÝÈ¿SwC"ÿ‚3‘¯´ù ùÉʃ+»šã‰üƒu>5ÔuyŸÈølÜM‰|²—Xèóª¹É'ýØMãsMö¿Ôx^ö@’1Ål7ÓtÐ݃q,Ê­þU° °äò±¹³w_ŽÎÉ2±«lä,ÆFT ^—à•r  »2„?åæByÌ’äþ÷k9©ƒu>W–t»$pv®|×)‰ùã€!ñ½îÖÄ÷¾öm‰o¥÷ƒÇa3¼€·êý€ãyÖÜB¬äîÑ -YÄÒ]@á­œ2fÙ$h½ß OŠgl»sº¢©;Ø%yâLž¾Ù·çq€¤ok4v.ÖQã±}ý_ë8 ÉY!C7¿âqÀºÓKÉ[è·Âèá〃u>·ôm&{ SÇåi·ç­êåÖ^´¨œªu=8Vås³'k0— êFxξ[žz‹þ,÷nÈSDz4©TyƒOmªjÛÒJ£A¨Ü¨¾–lÂmžÒãI!~ijÓŒÉlüaÖä=31UCâV.×r -éñ¤–[Zóm¦b+•zÕ\5ßEé¦N©)^¡=–Q^8øˆ¡úuM–s¯6×& vãvÄÇ–Þ‘ŸN>*¥}Ç -ã«éDÚmädº½tjLUUpÍJ“§Èåï ¾QyÊËͤäMýªw"¾ÙÈk%ôÐP‡5 XŽ½ì .c³ÙQ_6¥¼€n+Ý4¶¢*è1Wñ¤x¬É¶Y]# „Uý4¬‰¦ -î:Ù7S~Z‘»œ¾¹ª7­³`s÷­ÝN ;ŸFrl3nåµMÞÖî`ó•øX6Þ’ÅôSí¤“åŽÂj>­³Ø(tr‡Ñ§B®ÞÚÐI^UX¿v'ÓVÜÇÓϧ²Ì9òN2Q»è¸~ÒÔžÿƒ2ßà÷Ÿ'>[_‹0¯ãÎ4´p [Wäq%“w¦ƒdyÇa%6·ˆŽØïd›zY_­¡­ãÎ xͽºéÀ^KÚ† ¶qG¢ï:È®™®³4hÆ_ >n´Ø™›¾`Ï—T'ù7y¡F• -ãpp™:ú’|šÄ•íK:¸ì†Š¸ÅåÐaă;iªùyœ -’¾†‹!ŒKê<îËìØt¥•Q EÓx16,©µÞV^É£}·{}ð¼/"‡êBmÐÞ¨O#µ L¨ ðt*•Ë°¾lk•tPuÞ®¡Ö ¾G-Èé®ÑC ^]Œ6:PS¯¶ðc§\i«NëBÑà4Si­ÅXe -Kµª–2â¤j)¶˜¢S5íÇYiJô㬄]Yi·®x-Z¢ùÑœcé%[,™Zk7*÷’Tiû¾yÝw]mÏÃ0¸ zdjz5¿+yþÝã;sM&B+UJvĦþ"!,Ôl#9*ï†6)`Ëëý"§!]rsËù“}–¤æOÆž0™hå-ߺO`ä댡©úp½Z6ênS€’ê0gvÙ¡òš×’{+I¢ve«(ou& z“¼Œ2«ß»ÊóK$l\¥PÊ϶Á† -endstream -endobj -817 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 816 0 R -/Resources 4 0 R -/Annots [ 818 0 R 819 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -818 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 606.123057 101.433071 587.373057 ] -/BS << -/W 0 ->> -/Dest (cb276-1) ->> -endobj -819 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 254.981993 101.433071 236.231993 ] -/BS << -/W 0 ->> -/Dest (cb279-1) ->> -endobj -820 0 obj -<< -/Filter /FlateDecode -/Length 4393 ->> -stream -xœí\[,Çm~Ÿ_1ÏTfU±n€ ‡I`!"à yü°ZéØVd?äïçcM×¥»93=sÖÒÚ°Žv·›¬ ›ÅúÈ"gÚž ÿ¾²ø•ÙšœKŠ|~ýéôó‰L -„ÿj‹ÕMe‡ŸΖ8™`KÌáü“|2©—âùí„_›Û¹ùÛé¿~súßu{v¦”èl8ÿùGa±7)§DAa°Èz…‚IÉ…¨°¢5xÄR4ĉïY bpÉAcA v.+¬ 1<'ë÷¬1\²¬± †-!),KÃ:"•AˆÙ;…gƒ‰PzÔxΚ˜‹+*/g“ÓxÞ›˜Ø«ñŠ‰1†¬ñ²„BVãÈ,3i<ÈÂ>'!‹žTdq9y— ‹ƒvŠÂËÖ•Ud¡HVãoBÉÌ*¯€G9å=ÏQ0!{OÏZ`›^åaGa‘bRx²D -EåA–àÉi<Yÿ4p"ø”³²[ìnOÞj¼YœK¬ò _C! ¥¨Av\Ò0À¥d¸8Ö@Àeo8sÖPÀåb8%¯Á€+Áp,IÃO• ‰@€,•Y8±†¬Mñ%kXdñÎiXdAÈ a"S,¢oõxY`.êù€! "E €d&f Rˆ8A«/:“àZåeðlÒ° %6pÅVÃœ¥LƦװo$\Ò°b€gYÂT ¶Š†pE&;DæÏBÙ ÒÏZ ²ƒ,ˆ5,È.ã”IÃxhœ%¡jÇ$ç̬aAæh$TÔ°Û'M ¥Êƒ,€ °>rØàðƒÃ&Ž9*²øÀäì丙5,Ȳ8rÀ6å¼™4,(YñiXP( “5,ŒƒG¤aA±çMÇ`_Êy3kXP<Ἁ#ž²o‹rÞL†,!ŠÊƒ,šŠ²oI8o4^„,®°†%F9of f༉ˆ^M d9o&5]Ü Ȥñ€»ˆL£†¸Áy‘­v¶'oHˆÏtf–gV3è ð­jÊ€€½ðVIÍÀWÎHjÒbâd™£š5€[Ó’š6 à/â1ÞaÂ%û4§¨"Ì!Ágæ$Y°-Ñ}?sŒfþJ³K~ìÏ<ýöÎ÷üÇ¿œ>ÿ¦fÊÚ? ã÷å`í;KÚë ¼2u<˜Itk[E„„Ou1RbZã’v1áŒáp˹_صÐY¤¶gê³ñjb,VËG]ÚÇ;½»´,>ž½øñibWT)ï5¾+—ÿÎû‹;B®‡…¼×ø}…—’œŠ/ó¶Ò£Þ}Ýç‰[éÑNï.mAÔáýRîÀ½Æïh{û§O'œˆõÀWãv^wo[Z—ÏŸ~:ýöÛùÝ¿þÇwPçϧÿþ?ó••¿M¦ë…Žþ¿\ó+!´˜®iùûþæK[˜ñ÷K›…]á(?µ~û[in¡Ù1o£qYƉûvu>ÞȆyCã×±^¦¹šŒ8úöˬCQ[òó始´Láýeú:U¹ü­m!¿\þº¼QAœÆäEÄ+j¡ïÑ_Úä¡‚ÞŽ¦þù¢vzýæò qyÂ8?šX3#Tƒ_žÍ‡E…¢î¼<#Ʊ?ìÇ/AX\S¯»qªÚ—å¯cÅ›rÄtMÏRu¹ÒèF•MRð‘ØÅ¢Œ-²¹¸¬S^묙l5}ù‰—¿4=K½NCOÇšs˜tï›iÎÛcÌã~\tÜž5\ÚÖë>þM½åí³Õ­æ™&ýɸm»lõGŸY[»Ö7 ùÅvWÏ°Œ£=—mc,cŠ,B[ïÙ3G÷Ëг¾O†Ž¹±ØîjnêÒÑV—uÜ[i³¯üÂËuëÖt"ü.Ó"wkgíMY$ë¿’å²çÇ>˜÷ä?ªŽÉ Oj˜©œŽÊgM‰à³©†M³3{´ÏSwñaÆIÒÏ ¯é䊓•L¼slÜf½¨¦ßZº¼Ù㜬£êÙþíÛÿü÷ßOžÉ¡y†· :—ûÏÝ\'3*’¶ÜL|“eœ—1G»ñ‚_C~»o|±Þã}¼¦öÝ,üÛòJÕGZÉtìå Ÿ¿¹Ó;ÈQ3SÒz™=JíÂJÞcß¿>ß“@N×!‹‘\×w…”×ÍZ6ýÓZßöP‡¾/=Ku‡wœˆŸÐ'6.{ÝRîôÏ8§ÌQÓý!ÝŒÁfMû+{ “½ÝSª 8뻨ù2…2yÚS7öœ„1òsqë=±ísqMÆØ6±dAŒf -Lòm·ÁîXŸ_캼^럨ƒÝçµÒGLÚük z×»…š@ìâw׋QbîÇ› øº‘Á£wèhÜ×Xck0Ë_zÚµ±v»5©ÎËjx1)ñ|û|cÀ±Óf(ϪÆðð®ú6 K`µ‘}ƒDÕäçå.n&s œ7*>ˆÜÁ‡l¡¤ô¿ë7‚“Ëàb|rvÈ‚ÐûþÇüF€Uºàykb[ŸÛ|ë6Öé+‘®¬,OcLÖWÇÓ·³|@ÂÕ<Ø.%Ï÷¶ó±>g;Þì]ÁöžŠ¹¤b#\…õ›A  ò¡–¢Å¾÷‘Ùc6„¨É;mö—ƒaœÚz]‘a ]º—¸/—sd¬Áó3Zq®–n‰µÞGf÷òQ@Ü$möï§MÐ ¶SwÆÍ°2Ä.´5 ­¦ÜìGG:$·¯=®ˆýø[W"gÿ -×÷‚úØ‚ú§tyù™ ˆ‚”þ/—ç­Ö±=45 ²ŒÄt}¼ôstO´ÊîUæÅö©85¥Z]Þ÷ëÜÇ6o çØö9,ùX`‘àl&­©Û+gv±ÁŸ|ÌÛáÌÈ<ØçKòÙ~ßBNËS Ð‚Š8áFÛmÛôÀÖmåõí») ëï}¦`ÅúG¬ -ûù†Uu‹I#3×2…ݪæ,S®rï-ŠM)€¶™ð–EI\´XΦŽÉÝõÁǺ|4{ -ÎÞ´§ÑŲ¾þ*!F“#´rݤ>ß2‡[té›—ùæv­~2êt¿F‘i*¶qoé ·¶G‹œKÌã5¹íÐ_å»åG©©ïRÞ]ˮ鶮 5ét7ðJt*ñ²KÓØv-__×8yÚ4¯÷M¹­Î¬¿W ’O®û¿öº;îT’‘o‰û…kAë‰?~-h/ï#µ +O{¸´ïÿh-躾ÿúµ 't7Õ‚žÒÝT zRwS-è†îˆž¬)cþªµ LÙX yÇkAûüÚ`7äÅÄÓ–ôZÐÊ`wÆàås[R5;^ :Øçã#\‡ÙÝóý£´–ç™ZÐZÅׂöý©=7û¨íû?Z º"Á׿t-H¾ Sý´íáZÐÁ>g;'Þò-¹üŽµ õ Ö‚ö½«)³?\ º"Ã×_R zB+S-è)­Lµ eöw©ÝÖԗׂöãy-è)]Nµ ¥ÿ/U *Ö›RpÅ¿`-h=é­Ì}‘w¾\àïp-è`Ÿ–»/ÁßBο©Z÷–U½-h=áÆ¢¾[¾-—ÂYâù¶2Ž´yúò]7£»MîXMÓÌþ:g»ùîÎZyE?Éû7$r*I¾YzMu’<–i—$£$´}Kø•‹¹Ì×TÞ²©iI(†K†©&piQÿ’h­‰Ø²€oOèO>Ò.Ñ\ç{Y–í•zÂ|5þœÌŒsÂvz†Ðža·”?Ÿbý–´­oÊ 8këäUZçÈÆËÚÈgOåÖ@þ¶t¶*Ûž¯ô¬/ û¹·’ß ‘¼¦D¾¢^—v¾YÚÿ\ý§“•dÒeS_ÞD•œ]»ä·“+dæQ -ºCârI},ø9·¡½“)Û–Z.GùIÐèréB{éZ7ù^/Skäë7[/+DôŒvO–§G³å\Ùøå.vQ$e܉c@žÛŽGÇ»dëi"†=‘¦éYÊ\­­ë—¥¯9ˆ]ôYuvZþÖÖ¥i9o_O˜Öo©o*UÞüÓ†jÚE°Øh~ªtjh-û‚p_'…ôzRˆ_Qš±˜?­š¼?áBÌ͸·+­Bz=©í–ÑB_©Ô[åѵ4ÍQ†©ûܯÐ^§m’— -N{„|»\“¥òØךòd7nG|=ÁÅðŽüv -IiVPh¦7ý4n'gö2¨)7Uak6š|û\~_ "tª O½°ÜMJÞ 1îÆ$²7;y­¤™;ê°¦Ëi´Ôeåë´Š¾l&¥½€noÝ5¶¢N*›è©4ñ¤:x¬É¶[]' „5ýt¬œ‰Ô„Àtƒº)¿­ÈCÎзj >Y´“¹‡>î ÇŽo39õ·ò:.ow²ùF|­Ž·d1ýÜ&dGÝÛÉ&â  0ÈFß*¹íÖŽNòŠÃv96™æq_O:U7ç|p’ðˆÞÊÛ­æÈËžÿm¾ÅÏÿœøüûö:…‹wÔÑÂul]‘gO&ïBÌÉònÄFìÛf":ž`mmC³†îÇ›ðšGwÀÞZÚŽ ¶sgb:œÈ®›®³~ÒL¸A|Ýh±2_º6Ãa_n}{8IMÈ‹8šT¸™·yðüpÉçiHÜIÓáÒÁe7uÄÍ<(n§ Ël%¦ä…ÏìõuZ«ö¯fGl/ ‚£–ܹóõÒ”c†°¼0qžÒ%÷¹?ÙgIZþdž ËaØ{JVÞ®‹ðF¹Ï˜†jo×»Ré1(é¡sû—£Ô×ÃÖÔcMõÛ$GEy´— 7ËK,Yýs¶’Šõó¶s -¥þû9˜Ó— -endstream -endobj -821 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 820 0 R -/Resources 4 0 R -/Annots [ 822 0 R 823 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -822 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 642.273057 101.433071 623.523057 ] -/BS << -/W 0 ->> -/Dest (cb282-1) ->> -endobj -823 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 257.184971 101.433071 238.434971 ] -/BS << -/W 0 ->> -/Dest (cb285-1) ->> -endobj -824 0 obj -<< -/Filter /FlateDecode -/Length 3985 ->> -stream -xœå\K$· ¾÷¯èsËzP/ ð!@ĈƒX$#‡Ù¶ÇF0`ç¿Ÿ*=XUœž™Ý5$^ÏN©’>QÔGRU½îjñç3‡¿ -9SJ͉®·/?]¬ÉÑâ¿ÖbwÑÔ_ã'Ç«³”Mt5•xý‘!›\£ÏéútÁ_‡KÙüéò×_]þ±¿Ç]½©5y¯?Ç* -&—œmTT*ë‚¢ŠÑäìcRTÉL±VM1“§³*Õ5`÷EQÀ”]8«*`øìHS†«1+*gÃykU€X¢à‹&ÁèIÓygR©¾ªº Ë^Ó…`R&¦«&¥‹¦#`‰Õ:M%:"«é€…BÉš.KHÁª:`ñ%M—ÅÃ:UÑ`wU,6Y§éj0±"UW¡³%—³ÎÛhb Áj:çL„oU‡…EJYÑy`I6VU,1X¯é°þh:ðD ¹e·zÞÝÁ§é"°xŸIÕ _cŸ€Åæ¤Qva^Ò8Àçl¨zÒHÀ—`¨PÑXÀ—j(ç Ñ€¯ÑPªYã`tÞiD,°DJ,„«ê€%TÒ¸ x`A BOAザ%x‹ÆtK¶: ø–¬K.`Z 7”DP.\©j\À¹Ü©qAéb»g X7Ää5. Ý@%i\À»œÕ¸€À»!àNU,p` ÀŽ&¸4. ðnp6k\@à]l#¯qVÕÀ“ÆðãK±x×Kx×g„U— ö`и€À»>b -Zäïúh½ÆÞõä“Æpþ±j6Þ…D=¬Æˆ÷Ðù q:3i‰Æ¼ë*Ÿ²§ÁVÆ•š4.ˆà]W°|ª®—aqeßÂÊÆ¥T5.ˆà]ª qAï‚>‹Æàxƒˆê5.ˆà]©5x×ùj5.ˆà]ä Q㸃qH4.@|3ÎÂuU]5¶–¢qAï‚–¼ÆˆÂÆ0‰ªËŽä4.‹_O0tªJߌͧÍZߣOá™ÍÃù'm¿­˜Kûœ—hôuëkÖñ¶v· ãò¨5Žÿ®ÛxÌ5nmÛçÙÿ]»…ãÜÚŽò“°ßƺýìcÇ:Ú{ãÂO‡9ô~´y¹ÑG4Ù˜'õyßÄ Ÿ» üv¯Å~h×E¬Ëm}nkÓly׆ñhÃØm(ׯíÍÇŽ[úJXÞ¯ulþÓö½¶ç“­¶,÷ÛswñVwÀëIàºí÷+âÂ.vÞ–©W;k‘8:Þ·¯¼çƒ2®_"Âòƒ”‚TÆ[5ÄÒw‚&ã$øí÷B=ÄÒ#~o‹ñìÀ(ÉlåóÊÃÀÕô~֣aøÆõîÞÇ}:0q“ÀÙÓ‡x˜S<ÌiêoÏÌyØ"‹>_ÀØÚøîoEû »þ¾MÛ‘: -GŸ›ÆÇ/^¸¥^ ®–øÜŠ¼pô­˜ £+}3fE/!HÕTܔŸpö™-Š‚¶Ô–ûš ¿ÜÀÇQ÷·èëîùOoÑ…7òó†\@mÚ.:Måήwܲ[„9¸>‰­~;¸ÿÁÍ·èsp×>Ö‰ã­wÜN‡ñòAØ–tDVÏâÕj1üÄÚz5oçˆßï£ïÈ&FV¢gyç,ŠŸ:W~¾s´ÕÏDòaº¢ |ÚïSzÁ}_yÏÇÔt¿D ¡Pîy±}àØÜ=¨Çvû ò¶÷îxïègðÈ{r}ì7xåzÏ˦å•+ŽÜuzY]uHó²¢x™ZcÉî0à=‹übó–`-ì /8Øënùoó/Œ}Ï¿öëûÁç1ŸÒb°·ˆZùý,`à£É£¯?ˆEš·¥oªkŠOSó'Ï,ä>û°šÿÜÏfÅŽ­ñÁ]±<‡ã£kþsß­ÆÒêÛWîëÚaÏfßç6jÕ­M]ïsÔÐAÔÇ£nu‹8Gç³ï:êÉ»6ÏG»kwYçF‘9Œ:5v\mž£œ_Væ:ëðeëY_Óš×Xû8ÚÜD›ØíC›|ÖȯØD_w;ðYN»ýŸðÙ[èõ¶G[o§fçùsY+ñ¬áÓ°\ÎÙØOÀrç~ÞÆr…_Xú…XîÜ÷.·¯b §wÃwÛŒ)é{/úÈ‘ÝÜòÿ8N€{ûÙßaŽ“%âb—ñs:}ô/Ú;mÇX‚Å,û`w'zÇÓᆋÖ:ÎOêý¹‡›¯½+lwÇ^ª­¶Ñ҃YW„¹k¯x²×SZÉ؃ý£˜O¯=ïùeD§¿ÓîÇÓù´·Gëë¥vùÚÁ‡ž;Ý?Ûô®ÝòÑn+‹½’÷sÜEÚSŒXó™'óÊž|ΗV ø:qÌ‚Þ;V¤Feòu­"Ç+Ÿ²ñkmˆE¼¥1k·›¼P«ßéOž¯îð¬_W>‰Èü¢¶GIV3¿‚ô\Ìp8©tãÓõ·Í­šyù)ê©E_B?¶—[ËÒ\ ‡>nQlwÓN%ͼu“{î"’°ãÞ6ÞÃÚÆòÁÅìl1g—ðÕm~ÛNKùÓ%µ×é\{¥Ú¦bœçï\]QTòs\¯ü -_±æ«®Û]Ÿ¹³}Sí§ÙªyÍòûìü.ãöÍ6qÑÛÿÔýGd)dÒÈKÚMl?.–øéÂ_4"EL´’›Ä,ìíì‹ÜÌ•†ìvqðâzl‰rßö+¡â3€í£c6|·ñ `dG£Ð^ÚV„¸3¹³˜goëbþ²V1¡_¥ %¦ÂÕ!ɶ«Ãuã‹b¬ƳЊá–ØÓÀãøåÞiº´„º4Ë?Úú,–óžðvÁ°á(}R¥ü‘ÑÕ°®·S¨:¥q´œ BsÑí¢?³£kÂbN½X5~Ñv–áH4ÛÕÑNÝ.j»Þ[œ+•g«²n­Ãò ÊrõP¦áÙM™¿}*öˆ ãã^Ì9ò\k[„ßø“ðvAˆ¡“øé³Ò:.®°q¸žÑï»üeIQ‰wSak¿¦ÈoT§”™§}p4]Š0×Õ„÷æï$åi²ip”W[a.—óôYi/W¬ÒžIw¶žÛI…É„<ϷϘ¤&yìÅnzÝ3… ûL®”B;@`¸%ŽÓ•Ÿvâ…3έí,9áîqö»Äirç“ç¹âŽßŸxg¿Âç‡ðÖÅìúe ²ÄÞÎh·Â ¤°Ä‹FŸšxìÖÉNü]Øñqm2-âÞ.?\Z˜ó!z~¤˜‚ã¯AÉÌË]ÿ…6_âçïº~5Þ»Ý⸷“-üäÖXF2þÒly¥˜¿D;„sÛ¡'AûKìÊj‡7Ì8î½àkZ·ÛE죥› ê¦V -㲡ûéºÞa™xGx;Xq&2»6+`o—aLÃ~c{ Â…œ.ËÒ…’¯¢K\qÓÒ¡%/nÄ…ì—bÀºí`²CÊA¦é?É¥<–¸i_†¥£fe×CÖf!š òBvLNZwxм½>zÝ;ä4vK'µO铔Ή±tž. í2í/gÌ í™ôؼËB³¯ ö^˜IÎÚ+µ Ý…ôQ!-ë¶Þ ÊAiÈvƒŽ@1é2;d³Ç<0¥~Û0K›qQ­”gN±¤?HKG¹*ÓˆQ®J:µå~GÄ›ÙR˜ P”îœ×ììj9sɢȒ¼{Jiµ Cv›öch{Ó $­ÌÔ®Ûâ©åñ߇ìížÃI„Öjüi§#®¬oª P“ËÁ‡öØ’8„øû£™Š8.yó=÷ÏOΧ$ãüDŽ„å0‚ÍŽÿÂõe…èjü3úmÕªSz›žýÊÏYÁ§CíßhüÛ!ѼÌ\*ò?8é-ümçlþÒé¥ýù7üÞc¯ -endstream -endobj -825 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 824 0 R -/Resources 4 0 R -/Annots [ 826 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -826 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 606.123057 101.433071 587.373057 ] -/BS << -/W 0 ->> -/Dest (cb288-1) ->> -endobj -827 0 obj -<< -/Filter /FlateDecode -/Length 4662 ->> -stream -xœí\K$9n¾ç¯Èó£•DJ¢€ÁXx 0ð ªk§waT˜õÁß•¡GD2ÕÓö °=5Õ•AêAQä'’áìñóMÀ?ÂÁ‰Ô’ùüúéôÓÉ»’<þk-vý=~K:ÏÅ¥P³¤ó'%Pq¥¦Xòùí„—kó·ÓŸ~sú¯}ŸpŽ®ÖC:ÿíGe1¹"¥ød°*X>ÁJÉ•S6X98,±V‹1RáÈ׬1¸J²Xƒcƒ%ƒ¸ºfUˆK`‹1BMÅ`9BôÞäAÏLÑà…ä2”ž-^ .KÕäðB‰ÈåÂ!‹W]Î9‰ÅcÈ’ª/A–˜½Åƒ,LR,^†,”É›<È¥Å+%B;Õà du‰Éƒ,>û`ñ*¹T…ÙäUð¼¹æEŸ\"oñBp ¶I&…MÊÅàEÈ’}ª&²$òÑâdaüX<àD¢"bxkTï&OÁâ%Èca“Y°ùÄ Y|ÉÀƒœâ’…±Ç5²Qȱ°X(¥:.…,ˆ59εX8@>€ƒä!Kâl!ÈÂð\“Y¨²…! XX@Y"“…´eX‹…¸e_ƒ…¼e²…À…˜ÞÂâ’d¶°€¹0¥jas ØiatáîÅÂêRÊÑÂìK¶°€€»ÄÁ[XÀÀ]"ô4ylaÐÑQ²°€»|±°€»p£havÕÁ³…°E¼… ÜâÙÂîÆ‚#Àä$ ¸–`ÜÀݘ|´°€»‘c¶°†â€?ÞŒ€»€d‡kaÎ{ð"YX€Á\DXbaAãÏði • R³… ¸Ûgòª 7üZv!çjaAîâ " pð)ãNÔhaAîÂImñ€»!VoaAî"nHÀ\@`aÎ7; “-,Œƒç½…5òÍÈÀ/5ß *yä›Hñ ¿­”5ß,T†, !ŠÉƒ,šªá·À$ä›@'‹—!K¬laAÍYóM±°aòMDôfI@4ß,f¹¸›*Éâw™f p|‘­•Û{o*ˆÏl¦hÆ)fÅÀzÎV³dà½8­ŠY3ð_Í‘Ì¢ÄDf)Ù¬àX3x³l࿈Çø -.Õ§µD•ag¦]d…[0¢û‘sÌft£Ù¥>ö·¿œ~û‚Ã÷ü—ÿ>}üM«”õµ¤N -˜ÆnÇŠÝþt‚B"®Í ù dAdz `º·¸æ#±U-ñõ´‘–‚ZìÛžŽlP}™qmo½È¶P_—•,ä·’d¤rJ³í˜n%òw’çJÞê\ôœjjÇÒïëéOØèŸÖ1¦6*Çš:âÁã ¾ºè^–:÷:àtÙj—h¡†ö{­ÖÍ^·hÙekþ·Eëz­¯äf²Ë‹mCe¨(ÂíÉš>÷¶øtEÜÙÐ$ïmh¥#jêÖ2¦ z®6$¶ ÉbC‚ÖGrʳí˜n%®6”MÔ¹è9ÕÔŽ¥ßׯžû‹x®†êúßùúƒ²;íŒ5|²ò¦“íô¶èþ«ó}u¾¿3çËú_9_x‡ó­/+^±³ì¯Î÷Õù¾:ß;Ït²÷…œ7ò«ã}u¼¿3Ç{Oȉ¤Ðgý¦œ);Iq‹w-iäv{ˆˆ—ܳÊÏés?ÕÚzL\Ïプ -®•*x7o -È{}¤lÊúî>_\Ö”Åeªš˜/óÆj -ù¨ñCéžÚûk!õ[š§…|ÔøË -9­M*Ll›wZ[Ðê™ÄJbšè³¾ø¾¯O-™Ò¾¿Ó—öºÚ÷ûNðŽvKþVvÌÒ¾ Ô{tŠ~¡qþáÓé·ßýÃ?ýã¿~1øxú÷o½‚ß %qýRÿã3ƒ}ûô‚߈ßÚŸ.4þˆßWüæí¯öÉ¿ûóßÝCï¥rèÔКO:]¹ óeúøz&TÀü¸óï›y¹XHŒYïÔˆÐî6jß}¾‹jy›a㥰ýÍÛßNO—…h[U¸Ð›¤Å ËQò˵*¤ÏÑúÈ~¾1Çq~Ú~㔧mDžcí7hk·´ßoÔ6Ÿ½Yß„çõÌG=ûX//²—E?u¦sµ·iòn|­œ@ÖA©Ë©s\Ö ã…?_“I¿¶Ò[£®Çñ›N›núxév¶Ú\··ËZû8\6§Ýè­MØäîv½éyÚà´¿Þþ0¤»À€6ïêºÑþ]¯©µÙS›×Ð_‡ê°Ñ6»éËýÕmÌ0÷@û¶Ï›ë»~µŸ¥ã¶öm™§ÞyÛ_®‹ìÛ|C··öõã;¥»úËWú«‹ÌåZþŽ¾ýs÷¯.ck»øðЇl{ûaAð×Í~ü6^öÑú­¾\¶ëÍF’!ÛhËî¶öW¶~ô™7=¦ÃZdYß} Ëûþô5ô±C¸7‡|낙˞,˜ö‡ZDA#ìe TI¿ÇOp*ÒnY@Ç  —(ä½}>+Ùbõ¦¬EýÞ»ä«x>$û¬ÕŒË@iÈ«‰j H—ø䟿û·ùãŸðóˆáÔÏío?>K?æÆ‘vs⚯z[Öaâ oã¼Ì9úØ—härÙí½ZçÅD·vwÖÑÚöµ¼.ŸË¾]ò×s´5»Ÿ'|˜c´6|}û«(×u8Ú„ùù8v“3æûó"oœc4þý½Èäõ.•Tª±©·{kEF4®¾±“ú³8½‹°ZýÛªø‘ÑRÕ»IîIpåÔY‹F™2FEõõ‰ûNý\Ÿ_Ú©§¼œ”Tc6:´3㾑w£"={ýS[ª*°0!›Ý ð”AE„gAo"£÷3³ÇvóbôÊ 4ÈÖ[šs¾%Á¦»®£#H Ç=\ùmŒÅÑã=±ÚË­î!KÖ‡º&ä…˜]o¨ú,]³®DJÖì/¬=C÷;rMGsÝiû±ÆLì¤ -Õð9ZÑ[ÚS z‹Òçi¥D%i˜ýòßýzñkxk\l3ò«P}y ©Kž²Í¿ÍÏùmÒ(Ü#’å9‡ÃþÛ?†w`A{RÈÒÅ3Ǭ׃…%þå²ÞàoÄmUï×m• Ä’ˆø"ñ#„ªË¯à‘m»@’ã¨íŒÂË#>†‘¼ EŽÊ–JbÆÔ 'wÄ`ŽVE+ÊÅØ[R%K’Ñ t«¸p¼ëóJUŸ 8LÚ±A{*ÔwRŸÿ ŠSò`÷ŸìósŠ³ÿ±{¹g—²Ûæ¶ý¸?ÄÉ ‚ŽqýñØ’=l ˆ)Öøu@½Ãªr¬÷¬jXLÙÒÀ%­VU—TZšÜ×Ů֤UÐý„÷,*ãTéØŸƒ“çºüÚì)«íß±'¿ÈO¢K`{ÿŸ¨wêS)U}Ó®šEæa_¦ÐÜ-‰·"õ‚ŒEŒQ4nmóžÞÆXÇ­sÎ_¦ˆ\hUj;':.bÕ,w¯ú²…梷ºï¼îó -Í×㼯Ð,^nÉáçZ>¯Ð|=v³É­(×mªõ²Úà´Q0îEáns[ÑòVñõø•Në¿­ëXL¼÷M“õ-Sº»¯úˆÍ~Í­º¤^kÐ à}ŸÚúû:ºOvd_ìpÕ‘êã~áOrvú†ˆ0ä± -MyÑÓëņnØVçb.”’1¾§åôhOí“ÿSÐÒô( ò!P+ÇÇûûüÿ„£i,ã2òî´a„£sëÚg­)lõúav‹ùi»ÐiwÌ´ñ|ïú÷ìÃ]ª¾{!ˆooßÈðßô¨ô\—_:W§:è{›Ót -Í_Ñb8ÐyžÞR*pÀ «÷Cªûʼßôg(q? g¼¾[Eoý‘DZ8y ØS]¾ÈÍ_45Ô‡Ð(åíížß/Aüƒ¢}Ò×°>f¶üÉ\>dq>”DÑèßÊM–(7Ì©G¹J ÍénÓ/fN5ã´‹í!GÒg× aÉ#Éžëóë3¨àõ‘\`lÝé¯_­ie[6Ö÷1³$k€ôã°Èï·§ùJ:ë Fú45ŽiY»þ°ÉƒMîÉÒõ-RWžíói ©¯ñ"9G,°}òõV6­_ÔÆí í7;h‘zLV/„–[m_¬ÇåËó~¨`É[Ô©GlÕo¨[‘rÄçKÜŸ¯cÜ6ß˳-7ìÆï7",òô/†ÇR_ÃÕVþtÊí)îÐÞäáSZ}ñ‚#Ý›zÖ'ÇŇ¾u¡);œoôl/Hûi´ÒAòú}„¾míz±µÿ©mú'¤qìrOÜÚû|#Kì“üvÒZdæ™ý= +qûèÇXFÈ×i¯€2½öÐQ†ß>ÎŒ“fˆ˜új´êÝô¹cö½µ'o/DôÌᚬ«÷.ld}G˜8Ú®ò%å.3ˆs@^ÛÎgLJä@~!¦k¢_¦›äÈ]ž ï”ªË“8D_U–íïmcY¶óñõ„iéH}3©úf¢>T×."´N£E¨:¨©·ÂcŸ ’Þh}EüÆ÷¡›9øË®éû.Dé†Ä£]íí ÒëÉl·–ÆN•ÑJf×Ú5?E™¦N2oÐ^—ªLÑ—.>â©Ü“µ0öÚËb7ñŠøzÂÃWävsýuë4±Â§nz+‘–qYü´—I-ÒU×ì4}:^ÿ½@ETEžö!ð0)}Ãżš“¨oò^I+=ÔaKËl»¨+”2lvÕR9£½‚îh=4¶£.*[è¥vñ¤xìÉaXÝ +„uý ¬\‰¾ é&9 S~Û‘§œi¸jòc²sOcÜIÎ;ßVr;ôu%CÞ1îbóøÚ6>’Õô¥O2ÉÑÓnN¶§`…Iž0úÖÈÝ[:é+ûÇédÖ‰ûzúë©s‘RÔ`;Sзo­‘W8ÿÚ|‡ßÿ<ñùý©Ë9ý@‹8°uG^O2}W£¨o+u,L©ðl*µË¼¿gµ/´»óN ±hñ=AÎtZðîbµÑ…*³ÛÖ ­“r§í&íÅ€ Ð|§K—)oݺZÚŠÅÔR1ŤþuÕtZwe(1­»’¯Úê¸ýÄÑ(­æ\æêül9bI1hyí=¨<[R§]ÏÍû¹ûi{^–ÁS<#S?»¥«–Ÿ…Ÿã;æcNV«þÓª#Aæ ’pPkÕ0R{çµ—œ!¬¯-,¼<Ãõþ>÷ë'·_ϳ΄ípLäKз—Û"¼Q3–¡ú›ÍínÕ›KzŸŒòЄ¹«‡ÒB{}m»{ ‰ÆeÑTQßVMôŠ¾d³ø©ñö5ûË®„Ò~þóŸÕÓ -endstream -endobj -828 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 827 0 R -/Resources 4 0 R -/Annots [ 829 0 R 830 0 R 831 0 R 832 0 R 833 0 R 834 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -829 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 512.554475 101.433071 493.804475 ] -/BS << -/W 0 ->> -/Dest (cb291-1) ->> -endobj -830 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 172.663410 101.433071 153.913410 ] -/BS << -/W 0 ->> -/Dest (cb294-1) ->> -endobj -831 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 153.716389 99.933071 134.966389 ] -/BS << -/W 0 ->> -/Dest (cb294-2) ->> -endobj -832 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 134.769367 99.933071 116.019367 ] -/BS << -/W 0 ->> -/Dest (cb294-3) ->> -endobj -833 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 115.822346 99.933071 97.072346 ] -/BS << -/W 0 ->> -/Dest (cb294-4) ->> -endobj -834 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 96.875324 99.933071 78.125324 ] -/BS << -/W 0 ->> -/Dest (cb294-5) ->> -endobj -835 0 obj -<< -/Filter /FlateDecode -/Length 4156 ->> -stream -xœÍ\Ko$¹ ¾÷¯ès€ÕJ"©°˜C€$È"dArXäàñÚ»<fsÈßÏÇê’JÕEw•g<ˆÇ»‹Ôƒ¢È¤ªªÃÙã盀_…ƒ+¥æÄçû§O'ï²xü›Z¬.&öøŸåX¼JNja6y<_rÙò¢'…È[¼œÀ6ÉäÁ£°I)¼Y’—jò ‹ ãÇâ'„r)†·Fõnò,ž@–3›<È‚Í· &Èâs² ä—, ˆ9;®‘-ˆ…. -ÄRçL Ä*ŽSÍàÅ`yÈ"œ,$ Yžkò U¶°€"dA ˆ Kd²°€€¶ k±°€·ìk°°€€·ìC²°€¸Ó[X@@\*‰-, @.L©ZX@À\vZX@]¸{¶°€€º$)ZX@€]â’,, à.qð0p—=Md[Xtt -YXÀÀ] ->[XÀÀ]¸Q´°»ê`‡ÉÂØŠ‹¥x ¸‹g ¸3B€ÉË>H0p7 -–`Enàn-,`ànä˜,,€¡8à7³à. Dìt²`-,@¼/’…ÌE¤%p7T„?çV.”š,,àn(Ø>“W]Èиá·Ð² )U ¸‹@EpðY,,Æ;DÔhaw!R[<ànˆÕ[X À]ä baÌÁ$ ¾¹àaº&¯:_K±°@€»€¥ha¢°óHbò²ƒ! ÆÎ#µ° wÞ«… ¸ë…È‚ÜõŒ´ÇäA*ÑÂä5àÁm ŸF²ê|RX<à®Øa‹Üõ>W pWæ…)+!  C-,H…]Í9YXª)ŸÉK×baAö  ËäAÎlakW© r„,£…9B¤  #p5 û6ËÈs1ë†,È-,’¹R™-,È’PA«/EW2àÚäðB¶° gvÅÁÂÔR®Àé-,À;M—,,€à¶° WÈW±°¡È•ˆÌÜâÈ‚$ÛÂdºà…`aA‰Ù …%T™É[X€Zª¶xìµÎ,NNSE à&¨4”&²&,,Àþh±- øA±‰2ÇäA¶° ”¨åf±° È}´°¶©õf¶° zÈ‚ŒÏ‚ê“Ó4ÙÂÀ8xÞ[XPCA½ÙÂø¥Ö›Å‚Jõ&J<Ão+%­7³…•!‹ E1yIS5ü˜„zèdñd‰•-,¨)i½Y,,@šz½y$P´ÞÌæqpW*Éâw‘™& pz™­UÛ{¯däg6³hÅYÌèÄVóÈÀ{­²yfà¾Z#™‡•eIæ©Â*˜Á›Çø‹|Œ7˜p9}¨Ì!#f–¬‹¬p FvßkŽ¥=Óìr>öÛ/§oï|Ï¿üçôø»é¤¬ý?qÒÂZÔEbÅv®Ü4£˜HHF)Ä‹„ðsú¨¹.BÀâ|è¦B"#ÜÖsÿÖ"Cb•9 ™™VÆ㼨¶Š’-ë‹û¼’¬ƒŽ`€HËa£’t#Öh`7õz¬Ïëëu˜wQ’%ë‹û¼¾¬À‹ %¯çµ…Üi¼+é¿óöÃŽI‹£Bî5~e!©ÏëµÀEy1“z”tl*\ÍNQ_Øå5öi¶šÐŠjÔèÈF]æyÕø÷ïO°ÃyúË=„~9È|“¡ÛèÏï?ž¾ýË÷ÿë?bÚ÷§Ÿ¾ÓäÝ7ṿÿ<¿ÿþÆÈr}Ȃ赚C‡år†Óü÷ƒ÷w‡D„÷5Õí$Ò3ZF -­î)ó0Ï=^þJ“p–ØË»i’?¼_oǨf°È`dš‹Þ´—#>ËZ¾†‘T„БכF’¼­¸+òk_+DÜÑÆí¦_ ‡õ,H4Aê圵iLiO²c}ÞžcT®ÆîíM“<¸Ì>¾¼È³×“ôàuPð¥«ÿݺo&‰áÕiûùêžk{—È”¿ëAÜ®AÅsf¨.УPZ÷i槮ÕÜ#êÔP¢ÿ°‰J˜Dò×Kž ÃÈhè³³(}#éÀÛÄú°NÁ¯ãèªÏÃà°2Ï%ë¹t¼‰~ÃÙù0_ä]t ¸äÏ×V°q½Õ“Æ~f=9‡º£ì¹Ê±>oÇUô–±Þc)v¶ -“»mÒ4mæ Ü¡mÈ„êá+ŽÆ¾zÚ`(R^!Z•Ê³’\M‚JÇd\Y¼ŠC?R4 [½Þ¢—ôÈu;§<îHŒz)¤ €zNâþE-±0jêmÿiU¼'’fJÐmGgrí–Ï»<Ì8PIÑÜXiì<“{ÈU® 7!!EG„27œSuS¾»‹‡º¼@@Ý%’R!;5¾ª®&‡»ÔûÁïWP¡²óUoè_M7mܽ]1Å’õ‰Þü -¸š|Õ{d·u¬Ï›Q¾>|VB¥l£ñç%.ëA¹îmÔR™lGiÒÐ^Æô °ë™Q›‹Ñ¿!ÿWJÆö£Ad=¤Ú|ÞêHQ¬JÖ껫ía,ie¡#—»ho”¬7Z‹šòó£ð®VtÏxºÍk¬êáXÔÑ£X -²qŒñhj•’:Ô÷&¦g"ŽÕìóv #"ñ,¹çW<£_Oò:‡ôÛ1_vJoôÿÂcz"Ô¸qz<êh?Öåí‹è=S)õkËj’ÑXäÃU^foR^*z³þ¬ÏõdâÝx¬ËÛÙ†¬ïdN|öx¸_ ÚŽ3'uÛj.xï—ãj>Ôåͨ™½>fçõõ3¥ÏÌÆš×TrˆÖXòîÁýí¦¯up¯‹‡<=HP±óúðí v¨ËÛ;¶g{W±ïCf, k=ÁËïTýe{­ŸzmãÐep¨F5’æ™ÒyxÆ…«¦› ù⤃ïÿøç?ýmÐAd_Z}^çÖ5\îGM°«¼ti#­MœOå~¶ã!øNßØ"žÞVIÂÓS†7Mì`Ÿÿ7FH—@†¬7²˜¦Ú¡¥qÚiCeq}é»…÷Üa)_ãÏ3·Þç`õÓ¯¯ÎÄt}==Ú;vFZï" ³VÛÚa™³dÑGh Ûœg³L7ÏŸgÓÖÛ¬z-³Yó㤷Ë–IõdÛ¢GDëI§ý}Æôõ­„ÙŒ£¾èC4=¾óÏ¡>»¦㱤¯áI_.}ÞüÝ »*Äûµ…uz¯f‡þW‰z?‹»ŠÌ=!:$Ë @5Iºe…ÝÂò œÒ¼t°Â©à˜­¯Lrl-]­Rô$p5áM ,±i9–žëòæ쯦[öws¿›æ~œŸÒEñ¥7Zõ-‰"¡ ýv}í6ÙÑO³©í‚çp• -­ÍCêëùØ’éà(ëíÏ]|¸@`9Šâ""6¥ËµÞß <‡§:·iÆ.p9eAþbœj¸üpi§GK“á¦Ù/aKéS‘.ÿ;´¦yœÒÈæùîfƒ¿Ÿ³Žr5¾ÌsòðìD} ÒÖðîz+?ÒôvF˜ÞÐóIël}…ÿœØ‘îM=ë!ҶuaR6¼Ìî9}ñÁ§ÞJƒäõõH}5fÚÚñbnÿiÚô'=ŽTý«ù^Þ[ö^'×䧓¾·Î™ÙŃd%Î}‹CkØi÷ìêuK¸˜Ÿ?Ö>¸úÝå£fgKiÝô¹-ö­MOÔ_&6ˆè™Â–¬«÷.Ìd}÷¿8š¯RPX;qǶˀKÇ]r ?eKôÃt 9r“'è»b]ui!vÑGÕ…aû[Û˜‡í¼E¼?aZº¦>™TM*ÚPM»H·¡j§JkÙ7„û>¤û“AüÆ·¡Ò¡ó‡]Ó÷¶.ÄÒ ‰{»ÚÚ¤û“ÙnMúNåÞª,]kÓü"ÊbêTºâ Ú¤£™šõËLñÔ>®ÉIw íµ/ƒÝÄ ñþ„ÃòÓI²ÑZ¬ðÒLo$Ò0n'¿ØËBÕu.Ÿàš¦o½èï TH§*òLw“Ò7×–«eõÍN^+i¤§Ž:li p^Úê -9w›õŠ7Ú+èöÖ]c+ê ²žkOAªƒÇšºÕu²BXÓOÇʑ蛘n!K7å§y‘Sº«Šï“¥0˜»ôqrêØù4’sßñ ¯!vyû¸ƒÍ7âýØøš¬¦_Ú$ Yð›ùôÉâ"@a!/0ú4‘›·vtÒǧÛÇÅɬˆ{úõ4…¹Hõˆ QзêÇÌ+œÿ‹6ßãÿ¿N|þ¡½Æu‰ãÑw´ˆ[Wä1’éw°”ƒdýN–Fìn3#°¿CYÚJ³†Çcðš—î~öÖ2t ;eÑá@ŽÝtc A3rƒx¥ÅžÈ|éÞ,ûrImq˜†ôÀ&.Æåà²,W'V«ö3Ž„²¼øŒ@­o.Dš¾ËΗ”‚ÞÔCIž¹ Ç%/îsûüd{JÒÎOÆ™°Ž‰|ú­„¶O`Ô}Æ0TûÆB»[õæ’^¦ãxh9¿9š¾–j:d›‰úeÖRQ¿…Ž4é-úå9ÙÛg”Ó1> -endobj -837 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb294-6) ->> -endobj -838 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb294-7) ->> -endobj -839 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb294-8) ->> -endobj -840 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb294-9) ->> -endobj -841 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb294-10) ->> -endobj -842 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb294-11) ->> -endobj -843 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb294-12) ->> -endobj -844 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb294-13) ->> -endobj -845 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb294-14) ->> -endobj -846 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb294-15) ->> -endobj -847 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb294-16) ->> -endobj -848 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb294-17) ->> -endobj -849 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb294-18) ->> -endobj -850 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb294-19) ->> -endobj -851 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 454.020714 101.433071 435.270714 ] -/BS << -/W 0 ->> -/Dest (cb295-1) ->> -endobj -852 0 obj -<< -/Filter /FlateDecode -/Length 3347 ->> -stream -xœí[K$· ¾÷¯è³•%‘z†’ ÄÀ>9ìv<6‚Þëò÷óQU’Xݜٙ]9xvv¦K¤E~¤Têpöøyð§rpµ¶’ù|ùpúxò®$½Æ¡ÐÙßã·¤sð\\ --×tþ *®´K>_OøsSÔÕ¯§¾:ýûØ&œ£k-Çοü(,&Wj)>¬–d°Rr¥Ä” VSlÍbAŒT8ò=«@ n5Y,ˆÁ1VƒU!q tÏj#–À b„–ŠÁ -r„è½Éƒ ž™¢Á Ée(=[¼\®-6“WÀ %Z<"— ‡,^s9çT-C–Ô|°x ²¤Àì-daªÅâeÈB™¼Éƒ,±²x²Dh§¼ -Y`]ÕäAŸ}°x\j•Ùä5ð|-õž}r©y‹‚K°M2yð(,R./B–ìS3y%‘ ãÇâ'•Z oâÝä)X¼Yb,lò ßB€˜!‹/Ù‚x\²0 –â¸E¶@ Vr\¹Z(ks\ -Y0[rœ[±p€|/ ÈC–ÄÙB -…á¹&²Pc (BT°°€²D& hË° p˾ xË>d € 1½…Ä¥šÙÂ䔚…Ì%`§…Ð…» ¨K)G °K\³…Ü%ÞÂɃ,0` €ŽŽB% ¸KÁ ¸ 7Š`Uì0[X[q±VoawcõlawcA0yÅÁÉÂîÆ„)X‘¸“0p7rÌÀPðÇ›Ùp’ìt²`-,@¼/’…èÌE¤%$ành†O­\¨-[X€»¡bùL^s¡@ã†ßBË.äÜ,,HÀ]*²° wŸÕÂ`¼CD$àn Dj‹Ü ±y pyC²°æà ß\ð0]“לoµZX€»€¥ha¢°óHbòŠƒ! ÆÎ#µ° wÞ›…¸ë‘…¸ëiɃ,T£…ÈkÀƒÛ>dÕù¤°xÀ]°Â¸ë}id஄M rB¬@@‡,8ZX+»VJ¶° 7R>“—ÊÉ‚âAH€,“Y¸°…H¬]£V-,(²PŒ”Y2XX€ŒÀµ€ìÛÜ@˜‹¹?`È‚LÑ ™«Ù‚’2öcЪÅËÑÕ¸6y¼P,,(…Bq°°{)Wáôà¤K@ ð[XPd«XX€PäjDfnñdA’ma2]ðB°° FÈ‚lЂ+v™Ù[X€½$TmñØË>³ZXP9;I-,€›`§ ¤4y0aaÖG6ÛÉÂl~°ÙÄ6ÇäAJlaA­Q¶›Õ‚Z!KôÑÂئì7‹…ÍCd|4Ÿ¤ÉÆÁóÞ‚*ö›‘-,€_Ê~³ZXÐÈc¿‰-žá·²ì7‹…!KBŠbò ’¦fø-0 ûM “ÅË%6¶° å,ûÍjaÒ ì7‘Ñ›GUö›Å<.î¦d²xÀ]d¦Ù°ßDfkíí=€7äg6³ÊŽ³š'Л[Í#ìE´*æ™øÊÉ<4€˜ØYÖlž ¬‚¼ylà¿ÈÇø¶Ó'}D•a1³™dƒ[0²û¹çXÕè‘jÛùØ/?¾~‡à{þé?§‡¯úIÙøÛH⤀i¬vlXí'(ÛCäµY‘¯ Wd¦7dLº×|Kì§x9)2¶¥@‡ {=Ò±¬®†C^;j+Ùõ¢f¢È×6 Ø‘ÞSZuçpšÈ«ßE^3¹*êšôjiÇÒïåôú£îci RÖÄé_ðÝ8ÐDÖ²´µÖÑe?»D 1Äp\k,µ,¶^"µÊÖøW¥G=_¥uMî&«æXl*º£"w$ËöyÔÅÓñ`C‹|´!MGÖ4¬e$®6TmªÊ†*jß’S^uçpš¨m(›64©kÒk¨¥K¿—WÏý¿x®¤êòï|ÿ` ìA;sl‡|ÔÉzSºu¾Wçû9_–å|ÿðçÓ«kE,ûÕù^ïÕù^è|¦“½,å|Ä!_ïÕñ~gŽ÷ü”ó~¿ÿ‡·'HÖ/Õà³±c®ýu€¼¥/r¤y~ûáôõwúËŸÿö=öoNÿÆûPñð[äXÿ³÷ ã3¥í9—ò·ÿ8¿ýî‘1äMùCºEOžÍÂöÉïö®üþ¤Û­Ëа óŽÏ›Uľ×g¹ c–w²‘ê!Ôoß„o–ðý“÷IОÛ>bÚxio‡ õO¾ˆ4ûó»½ÎàÙŠè<©×g¨ËmëöúŠ—â>î­Ÿwk>ï 9(úÇäØuÅeé$íÏ)n–nÈ&—g²ç˜›Ñw_ïËfO]NÚûÊÛoç)½û‡½ÞéÝZ£.KU6´÷×Û^6›³dîõóVfÕG·Ëx¯¯å°‘GdùÈfs¢»'uηz]÷vA–îŸÛöͽ ¼¿ñÏAc¥—ÃvÚéàW;í€zÏõ%Á´ç#¤DËòi„LËCc6<_¡âXõ¡‰þü~i}÷š£7Ñ4³¤ý9ãį‡ Š¹ïçe‰“ã‹ä¾ï‹€Úƒ•Å?Ç{Ó³âúˆx;ÚÜÌeöwÙ”|Ú›ÅÒe¯;Ú÷zOê¹Üê¢#ÜÃj?Ñ‚”—t¸±ùÎöÏ7:Û½\Ú0¤°i×Ùå7Ðé@ä‡]·v²Ûàßî¯ú]i4VÞ¿C/U½NÚß6<£ÊÓ/$Œ—Oûè÷¯*¦ªuC—rñ˜Ÿ[‘w¥V–*¦įd«iÁW¼lëTI;Ìí3¦¥Ân…÷ãV/ø›ì÷a3K¡Gö+ðÖõl-O|·›˜2¥CÿI-u6‚MÛæ·Íán)?žrïúÝ/Ÿ« Q.‡Ÿ3#Ó“;7g¹kP=qKº²Ãù‘–ýJýÇYk¿eïåâ\ºØ®à«Â^ÿc_ôˆLìòˆEýF¬ïäGa‘¯'¹Í™y´O…¸?úÙ‡ír -$;¯›š”œßW¥4c³‘öi4“7ÕHFâ(‰lD´Ìáž,³÷.ìd¹U^í¥=h¤„j“šF͹ <×É ÉÖüŽøÆ®‹9ùjÕäFÐF¬ÃxÖk£žAºœÌz{oi®T™µêjÚ†æ—(ËÔ©NÅ´‹J4‹|MFùˆ§ñx$K2×ÚWe7ñŽx9!Äð¹ÇÜ×N +|¦§‰¤úäê—½,j©CUpÍA“ûòwƒŠ4©‚<ý!ð4)¹µJkñÍI>*IÓóD¶4¸¬ºJ]¡”i³Z_¡z£¾€î¬=5v *•)ziC<© Gr˜V7ÉaC?+5Ñ!0Ü"§iÊ×yÉ™¦«ÂØÇ`9(sO³ßEÎ;¯š\抹à6åý*›ÄKl|KÓ¯cEŽ~F»5˜".Á -‹¼`ôÚÉÃ[':É—vÆãr2+â^N?Ÿz˜‹”b“{ -r_[g^áü_Ôù¿ÿ:ñù¯ã‹ãÑO´ˆ[dÉäÛ=õ™dù¶Ï N·QÄÈ -ö9ÔU7 k˜q> -endobj -854 0 obj -<< -/Filter /FlateDecode -/Length 3190 ->> -stream -xœí[M‹$¹½×¯¨óÂh%Eè –=lãƒö`|è)Ïìbj ³>øïûEVê#«^Ï×|Ø2_(¥P(â)¤T…³Çï«€Uƒ«µ•¬çËûÓ‡“w%yül%7›øGü•t^‹K¡åšÎï âJK±äóõ„w·kñëé§oNÿ>>Îѵ–cHç_ßšHÅ•ZŠODÔ òAˆ(%WJL™ˆrpèbkL5RѨ¢5´ÕÄDPCc¬DT¡†h ò(jP#– L5BK…ˆ‚‡!zOePÄ«J$²\†Ñ3“Åàrm±QY,”Èd". )0Ys9çT™L¡Kj>0Y‚.)¨z&ƒ.*µ0Y†.’ÅSt‰µ“èaFdºÀ»*•AŸ}`²&.µªJe 2_K}”EŸ\ª"žÉBp ¾)T†ˆÂ åBdºdŸ•A—$>2™@Å/“'’”ZI´F‹nñ˜,A—‹RtÁà3ˆºø’ ‚œñã€XŠÓ•‘@¬â´je,ksZŠ0ˆ-9Í­0 ‹xè’43&]‘KeÐEš2.]P€qt‰*Œ l«ðƺUßãߪ™q€p¡¦g\ `\©Y(®Ô8WÀŒ ¤‹p/Œ ¬+)GÆÚ­™q€wEƒg\ à]*k.XœÄ-¬ìBÎqAïb¢Æ ¼ ú¬Œ Àñ3jd\À»A0S3x7Äæ$ð.ò†Ä¸îàƘß\ðp]*kηZ$ð.h)2.À,ì|“PYqp¤À¸dì<òPƼ‹é½1.Èà]ŸDdð®W¤=T]¤FÆÈk CØ’˜F²ê|S0x׌0“w½/qAïڴɸ be\²àȸ Wu­”̸ 7R>*Ë÷‰qAñ(‹Ê ‹e\€ÄÚ5i•qA‰ÐEbd\P"tAÊÀ¸kÙ7]@¸ ](tA¦È¸LæjSe\PRÆz Ve²]- k*«…¸ u˜Šã¬¥\EÐ3.Á;K—@ È‚2.( º T`*r5"3g²]d3.@¦ YŒ j„.ÈÔX±ÊÌžqfh¬%aj&SoëÌʸ jv–*2.@˜`¥ ¦¤2èš`\€ñ±Åvb\€Å›XæPt‘¤Œ j¶Ü¬Œ j….ÑGÆðM[oÆÍCd|Œ šÏÎÒdÆ qȼg\ÐBÅz3*ãÄ¥­7+ã‚&ëM,ñHÜ6ɶÞ,Œ šB—„…Ê  ’¦F✄õ&؉É2t‰M´œm½Y ÍÀz=ݨ¶Þ,t»¼›˜‰ÉÀ»ÈL3ãÜ`½‰Ì–­í=ˆ7äg\XmÅYéŽõ&Ì­tËÀƒ{1[ºgàA¾¶F¢›P+˚鮦Uƒ§Ûü‹|L8á¶û´nQe¸CÁœY‹u²!,ÙýXsÌbòL±Ûþد?Ÿ¾}Âä{þù?§wßl;eý×|#Y‚¦1Ú±a´ßŸ`,‘×æ¾®ÈLï`M÷² ×|n»x9-0–¥`‡`{=âX Ö _šC^ÛK/º-èeéÉ_OX,`Ez§4ËŽæVPg½ž=¹.èìôljZ‡Ù÷rú ýa­cZ¤R0­YÐ! p¾à7çÀ#6–¥Í±˜]ö½K”0G DZÆPÛ`¯C´Œ2kÿºØqíïbõÞ\vécá>TÖŠŠ1ܶås/‹«ðàC>úЊ#kêÞ2š 6¯ªÜ‡êâC¥ïá”gÙÑÜ -®>”© tvz65­Ãì{y‰ÜÿKäZªn?çÇ Â²ëŒ>¼çùlì¶Øþ%ø^‚ïw|Ù~Êùñâ ‚oUxéñjˆƒg¿ßKð½ß ²/K9Ÿ È—À{ ¼ßYà}~Êù¸ÞÿÃë4ÛÕ೩S­Ûë{K_lKóüúýéÛþô—?ÿíG¬_¿;ýý;ïCÅ_¸}zñ>â3½ÁÖžj×¥Œë þþÞþý?ίx¦={k>Ú³&¢âTgïË­«®W™â­‰­é<ï­ù”n÷úîÖ\høqèÕ¼Åú؉f;4c¶w·Qjo=Ôï_…ïz'—k][½á)Ü>µí~¶?cÚh7ÒeïÞÊt\¤k½?Óº÷zu¹Îó¹ÑFÞe—¥ÜÓô^ï{Ï4Ý´Ü5܆órÓ&áSžv¼îÃýf×,?õíMs}[Ò“;ënÏ«Ï1_t{·[0Ýžóoìãњ݂›>xÆ_v«åÝ\ù`'„²&ÃGeÝÍ7ë­Ó'üó±ž,¶MnG1ëÙFói×-mú}D‰þ9=ü>eÝCr‰¢›ÉÉ^cn¤îÍs[©½ñ¦ï¦·Õÿfñò·»-Òkw».Ó^Ûx–½ÞÝ~]ÿËLÿî?[e×!Ïú·zd/÷àǵ«Þ÷=È\£rio7ìãõÇ×û–ÚvÖÐc°÷W5…ºlÇî»uŸQäãzdóvoýq«4¿ôUÚÁIÄ{„'¶bïË›[Ùp»‡4‰ÏèAö!4³)näØö2i1U¾¹G†w°ÑÜp7ãæ^í†ýʯóúÞE¶öžv—»ì®_ïêOwCöæH[RïÃÃP~8åí½YØÎNø\]ˆv¸òœ¼iï¬Ïö®®zÑЇ.lÆçgžÜŽ¤~¥öSªÞ®ØKËÛÖåf/ÿaô÷`uu¹óøv¢ÌopýfÂד(T«ÎÉà°û¥uisKÇ.§ –¹Ü•”äü~9' Iý2¦Þ{>õÇìMB2ö;‹ƒ[ÃÄ“9<ÂÖ{ïÂÛ©Ìêd¿ËCä½m€³B]ËÎ -烟„ƒøL _š›pÔ®O°·øÃty‚CõÕtaþ^6–e8?^™õþNôJQ; Ö«êÖÅÌÑ1Y”jM½äãD KmÀW¾W­Ì!_FÍÞ¨ßÀÚIG¹ÖËèr¢åöÚÒ©2JÕùhë–ŸªLW—: O°Ë’¤;f¾Äˆ—~y„mÎcíëâ7ñIJCG$Nx[Î<–N“+|ê®·‚²Ô;à꧿LË™ÝTÍŽÙûHû£Š4Pcží"èp);S0ïf#›>iÅó`eZfÙÅ\¡”ᳫ½°Ø!åtGéa±º˜lÁ±Äö£ê<Èã‡áu6 -ëö\¹‚¾+æ&œ†+_ðÔ3P…³÷ÆrXÜ=z'œw^W¸Œv@dè;ê]|¾ƒ—mbÓ{Ø\¿öF&ý˜ífc 8)LxÒèuƒ{´v²Cïýr›q/§_NÛ4%Åf^ì¼ãšy…óQæüýë¤ç¿ö °Û<ý`‹8¸õ¯3™Ž¯Ÿ ÛiùŽ°YÀ¨ íO8ÔY6uoóxŒ _ë|ÜObï%Ã`Ð0¤+˜¦ 8×Aˤ€—;+ŽDæ·ŽÍœ°o·Ò;‡fÄŽft­p³v·uÊdNÉç¥JÜYÑ9¥Cªqy7k¥¸]lS³ƒšæk#Ãô¦¿®C!ÖÖr³¤v+S¦sš]«îØÖ‹¥R`YoÖŠ5¬¶ƒ>D鯯ß<î»Ê¹G€¡ƒÚz]ÑÑ1CáqT¶Û|¼sŽœí¦ï´Ð¨K–Ø“‘äÌИ©…nV]Ð:Û ¤µQíØ¡Ñ>Q ºæ;6j,]§¼?ÖͲõ¸R+•‘SLô—ÕÒi•aÄ´ŽJ~(kõöodK2 ´ºs™½ó³äÈ%+Áòúô@u–”Ž=¶­Ç¶ûl{^º¡S‘<3S?K%¿Šÿ¾&vè¶2+Õ·Ý‘Pç‘4LÔŠDÙ¾eèkÎൃâEë²]òÅÏ|í¨µ% ‡S_‚}_”«p… }Z°TÕ¿KÊkžvéË ðìÙ>ú l_ÚÞl›Dã¶ØRѾ(–ôVûZCñϼ°m Ûý”ÃÊöû?OâË- -endstream -endobj -855 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 854 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -856 0 obj -<< -/Filter /FlateDecode -/Length 2995 ->> -stream -xœí[Ë®·ÝÏWÌÚ€i’U|A’ Ä€/‚,äFä,òû9ÕÝ|ô̹²$/¼ðÕhîmžb“ÅbÕa‘Ý7\=>_ü¨\­­d½ÞÞ]Þ_¼+ÉãßVãTØÄßà[Ò5x-.…–kº¾3@Š+-Å’¯÷ ~<×ê÷Ë·_\þs¾'\£k-Ç®?o"Wj)>QƒÈ!¢”\)1e"ÊÁaˆ­1ÔHE£>‹ -ÔÐVA ±Q…¢%ȳ¨AX‚2Ô-" -z„è=•A¯*‘ÈBrFÏLƒËµÅFe²P"“‰¸\4¤ÀdÍåœSe2….©ùÀd º¤ ê™ º¨ÔÂdºHOeÐ%Ö"LV K„u‘UèïªT]|öÉš¸Ôª*•5È|-õY}r©Šx& Á%ø¦P" -“” ‘Eè’}jT]’øÈd]&O$)µ’hÝâ%0Y‚.1¥2è‚Ég 3tñ%3 -@9ã%Ʊ§-*#XÅiÕÊX Öæ´a4[rš[a< >@#ñÐ%ifL º("—Ê ‹4e\ º ãèUØVá-Œ t«¾Æ¾U2ãáBMϸ@À¸R³2.P.\©1.p®€;Há^XWRŽŒ ´+Z3ãïŠϸ@Á»"¸“Ê  ˜qØÑI¨Â¸@Á»|a\ à]„Qd\€YuðÃ̸¾âb­žq‚wcõʸ@Á»±`  ²âƒÂ¸@Á»1alåïÆä#ãïF™qÅ<ÍÀ» ÄÓè‚e\€õ²(Œ И‹HK$ðnhXþHLƒ­\¨-3.HàÝP1}TÖ\(°8‰[XÙ…œã‚ÞÅB%Œ xôY€ãVÔȸ wƒ`¥f2ðnˆÍ3.Hà]ä ‰qÜÁ$Œ °¾¹àáºTÖœoµ2.Hà]ÐRd\€UØù -&¡²âàHqÈØyä¡Œ 2xË{c\Á»>‰0.Èà]¯H{¨ ºHŒ ×@†°%1dÕù¦`2ð®˜a&ïz_ã‚ Þµe“qA.Äʸ -:dÁ‘qA®êZ)™qAn2¤|T–ʉqAñ(‹Ê ‹e\€ÄÚ5i•qA‰ÐEbd\P"tAÊÀ¸kÙ7Ý@¸ Ý(tA¦È¸LæjSe\PRÆ~ Ve²]- k*«…¸ uXŠãì¥\EÐ3.Á;K—@ È‚2.( º T`)r5"3g²]d3.@¦ YŒ j„.ÈÔX±ËÌžqVhì%aj&SoûÌʸ jv–*2.@˜`§ ¦¤2èš`\€ù±Ívb\€Í6›ØæPt‘¤Œ j¶Ý¬Œ j….ÑGÆðMÛoÆÍCd|Œ šÏÎÒdÆ qȼg\ÐBÅ~3*ãÄ¥í7+ã‚&ûMlñHÜ6ɶß,Œ šB—„…Ê  ’¦F✄ý&؉É2t‰M´œm¿Y ÍÀ~==¨¶ß,ô¸¼›˜‰ÉÀ»ÈL3ã°ßDfËööÄ› -ò3.¬¶ã¬ôÄÀƒzÖVzdàÁ½X­ -=3ð _Û#ÑC¨‰eÍôÔË*„ÁÓcþE>¦Oœ°Ÿ>­GTîP°fÖbƒl Ev?ö³š¼Pm?ûùÇËWo±ø^üïå‡/¶“²þ1ßH¤ iÌvl˜íwÛCäµyï€+2ÓX@Ó½.È5?‚Û©ÅÞ. ,Æ~0<ö~Âm§X7|é{^{ÑmAoËHø~Áf;Ò8¥Ywt·€S·ÛeÂs$÷ƒž]Më0ûÞ.ßb¢ß¯mLk‚T -–5\"©AÞŠ•ÅoÎ[l.K›s°ºg—¨aŽÎs©¶É^§h™eÖÿ}±ã:ÞÅê+¼¹ì2ÆÂ}¨¬ c¸3lÛç^WOàɇ&|ö¡˨oÝ "–ùPä>ª¨ý§<ëŽîðäC™úÐ@ç gWÓ:̾·×ÈýM"×fÚþ]Ÿ/Ëž¬3ÆðŽä‹A¶Úmµýkð½ßï,ø²ý+×ç‹O¾uˈCœ=û5ø^ƒï5ø>1øh}ZÊùB@¾ÞkàýÎïãSÎçýþŸÞ\ ÙöR ~7uªu{`Oé‹i^ß¼»|õõ_þö×|ƒýã›.ÿüƒ÷¡âðmv,ÿØsêwøÖ½œìÀL:½®î2} 90½ák÷Õ?þëúæëô°§éCë:eÜòý~{’½lÍ>ª¤è.…½‹ÑmÜUì÷(ꦴãÉ@ l¸ÔÝõ—½™“*o÷ß›…ÞNëlª¥_yÌá¡ËmÄ6"³À‡Ë‚¿=š¿íêl×Ǥìݪú3¶µuû€*âÛ£*í0Z:º±æ¾Û'ÄšÆ×]•M¥¸c!ì]ýùÍqþ°½˜å3vØ_S¨ËÙÕq´ñU>|úANºŽÞŸÏE!/šå+š´·Ì¤^# ÒŠ̲˜"Â/£Mþa–ˆ™Šºd‡ŸÆcÆÌ~wÌPw’ï§ò‡#å9k6 †GÝ}:åéßÛ×϶»Għð{h?-Ó—Ï4Æúž¦òý%oÂö ÙçêB´7Ñ®Y±DgW{@!úÔ…ÍØáúÂÛû{ïG­ã•>oOùí Ïþ¾ßR8ê¿ß&ýÝ%À‘Íþö eýÆop½0áûÅ^¿R«ºø‘°Ç¥mièv»1š¨)Éùã²Æ%õ˘úhìþÔo³cqõ½’lÃ{ÇÄ9<Ã6zïÂÛ+lÕÉQÊC$ m€³A]ëÎç¿ñ ˜žA¿t7á¨]Ÿ`<‡éò‡ê«éÂ2ý½n,Ët~¼)ûx'z§¨½8Ó›êÖ~`²(ÕšzÍ1!:æ‰@–<_úÞ´b2‡|™5{ü¸ƒµ;’Žz­×#ÐíBë­¥1SeÔªóÖÖ-?U™®.už`›´Ø;¹KŒxé—g8Û ô¹öuñ›ø"GÓ‰Þr¿çÚir…OÝõVP–v\ýô—‰"÷;L…Ðì˜=¼±Ÿ;U¤ólA‡KÙØYšXløl¤σu”Y h™us…R†Ï®öBDêéŽÚÃb't1Ù‚c?âGÓyÇÃëlÖí3¸r}WÝM8 W¾Ÿà©g¡ -gïå°¸{íN8p3ìiúÐw´»ø|oÛ¦°¹~íL8ú±ÚÍÎp*R˜ð¤Ñû÷hìdo÷ËdlŽ]~ºlË\”›H°—ÃÖÌ+\ÿ‡:_ãûï‹^ÿÞO öu<úÁqpë ^W2{•¸~$l¯wp„ÍF]h¡κ©{ÃXÇc\øZçí~{¯ƒ†!]Á4m¸Àq¸®íN¦eÒÀÛƒG"ókçf.Ø{QúàÐØsì® -ëpP¬S&sI¾.M¢dUç’©ÆåFÖFQ\:lS³“šæk'Ãô¦¿®S!Ö×RXÒ+Ê”é\fצ;¶b©‚XÖÂÚ°†µÓvÒ‡(ýÙáõ«çýP9÷0tPû@ï+:fè <ŽÊVÌçâXsäj…¼ÓB£-YbOF’3Cc¦z*¬>º uÞvTHk§Ú±S§}¡tÌwl´XºNù¸­›eq¥V*#§˜èO«¥Ó:+Èi•üT×Úí+ÞÈ–d$@iuç2GçgÍ‘KV‚åõîê¬){î[Ï}÷Õöº C§"yf¦~Þ–žj~ÿ}NìÐ38V«¶Ó‘Pçû;X¨5‰²ýI–¯9ƒCÔÞª-Z—ã’O¾çsßY{Ât8ñ%Ø×qî´_,Mõ?¼ã·5O‡ôixñE(zb¶¿®ØŽZ·C¢Q,¶U´?¦Kz«½^ü '¨v Tì÷éeûüÏk5f -endstream -endobj -857 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 856 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -858 0 obj -<< -/Filter /FlateDecode -/Length 4328 ->> -stream -xœí\K$· ¾÷¯è³•õ~†’ ÄÀ>9̶=6‚Ùëò÷óQU”XUìžîÝ5rðî`vJ¤J¢(ò#Åî*w¶øyãð_ÎÔÚJŽçËûÓ‡“5%Yüë=6Îþ¿%Å$×rMç÷DÅ”–|Éç—þÛ5e÷—Ó_þ½½Ç½i-{—οýL¬L©¥Ø¤°XÖ…•’)ŧ¬°²3Xbk b¤}<² -Ĉ­&1¢÷UaUˆbqáÈjÃ5Äp-…å,äpÞZ•AlŒÁ+<—L†Ò³ÆóÎäÚ|Sy•×Œ+иâ·Ð²q97 p*hX€»€Ïªa0Þ ¢z p×DjÜu¾Y pyCÒ°æ` ߌ³0]•×ŒmµjX€»€%¯a¢°±H¢òŠ!9 ÆÆ"Õ° wÞ›†¸kSdà®H{Td ÕkX€¼<¸­âÓHVõ@ -ܵ;¬ñ€»Ö–¦aAîRØÔ° "øªa4È‚½†¹FÓJÉäfÁCʧò²A;iXP, ¥ò K,QÃ$Ö¦…V5,(²ï5,(² eаiÙ·z<€,0õ|! 2E €d¦¶5,()ã<­j¼ìM-€k•WÁsEÂR¢A(và,e*œ^ü¡tIÈž‹”Yà* ™ê‘™k<YdkX€L<ç4,¨² Ô° úŠSf¶ Bã, Uk¼héœY5,¨1J5,€›à¤ ¤Ty0¡aö‡ÛIÃ~pØÄ1GåA–¢†µz:nV j…,Þz `›tÞ,4 YñiXÐl6”&kXÏZ š«8oú¨aü’ΛUÂ,Λ8â)~ÛB¦ófÑ° EÈ’¢¨<È‚¤©)~ LÂyè¤ñ2dñ-jXÐr¦ófÕ°iΛÈèÕ’@¥ófQËÀÝÔ€L¸‹Ì4kX€ΛÈlµ³½ð¦‚üLgV:qVµb`½ ±U-X`/¢UQkàKg$µh1q²¬Y­ ¬‚é¬Z6°À_äcñ€ KõI–¨2Ì¡ fÖB‹lp‹ˆì~œ9f·p¥ÛRûí—Ó×O¾ç_þszþªWÊø‡l#‘“¦±Û¾a·ßŸ ‘×fA~¹"3Ý‘`šû\óžØ«x9 2²< ƒ#‹}ÙÒqª«.¦sÈ5×ÞB6A½ˆ•òË ‡œHwä”Fß9$æ9î$Ï•¼ê\ôœjjGÓïåô#6úƒcj RÖèV¤»°=g»màÚÊÒæV;—µt‰d‡n»ÕØiÚk¹Cb“µé_„år…Ò%¹[¬XbÑM¨È -Ü–L§gî‹«qcB“¼5!IGòÃÆ2¦s6²º YaB½÷䔧µŒé$QšPVMhPç¢çTS;š~/_÷ÿ⸔©Ó¿óñBY©¹†÷ºC^u2©7©û/Î÷Åùþ`Ηé_9/p>!°\±PÄÖ²¿8ßçûâ|:Ÿêd¥œWò‹ã}q¼?˜ãÝŸrûß½=A²þümÑÄXû§ô!}¡ŠæùíûÓ×ßÿù¯ùû8?¾}>ýãk]ůÃïUå­õøAKný›ð7â÷yáü&¿´ã¿yýK}ó·ÿ<¿ýþävh|gçÍlâ kBÌýÃ}h(çC%±I¾}ã¾™Òô¿q•*¯’ÔEšT–kâuéЦOãI’ä–qúu^®©?¯¤ßK¼&ÆH´ªµï*ǧ¬÷¥ÍJ;ïí4šãi½§²g?–È´Ÿ/­Úä>÷ë²íu9ÆÌB¼žu§G;®º“²±^óq½öý÷ºí:†µ\VkÈ«èYÊìáM1àXæ0ôCc-cNÝOÇqr B5}â8N_ÛÓÜ3ÈwKŽâ¯É±ê$®ö²±¿xˆ"})&ÛèsSÆî¶Ü„=¯cñžÐøï„]–µïª“±Oní«ÈÄ>Ñ=¸¬íþÓûml@ÛÿuœUö”nê´í×Ý×@óÿ´ÊWáq/SöÄkYчõÐåBg—£>ÆÚóq¬±Ö:÷u¯sϹûQ,oÊë(–¦÷øº “(P¥dÂÓŠBç¾Y O^5ÌcÍõ~+1v´[÷³°:œû±¥ <Æ´ÔµÍÿóŒÎ? Ñ´×(ï}—4 -œy{.ðmîûQ³C,iÙÚkcC†é;÷ù014úôÓ1ñ8Îc˜ðº&Ç'câqìžUä½ån­v±È-¶Øÿ¼â»¥Í8%±Ž±dXxž´—SŸûqë>-íƒÄížØç­Lñù¦Žã^³–NäúÊÔY7M'¯-¬ºfÙxù4Ûý~öþ+8ÚÇ -SŸû¹õ=»©§|ÐÓ=úñdSã:7ë‡í Íë‘^&fp\IyŽÏ¹+MG¿·ä#~ûÉnâ0IªóÃvæµ´êùlZõooÆâX5;ëòý²¯tŠòÑNËÉ+ä½ñ™Åîô—Ž>w¿ Þ\óŸ?¯­~¼^z®ðyÖxÄÞßc¼wÛŠb·J®Ûmö²³]+0ZæâlzÍ÷þèØ7núÝMý0ù0WªÀ“qv1âÝ´oÎíû=?ÝÖŸâ:ù8,²ßZ[¡•ûÜÔ™ŽÃnâѵóÜ8ËÜ_o!·Y¹½Ï|»–—ÍÓ„ŽÑ¯ëW“Ê-Ýå#òu»ËÕ§î†ýɼñ†í©ù&_óZœÛÙV¥=aC#_ùñºö6ë[}_xeöÕ6Þֺװ™¨Ÿ „ؾ?ûÙ¦±O\0Mëy²•û¸ÍÑï±íWd>`õ-›”þ*s|¶ Îëµ\»ÓïÍ]Ü\ù‘\ÿ°‡Oô»æ:^ÑÑ1GÎBÇl+±–ĺ_ó8+òúÏ`÷Ì?ülÅâø¤`¿pîŸV?ÞÅòTî¯@[Œ{½¦“ªpƶž—“Õ¶³©ïkÕí}u¥'¬bWs —ë•ä‰³Ò±©Z‹*{íU9Æî‰:P²V©‹ß땪&^TtäúFÏžB2Þ¬ž”œŒÿ Õ“ã8UOªu×ä°s-W=9ŽýhEÙ߉pŸµú|ÅGn#õMû½ˆ#|GË ng#v›9ì3×(ª®ÈõdÚ›åÌBd±| - ô]vV¬n­ïPÁ¹©¿¸×ßð7ÞÎtv'ñ÷¶•—ÓŸbÃëò¢úÖ#å;!KZ"'Wäø+Ñuâ˜}=ú=P鯕žƒ~5*¬»” -ý=uìG>“[,gíÿNۚݮ[§üÄaÿ¹¡°âÏSãnÐnþ (}ç1”ný³úߥcs=sÞ}=zx’ü”ç‘Ïåöõß+Ÿ÷©µZQã‘ã¾ÏúZÙ¯U¢=Ÿ ùz£ÏaëlOBæ']ï{ä|$šmjùU]º­®ö{#u&ëáé馮Ú^WÉôÀþÊs÷&Z‰3Eß Qϸ×æ5ÿôv}ê ¿ÅžS¢'üp©â•õ†;ºÜ~æAy¼eýø4Äwo¥þ1$½Z¸í£‰­ÐÓXÚaz©ñçÅM$2 ñ‘½C=›àŒX#(>/ê'º—-Ôy½O¸ú|kÙ¾o›p£1>—…<›Þ–õ-k8lå‡SîOºþt¹ÍÕ8O¯ŸÁAÜPT+íLO3V¢ã­s]Ùî|åÎþÒž£×úKöÓcËK~Dcíÿ¡oú{Dçh2ÇãþÎ ÛÉÕsc’_NôΕ¨cœAý2×K;Æ¢„iG»œ\ /wíz†dìz9‰øÒ'^ ÝŸø6z.ZîúÓ`ËÄ -wfw$Óê­q+™Þ[SMX[yˆ’2ËL_hFÙw8o|•ì‚Ät$Z1Ý$ûÈò8zÎy¨.Oâ]ªÎ‰íç¾8bú»ˆ—¦ {ê‹J¥·eðP¬]o-¡Ú &î96$Ž}RHôí¿ñå¡#6sðÅ®Ñ3Ç ±²!Åѯq?…t9©ýÖÑÒØ©2zÕykcÍOQ¦©‡:¯Ð."Ù.ô".á#6ðå–L¹ÕØk[…ÝøñrBˆ‰rÿÆç±wšXa›ž$1î W;íeRKeUÁ5™FOlÒÿ T¤A%äé.“¢§®gkNB¾9È[%Iz¨5 ¸Xf_¡.WÊ°Y©/W­ÒŸ@wôÛP…ʽ4@j€Ç–ì†Õ 2Aëg`¥$ZÓMr¦ü²!O9ÓpU;O–0÷4Æä<°óE’ËØqGÐyǸÂæ™xé-îÉdú•'™doG´›“ â  0ÉF_:™½u ½Œ/§“i÷rúõÔÃœÉ7z& 8z#ŒÌ¼Üù¿èó=~ÿuŠç¿ñ3K÷v …غ!ËHFï«w’é}bLn#ˆ> -ØŸdWgßÄÖ0â¸÷¯ã¼ÝN`çžn ¨\ILS‡‚ì‡éz„fÒ âe§Å‘È|êÞÌ€½4/Ózx¥BC.Í:ya†ä³-ê:C:¸Ñ‹у¢)&lS²˜dr’¡z’?Ê­4—hˆ4‚šaòâ ³rh¦õUˆ.HƒlÈ£““¶<ŠÐí^Ÿ¼ï«È™=€¨ÚõERLj:O§†ÞÌÛæˆ9áL vÞ©¡1V¾F’3]c¦qÓ6*¨uÞ¶vHrÒȴͤ(\€f™6F,,S^ocµôWUKeä“ú«Ôt’»2”˜ä®äC_—#ÞÈ–ÂH€’4ç2WggÏ‘KV…–å݃gÏÀ´ãÜq;7GÛ³XFœ‚ä™™Úy[:ôü(üûßQŸ¼ÑzñO¯Ž¸:_Ú@] >ô÷°Úš30$Ò«´J¬¢\òð=ûÎ9¶ÃÄlqôF]]„0Úë 1¿mW¿­YuI)àêÛOÔç¤\¥bÀª‰F“>¢ôôÕ@Io¥¿{幩¸Tû]Ú”PúÏÿò´°æ -endstream -endobj -859 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 858 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -860 0 obj -<< -/Title (RKE2 CIS v1.6 Benchmark - Self-Assessment Guide - Rancher v2.6) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 142 -/First 861 0 R -/Last 998 0 R -/Parent 1003 0 R ->> -endobj -861 0 obj -<< -/Title (CIS v1.6 Kubernetes Benchmark - Rancher v2.6 RKE2 with Kubernetes v1.21 up to v1.23) -/Dest [ 306 0 R /XYZ 84.259843 784.970079 0 ] -/Count 2 -/First 862 0 R -/Last 863 0 R -/Parent 860 0 R -/Next 864 0 R ->> -endobj -862 0 obj -<< -/Title (Overview) -/Dest [ 306 0 R /XYZ 84.259843 704.822079 0 ] -/Count 0 -/Parent 861 0 R -/Next 863 0 R ->> -endobj -863 0 obj -<< -/Title (Testing controls methodology) -/Dest [ 306 0 R /XYZ 84.259843 169.826079 0 ] -/Count 0 -/Prev 862 0 R -/Parent 861 0 R ->> -endobj -864 0 obj -<< -/Title (Controls) -/Dest [ 313 0 R /XYZ 84.259843 570.381496 0 ] -/Count 0 -/Prev 861 0 R -/Parent 860 0 R -/Next 865 0 R ->> -endobj -865 0 obj -<< -/Title (1.1 Master Node Configuration Files) -/Dest [ 317 0 R /XYZ 41.740157 784.430079 0 ] -/Count 21 -/Prev 864 0 R -/First 866 0 R -/Last 886 0 R -/Parent 860 0 R -/Next 887 0 R ->> -endobj -866 0 obj -<< -/Title (1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 317 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 865 0 R -/Next 867 0 R ->> -endobj -867 0 obj -<< -/Title (1.1.2 Ensure that the API server pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 317 0 R /XYZ 84.259843 352.457453 0 ] -/Count 0 -/Prev 866 0 R -/Parent 865 0 R -/Next 868 0 R ->> -endobj -868 0 obj -<< -/Title (1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 321 0 R /XYZ 84.259843 736.220079 0 ] -/Count 0 -/Prev 867 0 R -/Parent 865 0 R -/Next 869 0 R ->> -endobj -869 0 obj -<< -/Title (1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 321 0 R /XYZ 84.259843 351.131993 0 ] -/Count 0 -/Prev 868 0 R -/Parent 865 0 R -/Next 870 0 R ->> -endobj -870 0 obj -<< -/Title (1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 702.470079 0 ] -/Count 0 -/Prev 869 0 R -/Parent 865 0 R -/Next 871 0 R ->> -endobj -871 0 obj -<< -/Title (1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 325 0 R /XYZ 84.259843 351.329014 0 ] -/Count 0 -/Prev 870 0 R -/Parent 865 0 R -/Next 872 0 R ->> -endobj -872 0 obj -<< -/Title (1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 329 0 R /XYZ 84.259843 736.220079 0 ] -/Count 0 -/Prev 871 0 R -/Parent 865 0 R -/Next 873 0 R ->> -endobj -873 0 obj -<< -/Title (1.1.8 Ensure that the etcd pod specification file ownership is set to root:root \(Automated\)) -/Dest [ 329 0 R /XYZ 84.259843 385.079014 0 ] -/Count 0 -/Prev 872 0 R -/Parent 865 0 R -/Next 874 0 R ->> -endobj -874 0 obj -<< -/Title (1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 333 0 R /XYZ 84.259843 763.220079 0 ] -/Count 0 -/Prev 873 0 R -/Parent 865 0 R -/Next 875 0 R ->> -endobj -875 0 obj -<< -/Title (1.1.10 Ensure that the Container Network Interface file ownership is set to root:root \(Manual\)) -/Dest [ 333 0 R /XYZ 84.259843 586.473057 0 ] -/Count 0 -/Prev 874 0 R -/Parent 865 0 R -/Next 876 0 R ->> -endobj -876 0 obj -<< -/Title (1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive \(Automated\)) -/Dest [ 333 0 R /XYZ 84.259843 409.726036 0 ] -/Count 0 -/Prev 875 0 R -/Parent 865 0 R -/Next 877 0 R ->> -endobj -877 0 obj -<< -/Title (1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd \(Automated\)) -/Dest [ 338 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 876 0 R -/Parent 865 0 R -/Next 878 0 R ->> -endobj -878 0 obj -<< -/Title (1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 338 0 R /XYZ 84.259843 471.123057 0 ] -/Count 0 -/Prev 877 0 R -/Parent 865 0 R -/Next 879 0 R ->> -endobj -879 0 obj -<< -/Title (1.1.14 Ensure that the admin.conf file ownership is set to root:root \(Automated\)) -/Dest [ 338 0 R /XYZ 84.259843 157.876036 0 ] -/Count 0 -/Prev 878 0 R -/Parent 865 0 R -/Next 880 0 R ->> -endobj -880 0 obj -<< -/Title (1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 342 0 R /XYZ 84.259843 538.576036 0 ] -/Count 0 -/Prev 879 0 R -/Parent 865 0 R -/Next 881 0 R ->> -endobj -881 0 obj -<< -/Title (1.1.16 Ensure that the scheduler.conf file ownership is set to root:root \(Automated\)) -/Dest [ 342 0 R /XYZ 84.259843 221.381993 0 ] -/Count 0 -/Prev 880 0 R -/Parent 865 0 R -/Next 882 0 R ->> -endobj -882 0 obj -<< -/Title (1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 346 0 R /XYZ 84.259843 622.576036 0 ] -/Count 0 -/Prev 881 0 R -/Parent 865 0 R -/Next 883 0 R ->> -endobj -883 0 obj -<< -/Title (1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root \(Automated\)) -/Dest [ 346 0 R /XYZ 84.259843 290.381993 0 ] -/Count 0 -/Prev 882 0 R -/Parent 865 0 R -/Next 884 0 R ->> -endobj -884 0 obj -<< -/Title (1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root \(Automated\)) -/Dest [ 351 0 R /XYZ 84.259843 675.470079 0 ] -/Count 0 -/Prev 883 0 R -/Parent 865 0 R -/Next 885 0 R ->> -endobj -885 0 obj -<< -/Title (1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 351 0 R /XYZ 84.259843 362.223057 0 ] -/Count 0 -/Prev 884 0 R -/Parent 865 0 R -/Next 886 0 R ->> -endobj -886 0 obj -<< -/Title (1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 \(Manual\)) -/Dest [ 398 0 R /XYZ 84.259843 324.635606 0 ] -/Count 0 -/Prev 885 0 R -/Parent 865 0 R ->> -endobj -887 0 obj -<< -/Title (1.2 API Server) -/Dest [ 486 0 R /XYZ 41.740157 784.430079 0 ] -/Count 35 -/Prev 865 0 R -/First 888 0 R -/Last 922 0 R -/Parent 860 0 R -/Next 923 0 R ->> -endobj -888 0 obj -<< -/Title (1.2.1 Ensure that the --anonymous-auth argument is set to false \(Manual\)) -/Dest [ 486 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 887 0 R -/Next 889 0 R ->> -endobj -889 0 obj -<< -/Title (1.2.2 Ensure that the --basic-auth-file argument is not set \(Automated\)) -/Dest [ 486 0 R /XYZ 84.259843 528.904475 0 ] -/Count 0 -/Prev 888 0 R -/Parent 887 0 R -/Next 890 0 R ->> -endobj -890 0 obj -<< -/Title (1.2.3 Ensure that the --token-auth-file parameter is not set \(Automated\)) -/Dest [ 492 0 R /XYZ 84.259843 427.220079 0 ] -/Count 0 -/Prev 889 0 R -/Parent 887 0 R -/Next 891 0 R ->> -endobj -891 0 obj -<< -/Title (1.2.4 Ensure that the --kubelet-https argument is set to true \(Automated\)) -/Dest [ 497 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 890 0 R -/Parent 887 0 R -/Next 892 0 R ->> -endobj -892 0 obj -<< -/Title (1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate \(Automated\)) -/Dest [ 502 0 R /XYZ 84.259843 277.220079 0 ] -/Count 0 -/Prev 891 0 R -/Parent 887 0 R -/Next 893 0 R ->> -endobj -893 0 obj -<< -/Title (1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate \(Automated\)) -/Dest [ 507 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 892 0 R -/Parent 887 0 R -/Next 894 0 R ->> -endobj -894 0 obj -<< -/Title (1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 514 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 893 0 R -/Parent 887 0 R -/Next 895 0 R ->> -endobj -895 0 obj -<< -/Title (1.2.8 Ensure that the --authorization-mode argument includes Node \(Automated\)) -/Dest [ 519 0 R /XYZ 84.259843 652.220079 0 ] -/Count 0 -/Prev 894 0 R -/Parent 887 0 R -/Next 896 0 R ->> -endobj -896 0 obj -<< -/Title (1.2.9 Ensure that the --authorization-mode argument includes RBAC \(Automated\)) -/Dest [ 524 0 R /XYZ 84.259843 577.220079 0 ] -/Count 0 -/Prev 895 0 R -/Parent 887 0 R -/Next 897 0 R ->> -endobj -897 0 obj -<< -/Title (1.2.10 Ensure that the admission control plugin EventRateLimit is set \(Manual\)) -/Dest [ 529 0 R /XYZ 84.259843 502.220079 0 ] -/Count 0 -/Prev 896 0 R -/Parent 887 0 R -/Next 898 0 R ->> -endobj -898 0 obj -<< -/Title (1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set \(Automated\)) -/Dest [ 529 0 R /XYZ 84.259843 280.473057 0 ] -/Count 0 -/Prev 897 0 R -/Parent 887 0 R -/Next 899 0 R ->> -endobj -899 0 obj -<< -/Title (1.2.12 Ensure that the admission control plugin AlwaysPullImages is set \(Manual\)) -/Dest [ 535 0 R /XYZ 84.259843 202.220079 0 ] -/Count 0 -/Prev 898 0 R -/Parent 887 0 R -/Next 900 0 R ->> -endobj -900 0 obj -<< -/Title (1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used \(Manual\)) -/Dest [ 537 0 R /XYZ 84.259843 736.023057 0 ] -/Count 0 -/Prev 899 0 R -/Parent 887 0 R -/Next 901 0 R ->> -endobj -901 0 obj -<< -/Title (1.2.14 Ensure that the admission control plugin ServiceAccount is set \(Automated\)) -/Dest [ 537 0 R /XYZ 84.259843 499.276036 0 ] -/Count 0 -/Prev 900 0 R -/Parent 887 0 R -/Next 902 0 R ->> -endobj -902 0 obj -<< -/Title (1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set \(Automated\)) -/Dest [ 544 0 R /XYZ 84.259843 370.970079 0 ] -/Count 0 -/Prev 901 0 R -/Parent 887 0 R -/Next 903 0 R ->> -endobj -903 0 obj -<< -/Title (1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set \(Automated\)) -/Dest [ 549 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 902 0 R -/Parent 887 0 R -/Next 904 0 R ->> -endobj -904 0 obj -<< -/Title (1.2.17 Ensure that the admission control plugin NodeRestriction is set \(Automated\)) -/Dest [ 554 0 R /XYZ 84.259843 183.470079 0 ] -/Count 0 -/Prev 903 0 R -/Parent 887 0 R -/Next 905 0 R ->> -endobj -905 0 obj -<< -/Title (1.2.18 Ensure that the --insecure-bind-address argument is not set \(Automated\)) -/Dest [ 561 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 904 0 R -/Parent 887 0 R -/Next 906 0 R ->> -endobj -906 0 obj -<< -/Title (1.2.19 Ensure that the --insecure-port argument is set to 0 \(Automated\)) -/Dest [ 566 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 905 0 R -/Parent 887 0 R -/Next 907 0 R ->> -endobj -907 0 obj -<< -/Title (1.2.20 Ensure that the --secure-port argument is not set to 0 \(Automated\)) -/Dest [ 571 0 R /XYZ 84.259843 689.720079 0 ] -/Count 0 -/Prev 906 0 R -/Parent 887 0 R -/Next 908 0 R ->> -endobj -908 0 obj -<< -/Title (1.2.21 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 576 0 R /XYZ 84.259843 614.720079 0 ] -/Count 0 -/Prev 907 0 R -/Parent 887 0 R -/Next 909 0 R ->> -endobj -909 0 obj -<< -/Title (1.2.22 Ensure that the --audit-log-path argument is set \(Automated\)) -/Dest [ 581 0 R /XYZ 84.259843 558.470079 0 ] -/Count 0 -/Prev 908 0 R -/Parent 887 0 R -/Next 910 0 R ->> -endobj -910 0 obj -<< -/Title (1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate \(Automated\)) -/Dest [ 586 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 909 0 R -/Parent 887 0 R -/Next 911 0 R ->> -endobj -911 0 obj -<< -/Title (1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate \(Automated\)) -/Dest [ 591 0 R /XYZ 84.259843 389.720079 0 ] -/Count 0 -/Prev 910 0 R -/Parent 887 0 R -/Next 912 0 R ->> -endobj -912 0 obj -<< -/Title (1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate \(Automated\)) -/Dest [ 596 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 911 0 R -/Parent 887 0 R -/Next 913 0 R ->> -endobj -913 0 obj -<< -/Title (1.2.26 Ensure that the --request-timeout argument is set as appropriate \(Automated\)) -/Dest [ 601 0 R /XYZ 84.259843 239.720079 0 ] -/Count 0 -/Prev 912 0 R -/Parent 887 0 R -/Next 914 0 R ->> -endobj -914 0 obj -<< -/Title (1.2.27 Ensure that the --service-account-lookup argument is set to true \(Automated\)) -/Dest [ 606 0 R /XYZ 84.259843 164.720079 0 ] -/Count 0 -/Prev 913 0 R -/Parent 887 0 R -/Next 915 0 R ->> -endobj -915 0 obj -<< -/Title (1.2.28 Ensure that the --service-account-key-file argument is set as appropriate \(Automated\)) -/Dest [ 613 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 914 0 R -/Parent 887 0 R -/Next 916 0 R ->> -endobj -916 0 obj -<< -/Title (1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate \(Automated\)) -/Dest [ 618 0 R /XYZ 84.259843 670.970079 0 ] -/Count 0 -/Prev 915 0 R -/Parent 887 0 R -/Next 917 0 R ->> -endobj -917 0 obj -<< -/Title (1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 623 0 R /XYZ 84.259843 577.220079 0 ] -/Count 0 -/Prev 916 0 R -/Parent 887 0 R -/Next 918 0 R ->> -endobj -918 0 obj -<< -/Title (1.2.31 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 628 0 R /XYZ 84.259843 464.720079 0 ] -/Count 0 -/Prev 917 0 R -/Parent 887 0 R -/Next 919 0 R ->> -endobj -919 0 obj -<< -/Title (1.2.32 Ensure that the --etcd-cafile argument is set as appropriate \(Automated\)) -/Dest [ 633 0 R /XYZ 84.259843 370.970079 0 ] -/Count 0 -/Prev 918 0 R -/Parent 887 0 R -/Next 920 0 R ->> -endobj -920 0 obj -<< -/Title (1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate \(Automated\)) -/Dest [ 638 0 R /XYZ 84.259843 295.970079 0 ] -/Count 0 -/Prev 919 0 R -/Parent 887 0 R -/Next 921 0 R ->> -endobj -921 0 obj -<< -/Title (1.2.34 Ensure that encryption providers are appropriately configured \(Automated\)) -/Dest [ 643 0 R /XYZ 84.259843 220.970079 0 ] -/Count 0 -/Prev 920 0 R -/Parent 887 0 R -/Next 922 0 R ->> -endobj -922 0 obj -<< -/Title (1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers \(Manual\)) -/Dest [ 645 0 R /XYZ 84.259843 547.576036 0 ] -/Count 0 -/Prev 921 0 R -/Parent 887 0 R ->> -endobj -923 0 obj -<< -/Title (1.3 Controller Manager) -/Dest [ 653 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 887 0 R -/First 924 0 R -/Last 930 0 R -/Parent 860 0 R -/Next 931 0 R ->> -endobj -924 0 obj -<< -/Title (1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate \(Automated\)) -/Dest [ 653 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 923 0 R -/Next 925 0 R ->> -endobj -925 0 obj -<< -/Title (1.3.2 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 656 0 R /XYZ 84.259843 633.470079 0 ] -/Count 0 -/Prev 924 0 R -/Parent 923 0 R -/Next 926 0 R ->> -endobj -926 0 obj -<< -/Title (1.3.3 Ensure that the --use-service-account-credentials argument is set to true \(Automated\)) -/Dest [ 659 0 R /XYZ 84.259843 558.470079 0 ] -/Count 0 -/Prev 925 0 R -/Parent 923 0 R -/Next 927 0 R ->> -endobj -927 0 obj -<< -/Title (1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate \(Automated\)) -/Dest [ 662 0 R /XYZ 84.259843 483.470079 0 ] -/Count 0 -/Prev 926 0 R -/Parent 923 0 R -/Next 928 0 R ->> -endobj -928 0 obj -<< -/Title (1.3.5 Ensure that the --root-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 665 0 R /XYZ 84.259843 389.720079 0 ] -/Count 0 -/Prev 927 0 R -/Parent 923 0 R -/Next 929 0 R ->> -endobj -929 0 obj -<< -/Title (1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true \(Automated\)) -/Dest [ 668 0 R /XYZ 84.259843 294.470079 0 ] -/Count 0 -/Prev 928 0 R -/Parent 923 0 R -/Next 930 0 R ->> -endobj -930 0 obj -<< -/Title (1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 668 0 R /XYZ 84.259843 133.670079 0 ] -/Count 0 -/Prev 929 0 R -/Parent 923 0 R ->> -endobj -931 0 obj -<< -/Title (1.4 Scheduler) -/Dest [ 675 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 923 0 R -/First 932 0 R -/Last 933 0 R -/Parent 860 0 R -/Next 934 0 R ->> -endobj -932 0 obj -<< -/Title (1.4.1 Ensure that the --profiling argument is set to false \(Automated\)) -/Dest [ 675 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 931 0 R -/Next 933 0 R ->> -endobj -933 0 obj -<< -/Title (1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 \(Automated\)) -/Dest [ 675 0 R /XYZ 84.259843 313.654475 0 ] -/Count 0 -/Prev 932 0 R -/Parent 931 0 R ->> -endobj -934 0 obj -<< -/Title (2 Etcd Node Configuration Files) -/Dest [ 681 0 R /XYZ 41.740157 784.430079 0 ] -/Count 7 -/Prev 931 0 R -/First 935 0 R -/Last 941 0 R -/Parent 860 0 R -/Next 942 0 R ->> -endobj -935 0 obj -<< -/Title (2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate \(Automated\)) -/Dest [ 681 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 934 0 R -/Next 936 0 R ->> -endobj -936 0 obj -<< -/Title (2.2 Ensure that the --client-cert-auth argument is set to true \(Automated\)) -/Dest [ 681 0 R /XYZ 84.259843 538.851496 0 ] -/Count 0 -/Prev 935 0 R -/Parent 934 0 R -/Next 937 0 R ->> -endobj -937 0 obj -<< -/Title (2.3 Ensure that the --auto-tls argument is not set to true \(Automated\)) -/Dest [ 681 0 R /XYZ 84.259843 408.051496 0 ] -/Count 0 -/Prev 936 0 R -/Parent 934 0 R -/Next 938 0 R ->> -endobj -938 0 obj -<< -/Title (2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 686 0 R /XYZ 84.259843 708.470079 0 ] -/Count 0 -/Prev 937 0 R -/Parent 934 0 R -/Next 939 0 R ->> -endobj -939 0 obj -<< -/Title (2.5 Ensure that the --peer-client-cert-auth argument is set to true \(Automated\)) -/Dest [ 686 0 R /XYZ 84.259843 547.670079 0 ] -/Count 0 -/Prev 938 0 R -/Parent 934 0 R -/Next 940 0 R ->> -endobj -940 0 obj -<< -/Title (2.6 Ensure that the --peer-auto-tls argument is not set to true \(Automated\)) -/Dest [ 686 0 R /XYZ 84.259843 416.870079 0 ] -/Count 0 -/Prev 939 0 R -/Parent 934 0 R -/Next 941 0 R ->> -endobj -941 0 obj -<< -/Title (2.7 Ensure that a unique Certificate Authority is used for etcd \(Manual\)) -/Dest [ 691 0 R /XYZ 84.259843 652.220079 0 ] -/Count 0 -/Prev 940 0 R -/Parent 934 0 R ->> -endobj -942 0 obj -<< -/Title (3.1 Authentication and Authorization) -/Dest [ 696 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 934 0 R -/First 943 0 R -/Last 943 0 R -/Parent 860 0 R -/Next 944 0 R ->> -endobj -943 0 obj -<< -/Title (3.1.1 Client certificate authentication should not be used for users \(Manual\)) -/Dest [ 696 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 942 0 R ->> -endobj -944 0 obj -<< -/Title (3.2 Logging) -/Dest [ 698 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 942 0 R -/First 945 0 R -/Last 946 0 R -/Parent 860 0 R -/Next 947 0 R ->> -endobj -945 0 obj -<< -/Title (3.2.1 Ensure that a minimal audit policy is created \(Automated\)) -/Dest [ 698 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 944 0 R -/Next 946 0 R ->> -endobj -946 0 obj -<< -/Title (3.2.2 Ensure that the audit policy covers key security concerns \(Manual\)) -/Dest [ 698 0 R /XYZ 84.259843 418.457453 0 ] -/Count 0 -/Prev 945 0 R -/Parent 944 0 R ->> -endobj -947 0 obj -<< -/Title (4.1 Worker Node Configuration Files) -/Dest [ 701 0 R /XYZ 41.740157 784.430079 0 ] -/Count 10 -/Prev 944 0 R -/First 948 0 R -/Last 957 0 R -/Parent 860 0 R -/Next 958 0 R ->> -endobj -948 0 obj -<< -/Title (4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 701 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 947 0 R -/Next 949 0 R ->> -endobj -949 0 obj -<< -/Title (4.1.2 Ensure that the kubelet service file ownership is set to root:root \(Automated\)) -/Dest [ 701 0 R /XYZ 84.259843 394.260432 0 ] -/Count 0 -/Prev 948 0 R -/Parent 947 0 R -/Next 950 0 R ->> -endobj -950 0 obj -<< -/Title (4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 701 0 R /XYZ 84.259843 263.460432 0 ] -/Count 0 -/Prev 949 0 R -/Parent 947 0 R -/Next 951 0 R ->> -endobj -951 0 obj -<< -/Title (4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root \(Manual\)) -/Dest [ 704 0 R /XYZ 84.259843 584.879014 0 ] -/Count 0 -/Prev 950 0 R -/Parent 947 0 R -/Next 952 0 R ->> -endobj -952 0 obj -<< -/Title (4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive \(Automated\)) -/Dest [ 704 0 R /XYZ 84.259843 214.987950 0 ] -/Count 0 -/Prev 951 0 R -/Parent 947 0 R -/Next 953 0 R ->> -endobj -953 0 obj -<< -/Title (4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root \(Automated\)) -/Dest [ 708 0 R /XYZ 84.259843 603.629014 0 ] -/Count 0 -/Prev 952 0 R -/Parent 947 0 R -/Next 954 0 R ->> -endobj -954 0 obj -<< -/Title (4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive \(Manual\)) -/Dest [ 708 0 R /XYZ 84.259843 252.487950 0 ] -/Count 0 -/Prev 953 0 R -/Parent 947 0 R -/Next 955 0 R ->> -endobj -955 0 obj -<< -/Title (4.1.8 Ensure that the client certificate authorities file ownership is set to root:root \(Automated\)) -/Dest [ 713 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 954 0 R -/Parent 947 0 R -/Next 956 0 R ->> -endobj -956 0 obj -<< -/Title (4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive \(Automated\)) -/Dest [ 713 0 R /XYZ 84.259843 463.229014 0 ] -/Count 0 -/Prev 955 0 R -/Parent 947 0 R -/Next 957 0 R ->> -endobj -957 0 obj -<< -/Title (4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root \(Automated\)) -/Dest [ 717 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 956 0 R -/Parent 947 0 R ->> -endobj -958 0 obj -<< -/Title (4.2 Kubelet) -/Dest [ 720 0 R /XYZ 41.740157 784.430079 0 ] -/Count 13 -/Prev 947 0 R -/First 959 0 R -/Last 971 0 R -/Parent 860 0 R -/Next 972 0 R ->> -endobj -959 0 obj -<< -/Title (4.2.1 Ensure that the anonymous-auth argument is set to false \(Automated\)) -/Dest [ 720 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 958 0 R -/Next 960 0 R ->> -endobj -960 0 obj -<< -/Title (4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow \(Automated\)) -/Dest [ 724 0 R /XYZ 84.259843 520.970079 0 ] -/Count 0 -/Prev 959 0 R -/Parent 958 0 R -/Next 961 0 R ->> -endobj -961 0 obj -<< -/Title (4.2.3 Ensure that the --client-ca-file argument is set as appropriate \(Automated\)) -/Dest [ 728 0 R /XYZ 84.259843 670.970079 0 ] -/Count 0 -/Prev 960 0 R -/Parent 958 0 R -/Next 962 0 R ->> -endobj -962 0 obj -<< -/Title (4.2.4 Ensure that the --read-only-port argument is set to 0 \(Automated\)) -/Dest [ 732 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 961 0 R -/Parent 958 0 R -/Next 963 0 R ->> -endobj -963 0 obj -<< -/Title (4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 \(Automated\)) -/Dest [ 736 0 R /XYZ 84.259843 614.720079 0 ] -/Count 0 -/Prev 962 0 R -/Parent 958 0 R -/Next 964 0 R ->> -endobj -964 0 obj -<< -/Title (4.2.6 Ensure that the --protect-kernel-defaults argument is set to true \(Automated\)) -/Dest [ 740 0 R /XYZ 84.259843 389.720079 0 ] -/Count 0 -/Prev 963 0 R -/Parent 958 0 R -/Next 965 0 R ->> -endobj -965 0 obj -<< -/Title (4.2.7 Ensure that the --make-iptables-util-chains argument is set to true \(Automated\)) -/Dest [ 744 0 R /XYZ 84.259843 544.220079 0 ] -/Count 0 -/Prev 964 0 R -/Parent 958 0 R -/Next 966 0 R ->> -endobj -966 0 obj -<< -/Title (4.2.8 Ensure that the --hostname-override argument is not set \(Manual\)) -/Dest [ 748 0 R /XYZ 84.259843 333.470079 0 ] -/Count 0 -/Prev 965 0 R -/Parent 958 0 R -/Next 967 0 R ->> -endobj -967 0 obj -<< -/Title (4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture \(Manual\)) -/Dest [ 751 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 966 0 R -/Parent 958 0 R -/Next 968 0 R ->> -endobj -968 0 obj -<< -/Title (4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate \(Automated\)) -/Dest [ 755 0 R /XYZ 84.259843 614.720079 0 ] -/Count 0 -/Prev 967 0 R -/Parent 958 0 R -/Next 969 0 R ->> -endobj -969 0 obj -<< -/Title (4.2.11 Ensure that the --rotate-certificates argument is not set to false \(Manual\)) -/Dest [ 759 0 R /XYZ 84.259843 389.720079 0 ] -/Count 0 -/Prev 968 0 R -/Parent 958 0 R -/Next 970 0 R ->> -endobj -970 0 obj -<< -/Title (4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true \(Manual\)) -/Dest [ 763 0 R /XYZ 84.259843 187.970079 0 ] -/Count 0 -/Prev 969 0 R -/Parent 958 0 R -/Next 971 0 R ->> -endobj -971 0 obj -<< -/Title (4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers \(Manual\)) -/Dest [ 769 0 R /XYZ 84.259843 745.970079 0 ] -/Count 0 -/Prev 970 0 R -/Parent 958 0 R ->> -endobj -972 0 obj -<< -/Title (5.1 RBAC and Service Accounts) -/Dest [ 775 0 R /XYZ 41.740157 784.430079 0 ] -/Count 6 -/Prev 958 0 R -/First 973 0 R -/Last 978 0 R -/Parent 860 0 R -/Next 979 0 R ->> -endobj -973 0 obj -<< -/Title (5.1.1 Ensure that the cluster-admin role is only used where required \(Manual\)) -/Dest [ 775 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 972 0 R -/Next 974 0 R ->> -endobj -974 0 obj -<< -/Title (5.1.2 Minimize access to secrets \(Manual\)) -/Dest [ 775 0 R /XYZ 84.259843 523.851496 0 ] -/Count 0 -/Prev 973 0 R -/Parent 972 0 R -/Next 975 0 R ->> -endobj -975 0 obj -<< -/Title (5.1.3 Minimize wildcard use in Roles and ClusterRoles \(Manual\)) -/Dest [ 775 0 R /XYZ 84.259843 423.051496 0 ] -/Count 0 -/Prev 974 0 R -/Parent 972 0 R -/Next 976 0 R ->> -endobj -976 0 obj -<< -/Title (5.1.4 Minimize access to create pods \(Manual\)) -/Dest [ 775 0 R /XYZ 84.259843 307.251496 0 ] -/Count 0 -/Prev 975 0 R -/Parent 972 0 R -/Next 977 0 R ->> -endobj -977 0 obj -<< -/Title (5.1.5 Ensure that default service accounts are not actively used. \(Automated\)) -/Dest [ 775 0 R /XYZ 84.259843 206.451496 0 ] -/Count 0 -/Prev 976 0 R -/Parent 972 0 R -/Next 978 0 R ->> -endobj -978 0 obj -<< -/Title (5.1.6 Ensure that Service Account Tokens are only mounted where necessary \(Manual\)) -/Dest [ 802 0 R /XYZ 84.259843 449.446885 0 ] -/Count 0 -/Prev 977 0 R -/Parent 972 0 R ->> -endobj -979 0 obj -<< -/Title (5.2 Pod Security Policies) -/Dest [ 813 0 R /XYZ 41.740157 784.430079 0 ] -/Count 9 -/Prev 972 0 R -/First 980 0 R -/Last 988 0 R -/Parent 860 0 R -/Next 989 0 R ->> -endobj -980 0 obj -<< -/Title (5.2.1 Minimize the admission of privileged containers \(Automated\)) -/Dest [ 813 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 979 0 R -/Next 981 0 R ->> -endobj -981 0 obj -<< -/Title (5.2.2 Minimize the admission of containers wishing to share the host process ID namespace \(Automated\)) -/Dest [ 813 0 R /XYZ 84.259843 388.457453 0 ] -/Count 0 -/Prev 980 0 R -/Parent 979 0 R -/Next 982 0 R ->> -endobj -982 0 obj -<< -/Title (5.2.3 Minimize the admission of containers wishing to share the host IPC namespace \(Automated\)) -/Dest [ 817 0 R /XYZ 84.259843 763.220079 0 ] -/Count 0 -/Prev 981 0 R -/Parent 979 0 R -/Next 983 0 R ->> -endobj -983 0 obj -<< -/Title (5.2.4 Minimize the admission of containers wishing to share the host network namespace \(Automated\)) -/Dest [ 817 0 R /XYZ 84.259843 412.079014 0 ] -/Count 0 -/Prev 982 0 R -/Parent 979 0 R -/Next 984 0 R ->> -endobj -984 0 obj -<< -/Title (5.2.5 Minimize the admission of containers with allowPrivilegeEscalation \(Automated\)) -/Dest [ 821 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Prev 983 0 R -/Parent 979 0 R -/Next 985 0 R ->> -endobj -985 0 obj -<< -/Title (5.2.6 Minimize the admission of root containers \(Automated\)) -/Dest [ 821 0 R /XYZ 84.259843 429.281993 0 ] -/Count 0 -/Prev 984 0 R -/Parent 979 0 R -/Next 986 0 R ->> -endobj -986 0 obj -<< -/Title (5.2.7 Minimize the admission of containers with the NET_RAW capability \(Manual\)) -/Dest [ 825 0 R /XYZ 84.259843 763.220079 0 ] -/Count 0 -/Prev 985 0 R -/Parent 979 0 R -/Next 987 0 R ->> -endobj -987 0 obj -<< -/Title (5.2.8 Minimize the admission of containers with added capabilities \(Manual\)) -/Dest [ 825 0 R /XYZ 84.259843 431.026036 0 ] -/Count 0 -/Prev 986 0 R -/Parent 979 0 R -/Next 988 0 R ->> -endobj -988 0 obj -<< -/Title (5.2.9 Minimize the admission of containers with capabilities assigned \(Manual\)) -/Dest [ 825 0 R /XYZ 84.259843 315.226036 0 ] -/Count 0 -/Prev 987 0 R -/Parent 979 0 R ->> -endobj -989 0 obj -<< -/Title (5.3 Network Policies and CNI) -/Dest [ 828 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 979 0 R -/First 990 0 R -/Last 991 0 R -/Parent 860 0 R -/Next 992 0 R ->> -endobj -990 0 obj -<< -/Title (5.3.1 Ensure that the CNI in use supports Network Policies \(Automated\)) -/Dest [ 828 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 989 0 R -/Next 991 0 R ->> -endobj -991 0 obj -<< -/Title (5.3.2 Ensure that all Namespaces have Network Policies defined \(Automated\)) -/Dest [ 828 0 R /XYZ 84.259843 318.510432 0 ] -/Count 0 -/Prev 990 0 R -/Parent 989 0 R ->> -endobj -992 0 obj -<< -/Title (5.4 Secrets Management) -/Dest [ 853 0 R /XYZ 41.740157 784.430079 0 ] -/Count 2 -/Prev 989 0 R -/First 993 0 R -/Last 994 0 R -/Parent 860 0 R -/Next 995 0 R ->> -endobj -993 0 obj -<< -/Title (5.4.1 Prefer using secrets as files over secrets as environment variables \(Manual\)) -/Dest [ 853 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 992 0 R -/Next 994 0 R ->> -endobj -994 0 obj -<< -/Title (5.4.2 Consider external secret storage \(Manual\)) -/Dest [ 853 0 R /XYZ 84.259843 568.851496 0 ] -/Count 0 -/Prev 993 0 R -/Parent 992 0 R ->> -endobj -995 0 obj -<< -/Title (5.5 Extensible Admission Control) -/Dest [ 855 0 R /XYZ 41.740157 784.430079 0 ] -/Count 1 -/Prev 992 0 R -/First 996 0 R -/Last 996 0 R -/Parent 860 0 R -/Next 997 0 R ->> -endobj -996 0 obj -<< -/Title (5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller \(Manual\)) -/Dest [ 855 0 R /XYZ 84.259843 684.651496 0 ] -/Count 0 -/Parent 995 0 R ->> -endobj -997 0 obj -<< -/Title (5.6 The v1.5.1 guide skips 5.6 and goes from 5.5 to 5.7. We are including it here merely for explanation.) -/Dest [ 857 0 R /XYZ 41.740157 784.430079 0 ] -/Count 0 -/Prev 995 0 R -/Parent 860 0 R -/Next 998 0 R ->> -endobj -998 0 obj -<< -/Title (5.7 General Policies) -/Dest [ 859 0 R /XYZ 41.740157 784.430079 0 ] -/Count 4 -/Prev 997 0 R -/First 999 0 R -/Last 1002 0 R -/Parent 860 0 R ->> -endobj -999 0 obj -<< -/Title (5.7.1 Create administrative boundaries between resources using namespaces \(Manual\)) -/Dest [ 859 0 R /XYZ 84.259843 720.651496 0 ] -/Count 0 -/Parent 998 0 R -/Next 1000 0 R ->> -endobj -1000 0 obj -<< -/Title (5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions \(Manual\)) -/Dest [ 859 0 R /XYZ 84.259843 604.851496 0 ] -/Count 0 -/Prev 999 0 R -/Parent 998 0 R -/Next 1001 0 R ->> -endobj -1001 0 obj -<< -/Title (5.7.3 Apply Security Context to Your Pods and Containers \(Automated\)) -/Dest [ 859 0 R /XYZ 84.259843 324.051496 0 ] -/Count 0 -/Prev 1000 0 R -/Parent 998 0 R -/Next 1002 0 R ->> -endobj -1002 0 obj -<< -/Title (5.7.4 The default namespace should not be used \(Manual\)) -/Dest [ 859 0 R /XYZ 84.259843 193.251496 0 ] -/Count 0 -/Prev 1001 0 R -/Parent 998 0 R ->> -endobj -1003 0 obj -<< -/Count 143 -/First 860 0 R -/Last 860 0 R ->> -endobj -1004 0 obj -<< -/Length1 41480 -/Filter /FlateDecode -/Length 7852 ->> -stream -xœí| xU¶ð¹÷Ô­®^Òéîtg![gOØ¢4‘MŒ -(š@A„Â"F&!‚“ &,*DDÄ€"êˆ""³θ=pЙ€Ì :ŠIõ;U„àŒofÞ÷ÿ{ïûêœô­{oÝåœsÏVõ})`B…yyn®¶k3À¨7ê¦á#òB ­¡vµËnÊ¿e|ò'×´Qûš{Óø‰Ãξûr@CÝ¿tóÐ #ÍC²~ -ð´ƒÚßÜ2>=sö·/.`ÍÔ¾}úœÂ2|E¢õò¿ ö¶é‹xaVô@€;hŒZ\6sμkÝ pëZº¿sfay˜ቑԶͼoIñ/·ßèxˆÖ^2£°(ö/ž‡in.ÝÏ)¡ûSåÔ^@íÄ’9 îß%¹.p?îÝûJ§.ì(£ý'Ó~)sçÞ_vŽLã7ÐxïÜÂ93RÎ_`#ñÏN••–/ðShÿTí~ÙüeƒM¦êm׈ÐdÇïnîóÓ_ï ÎýbÐàýó›«´ël=q8ügLѲ›š -pÍ3ÍQ£©èj‹0ø”~õ=ÇP»æ_]O,‡X -ÇD=”ëm;Ó®rV Íï -´ÅÀõ®QCóÝPõïqéTè×b˜GkÌ“Ú`ÿ ¤ëëºà ¯é÷·êt¢µ~és˜×µŽ¦v(Å@÷vK­pý‡ 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À 0À€ÿm V@º°~¦VH|­Mÿúžö5=7•L¿JPKW/¡¤_ûC&äÀ0n‚Q0ÆC!Ã,(…E~¿>¢\C#†v¸FL‡˜ óý~ÿ™ÿ -ø¿¿‡&YHÈôõ:šxÒ¨¢&ß­“¼oMŽë×÷M¯Ãäm‚ü¦ %Þf¿?’)&7‰¨&LRš¤¤„Oìæ§ýúŽÉŸämê1¼sÕéoü$ªj-ê¦þÃõ{Ú¦M"‰þF4y§—xv<œ0èaÇŒAý ™/óù¿Wñ²¿KÂo3ñoõø¿Vñ’ŠM¿ØñÏõx1 ¿zx¨øJÅ õx¾Û.ãŸ.ãUür~1 Ï©ø‡Lüüìxñy=ž¥gÇã™ÏÒÅ™ËøY:~ªâ'*~œ‰ÿáÆêñC?páûKñ½Cø{ߥáï.ÅÓ§n§—â©›ðäo#ÅI‰¿Qñ×*þJÅ_ªx¢ß9#ÞQñx ¾‰ÇT|s¥S¼…o„â_Wñ*¾¦â«*¾¢âa_V±UÅC*tb˪$Ñ¢bóC¢YÅû§Š‡ðÀ2iÿÏ“Äþ©>?î÷I?OÂ}*¾T{UÜ£b“Š/ª¸»_°ã®IbWîlt‰IØèÂç‰èç/ãŸSq»ŠÏºp›ŠÏlµ‹g2q«Ÿ.ÂÒP[TÜü”MlVñ)>ùD„x²ŸØäODà&n´à×׉õ*ÖaMª«Çdz‹ÇSñ1;>z×ÕëT¬­™*jaí2©ægI¢f*Öø¤Ÿ%á#*®]Ó_¬UqM|˜Ø|x(V¯¶Šj7®¶buTá*’Ôª$\éÄŸª¸b¹S¬Pq¹Rq™Š•*úü?YºTüDÅ¥KñÁ"¬˜àIø€ŠKT¼ßŽ‹m¸È‚ U\pË/ãüË8ï2–©Xªâ\ï‹ÃÙ*Þë&î³T,YŠ3©Q¬â ‹Tœ®â4 aÁe¼Û†SU¼SÅ)*Nžd“/ã$ Þ!îÈÄÛUœH;O†<8ž9Äøp¼Í·Ž·ª˜oÅ[Tw³CŒSñfŽUq Ý£âèQ1:GE‰Q„7©˜W#êq¸Š7ò~âÆË8ìƒ>‡¨xÃõ.qƒ¯Ï ×»0wpÈõùƒqpRq Š× p‹ë.〇àÆœl«Èq`¶¯Á¬ ̼Æ*2U¼ÆŠéV‘„éVìßÏ,ú;°ŸûfbŸÞI¢OöNs‰ÞI˜æÂÔ”$‘:S’09É*’ƒ1ÉŠ‰*&¨ŒqÄgœ ½E{cˆ…˜"ŒÂ(’`”Š‘—±×0Œ F„ŠáEF’ -S1”&…F GE·Š!*ºh€KE'ñꆎ¥\„vƒl¡"HE¶…¢UE‹Í**4LQÑäF¹%º)‘xzQ%¯å¼2‚Š¬™­|„õù¿ð?MÀ Ñ,šá8ákÐO²íÔÒ¾Ï:zø^X ©çuvœUó~Ô·.ÂIYDZQ6²¨à=Áá›ûhÌÍšd ¤qÒ>é6©Y:'€R¹tB*ÊYn·‹íôˆopƒXhfC9Ä/1 [¥á’>ÆØŸÓ.Zì<5° *ˆ7+…J^Áo£ž£âl",¥û'Øfv’¨;ÈVÀiØ€ ›Ùiâë8|+p¯¤ðœÅ‹‰þ£´Ö š¿ Ê%§™TÞ‡úˆzÚkš^Fc?qZÇ‹PI;O€mr³ì6%Ð.šÄ¶³×Y›ü4ÀI¼ çál¥” íFBM@X5´ö&mŽ\Ì–ïVh«óÅRk„/¥Ó4Zû #Ús¿MhßÇm¥ßbÙA< f+±š(ÕîFà Óh)æÓ -¦¥Ä5@)fýT«€Ý°úa=ÔÐJ:¿òñ Í|Rú”x®aðoà‡4(–.h߶uÃÕ_ÍýQ…Þ:Â'dcþ!¾Å½|6á&Âóü<: ·õD©¿Ôøã(|„kÄïä¡ò#„Çä?Ë6Í2U™¾P•…:î2ßiÞ`~ß2Û@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ 4Ð@ÿ?àëVu‚õu[<0(bóJ¾œûáI.1¾s 8Nµe„ÄyâŠxdÇç|Å6mìTìU{Vpá’£½íHoËåIøàäIU¥qŸHSÄi°€Ïç† o™ Á¬ÄÊQ±Ìê85¦)x¤ì»nrÛ‘À"™—Úh×1ã'MŽgû‚1XâSÄ9EvR–“(QÙhu#›ñ6ݾ­Q*Ù<òòéFZ žv-.Blö¥DôŠÄð(§À)„4Ìñ´óñ ÷: 88,œY¢Â(G;ÚÇ4y&Œi -pç˜&÷„;‰ô¿zÝä#§Ú^}ÕéØIÍ%“Cœ7‰ó¬)Êá H´ù2'J·‹ÛMHˆE‘U& ¤©—)¢À"ya¯òÈQËaUÄò^Ë#—G퀑Ω05‰˜ÈÎ99Ù×&'Ä˦윜¬LÉã–M2°jþZûØröHVáÍÏ­ºçäýœšôs¸3B½ÔØظ˜­4gý¨ÅõÃn|çšÌ/~q׳eÑꟀCÿŒTOÜ[!&ùCdZeƒ†P¹!*ôYGƒ­:~]ÔÚ$[¼9*"&$ -ãb#“èȈ³³tÆg/m?븠!1ás‡ãì?'¤ãâ¸lÚ³7†OeSY¼ìq‡fej„3O2ÏQ£1ö­“Áƒ÷Îþ” õâgj‡zå³È±Oààƒ[Ÿ>tèé­ù’æÄdõ/êWwLU¿úÓÔ?²GØ6=£ýïŠ@”qÒ¡_ø†‚“ÔRH\;Sæ´ œ-&:hYë4;Ñ¢h7†šê>dfÅ$ëÿ_bÒ·#aÚ¡æž=ÕFŒ^9Ô:õÉñ{½6Ʀú†³`l -V‚a,‚2X fS¸Œf)”EðÛÙ$žo›ÉJøýlçK‹M÷+Ul5_fÛÀ7b½F'ÏXËb ‡ ¼U½À“ÔŠÏùÀß®î¸gõiaïˆÀÝ—û°Jõ!²¬c¤ÍmĹN𾄨³˜ë\±:Ë ±N«ÂC"bØ£BEDT3D¹¤8:ÐÌv2ÒκêÒñ:. ÌØO<0gœ~p Ý•$:-MëB©”âØclø3O=õŒÚÊú<¾nÝ㪕Kç./{°îYõâ÷_ðcU­Y»’«7”ΟW¶ýÕ=Õ[ÝÞãÞzŸ¬¯ÜF¤þE@Ž¯WÐÓöÝ–:'{vKuaëœk{™"‚ Ãí襑ئkœNÛ72öGÆFr"OÓ§NÊà‘ån…)Åç–ûA½È –Ÿ+¾÷üOÕÔØ*6~Õy1íô=w«GÕß«ï©Gï¾çäÈ‘l £s`[n"ª4)®!)Z¡¿Ï#×I¼Rê¤,‚™M’M#èÔ‘#ÝÒÊØDÂÒ\ž³ów ›:zñ£ù·í7ˆÓj^cÇ™ÆNž×ÏÑ0ÐçÉê0²Nq=íÜí©³¯SÖÆpˆr^+e…GX1´QûÙö#ݼ«§.8ÌHrÆeÇ9e©‹[)¬§¤×ÕýܵPýCƒºU]ÈÖ°»e¦Ò²ö5êõ< a®Ù;N³uÛ;*ÇOdÙ6—m™÷»{ -Ô_ª¿Q«þ2) öÉ¡ÿx‘3âZÒüžCó» û]Ýs3_P†ð‰|Q jÄ!O Ér&{ûmqúr¬#îÕ½ùW¾TÅ)darʲ@g—ESG„Ͳ`’¬hYâuê6×–ÖirR#“4#SP3²GÝœIܬ„òT‘ª à9âZå&ž'nT&ò™|_,VðÕ¢Fyœ?¡œã²=a–#1Â$ÈâMá˜*úȽM9RŽÈ‘³M¶¡è“FŸì3ùlÓ°@*3M‹E™m ®?“kL5¶Mø”ü”i?þÜô¾aú¾kú¿”¾”ÿ†ßŠïä¾SçÁÔy$2\úÓäÁ73©#{©ßtd‘l:ªù⎑ígø¯:®Ñ<–&¥ $¥ŠC{|Ùä}Ð";QBá”$&KàAÉSgv×=d•„ŒN²ÝP»°DDHÎ!nK”MŠÖíøˆfÆ΀!çjÑ5PÃnŸE?= -íõÅèê&@0A.É$yÀÃÜ<ä$HbI<SädS²’löÆä°žÇòx‰X(-‹CVË«Mä ¦XÍA…††…$ i`‚3ÁçÕÜs~>2´â†ï½2zÍý¾ÍÞbо¢£Z}´®îQÞZûµ„UÖO먧ßýý#ù-ªV¬X©iNŦ­d')ð_nÛ­<&6F1s“…ÇÆÆ ³Xcb%ÏÓîÇÃëœR<žDN#5Æb4A|d„½Ÿ)ŸêøðH[{ÛYŠQº\´¸¥;Ç›Î.Õ²kRé¼p‚ÓH8ûcÓÒÓnIÀÑcXX˜îôââ“S²C;#ZJJrröµ‰Y™¡ÒÈòwîyö¥ÅÛøìwêGê¹{¿ZVÑ6ÿ…ÖªMŸ½Í¾žõ¾ØöÆ€œe‹¦ÏˆèóÞþ÷>ÉHÿõˆ¼Õ?™û`lx¿Ww¾y6YÓ… -⻟TA“­”“ÄZÃÌvx>Ln±;½«bFµ$4;׆٠Ã̊5÷ˆd:ýwNµef:õ£?röR;y‹7µÐLê Eç¹Ñ1±ÞŒ¸Œø!)¾h_Œ/ÖçõÅùâó£ócòcó½ùqùñù)e)+£«bªb«¼Uq+ãkSR.¦ÄtMíšÔ5¡ ¦ ¶À[WS[æ-‹[³,v™wY\øUq?{€3!›|súîçw׶£¨ g -áðBÕsüܹãôƒNº*IZnˆ„2_"Y»y•²Zxžg¢ÅÆ…·¸šmk£"=\ñ(0†»‚GDé$ÑsZMxtïR ßK]Ýýëè‹Ñb aCøÏHÑ×”®¤›ûZJ¡”•òROi¤yêûR›æHœ.òG{ ¼­£JvwlžQô•vƯ‘P–ÈÚÿm› Ï.–ö@+L‘ Oq´S8Õ¸lo#ýw˜}æ|s¹ÌLú¯…m'=…½ÖL |ß »¿„N>ž¤õ,ä‹Ò~<~·Âú®®@ÞÕüìp‡ž%ß#q Eïž&ú(·ób>S)§¨½œW‹Ÿ)ñz±^y†»´¨Í­±S1EÒbvŠÏ%X`«Æ•Rµx„"ó&\ojÄçÄ~Ó¦wMËø7é¢ÔK‹ÆZ0ÎbŒ²Ø„ƒ-<éO»ùì‹G[dwû,v¦ãRÇ.žÐññ{E~ñ`=׸é~Jõ9:S2qQÈ¡‘Àd÷wm²2E“}ÅÃ_²ì2‡ƒmòت¢½ØÙá03XQä|§œ®ôÊKЃv{{[à©17÷ì¥Ü#m™º"øB2óËk_Iü8ÑŸh&ÍÐuÁÓS?®(Š' (i#^]þâá–ù k¶·Ì_üÈö––!MK؉Õ.úú3Mmž~RS¾yë¯<ÓQ%ìž9íÁ®Ó."B(¿Jk[ÿ±ÖžíÒÚ}ž_yøõÖóOô–6ÖÔ6à™Ò¾VƒÑ¾¹Å-¶f×Úp³+øVtyF„뎨Ӄ“óNQr¥©R©4WZ*­¶Ê J{ep¥£ÒYájˆ¸á¼úÉ3%Só9¯ÎËßµ³î±]»»È\ê…‹V¿bNüøܱcç¾xëè—Oªo©mêyrCÉÛ¸ÙuÉàh¢Ð ô +[é$­Xeo6·š,²JžËA¹—n[ä/O½£9È}ù![B4™$ÿ@ a8:vTß'ŸkitpeHÿ(Üçr?ܱ—ÄQ<]Ú­”âÚQÚ-Îuæ>ã;SŸñWRŠwÕ’{•§:\‹wIÍWrŸÛ"»IqÇHÕ¨:uUîCðk-º®Î}ºRHÑLrN”%ÊeëOn¼¯µ¯m°y°e°u°Íê/Kä©–Tkïtwº§whjLjlš7-.1e•e•u•mUK{3Ĺl‘­hà ´c0:0{a$FIÑæ”ô´!i÷¤U¦-K«MkH»˜N)ä¼&YZ²ðÃ$K“®·cJuõ´Ç‡yöo¿Ÿòú}Åo._;c§oç†O~Y¼O²;5uÂߨ8{ïÕOîOH8œ=ùÖ1ùIÁ‰uË7ïŠÑ´|9Ê¿ˆÍ¤åíB ÆçÁÉZ•*‹•dLñÙá²kZ®†ÌÀCqÀ.),ì}1àŸµh@ºE.“²-*8ÙbV¡®Sþò˧·VU‰Íê/j:ªÇmÚò[^PÃnмónÒóIº}¹a°/ꊅ­µ°Vw³ìËmG––çÑ~`@£Îfv›Y©çUÍÌB(&»;KHf»53{¡¹ùÆ= _{‹ýŠäÛ; -·l9¼W|ß°«xúEÜ¡q=Ùx¥T2|ïKéô㌠í‚\ÊÜäaáröÈ™À¤½q³t?ùi/½´7`Ú‹/Ð_|…ÞyõxÎPºßŠh¯¼~6’ßË+x%_Å—ñu|W´ÌhÖŸ9za/)’Y¦I^%²Ù $e(yÇFá()OŒ”}Êíp;›Œ“¥|¥ŠÙ,œ%Í%r²° -¬ §’ä•°’Uc5ŃUr=Ô³õ|n6ˆõòñœÜ¤¼ª|¬ø•¦ji/U®ÝÍî~]½ë²TÐ>w}ßÈ)D#Å€Dé IÖS[\xPŒâ´Å9Üc“4ÍÈÔtÑ«eôtîsšƒœÏ»x¯*_/ǺZ­Áé¹ÈÌTs/dR:‘™qU -Ñ#ÐÔǤÝТ±+§PMzZ±»izJ2ûîªü¢+ÇؘšZ2]Ë5¸F¯4šèõP|›Ï™aJh°[R µÈc{]¡WÍ%ês)¤ðŽ*{øáÐ=öõfhL£ö‚ª¿ËˤÔÀOIq-%Ç=5þ{’‰bFWit€Ò^jÑ(ÿ®¥E˺h<ð¢F4ÛûegžÖIã_pXå#›¢8$—}l¨F_€<:ÊÖž7K”Â9Í­A\#LÕ©bºè~˜ˆñÑZÔWr1-‹Š«²1]Br;ížý(6‡§ç…õQz;"=J¯Þfˆ••Äs|òØþWu$S+Ûuq…EÆ&<Ÿè¤¬²ßáÞ{°>Ԕا…ëÌL2Î6G[&ýN¹ó4ä èU×™÷¢ [Z -©ïQ)ãVÐQßÌ÷jâì<{$iÒ±NybTHŠ&Ì.áv±Æ»d«s— ã|¡©yAŠ#4Ü­8Ì%+q‘æØ„±)=8ÓÓÕ <Êû|œ“WÙ’×{Lq­Á½b,]Êý{~è±íjñÿ èiϳè䣛‡=Ï¥ûl(e‚)ÚW†$3±’¡wH«3¥V ÎAayuìÑ/õ¨ gã:ë2¸Y1Ü¥PK`>Ì‚™P À ©0tÀ ™A˜Eµi4 ÃhÌ(§ß|˜…0úRï(˜KãûSm(ÜGè…Ûº×*×[3è:ƒæ,¢²ˆFZþ…]sºw@;-¢½´¯Ì¥Ñ…4çßÛq8Õî¥y·ÃB¡}a©P_m†>£PçÈK«Ì¥²ŒÆL£ugÑ8/Í/¥Ý õ{?\g¼¾J9QDÏq0›zµ]Ëõ/<ÍÕyéOòpÕ¬®9øØ‚ÿ÷t²ÿèDûýúHý[OïW•Öè×󛫺¯Ú[÷ Ö¾Få ŒæIù»*IóI9•JíëŒN¯/•ý d“ÄÑ9œÊ<:Sc`,•ãHš &Âd`!{B~N;hûYhN.ðáyc'€ý¾Âs!\ÿâè_µêªi#ÙìóçÝãú•8ãŸh#‘ã¦ùiœôÐ+cþ¡D’»*þcúØa ]? ü´RÇÝ£>ì*ý«¯,¸÷? þ´NZj;Ûj7õ±©çÕÿ‚ÿ€ÿ…½'õr[ñÛ®¾B‰ý¿­ö¿4îG$ÝÉï=uÿkÿ-‚’ÿ½3õ/õÿAi”&Õnm:ÙsEÿ1῱<#­vÕ%Ñô&{Ñ,l$YÖ8¸•lJ³(vºŸH#“9K&ÛÕlSÒ­RÐœlòÓ9„&š;’¬f¡™ÖG6x+¡•Öºì"a­9™ÖÔ¬4•ü_¢i7ÑY7u^å«FȺýþPD"Z¬DCÕìĵª9Á¥×Ct?JO­ß±v[÷Î/œµ…óçÌ…Úió gAíô¹åT–̘Oå’ù÷AíÌ¥TŸ9Æl¨-)œKcJfL£žÙ…s ¡ö¾ÂR¯V’úéœÂ%P;w¶ÖS:³pÔÎ_8—F.(ž;“ÊmýñSú‰Ý7kfáU¾J‚€¯bºwTHN6â% -â!•|!ÒYܲO¿Ž y‰ä}KÈ^*džì¡Ró¡L/5ž?/ rm`úHÛŠ/§í (ƒ>ØZ«÷„®6+é¬OüçÉì´î¢>N‹7ÚX=îtÕ{¬qUÿ”íùWêü:€ïµX”Û=5•¸´ÑŠÿ„Û ¢ -endstream -endobj -1005 0 obj -<< -/Length1 7456 -/Filter /FlateDecode -/Length 4548 ->> -stream -xœíY{|SUž?çÜ4iB_i´<Ó„¦PúÊmúnš6iÞiK“ÒGÒ–ôݦïj¡-å!«Âˆ2«¢¬òЮðQœEÅññÑÏ(³‹£   ãÌŒã¨ËÌ: -ÍÍþÎMúBÖýwïí¹çžsçü~ç{~¯“"ŒZ€Æƒ4†Ò»n£uBKÎAï -ƒ½¼p¹Qáö·ÐN)±'+«#-a#´×7tº{Èr¡ Ðnéjîd¢å"y±µÉÝ#xå|; %½:‚eÌ0^mykçÀ=Çn…} íq„˜ÆŽîwìžø…0ß}ÐwªÓ}O¶¡x§òt¹;›dò,¡ÅQÐ÷DOwÿ€ïe¤ùž§ß]‹ ÷6|)¬[”ûŸˆaþ=èâ3ÿz†ÖŸþM…ïwƒ9Ã<M"ÈÁ8A w5 -„¾k(˜9ÃÏ4ûºÄ÷\Bi€Ó]0CY†„ЫåÛÆŽBAÐx€TBŸÅ_ãZ¤äÑ¢ŸÐ ¿™ËäЗ _ôúIÿ -„~N¿99ͯL€ÿ>køü@-G2t‡ ¿ƒ: Hñu”GŽ¡ -ôŽ# -”~‹ÖàËHEkPÉG,±¡T²ÅCŸ‰l†‹¤då’ȄΣ5Ss’QÓlä0Ð5!#@ ä-d#Ùð÷ОíSȆ¾ƒBé* ÿy诚סŽ€ïZ¨£ ^}”E–¢Xò4 ö ŠfÎ! ?Έ"¡? E÷òk:Šºøþ+¨ c´ Pl¤Ž¯HJÀ&$áßÇxþjô½ïaü²„@;Æÿ8 Ã ž‡’qŠ~#IE ˜4´†B õ»hÏ[Æïòÿ_ÿ‹/°+­ 0P¢à‰ùZ€Z¡ŽFaÐ#KŒ;ÊÛ¨@NTƒ6¡aŸ!¾?ú UAí÷}ñãûGžåNWä¬;£°Ÿ£ýè$zýMbvã|ÿ O#»ùû`à>Mn0+-SÅt2‡˜ÓÌ»pÎ|+ÈÁ€à¸à£ q"ÈT´î½AGƒ&à~î AW…1ÂRáfáIá5EÑ}¢çDïˆ>  ^ì ~8øÝà+!KCrBjCzB 9ò!ÜŸýŸ»¿m‘‘rŒ˜% "Ø6‘LÁBšŸ¿à -fÉ»pÁŽwøôøÌ´‰¨Ò"2X±ˆ£"$bÙOo[]O¯§¥Î…cÇãwHwéÀ~îz{Œ”ÂÈjÿH‰*=B•F*6:BED)-žÞžº¶^ÏúÓ!í8fÿ¬h qsçsŸÖÒ“‡[ñ8ù…CC"’ˆY†H‘¡È€”x»|×0Ë¢!Å®]+‡Ã¬áä©‚ì,måcUé²3µUûöÁ¨›”“N4ŸzA±L%S±*VÌ’òóå}T~.^´]º}œ¯C£Ôz2Y䱞<Ó(÷7ŠÀ>²±ÿ?x]üšJ¶ÆwAé¬Ñqª´tV-ŽÊJåò˜»e²»…ò˜9-”Vå[‡A¼†y1(>>Ä}]Ùçn *©½ªá¡‚UÎG‹Š˜š*6N%‹“Å -…â¨èhV™ž®R÷ìÞÕÓ³kw~RbÐê ‰A§5HÈÒ7Þ8~âÍ7OT ™ÍCÕ›ÌæMÕÀ7ìðõ lGªØpYxÜ«.2f÷&B¤ÀˆEÁ$Šür¤†¥œD²ôw¡H*–ª^x¨!_¯³0•‚±¦–¡†Ñz\É-?±}OQ¥Üг©¯Ñþä`‰µ€®1Õw‹„‘ÏQB`t‘˜¯èR,¿ÊðOOŸâ§kÖ5°†¬kZ«©ý¾àJ‘C¯756IîrÕiÔVQjMu¨ÔÕ¡AaµÖ,gZws®Õ”m)´âµJ£Iü ³"•ä,š‡BaçT˜ gÅt§#±4×u66V è6*Â×9yÉ¡Cø,·Êl‚œ"‹|ža©8}JìÛä¥b†KÉ|î¤:ÍÞš˜Þ]Ö¶maU¨CSRZZ¬*‰X‡_$;®®XUÔ™gì+ì¨ÎÒÔ—³kð>òP“?Ê+a7`2É4ÄÀ&N&UFKd Á”¦øáWú«*±ÄSزY屶 $aTß3Ïñ¢5¹²Lo/µ‘Gï2-g¬WסqÄÝík‘Xk]…¹¸Š®J -[äšÙQm“ª¤ø÷¥ Çp£øc²Û;@¶Ó‘ëûŠä‚Ö-F -ÐAµxzç¢g$LKÏS -…3¢>›î±Z=êtµI³Ájí×ÕxQ©¾¨Ô^¨µÿ¾Öi³U»,øAGnzËV¤gWˆ#ë´n•Ê] ]q±°P©+Ê|«¨HS\¬Ñx¼|$ ô(†jo:e¤˜–c7Å´ -Qa^3©í%D\Ÿ«mËîÛÝ›è©iî vœ[ç°êíeÅ÷«·=‘Èf´[<Ûyjô™u]å{í‹«Òhª¤–Í[2䌱ÔË€¤¾æ8HÒ„.“N‚ü~ƒ5A!ÞïI0d³]°Ù¨õÞd+y ¨æ!´R*’E²‘2Ãà?sç2×O¶ÝZ_6:º?yÉk¹†×séŒt`™^1|þ€[>…ÿÊ)c‰ðWbŸË_™Þ¢ç&o•Ú Ž{\£×>vÍZª}êv+Í«Uå©d"¹T©^±2W¥Êõ^Ñdek¿£:‘à»IÞ#o¢¥Ô:)ŽÙ×’Á@Npp÷=«è\Úi5 ˜¬ðªx¶Ï}À…ßzÚÕÕ”¯Ó8ì#:m~c§óp3¬Ÿ®e¬eDúé•ÈÂÙ€äá,Þw´ªêhߥKÿôàž££d¢ü)çI;™ðîݳuÛ^ïe*!̂߆“øÓH15_ð?áRñ8Çá%ÜýxtÿÙò­…œ¶h/Ç~_(5ø6|ûà»ïœdÂü3÷|õ¯ú3òos— F!^HjÅãAj–v™L´Ú ¦æó¹/ñ`°ëQ—û`MÍAw÷1þ&O«)+Önj5ë×í±ÃÚ›Ÿvv5d'ÍÀ‘FD -……'ivrO:¸VjÀ¹ÜÛd‚û7¬ Œ@ã0"B$P;) /3KÍ£ ‡~"ÌbŒßå>‡™Vôsoã|¬æÞ„©^ÃZîiî™ÿcÀÏCX%ÿ;wÒi6C—ÿ+ç™~éC§Å˜ s^×üÑYéIð”×JÞIä½ïo“Ü©uõžÎR/ gI¯“Û ²t9I‚÷<9íýY Zàûü°^„–ÃI4n¶3Êøø2³8ž‡µþ Ëu°žb>`6PäEΧ)ªÎÃ--‡%ºQ»c„W·Q]@Ï–óÈDzTÅdÔ\ÄBÐ3ªfdùà¦ÎÏ7nþ…ñŸwîÄösWÈD_õ–¼­>ÄK8Ln€„‘Ôâ‚ÂY»Ï›œ¢ì”¨dx«rO‰Zi{Þû(È8-ïŽ] §Åm<˜t?8ª›9 ï*w!= J™€¸<«Hçš@Át,5 ÊGõ…ójÓñã X1÷á¸ØM9%Áãk¿ÇÉ ‰ªâ'°ƒÓà2î|º¤ÄHbKŒ@y/d»Yí0¢¾ gÕÕbŽX&3¬‚õt¶. ‰õÓÉhb¦bqì) :me~m¡m¾dÄ÷1õ|Ôñ~çpÐ/á ýuf!ï9Ä -Õõóäa]_‰_¿ÿA*H"XGì´—ç'`{2™ 4Ûc\®Åƒi£ŸS–³¬C©t°l¹·nÑ«“½—›SòÛìy®Ô—:¿&5µ†&«È¼†ÈÕ)^³'ºèpÁm¼Þî(2oÔCƒg1øŽ`E¹•+)«oÔú-û6£:¥‰\å>îp¥¤Öä©)¯|ìúaa]‹o‹]þ4d&r醊›¶‹ë®Í-^¿¾8·tQ}ôŽ†â!]J}…2ÛSßБ™æhÒ­›Fëê´Â-³¦k) Õn0 Þ­œë]Ò’ú#¸ü¼ -`wÑL‰¤sCî” J"4Õ”’†35sJÂ`õÅ›õºÍ¥Å÷Ô&•¤¹E¸‡.]ëÌH*iÐo-/+Ò Z Ee1µ€k ™ä3¿y²4kV?¬éw um¹©ýø§À—, -W¹59]Áëwƒ×å(™Æpª7só`Õ,a£oƒoôĸ4ƒ%…V/ª-´Ôù!‚Ý>;$’HêœeCas¥2¯¶¼?EP9¶è/ÏFËu2ag¢ü٬ßèñÁØãýYÕec¹Ó¹¸.‡$©Ú­ ÓË*ª×q€ÝXä?S¡—É“rÛÀ±JóÔNikœddê Vå½Là´F|׸Iô -?R2wd$€”÷h2YL ”D³A·|Ö<Þ&m™œ<>•ÕÜ‚µÐhî·Œ Í·\p:?Ü© sãHlû÷ ÷×™¼àꬼàªw ´ýQü IšÊg£2ÿ COÌŠÆìêµEÿ¤œEí1’ö‚Yx9×q¿ª‰¼$!I›­AÓ;äÏç~Ì¿:<… õÍ‚_^Ì£O5¾ô‰Ï¢:øfÄ`-.5YÆŠSשÒ©J»2µ,5ôÛ±µ¨h¬¼|«¾4ÉUXèJLtj]‰¼â&Á%ÞÉñrÞîÞòtRïYò#ôu¾ßå's1ñMs<µŽÉ;zÖðŸðÏÝ.WL‡Ñx'ÏšŸÔ8y·%in÷~©ìçó«Ëbý°ÿªJs×ã ÷Í´Ú#Üɾ@œHÏÜs2‚ÿ.!P€Î5f3µ‚¢Ì´\6Ï–¡tå8{N&_•š-S%ç˜UXéÌ I°)W¥%Éä²ð0ijµ~•«4!muìb™84l¹Z™h\üc@ yn:ÖSq!Æ~`¿»Z[fµ Î=àq^‹—Úô¥XkyàšÃ}߃W—S+Ç3^—¦ -þœ°Î˜šLMs¨šÉAäÞËkW'ƒêâîýµ k8‘"°€ÿÿ‚œæ -+#YÈX|÷³î íêøoÐ< £€·©,A6•%(ŽÕîØQ{¼fô¾š{‡)ü"g#r. ŸåXü:(<À6ènHp²cXIËDb϶‘º“'[¶ ×=òìY†£ÞŸûî/¼LGVŸ¿Dò‰ÅJî—µWšŽ?Kä“ã`²ŒÓáWvÐ<´sòŠ‡q(· Ïã¾Ç½‹ï1›²Ñ÷(zYL=ƒâu§³¹ú­Øˆ?Áð¿-Ñ >ázñ#ô` -ü«é/À˜æ¦ïòÑÃwïÏÞ”‹ÎÞhºxBóð]w!Z†c‘u£4„úPjA­h¢š¥ðer@OÔ¥> -stream -xœí} xEÖh-]½Ý=wIn¶{/á&„5 ËpÅ°#DDd $@ÂN"$"@p„ˆ²"FŒÀ" h\Ø@GÑ_PÇ ÈøP1$•wªoufþï{ÿ÷Þ÷¾{]Ý]]]uêìUI„BQPHÈß«×;—­x¡W‡Am|ïìž½<Éž6p_÷ã{ç ºÛ›÷Cˆ è}÷==ο»/ˆÐ®æðüÊ »Û¥OknžÞ÷CÇMË/¾úS|B9ïÃýšq÷—ø÷z{¡á»"C -‹'LI¦\Fè®ñð¼bBþÌb¤¢WÀ½yÂÔÙ…¹öÙ/ ´ÆoõÚÄ‚üñžÎ*è¿5<Ïœ¶ïbçýx¿ùÄi%Œ·&äAßp;ðý©EãòOn=”ƒÐ(3B)…Óò(ö¾A–Cû…ÐÀ?=ZAkóí@ï+ÐæÅE3KêÏ 0¾èß_<£ xnþ†¯lGHy ^‘Ñ»ÿð]›¢1¶®? Là“‹Ï?.Οm8vo}5OP—Ë.h«d€÷”i<!õR}uý[êr£§&àÜ.j LCÔ¨ ÈŽBÐbI ܇´‚ìE j:°Õp›>ÓP!‰‚L*¥²Dˆ$Ú†šôSØs<ò#ÿ5,»¸ —+Óð—y××׋§Ò1TØØ’BÿèT Ǧ›ê£"ª£H5Pö Ç×pl€c£àxŽ²†ûypL¦Ð…ßCntÙ‹ö²s¨PÞçYhoÓç¤&|/w€gÐNùí•·‡ëØÙ†g©ðìm´œ•"½±Oõ$êf´9R_ýkãJ gVˆ†±=¨BÚoœG±ihƒRŒëí¨‚ìGF»Ááku(Ú*êYYø=ÑŽ~ï¿ ó<‰âàÙ:Ö ù”ñ¨KE>¸öJ[ШÍéD ˆ@"D ˆ@"D ˆ@"D ˆ@"D ˆ@"D ˆ@"D ˆ@"D ˆ@"D ˆ@"D ødñ=¶K¨)j5pFáþ‰¯ç¹ ÄÆYBâ;‰È5VäG©¨3ê‰ú¢( A÷¢áh š„¼†oáùQ ÔÝÏûÃóÁh¨ñ<MÏë¿ü-ŒyùÖ¯ùÝ -»™I”`ÔÚo¯$Á¾ã+Cw ó¿?<Цõ-·~»â¯D9•–ÙþÝõõ9ä86¼’ÅWÒ Z)“¾ø­‡_´iÝ?g˜7nÑ3»¡ÛžyÙPy÷0¸wP õ=³gbÔJ„}ó*ýã&úÛ'u^l/èÜæöGÈ|œŒ8¢8ˆP6ÇàÃÍQ Ü%!”ÍêšíÄ5Å~ã¹½e"e‚ñ4y¡Œ)PkÔx2Æ(£Òc”nì)1ì6îÄ5ÅNã:Ê(mØŠæÁs›q'®)¶`3zê,F@6cHŽO(”ó¡Î„u” uâ …2u¢†bÍxS5J™R¼!o¦-»Ý‰ec^Ì(%£5fDŒl”(T?ÖÿŽrNk¯µfµœ^kMk8ýùjoöóš@¸èáCo°Ãœz?—zƒš/½ª/ÈÞϥ÷‚ô]NßO«–ÙY§oÇÓ·8=Èé7;³5ôÍ—ãØ›éþ}±l:Ý·×ÁöÅÒ½oØØ^}c™½a£{ÌôuìuNwsºËM_‹¢æt'§;8ÝM_õÒJ}úy¥†nƒÓ¶ú2´9ŽVÀ©b}‰Ó­ÉôEN·pú§›9ý“N7qºqƒ•mätƒ•nIëQëkè:xe]"] §µ5ôy˜üóñô9N×<û[Ãé³å¹ìÙ7è³ó¥ò¥AVžKËCÒjNWv¬âô™¶t%¼¸21TOWÀ«+üôi3]UËûÓ?Âéœ>|xÊC—ÙéÒ ý§K8}’Ó'8]Ìé"N>d 9}È€*„Zq®ÀCP5< -–ÅCàl„hm$/¢¯ÙÛø2Ë"Yh˜4Mê&m—–¶C‹R©PzUB™E>ÖHs¤ãÒ4LP†ˆCÐÊq?ÈÊI9ÎÆ^œMŽ¡ƒHÐß—ã.ì;‚N£Ó8ZV YDÇïáïq;< o‡·~D?bÜe |  ¯BÐaLGåh)ä«`†Ç€î è{4S‚^ÑRvš´b§ÑÛè ô‘ñáÉXd† ´ ; xmA“3_`ÂNË.% ’«¨/ ›ÉUœ„ `ö7GÓcRžôž´žw0¡¨ö€r”hÁNãr â ¹φvçÀ8Õäm²æ¸…yÁèd™CÊÑY¼ ïŠzo“ò”±R*—Ë¥aè’à ú€~äüx=!·G?J2ºLàžÑuÉù¢‹E0‚Œ`#ÁF0‚Œ`#ÁF0‚Œ`#ÁF0‚Œ`#ÁF0‚Œ`#ø?€ã\ûÝ’»Ô}!„Q%ÿžJr² _Ȇ6)­ -–TdrHv«½¶¶*=*+«=²×V§á@2ÉèÕ) ·+ŠJü£Õ\¾ -§ÎŸ_Æ¿ÿ ï;süá"ïrö,ï,zÞÄ¿'WžãC´IÞhµ(ºCFÔj?U•^ÝØ­33*£#I x¢Ü.¢lš€SW-ÿãjþý%üîÙ³ø‹?ðîgÎð;~½á½äKrQµ‹¼„¶JIÐôuú -8E¤¤îIrŽŸ­?@ˆdáÐÚ± m!˜ §ƒ¶GíÂ?Àù*¼€Ï9S߃T³ÓÐÖ¹‹ %A˜¶«2ȼr4 wÀIÄúYÝ?ϲÓ?O¿:¶þKÖŽ]F&’BN­ÂF+Ükl«bÇ-{¢\10’Ë~þJµýR¶''5“vO‡ôLlG?r%Ý6iîÜÉ“çΙŒæø'üc~‡p -NÆ!Rc.\àßð ß|ƒcø> /Ç3q ^Χ‰ù}“€fµ¹é6‰lcK´MScäXŠb6oª«Â3N¿R}ʘ6saîŽÀe<„oÄ#ñt<äZ5Öé;}°ÜçZÿzÞ€tfƒž¥¢‰IÑØ“À˜d1ȺÌfªˆZ#¡WHŒ›!«êqã8+õÚ?í_i2ìuDëÜ6¼ªöTµ#+Ë‘u}t¸Kë÷0Ån½èˆÎRììâðf8”L¢[zZFSŠ¬Ñ,&:::¦jÝ,&eDgÄô@ýX¯è^1¶\”‹Ý833££à¥âÈÌìà—Ü.Y!ÉS×Þ&¾½–”ŽøðÁßó±§>tÇñ 8Ñã¡ìIóï€û´jS}òÁ“¯Â Õ)]‚¶@B­»Â©­Ô_µTÈþ•¾Wã+œ•IkäU©§×…ì^O²ÝC}.Ÿ_KLµ×ž†žªŽÊr„mãü•óµ aþÃ%û¥¬4ìñ¸]R YrŠÃ#D-HMÊh¸hJ3ÝóÌs¼‚ï™ùõ}SOOX½ñ…åžúÃâ‡r÷žñùTœ„‹i0åàŠÏ¾qjf§Éã -']™;ttËTë÷¿y`Á  …£@:€°³;B~°P -Pj "jR¶1L—hج£XY•Ì.0éS]«ªÓ ‘œ?ÕµÌ;,ébƒ4p€IBAä{>oáŠÓ§ùÓu“¥UuKé¶ÚÁüïü2¶ã~ÀÅçÁ -ŒŸ€º…šIJÂŠØ -žұÂU¡l·WÐ˪DÚ áhîCöDû§À»*û¥«øJ0Ÿ"„5ºkÛ…næ0ícº¯îþÖÃÓ°§ñ?óOÊ~žóà™ü'ׯòî½SÙi~ák³…wå{~©}:n׫עÒû¶j#¬´ èKb—ÀJ›£N!ŸUxäŠxóJË -{E³5ñ«‚f-ÖKƒÎXo´¯yPXìyû¥*ƒ&OÈ~2ÌÍ -² Ë^ñVèh%^!U€.VØ×xVãƒJ¬35‹µ²¯ª­=žHU£9w -ëa'YNj†2:6Ê»Y2n¤&zlÔ–ÁÙå#.ð¯qVpsâ‹ùžIpYA!(Eaa»Z¼ÓÓ±é“âfü~¾Šÿ÷‘K üþ‘G~¿`P|È(å\ˆšV²í¶È  9U{-Ø«p¥ ‘Nà<‰?#)Ïã›!A/:Br -èW<B 2Sd™é ªÎd¦‰k’ Q ‡š@%ª'hº$Ñ .¡mª´D&º¦*L"i2…²ÝGqn•¡o]Ï ÏÖ9ÕÐ9%üÏÐÀë5­ÏÑÛéCõB½ •á2µL+Ñëkõ7žÓíQj¼æ3Õ–šßÜWêÅz«}´at¸4”Ý+O¤“¤B6AÎ3— 9øA©”ÍQK´EÒcì1u‘¶ZZÉV¨åÚkêëÚô~‡QÞRi£ñ‡äcå´ú‰ÖÎ4€ ¤R¯ºÍcø<’ŠT>¯n ^}Ûùevº¦ ’Áâov÷‚7]œS‘ùQN(…^·í—_]¢½##…F%šmZLœ¤PO¢Ùã¶+/ €æ¤ŸÑ-ZXB8*)]©ÎJ i¨™½Y»f9Í$œÛ 3IgãEC´I†cBÔÈÑ£Gžþ¯’Ò’Òÿ"}æ.äŸòë&=p']H—ç ¼ó.^U7sì¸ü|>›x›¿µäo§Øé½Ç§­¿Qú> -lÙ‹º„bÍv y¨b×6jߦ­¡«bmÌHnk‡¬®1-áUöwÂ4§íl7&ŽàÜ ¨z£S‹6¼È÷„ °Q“¿šÇŸàðN\:ï«ÉSNÌüKuõ_fž˜2¸Ómx=.À…xýmø‘¾Ùüê7_ó«Ù}A§r–ÁÓhÔ6äF´%ø€G%±6ö¶È£Ñp¦ÉA#çÒ¶çxÁaGƒ‡ÀÀžèp†(·H·ÅÕ?_½X÷^‰‡à;gM*,œô¯œ,m¯½ïÛsŸ}ƒ“òK -øÕ^ä?”ä‹\ è¾:L(-ä’ÈûÉ´D= c¦45b¬ªj”]ÚkvKŽ¥Øªßhm÷J¶ºdBÝj²éÚ=gù·pl ç›0éfä­w¡ƒC·oö¯´ é_i2#„B· ' ø5; ±Fþ÷BöW&t±¡ù>#¯{8äTÔè ~@’Uѧ)LªÅÁ'Dƒš õ0l7w¥]”´¿2’c¹J ,Hž¨ä™ËèJ™Rl~TzLÞªD§tÒEíAú«CÈp6L£æ‘B6M-&€¡•©‹Ùõ%Õ™kLìþ4’VøͺöÔËë¶ zëΑ@]·ÚKd@ÝΦ\f(:d–°‡"*ƒÒ‰YŸot]¢+ƒ×ëŒ÷¡%fô—Pš©¨ -ÉÄD'J4]Ùº®u…P¤3LLS)ÁL—ÛKz{z^6À0GªàêF\T¯{&ˆ6#>jĦÚ4q+>Õ§¹õV¤;éC‘Êý^2\®O$EJ‘¾‚,S—i/’J¥R•°9ª{©ÝÚigœAáí­U‡k9Ö‰x-P'kyÖGÕÅÚ3j x §àÈZ“ ~ -;ÿ?Í·\á[ørvºö ê«i%eמ¡Ák{xÈ~^hhn(AÉ –)+rPLþ Êd¬ö’³ÖóÎj˜uV“\N2æª`”ê¨ËÈä•oýq?y(.ç˜&à‰rži~M¶zI¬ò;ÒAé “)÷J!™¤˜ Ác!)ƒìmć§ñÁu_# ŨÖø«¼FŸ©#'jò˜·)¦mh‰æ´(Xµ·‘L*(¬+ì"-ÜXˆlGn,ŽO -$‰¬}/)à ¸=?Î¿ä¼ ?|ºøÁ‹AÕ¾ýG]]´Ÿ™6~üÔÏ‚ Ï¥ÇÅ’xo‚'–)ÑÑž ×£;a)$o3/‰Ö=Îj÷ÊH²€±GÛ5Åc¢ a3²Àq‡UGP–••Õ4©‚GÀ˘x¡7¾¸˜8oll\\l|¦;ÓÓÓÝÓ3Ô=Ô““Xà.ðä%Ú®»x/iôéóD;)97{Ò¤ÙxË;çÒeƒæ…>à…¯uºo4í>bBá0þ0ÿ±î;ýî‡OïoUö0†gXž½ xöôB¨% -J®‡nJôInü¶ä~;f›CÚ\ãXÕ"Q7ùâ絺o³öO««NUW‰ˆÔ°RÁ~áz J )NÅY Y‰Y¾,¿Ä~¾~þazn¨ÄѾÑþÉñE E‰E¾‰þ"ÿô@‰©Ä\b™ë›ëŸXizÆülb¹o¿<°Ù´Ù¼Ù²5akâVßVÿÖ@‹\ẓ’#ExEÔrz),â””pR˜.IGæ|;qñ#ÃK7ýüW~†Ÿüÿ¯¥K±iîC\¸âóãØ­s°Ä6óªN· ÈézGL ýèÞŸþ™™{¸sÈÀ^iÝ~îr¸y›lä=BV9ì|n×~Sí§úWêà„­†f†6VÅWªÓÓðövÃÉë,;x· ç~m ´=ܳ‘QÉhA(…ŠÕ0IÀ„‰"2’q4 -ó„üJø% 2ôS;—"" ‰˜ç¯{$jˆøI%‘Àdh4Ž¡1R4ó©~µ7êûÐ>ROÖO¾£KUG£KÁ/ÀOâ'ð‚ºx8ÒíÒÀpô膺\øR<-ÔON_Ê€dð¥z¦IÚµL Ü” ë -=SÓaeA(1Cs˜…9¨C¸‘…‹UÍ&ÈÃ_ 1)È"x¨ |Ù¿Ò$ -óv´Ñõ¦ÿºçýµy¥ºfîbvf׃º°3¸áά;ë §† MF³|}7yU¯ŒeDç¯iÌ$›=$†FK^æV]Z¬)ÖœBZЩƒ”ÒÜΚ ±#]Jgirš’¦¦kaþÝ­}i/©ë©õ3‰üpAï‘îaƒåÁÊ`u„v)×\„Šp™N'J•u¢6EŸnšd.2Ï¢³Ô´ûM˜*ª‹Ì»Èúš´›½ªî7÷¿.#ÝÄnø>pÜÏ„ƒàé|ÏæÿäWx6Hêm©›8À‡]{ -$V_ š{Îðd+B-nÖ/JT¤ -ɨ†~ÉD‘:3ê¬hò°QØ Q( ŠõŸi\•FB$‡äöéG‰¥AÜ’fàÎ4M¤é‚M´!p¸ðŸ € Á›ëÞ3¢5qÕ®«{‚” -½C5-õñº‡7æÙðÎîø{µm‹ñ ߉¿Mÿ>ZvAnn ÅÉëÍ'lh½{•ípÜƘ^Ú#*cÖ,±v#d¥_ §RÆÊ¥´ƒóEâÞdEJý Hâà7x5ŠfΞ=sæœ9súí,=ŽuþãñÒýx9.üz˺u[^\»öErzl.ßÅëwåŽÝä€L…¬2@V^XAÇ¢£ø”d=j9¥¯wHë£AD±J ru¹yMqå’ý kL\™XO܈b áh²º2ú.´ò…Vy&4äå{ù|+äF톽$u㟦§½òÜs¯¤·çg|>Xý¸;ùD¾1J¬ê8{˜WÑëÑ «c=;¡®²Æ©KBŠíaê"x%´E˜Âù+ç«íçoðÊÈl y -Z:¤{hSæmÛÂý¶—ç?býxÉŽ ‚w3fϦ{É°Ÿ«7Œ…ûb -Ø7·öàž8ÂzÍtIü|º#@î¿aí¨zŠ­5ãbÖF6¯ŠsÕmAÙÄbëoÐWÕdóDpî’X‰%tODºž[˜æG,¬yL¯}òæÉû.Î+ƒXu‚¿‚ûãfXÅÝø²Yyo' -zèŽl^Ögàh…;ó·–Î+.¤š‹Ý%ÀC'º+ogج®—ñZ´Ñ*ïЉSAŠÆ,–ž6“+¼¡Û7M½t­®íZU^äžO¯­¶_?#HÃ!6_™¯ ZpÑŽ¦I0•ÌtÉ»ºâtþ^¾}ûÑe×?:e¬GµëhFw½bÈ•÷bVi6HµêJŽ·Qä>ê9å]•æ ¶ìHZõ :A“ÍÈb ¹ý=ä.©AÐr>,eþÃ%‘ð€¨[æµlXÏ[7 åèŒ@x÷¦q{‘6Ù¨¢›AäÇøl>Vº½¨ÀK|浪q£wŽ¬ÜT]4÷™Åsçî; -ßQs ß>jÜæZÿžéàèÌŒòMTÞ´²|í¦+7+ÀŸG£QF(Æ"!¬Ÿ‰:á>lßhÅÄ‚z;,›],zÖܵè>-mgžw¾7¬žH“–cpR´‡EñU»»OÛâùÂtïzmú[‡ÈÖº¡Exõòé±I)/¯®ûXvÕm›{Éøâ"‚ -±›” -ÑY´CÚH‚ì7í&…´-O+ÖækÒ<¨Š1x¹”wmìâŸ6Ìk6ô¨£'C.c]ºml\˜Zýæ…éy±0ÍóR/Dh¯ÜEéKû*#h®k`„ÁÙõsµ°š­°FÝ öD“B©qî(MR_Vblgü'’èáÄñ`:®(³j‘û¸,Q}|q–{rxýÖ“ ¬§¶«ØêëÚõü•®çÅv¼C,@À†l¾”´”œ”â”ù)ËR^IQr±!w·¡A'àèx]/ÜÆsiOöÅóU÷XXDøªÐà Åp;±ÇKJ¶Óͧ]ú²n(éc‰5eËÚºOHŸ=S^|®îc)oÓ˜¼bÔ¨³0»[uvǯëìù¯³î£³Ï>Õ¨³@…PÙšTˆŸªµ 9åõQh½ùpÔª­‡míáîrËOÕ^ëäìîíí¤Mc5˜r£·„’œ5oÞ¬Ò¹sKAAzò7ø9þ÷¦s^Z¿þ%q`ÄßçÕ€ïãÛ° ð6AIÊF%"Ît %܈3‡­«ðgtGĘmšDeûù󷆚àuV4ÄcgBI”àI“¼ BôL7êvÊú¦&™v1º!Ҍڄ¯4…ikÈb@\ÞqŸÙV%ÙBò†&Q°‘¶&)CSž9›DCá'd„¼@Ëìë¡0ìWÑYQ¯®Õõ`Ø\âÏ?6h­Î9 gð8¬š¬ zÀô´õ°¶CÑe RíQÂ(œÂ(Tã…†'?G×!9|«EÓêv¹í¯Üê¹c^TË´ÇýêŸêj¥¼ÝÓ (ãN†\e,Œ›‚> …,fb5e&ú™¬¨“ôLŸ/1^5yŒë¨ûTÌZ‡´6xøÆÊùî¸Á°tÎivg YNUŸ¿yíüƒÈl¢¢oþ!¦µa‡@5‰‚Ñš¦éšÉd6Y4KŠ5ÇZb­1¶Öj[­­ÞÖÔÖÜÖ’êÏR»h]ô.¦ÎæΖþZ?½Ÿ©Ÿ¹e–y–eºGÛ£ï1í1ï±­²U±ªVͪ[L,ÝSǤjbÍÒdi-ýâ‡á¥µá¢g~8¦p\ÿüîعŸ_å5EçMù¢dÒä¾ÓºwàJí¸O Ϻœ–Ö!£U[“–´î¥;“’°½cÇÎYií,jâ†?m¯H|ynbÏC¶0-keª®wàêz¤«&h`ö(ëW“Îþ•QDYƒÕȪnd UÕWº -§'^LwÔÝ)>íDmv›#‡äÐwɣቊ@úÙÁSÌÉ„ƒtÀ÷ñ¥¿µ›;õêöíìyþV=âÁêÑ«§ðXlý(^^D–òŒð8H$°ùŒëDô*;Þ%ä´Y½Á§ÙcövÆçÓox´¸ù"su‚ö¹ˆàs˜¹×sÆäux"±:<½Á§‰qן§½uï$Å#ùŶϊKJ®XMR¯­Û`x5Œ qe^ GF'oÝ? 7휻iÿ`í¶0W|Ën¬èÄjn()$óÉ2²Öta<xðs/z‚ÈGu°'Ž§±R2jŽ[ÑT)uÄY4KJS{¡^"¶”§> ?ŽÒÇÙBy%Z‰WÓÕÒ -V.o¡¯á×ióû>½Ñ؃'ðÞ|–”W[CåkëÄìû@ÜL€Ù›ñïoÙèÞè(ö#:ŠýˆŽ¿¹qîW÷#ÄžÎÿ‰­ˆ¯Üº_Ï ,Mïml:ŒÑ§êeºÁ>¨ Ùú Ⱦӣ=Ä+(f—íÐM”æÒ=¦dÜœ´b©rKµ•ÖÜ4·³f  Ü‘taåÎJ'õ6swkoÞ~è­ö1§C¥¡êHmˆi¸yŒµäIcYžœ§ä©ãõ ]j¥6×AÐRµ£žfÉ&ý¥þj¶^dy Í'K¥EòRu¾þ ZAÊ¥Õr¹ºRA®$oJoªB¯ŽKÇÕúGè9'ýM>§žÐ¿FŸ“ï¤oäïÔÏõŸÑrgá ±!4Cjø=>Ϲð žç-üÑÚŸù£¤Iâ;ñ€ºsuñXþ¼°;/¬¨¢@n6œºÃ–€l`ef µŠßâ¹Õ Ù ˜›-hÕ‰!}­ú E;ì6«IS…G/ooZyg8(;øOpŸQÊþ–Ä Xª†¨6ÝpXbó©€”ÇÀe=m8­MœÖ©§#a2¦0ÕƒÝÌ-»•æ¬¹Ü\6vÍ”3•,k–­'ê‰ûÑ~ROÖSž@ -äÇÈcì1y¡e¡õ²«-«­[ÈVºUzÑú¢íÏx/Ý-Uj•ú›¦×-¯[ß'G,G¬‡l’ $ëºcoüO§N^ðpm ÄòÔÞûž=^<òîh°‹:•\½–ùÆŠtîï®BHê\×ТP¬ -A¨pyAˆ—;èz¦ -@²îÝ'ÛdpïGÓ×îyÓïràPöp2T™D -•Ùä~åe¹¢‚’«v ¼£°javS2MUÛ™²Ôî¦~êÓÔçÕWé>”XV¿¤Õª×˜ˆ[ü*JéuÛÉÀZXwDÊ«©+¯G5¤0¼' ‹=Ô+äDqšÅcMq•ÅË–@O_ÒbÁÉ×£GÖv=Ú…1ñþõ;YkIÙèV;baUi0X­œošØPÄN@FÇN™w×”jì t -o$&âòÂÂq”qilðB±Y•²ëqñÙîºw˜qÞ7hÜ;¸w(S+ðP=Œ5†UƒW“,ÈbÂe6Íâìév ‰m¤H7¸rz4e]OÎêl­„6ºôv³ ÚÙ/†·4BŽËqâ*!˜W—ŠS±ñ+h´éÇMŽÅ`¿wûw&œ?çðg*+Å^ÿ7ûךPýJÃ.ŒAµ…B†TZp¬í=!ò4P\Û@¯Ý©J6ÓzMZ‹6:´b{}÷Å äÖ}2‡¼”\Ð{ù×ÆÞ‹X˲Ô_î¾-jhi‰Ú¢¡!¯ÕÛÊ’f÷´.C‰°p•ùdKóžÍ’‡´kÂÇ+b'H(‚;Ö—´¾íÙæ  -­,-AšïˆIˆÕ­ÐCþ>$ݬâ"nV‹þ a®Ò&š!¿U?ù|CCŒ½ 1CÁíTtg(:Æaie·–¡˜§,Q¶$õ ‡´l:»êZ1·¨ØÄfë“¢@ÉS7F+I;ìñþƉýºšrø·ŠÞ ¸3ókº.äô«ên€‚Fˆ¯ËK†qšñ½yq‘îÂש¸WÃ5E~<°áZjrÍP žÞp-£Düº¡b4Í@“Ð4•_£\ó£t”Ø®ÆB ?êmJÐL8f ”¦¡ÖPÛM‡ömáêv4Ð_ïk¦qWçxç~(ÇCKý?5óú¨C`¤ûa¬ÉðÎth-èȇwþ{#fÃÕdxo(*…ã m¾Ñ[ñF¾1#?ô2Êbh3úíüð~Œžo<»µŸ»^fEEÐ~üo<õ_>Ô j&ôUdŒ”´u@nz¯ñ­6×ß -ÿïõ-øué#R_o´4þW€O/Zjœ/>ÿøõ³xb¾þ†Z‹¼ÍuÙQ”ÍAäÚʶ¨=”1Ê*1ÊB¡ì -ˆºPf£PD¹;_v¾ -½Š1tx·+"Ù½ AÖ©ù%ÓQ 衘øÿ¯DK<¥`Æt =L5†gÄ8Ãl臢¥$IsÁcFß<]~²~Jý&~ò7¿+ 5|Y¶>¿¾´~S}×_6©ß>n©}¹~Yý²Ñs»&cü{øE›ú)¿Ý¸~`ÃyÓ-õŸþ¢œws þ2ÿª>Ÿü~KÅ{|!”Ù7Õúå(×i¾Ny˜šßâÉÍ´ÞJù¯?Éó›nò«ü2¿l\]®÷‰úòÕ[¿øU_éM£,‡ 7LÕ )BËáõo¡éºœëw]Ÿc#%/׬ïÚT ‡Â\j(ÿ…¼~ ê -nþK-úO{:t£l -üÓ_¶ý½ ÿoµž÷ïÛ4iýïÛ4[¶ƒ— ‚n¥€—hÞ%¼}'÷t"þ—”{Ðpðt£ ”%V–৤›úa¿Â À¡Bö­ÃÙdx7Ë-cZ¯_Ù®_Ùojáh8G!'Ÿ¤&È-ì0²€gL -šJ†Wa@q&PÐ P -³€‚΀šáE”ÈZzšQ@ xÉ@Ç @ħÁÐ÷=€ðøCaTñ…k'Ìy8Œ=Ð s4„}éó¨¹ _ú`þŒü±hYþŒiÓѲ±3ò'¡eãò§Ï„rbÁ (gϘŠ–M((‚ë 3 -¦ eó§C›‰c¡fJþô|´lj~‘_”à“™–_2-›>EÔMÈŸ†–Í(-K -§O€r¢èÿ7ü¶!Ë©“&äßä»%öݸ#Î æïBñ¨j±‚l9+óç+À×AÎmPp¾ e_x£¾ÿÜþY -endstream -endobj -1007 0 obj -<< -/Length1 17024 -/Filter /FlateDecode -/Length 12118 ->> -stream -xœÝ|yxTŶo {êÝÝé!ÝéÎÔI§é$B&’¦4aÂ<…yTD8Ü0ˆ`B%r1‘ƒxB!r%ÎÈáŠÑë ˆÐ)ުݼë{ïûÞïû^ojïª=T­µjÕZ¿µö#„¬°Pl~þÈÁOMÝûÚKKo°ÿÒ`'¡´õÏÛ§ƒ÷ñúÇPFï]Âï ^+žK²%@¿vÞìŒ.Ð'ÛÆ{ðXŒÞF'Ð -ØNhå:ŒšQ5šõ ¨mÀsPZ -®uƒ@~è"ÌÁEP< -Å{¬ÔŽ!š6H( ahš„VÞ¹Ãu õFÑphO¹sçÎW¿o÷kÈ›²$ -”`Ô)Ö¼Ÿx Šöû*Œ}wŒ;¹Ó}ÍX³» Ûo\[wçΰB!R³_ŒÚO½Ê~Áë¹üG/'w8¬0¶;úö vÛwr89¢ª¼§á|ß>Ú5>ê~Ñ ÿ -&ï6+öIó“žnOš§wK>DVcû­ÄÞQØŽ*…ýj$`bPÕöVd…½E«›µ½ m‡}ˆV7ø¡ŸØÛ‹h%´ È {=J‡½ªõ§ÓîR@¬ËZ]Ò §Ú¢Á¾1Œ2F[WR?£·½•N;Bo®¤¿Þ(eô×cÂëcÄeôÆjázK¼x} ½îZâé¿Iÿ}‹þ’Bÿ‹ÑŸý)^³Ñ+h3ØÌhsÝó¾;Âýè÷W‹Äï+èÕ"ú£ß~)~Ëè7‘ôkF¯Ì¥_1úŸGèå…‹—oÑ…ÓKôKF/2úÅçvñ F?·ÓÏ*觟ØÅOýd£^üÄN?^I?êF› ÑÔ^`ôÃTñCF?PéyFßgôÜ“ñ\ýg=Ëè{´±Ô+62z†ÑÓ+黌žbôFOn7Š Œž`ô8£o3z ú;f£G ´þGÄzFÿñÖñGè?V oñŠoM où„#^z˜ÑC´®¼·ø&£µp¨½E߀¾2úz=PDÿB÷[ékŒîc¾Vú*£{ý›•Ö0úÊžñ•tº'„¾¼Û"¾œHw[èK/&‹/­¤/&Ó¿2º‹Ñ­Þ.VÑÏ›Åáôy3}N¥;}y–ÑíFZµ­³XÅè¶Î´Ư¬ Ï+}të™#ô™ÕÂÖ§¼âÖ t«OØÂèÓŒn†öæ#ô)/-a”÷¦›€ÛM6ºQOËàDY-¡•z铺ÑõŒ–0º®Ø"®c´ØBÿƒÑµŒþÅ’'þe]Ãèê'èª?¯W1úç•t¥‹þ‰Ñ!t9£K}œÑ%Ä%&º¤#ßgÂcúØ1a±•.ö 2ú£‹]¸`„¸°‚.˜Ÿ(.Aç'ÒyŒÎM§sNgÝ¢3ÐŒNg´ˆÑiS]â4F§"³8ÕE§0:™ÑIŒN«'†Ð Etü»t4ÆÙèX=.´ÑÑŒŽbôáÈpñát:’ÑŒgô¡•t£Cmt£ƒq²8˜ÑAGèÀD: À)ȦZÅ'íß×)ög´´úÑ|hå¡}´œè“M̳ˆZéƒuÄçÓ y½Mbž…æÕ­Þ¾±·‰ö®ÃÇ åË5ˆ¾ê«Ã«¡•kЉ¹š[‡}¾"¡£=„ž·hF»'ÒnŒæ€€sŠh×´±ë@šÍhV²MÌb4s í’!vH3àÁh:ܘÎh\N‹ ©4j)NÚY&v>B“;…ŠÉ6š\Gø°Ì±S(íÄÉ­’ðŠIŒ>w>à¥I7±#£‰Œ&0o¢Þ°<ÑÛ—v0Q£q&“Ǩ;6Yt¯¤±É4f uÁÈ.F£ÙF1 ³N# gÔɨzpäÓ0{²–Gí6³hO¦63 …ûBmÔ -Ï[µç–zïƒWÀ˜ Ñ*G2z>«!£³¨¶-èE´Ꜳµ@ÿEt•nÛF®¢±P? XÍ 7$0nB7 §Ò“Ì€ûNBoÛÑv¼ÐÓb+gè²ØD’ ×ƒÀBSѱIÜÆåÇ&ñg¸‚P´T'ÙdpÁ嶿…ÓÈô!<¿¤ãé#ôs\,x„¥ô**'ˆNFsÐ9±I²¡rكʥx™0YÛVpþÈRa2®AW¡Ï©ô&´Ý@Ùc„’áâqG†pn‡¶/ì%3:KoÜ7†û ù4®¬¡mh<™’Ah!Í„Ñ¢âÆÀ†j`K7Ò -è_“Î =Ñ2—µ7@š i” cD‹×P1>t#y%Z,6qøx×/änìÅ{ÈÃdÙF¨…ö¤cé"ZLw -S…Â×bñ/âûR’4F:.GÉ=å™òFyŸüÒ¶WuX—¯[¥Û«ûPí U—ÃvYmÕOÐÿMÿ½ÁÛ£lL4Î7¾’òFÈMSºi„i¡é)Ø^2½dŽ0O5ï6_³äYVZþeuZYKBÅдÐ7C¯Ù°-¶½e§ö'ììWÃRÂ.8 -õNìœá\鼂´¨„Àœ@ü¢C1>-‘Ö¡õŠ@eL%¤š/ôhNÏÉIC)WüÍ©8ÃB=Ô’a÷¡Ñþ‚½±Qlj}„=‹§·Ö1Ъᴆ‚~–Q4¸!¼A€¾@$APÌš¿hNCæè1[<ÚFWí;¿:]ãEÓN$œëQ$ŠA|©Q¹Œ¢p»ìº²P“ÞbŒqEGEF8a¡V‹Ùb4¨:%À#$[¬ùÂ{Nn =zø{ð}Czs: H3B3h†Ý­O¨Š;Ó­ì¡dï¬ë³«g·°oGÞb—fUϾ1{ç,ÆpÇ‘ìN™…•ë#o$›‚w²)ÛÙ*6?ÏK²ïl=Å×õìCa,h‰„Œ(ùr”ÄHî輶³#{K;lŠI,wÙJC7áò·Ë,H”N"ÒK‘¡bblÎå0Q9Õ|ÁÑ£Ù‘îïÑlö_¹ü¼“ÞpíÆ5óµwn\³Xs,9«J2++³K|‚E’ì¶0`+>>!3,Ìa‰Ïì’•™á€†NZÂÂì6I&üiÑ—³–Ì¿P„gœžZÔ8íÝ3-ÂCw|ø…aÿüäê[¤B+š0ó<~NX4qTÑícà¾:w<Ø+à31µÏ ùáÑñjRŠÀŠ9¾}û?uü"7ÌÜ~°z\蔃FùR\ÙщqQ¦Hª{Ú÷tö–ħ;o6m¡O;£"“`&%Õ®GªÁ«vÑǨI†næ† Íþfó5v-‡³ÇgòðÍ€s‹ÆuçÙ–‘ιöÄIr—¬Œô0‡Æœ'.'`‡÷/“ºÙCÏ7hÈì’ºu¾Å;§.Y_Ëú{kG¿cöÐÁóæ <·¤®Ä·$99íðº’:œ;dÎÜÁƒçÍZr(µsÊc¹Å‡ßÄ“ñ®É_ æÎ’“—ô^w¨ŽG™9w¾N‚}|,Ç뾩3±š£!Äa4’;‘ÎIˆ Ó3ºdf‰iÙŒQ^¶A'aQ6¥(‰ÆÉi•Ö8··ÒUa­’(Ëu!;ÉíLŒ4¹…P%ÑêŽTŒæÈÎV{WóÍ þó;qÝÐÄêÁ¥÷Ε×>ú'\ -è‹Å‘“ -a£lùªíñG^ :&c®P \[ž 䆸*i -Å… Ú’m“5Yggee®Nˆ§øÅkš†Œ8<çöÍ“¥é©§^í½6¿ûʾSuË?îÝgß)Òc¦¥­çÓ*fÅæË /ü»ðëùù}°ñ½ ßõ²_Å>§ãÍï¸ÁÝל+øëøÊSN‡ÉaD˜˜i ©×¬‹õMŒÖ `W0*ܤ4h…ÔM B×°_èÉ -+¬š´=b”µJÈ©†ÀSéÍ®]fnÕ$b·Yžx’ÙÅšM—¯][\]¹uk¥d½Âºó5ëöÍ5|â_—pC3ô;úMhëWæýÊX¯ §`ÕC¿þæôßûͳÚmDödY3»<^ë³z—¬Í¬Ç¥Ë¬Gówø¯®àwx^h7 $ÞXÐ_'³QcÊÀ¡BŸ-†çTRaU *ÕIˆ  -7 z]¸Q²j&ú (Í(pqð3 ü´S±(Ê^Ž˜àõf‹– ‹WHbÛñŒ¶1ÛŸƒg°í9xØbY š`©EÕDÀ¡ÀиˆèZ%k_„{¯Â¢ü§Á½æZ´‹À¥IÑÜ™_õûq;|θ“'dkúôP0ìBÄEùííZ–¾bY½ÿÚQ±é·ùpg1¬öA0kzä@¬ú"èK:k¥ËPé¬pUu°»"%7ŠŒ3¹Ü1€èÇ ÆÜ|¥Ž®¥ú>JA)8…¤Ð!EL‘Rä%E—¢¦èsQ.Î%¹4WÈs¥\9WÉÕ媹ú¡h(J†ªCõ“Ð$<‰LR'éw¢x'Ù Hc§¸SÚ)ïTvêvª;õ¯¡×ðkä5úšðšøšôšüšòšî5õ5ýQt%GéQá¨xT:*UŽêŽªGõùDLp(:I˜$N’&É“”I:>ðuÔaž€5[°º¡qÄb¶f¤ƒ¿& ÚÞ£Á_ Îê:lhN×ÅKK7n*-ÝôÓõë?ýÔÒB®e–ÝuÈ ²ƒ½ÏN³3ì}œŠ³p6N­fO°5ì/ì ¼ÿ¯Âëaæn€çɇ™SQ¼ÏF+R)®—Q¥NñH. -ó¢‡)lðk“žÞ“êu[ÄLoWS‚»±}xØœå·FX2¨nÀ­¦¾"·A¯˜Û(ô¯#ŠòŠ’è  ŽH¯$‰yfËËÆJ[…€* 2««.Gœ™vˆ6ûa¤cÇÀÖ‡ky/`qÅ6SëHç…‘3³PvV›ŸÊÌy ÜæJ^Böù—ÁÎÌ¢ü-«Ç½»hæ©)Ÿcý˜¢®M555'qç^Ë+‡®Ü”÷à{iéWÿ1ùØc½yâm]ÌzQ? 7´Ò®–êv+¥˜ÒØÝQ•ž -©ÊþJÇ°PDmá®x³‹ÆÅØt1^ øB³E3Í š\99ÔÓÁý¦3È!EЧz2w®íDSeËöÃõ™ÍœñÎÔÝlÛ¾½tÇæucêg-ûGÁgXÜ@cN=óÏâ;œÎìR±ñ/U»—Ï_¼"1ñplìço¬x‘ûMˆ·„…0‡,kž/©QjÌCT/WŠ˜®×aƒŠ\Š ™ BÌ~?7rš‹»ÂkÖ _NƒˆOs7H#UÍ ‘K¬#þØýý©S§[KÄhÿô¬?ãE¶å’+É%ÃØѨ§/N£#*eK©y“­ÒH*Ñzc•\ã¢.äpa5™c\|Š‚+ùJPZ¬(åfËÙmè^±´Î‘–Ö†¤Ñ¾ÃföÕ¯KOxÊËoyù¡í »5l³ÙÄ®}ßÌ~Ž=›ž¶Wõ¯¤Ñfaœ¨Pç‘cÂ+Õ˜J³ú7”MBeX…¹ÊçBñÆ8YŠÂ¡1^nhüWšvÈûÚ¬AƒT¬9n¢È“'!r§‡á¸ Bé¥ÜMƒ½“Z³à“[.2ÿ/؃m¶²‹k¶n]³nýzñàao»Ä¾-šË~ý÷/Ž—àÍx9ÞÓ:ïð‹/þû«ûöƒDKa6¹-•P¦/\ôJ¨W…<äIEŠ‡bd ´As—)-Ím‹„—1q IØ]J÷¶~ÿ!QZ3ŦQ·ÖˆI<‡¿$2D³¹@Ùú¼NªL*]É•V°º ¯¤: pÙ;¸L:—=2ŽºLî˜T˜´fmÖ¸,ÚT·r@2w ÀÛ†søZ ê8zª$³J¶ÅW&7·¹пëÚ ·ÜPM÷¬Žß8°ÉˆµòÙ }~AëõyçEO«@÷ÝJÂÅl·S»ŸG€0},·Ýá¨RÕUZ×ãJõï1}xL¨BDâ -Ó£ÒtÈeMus zcÍ.6kÞ˜‡ùAãCÛ*^÷]&ÊíÆü´¿âù=?ýðôÚ5[Ù|øë›k×ny™Ý`¿±|rºõâŠOo 3X¯E+)ÚýΞ·…«n丷¬OhW8êì‹«¤Æ× Ì•º -Zšn@iRj'íw§6'p'|ˆ#è\8ÎËÊÒïÇ.³8GÛ5x@ͨ“ ' _)ÈìØWàEx®êØñ\OÀ»³ìŸì}×ó ±áA‰%úìR¥n=ª4IȤ“iº!Mv™S­@†ŸÇnñ€ñ¦gYÌñn%4@‹Û‚Þ9súš\„Gá>ì-VÃÎï¾ûã·o/SØV¶ðã30æo¥Á—4åíè “8rDë•Jáï*ui28ý ƒ6% í“ѾÞy9IoI6µ>JŽú—r/ž_Óú•†Á> -…гuð…{þæC붋è6ÀÃÝz®Ò…­ãÉôÖgyýkZ³µØä+aÌQ4êás‡G 0QuÏ<¹"Ã]”š.eº¸ŒxçÁÉbI£ÿÅŒY<™naØC³+¬ûpôĽÃª™tòäÑwœÞñS¼}ÅÀÁ¸/ä—™unp;Óvš5ŸñæÝ}¿ý5IW*Éß´^•€W1MTj@Žš[èq*©¡¿¹c€½gC#éØØØú1Ï'î E·’È©Ö.ÅÓЫ¤õ -BÕfG¨/“M]2ÊÖx$è”Cíôv1Bàé>M{²S8Çç°S ËÛ«jj„5(Hëi­×JŸ[ñê€ö²@½"JÑAUâE ÿN¸ùXÀ”ð Z³$íFC¸Ñ$‹a¢C‰ã•,’O&£•B]Y..SVèBYD‘ùM b')IŽWºÑÚOê'££ÅB©P­Ì¥Ëé²Ì Ì @ YÎÒ[Q-,|;—Ð,²­õyÿFÒübkpó1p³XËà:}MÍ°‹¦¡.’Yƒ)W²¶»?n$çýEbS0¾Ï-ƒç ¨Ø×Iˆ&SJTL°Žœ§Ê„"„¡³ -6UT%IHQ%”j ,Á64´ç”ÄÓü݆Á˜TŒ&ø:ˆŠªs`'u(N]<îHã•Žº,œC³”®º“ ›J!d uh}®-žQ—€‰¦#ìF»~ØVÈÍ[Ib‚ÿGzëÓ ÆÌ×VØ|_xxL xÊãd„ Å2±i²¥ªm&#@oÎ]‘‚À©t`>ƒñâ”;’x¹«<š‘9ò²\V,åãi4ž‰gIÜ ·°ó”b„ož¸ƒ˜rBlº!œ½•$œ½–l ¬×ñmy_¨®ÒD+í¦*'J7dIéÖL§FT€KÅm11@¶Ð»êtCÉöª’’ªí%þÚÚzãWë¯ä*.Àìö&«cßàp\À–³Õ ¯Ç%x5[ £s«¶D³£¡(ÉçÄ•f†×[ͪB$¦»ZK—a ¬ÈÀDja1¾Ë¹ùBô„Ë¿/{nÇF6¼… »sûû3bJë¹­ÅÅ[võùÅÿlÝñR9ÿ>F …hyŽ¯+8bªJ^*PÑ+4O -öJ„Tëõ‚h ÓIT¥BÕðtÁ’fS]†Ôè€Qä$Yr,Á fN(m>œ/½ sh9oçi±h;äæÃ?=0xÅ´·qõ ,½ÐúþÅÍ›*Ÿ"oÛîf³ð²&´n›¾ü`ë2¦õÚ_Ö­Ùô‡`îÐøz $DïuŸ‘UoLŒ+OÕ»blÝö²³Ò‚_G/ •Þ -KU¢KÕÇDÊ(>2'$Í&çÄ¥&òøÆß|…'²µ£Ýuþ·iXnLWEUF2¨/• 戣=ßêpüÏñxBW: £-ãM,ß=ÿ™9c7ý³/Ì]|vVUÍ’ÍóÞ /ªwíÞ£ø‘i³<δÞhúWròÇ}6¬XôxlxJ}õ»ÿ•¼§À<î‚y”Q”/D -“n௺‰üý–Bi7³ ða1KndI`]o5ñè £- ½žZ,ÝÑç0Q+°®ÒYeÆë]&—%€Euµë>Øl.ŠPXO6ž¥ä’3y“'B8§ññ[ ¦Øe£F?á6ÎääçÕÌ™]ó`ßn¤'Ýæ7ÌŸÞ½GîáãçÑþY_¿Û½[·î½NrJÀÛ´t¯#æ1(òJ€IYjˆ2‰ø Ô‘ISyˆà¤nîR7åÇ6è8&ÎËñÎ ³ð¤ólàu6ð|˜†©)øuŸ¶ 貯xªTUõ*˜'½Ö„ ÐBaE‘‰—2`/2ä©àx*µU Þ>)ÓË(%ø:ËߣÝÎÞK5s+së«p{æÔq%šCc„•gó’TžH쪎%cE½CO€`ü1QIÒyõñ†LÒf -ÝÄîJ7]}–a$‰Ç’B:Z%Ž“ÆÉÕѺBýÃLe–a}\X¦{\ïÅ´d„†òÔC©çdy͇{ËO^:Úxæ(ØÂ>4Îÿ…P+‰.õó5e¹Ôk÷ß@ä¡€$ôüÐæ}!>òjx‘(Ñ#=éóôà—0ë:IÒÌ,t—RPw•ûæ+þ+–û|³ù~ Ý?…² wL]¢ wŠ 8‘vãõ…ú'È2q©^ÏßBš“b#Šâ$Å«ÏŸ>F)ÔO'‹‰™;+ðΚƒ†£>p9äSÖ_ú”=Í–|†[À]%­yþ«dmëJêàºÑß(hŒ¯óý¼*Há¼*yÜ}P ¢€e$ô]¨‡¬ÓÖ^0Vû_*g€,XšÞñ<<÷Sææ€a>Ùâ?Ý:•<Tì*6k^³¯/J df@'󞙩Áãc!IÜk„´´Ãì{Ò3tŒLx¦†.ì>@Oû[`Þõä×Ö±iûí…5Û…Í<_ŽýB—J6°*.ŸI¨•Þ$µè €Â´'¥ýZ(í×’n»Ç’awãsxÏÏ?³BÉVþ›¿üþÜ<Ö A÷åæùdx©µÞÿ#OÎK[øÈcadÒ62­ÅoŠ|dÔS"ü…tƒÐF¶¸3ŒfR -þY²Ýü²\øÈÚWÃŒçúMo :þIÊ{Á7 Àµpþv -›?l -fê< -K ¾ÀŠGÄœ&Õ:å2«»4öhtY‡zk•ÓˆBxˆ*úÄ -’½×æî&ÒoŽR®´ø[‚y*KŽ6穾èÔ˜ÔØTwj\5ªÆÕ¤Z­Öï -«vT;«Ã«#B&`O[+;“CyÍtò4VFfü]‘:XXRßó…¿.Ÿ·m>t¨ûë«ÿöÞíÿŠ×m™xlÜŒ#…¥'{ÆÇ’ŒGM_ôáᎃZ×ì.šôö®#Ç£×-ËêR—0|xúÎéÛÀ)Ì p…R}NƒŽ–™teö*S}ä³áÈjíç4HRD~4p–žH¼k8Ç“mm* k¹Hí…@|ŸzZ±¾xÝ“O®+^ßúU§ggœùîjcQUçº:’òÑgŸ7]øâ3òÄðB;~b?°“£GläŸd`tèñ‚äÃQŠ/ÂPj§.„ò/®Ë,õ†g!’“Ð#øÌ|_‡Ú2ìѬ!®í}y€T-=«™!òÐœGÖ”ÖÕ¥íYü·WHmëR[¹éÍ¿µ–H¶Ö'O»Ì¥vÆëãéuö…+µÈР>‹ŽK¤V ƒôX¡ª“u%ðV¼U0}Ûšã »b§ñ|ÿ<Ÿ]Æ1uuÂdJy9Í#òÔ2:ÌFQ3ŒcDÔÕ-"¬–)¸–šBž¥Ç•V½BtÄ$H!(ð -¼¡!¨²Ú`5%j¯ mRà­•öáR!;¯¿þû~,,)ýºüvÙ‰w¬”^ºÊ¥Ù ÜÐ,ÛI_7ÅÀ&À&:øh‡ ‘°è¬ÁH208Žž f tX’ú ¾wsz,¹r,B;(á¾Tæxm¸D%Œ8E§’IºˆYJ>™A–ÇE0®ŠÖÃ)†K²SI¤ b¢Üv˜#g+hÏŽ—·Vÿiê–Ýdr9îħ‘ÂÄûV}•ŠøŠK_[õLv0+Ò–á"h‡†ñ'êæ.úË“‡¥½òÈÞ=x_ö|Ñ“e·wí™Rt™Ïep8_˜Œ$4Ý×ü˜Ž@œ >LB†hTâqæq‘¿“Ä¢P€úÊÚ[Hmô?-$hAsON)T‘x i…=EGq_œ”=ú#xò‘tïíê¶|ÐbÀ__=¸MU§ò,³^²t@“äà G !â$Dw%DŽÿQB¤å"LH[b¤=]¦× úƒ£IÂÅ(]¤¡1Ä£xÜ‘Ä‹¥Ž²GédÈ!YbŽ”#g(= }•]¾~€a”R¨­c˜AfÓÂlqŽnºþq²\|Bù“îQ}²I '<á.ƨ1jI{‘^bµ¿:FCf‹³Ôd]&¬–‹RW©N[[þóüIí‰êçv¨e·ö¿~`?p)Ék­§nW“­Ûù¬Iƒ$õè_À ²DùA0ÁÔA@>üÛRÕ¡S1?èU­Î’ÍSe -Ì8 ÖH"qœÂcüà[Òÿóô‰¬ÉÓhGžgËãe²$c Eµ«Ý„.êXa”ª‡:¢åG8&²…¸®‰Õ±CM¸Ž-|wÄ ÂäÖïZëðÛ,—ô'N6?Ã9Þc pjEÕ¾¾FGˆ‘«žè qYVÀ{“ñƒÅl 1š!!Æ×wî7-®ó“ã·Îh|?6ô„ûÀ³–e7» ²}bƒ0Ä¿•Îãœ6ò÷úÂTÀÒ…¾(ÊW‚â U֢〼Š\€¤¾*·¨é”‹éÊs1>{íªô¥”Ñ´P™Nç(KèrE½+=óMn]IÖúµ­ÏS÷ø¿¨¨¡^ â";@[óv@3|™á&»^òê"Ìöh½ë¦H_«CµøÝ){mè^ƒN;„…£hU %6ÞS5‰ÞßÍe GütÛìD·`õÛ>KæREÍzþþ1™–¨ÄpÚÜÑÓßo¯Ì-ëÕkãœW~óå—=:}.J7ea,ß?¶æðÞ§µßÿ=“Ú -endstream -endobj -1008 0 obj -<< -/Type /FontDescriptor -/FontName /EMBABY+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 557 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 1004 0 R ->> -endobj -1009 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /EMBABY+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 16 [ 360 317 ] 20 [ 636 636 ] 25 [ 636 ] 36 [ 684 686 698 ] 40 [ 631 ] 42 [ 774 ] 44 [ 294 ] 46 [ 655 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 352 ] 75 [ 633 277 ] 78 [ 579 277 974 633 611 ] 85 [ 411 520 392 633 591 ] ] -/FontDescriptor 1008 0 R ->> -endobj -1010 0 obj -<< -/Length 772 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -32 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0015> <0032> -<0003> <0020> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0052> <006f> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1011 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /EMBABY+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1009 0 R ] -/ToUnicode 1010 0 R ->> -endobj -1012 0 obj -<< -/Type /FontDescriptor -/FontName /JFIGPQ+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -132 753 704 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 704 -/StemV 80 -/StemH 80 -/FontFile2 1005 0 R ->> -endobj -1013 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /JFIGPQ+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 5 [ 291 ] 11 [ 453 453 485 682 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 32 [ 722 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 860 702 785 578 787 607 586 540 674 675 975 ] 60 [ 583 540 422 ] 64 [ 422 ] 66 [ 732 256 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 95 [ 290 ] ] -/FontDescriptor 1012 0 R ->> -endobj -1014 0 obj -<< -/Length 1402 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -77 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0015> <0032> -<0003> <0020> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0048> <0065> -<0051> <006e> -<0046> <0063> -<004b> <0068> -<0050> <006d> -<0044> <0061> -<0055> <0072> -<004e> <006b> -<0010> <002d> -<004f> <006c> -<0049> <0066> -<0024> <0041> -<0056> <0073> -<0057> <0074> -<002a> <0047> -<0058> <0075> -<004c> <0069> -<0047> <0064> -<0016> <0033> -<0045> <0062> -<005a> <0077> -<0053> <0070> -<0052> <006f> -<0030> <004d> -<0031> <004e> -<004a> <0067> -<0029> <0046> -<0033> <0050> -<0017> <0034> -<001c> <0039> -<0018> <0035> -<0013> <0030> -<001b> <0038> -<005d> <007a> -<002f> <004c> -<003a> <0057> -<001a> <0037> -<005c> <0079> -<005b> <0078> -<0037> <0054> -<0027> <0044> -<0032> <004f> -<000f> <002c> -<001d> <003a> -<002b> <0048> -<0039> <0056> -<000e> <002b> -<003c> <0059> -<000b> <0028> -<000c> <0029> -<004d> <006a> -<0054> <0071> -<0012> <002f> -<005f> <007c> -<000d> <002a> -<0020> <003d> -<0042> <005f> -<0043> <0060> -<0005> <0022> -<003e> <005b> -<0040> <005d> -<0038> <0055> -<003d> <005a> -<0034> <0051> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1015 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /JFIGPQ+Poppins -/Encoding /Identity-H -/DescendantFonts [ 1013 0 R ] -/ToUnicode 1014 0 R ->> -endobj -1016 0 obj -<< -/Type /FontDescriptor -/FontName /AHJHWI+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ -9 -92 733 729 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 729 -/StemV 80 -/StemH 80 -/FontFile2 1006 0 R ->> -endobj -1017 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /AHJHWI+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 348 ] 11 [ 457 457 ] 16 [ 415 379 365 695 695 695 695 695 695 695 695 695 695 399 ] 36 [ 773 762 733 830 683 ] 44 [ 372 ] 46 [ 774 637 995 836 ] 51 [ 732 ] 53 [ 770 720 682 ] 57 [ 773 1103 ] 60 [ 724 ] 66 [ 500 ] 68 [ 674 715 592 715 678 435 715 711 342 ] 78 [ 665 342 1041 711 687 715 715 493 595 478 711 651 923 645 651 582 ] 5038 [ 741 ] ] -/FontDescriptor 1016 0 R ->> -endobj -1018 0 obj -<< -/Length 1182 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -61 beginbfchar -<0014> <0031> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<0019> <0036> -<001a> <0037> -<0011> <002e> -<0003> <0020> -<0028> <0045> -<0051> <006e> -<0056> <0073> -<0058> <0075> -<0055> <0072> -<0048> <0065> -<0057> <0074> -<004b> <0068> -<0044> <0061> -<0024> <0041> -<0033> <0050> -<002c> <0049> -<0059> <0076> -<0053> <0070> -<0052> <006f> -<0047> <0064> -<0046> <0063> -<004c> <0069> -<13ae> <00660069> -<004f> <006c> -<0050> <006d> -<000b> <0028> -<000c> <0029> -<0015> <0032> -<005a> <0077> -<001d> <003a> -<004a> <0067> -<001b> <0038> -<001c> <0039> -<0026> <0043> -<0031> <004e> -<004e> <006b> -<0049> <0066> -<0030> <004d> -<0013> <0030> -<005c> <0079> -<0010> <002d> -<002e> <004b> -<0045> <0062> -<005d> <007a> -<0035> <0052> -<0025> <0042> -<002f> <004c> -<0036> <0053> -<005b> <0078> -<0027> <0044> -<0054> <0071> -<0039> <0056> -<0037> <0054> -<0042> <005f> -<003a> <0057> -<0012> <002f> -<003c> <0059> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1019 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /AHJHWI+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 1017 0 R ] -/ToUnicode 1018 0 R ->> -endobj -1020 0 obj -<< -/Type /FontDescriptor -/FontName /LJVNMQ+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -14 602 728 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 728 -/StemV 80 -/StemH 80 -/FontFile2 1007 0 R ->> -endobj -1021 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /LJVNMQ+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 601 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 602 ] 36 [ 601 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 602 ] 53 [ 602 602 602 602 602 602 602 602 602 602 602 602 ] 66 [ 601 ] 68 [ 601 601 601 601 601 602 602 602 601 602 602 601 601 602 601 601 602 601 601 601 601 602 602 602 602 602 602 602 602 ] ] -/FontDescriptor 1020 0 R ->> -endobj -1022 0 obj -<< -/Length 1570 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -89 beginbfchar -<0031> <004e> -<0052> <006f> -<0057> <0074> -<0003> <0020> -<0024> <0041> -<0053> <0070> -<004f> <006c> -<004c> <0069> -<0046> <0063> -<0044> <0061> -<0045> <0062> -<0048> <0065> -<0058> <0075> -<0050> <006d> -<0047> <0064> -<0056> <0073> -<0055> <0072> -<0010> <002d> -<0008> <0025> -<0012> <002f> -<0059> <0076> -<0051> <006e> -<004b> <0068> -<004e> <006b> -<0015> <0032> -<004a> <0067> -<0049> <0066> -<0011> <002e> -<005c> <0079> -<000a> <0027> -<0019> <0036> -<0017> <0034> -<001e> <003b> -<0038> <0055> -<001d> <003a> -<002a> <0047> -<0054> <0071> -<001f> <003c> -<0021> <003e> -<001a> <0037> -<0013> <0030> -<0042> <005f> -<0006> <0023> -<0004> <0021> -<0037> <0054> -<005a> <0077> -<0007> <0024> -<0014> <0031> -<0020> <003d> -<005b> <0078> -<000b> <0028> -<000d> <002a> -<000c> <0029> -<0005> <0022> -<002b> <0048> -<0036> <0053> -<0028> <0045> -<0035> <0052> -<002c> <0049> -<0033> <0050> -<003e> <005b> -<005e> <007b> -<0060> <007d> -<0040> <005d> -<0030> <004d> -<0032> <004f> -<0029> <0046> -<002f> <004c> -<003f> <005c> -<005f> <007c> -<0009> <0026> -<0018> <0035> -<001b> <0038> -<0022> <003f> -<0016> <0033> -<005d> <007a> -<000f> <002c> -<0025> <0042> -<0026> <0043> -<004d> <006a> -<001c> <0039> -<003b> <0058> -<0027> <0044> -<0039> <0056> -<003d> <005a> -<002e> <004b> -<003c> <0059> -<000e> <002b> -<003a> <0057> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -1023 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /LJVNMQ+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 1021 0 R ] -/ToUnicode 1022 0 R ->> -endobj -1024 0 obj -<< -/EMBABY 1011 0 R -/JFIGPQ 1015 0 R -/AHJHWI 1019 0 R -/LJVNMQ 1023 0 R ->> -endobj -xref -0 1025 -0000000000 65535 f -0000000015 00000 n -0000001200 00000 n -0000001339 00000 n -0000037576 00000 n -0000037710 00000 n -0000040416 00000 n -0000040615 00000 n -0000044367 00000 n -0000044773 00000 n -0000044982 00000 n -0000045193 00000 n -0000045328 00000 n -0000045464 00000 n -0000045622 00000 n -0000045781 00000 n -0000046014 00000 n -0000046248 00000 n -0000046463 00000 n -0000046679 00000 n -0000046920 00000 n -0000047162 00000 n -0000047385 00000 n -0000047609 00000 n -0000047841 00000 n -0000048074 00000 n -0000048288 00000 n -0000048503 00000 n -0000048730 00000 n -0000048958 00000 n -0000049167 00000 n -0000049377 00000 n -0000049606 00000 n -0000049836 00000 n -0000050047 00000 n -0000050259 00000 n -0000050478 00000 n -0000050697 00000 n -0000054468 00000 n -0000054933 00000 n -0000055134 00000 n -0000055336 00000 n -0000055551 00000 n -0000055767 00000 n -0000055964 00000 n -0000056162 00000 n -0000056381 00000 n -0000056601 00000 n -0000056802 00000 n -0000057004 00000 n -0000057232 00000 n -0000057461 00000 n -0000057671 00000 n -0000057882 00000 n -0000058097 00000 n -0000058313 00000 n -0000058541 00000 n -0000058770 00000 n -0000058970 00000 n -0000059171 00000 n -0000059308 00000 n -0000059446 00000 n -0000059637 00000 n -0000059829 00000 n -0000060019 00000 n -0000060210 00000 n -0000060401 00000 n -0000060593 00000 n -0000060785 00000 n -0000060978 00000 n -0000061217 00000 n -0000061457 00000 n -0000061672 00000 n -0000061888 00000 n -0000062095 00000 n -0000062302 00000 n -0000065877 00000 n -0000066355 00000 n -0000066551 00000 n -0000066748 00000 n -0000066944 00000 n -0000067141 00000 n -0000067337 00000 n -0000067534 00000 n -0000067734 00000 n -0000067935 00000 n -0000068133 00000 n -0000068332 00000 n -0000068566 00000 n -0000068801 00000 n -0000069000 00000 n -0000069200 00000 n -0000069403 00000 n -0000069607 00000 n -0000069809 00000 n -0000070012 00000 n -0000070212 00000 n -0000070413 00000 n -0000070609 00000 n -0000070806 00000 n -0000070995 00000 n -0000071186 00000 n -0000071378 00000 n -0000071571 00000 n -0000071761 00000 n -0000071952 00000 n -0000072138 00000 n -0000072325 00000 n -0000072537 00000 n -0000072750 00000 n -0000072965 00000 n -0000073181 00000 n -0000073394 00000 n -0000073607 00000 n -0000077325 00000 n -0000077828 00000 n -0000078030 00000 n -0000078233 00000 n -0000078435 00000 n -0000078638 00000 n -0000078849 00000 n -0000079061 00000 n -0000079282 00000 n -0000079504 00000 n -0000079733 00000 n -0000079963 00000 n -0000080164 00000 n -0000080366 00000 n -0000080564 00000 n -0000080763 00000 n -0000080976 00000 n -0000081190 00000 n -0000081389 00000 n -0000081589 00000 n -0000081797 00000 n -0000082006 00000 n -0000082152 00000 n -0000082299 00000 n -0000082513 00000 n -0000082728 00000 n -0000082920 00000 n -0000083113 00000 n -0000083324 00000 n -0000083536 00000 n -0000083755 00000 n -0000083975 00000 n -0000084174 00000 n -0000084374 00000 n -0000084582 00000 n -0000084791 00000 n -0000084987 00000 n -0000085183 00000 n -0000089028 00000 n -0000089499 00000 n -0000089636 00000 n -0000089774 00000 n -0000089966 00000 n -0000090159 00000 n -0000090358 00000 n -0000090558 00000 n -0000090715 00000 n -0000090873 00000 n -0000091086 00000 n -0000091300 00000 n -0000091496 00000 n -0000091693 00000 n -0000091885 00000 n -0000092078 00000 n -0000092301 00000 n -0000092525 00000 n -0000092726 00000 n -0000092928 00000 n -0000093125 00000 n -0000093323 00000 n -0000093517 00000 n -0000093712 00000 n -0000093872 00000 n -0000094033 00000 n -0000094230 00000 n -0000094428 00000 n -0000094563 00000 n -0000094699 00000 n -0000094882 00000 n -0000095066 00000 n -0000095258 00000 n -0000095451 00000 n -0000099307 00000 n -0000099794 00000 n -0000099953 00000 n -0000100113 00000 n -0000100334 00000 n -0000100556 00000 n -0000100759 00000 n -0000100963 00000 n -0000101183 00000 n -0000101404 00000 n -0000101605 00000 n -0000101807 00000 n -0000102038 00000 n -0000102270 00000 n -0000102483 00000 n -0000102697 00000 n -0000102923 00000 n -0000103150 00000 n -0000103368 00000 n -0000103587 00000 n -0000103823 00000 n -0000104060 00000 n -0000104278 00000 n -0000104497 00000 n -0000104632 00000 n -0000104768 00000 n -0000104961 00000 n -0000105155 00000 n -0000105366 00000 n -0000105578 00000 n -0000105781 00000 n -0000105985 00000 n -0000106176 00000 n -0000106368 00000 n -0000106582 00000 n -0000106796 00000 n -0000110880 00000 n -0000111367 00000 n -0000111570 00000 n -0000111774 00000 n -0000111979 00000 n -0000112185 00000 n -0000112375 00000 n -0000112566 00000 n -0000112800 00000 n -0000113035 00000 n -0000113266 00000 n -0000113498 00000 n -0000113699 00000 n -0000113901 00000 n -0000114106 00000 n -0000114312 00000 n -0000114517 00000 n -0000114723 00000 n -0000114876 00000 n -0000115030 00000 n -0000115227 00000 n -0000115425 00000 n -0000115586 00000 n -0000115748 00000 n -0000115930 00000 n -0000116113 00000 n -0000116278 00000 n -0000116444 00000 n -0000116641 00000 n -0000116839 00000 n -0000117041 00000 n -0000117244 00000 n -0000117393 00000 n -0000117543 00000 n -0000117728 00000 n -0000117914 00000 n -0000122104 00000 n -0000122591 00000 n -0000122812 00000 n -0000123034 00000 n -0000123248 00000 n -0000123463 00000 n -0000123681 00000 n -0000123900 00000 n -0000124104 00000 n -0000124309 00000 n -0000124488 00000 n -0000124668 00000 n -0000124867 00000 n -0000125067 00000 n -0000125262 00000 n -0000125458 00000 n -0000125656 00000 n -0000125855 00000 n -0000126007 00000 n -0000126160 00000 n -0000126350 00000 n -0000126541 00000 n -0000126735 00000 n -0000126930 00000 n -0000127076 00000 n -0000127223 00000 n -0000127425 00000 n -0000127628 00000 n -0000127795 00000 n -0000127963 00000 n -0000128119 00000 n -0000128276 00000 n -0000128483 00000 n -0000128691 00000 n -0000128919 00000 n -0000129148 00000 n -0000131463 00000 n -0000131758 00000 n -0000131902 00000 n -0000132047 00000 n -0000132249 00000 n -0000132452 00000 n -0000132666 00000 n -0000132881 00000 n -0000133069 00000 n -0000133258 00000 n -0000133433 00000 n -0000133609 00000 n -0000138442 00000 n -0000138697 00000 n -0000138958 00000 n -0000139226 00000 n -0000139493 00000 n -0000139700 00000 n -0000139906 00000 n -0000143668 00000 n -0000143899 00000 n -0000144097 00000 n -0000144286 00000 n -0000148668 00000 n -0000148899 00000 n -0000149033 00000 n -0000149167 00000 n -0000153295 00000 n -0000153526 00000 n -0000153660 00000 n -0000153795 00000 n -0000157936 00000 n -0000158167 00000 n -0000158302 00000 n -0000158437 00000 n -0000162498 00000 n -0000162729 00000 n -0000162864 00000 n -0000162999 00000 n -0000167078 00000 n -0000167317 00000 n -0000167452 00000 n -0000167587 00000 n -0000167722 00000 n -0000171667 00000 n -0000171898 00000 n -0000172033 00000 n -0000172168 00000 n -0000176112 00000 n -0000176343 00000 n -0000176478 00000 n -0000176613 00000 n -0000180573 00000 n -0000180812 00000 n -0000180947 00000 n -0000181082 00000 n -0000181217 00000 n -0000185470 00000 n -0000185725 00000 n -0000185860 00000 n -0000185995 00000 n -0000186128 00000 n -0000186261 00000 n -0000186394 00000 n -0000191061 00000 n -0000191580 00000 n -0000191713 00000 n -0000191846 00000 n -0000191979 00000 n -0000192112 00000 n -0000192245 00000 n -0000192379 00000 n -0000192513 00000 n -0000192647 00000 n -0000192781 00000 n -0000192915 00000 n -0000193049 00000 n -0000193183 00000 n -0000193317 00000 n -0000193451 00000 n -0000193585 00000 n -0000193719 00000 n -0000193853 00000 n -0000193987 00000 n -0000194121 00000 n -0000194255 00000 n -0000194389 00000 n -0000194523 00000 n -0000194657 00000 n -0000194791 00000 n -0000194925 00000 n -0000195059 00000 n -0000195193 00000 n -0000195327 00000 n -0000195461 00000 n -0000195595 00000 n -0000195729 00000 n -0000195863 00000 n -0000195997 00000 n -0000196131 00000 n -0000196265 00000 n -0000196399 00000 n -0000196532 00000 n -0000196664 00000 n -0000201814 00000 n -0000202213 00000 n -0000202347 00000 n -0000202481 00000 n -0000202615 00000 n -0000202749 00000 n -0000202883 00000 n -0000203017 00000 n -0000203151 00000 n -0000203285 00000 n -0000203419 00000 n -0000203553 00000 n -0000203687 00000 n -0000203821 00000 n -0000203955 00000 n -0000204089 00000 n -0000204223 00000 n -0000204357 00000 n -0000204491 00000 n -0000204625 00000 n -0000204759 00000 n -0000204894 00000 n -0000205029 00000 n -0000205162 00000 n -0000205295 00000 n -0000209925 00000 n -0000210436 00000 n -0000210569 00000 n -0000210702 00000 n -0000210835 00000 n -0000210968 00000 n -0000211101 00000 n -0000211234 00000 n -0000211368 00000 n -0000211502 00000 n -0000211636 00000 n -0000211770 00000 n -0000211904 00000 n -0000212038 00000 n -0000212172 00000 n -0000212306 00000 n -0000212440 00000 n -0000212574 00000 n -0000212708 00000 n -0000212842 00000 n -0000212976 00000 n -0000213110 00000 n -0000213244 00000 n -0000213378 00000 n -0000213512 00000 n -0000213646 00000 n -0000213780 00000 n -0000213914 00000 n -0000214048 00000 n -0000214182 00000 n -0000214316 00000 n -0000214450 00000 n -0000214584 00000 n -0000214718 00000 n -0000214852 00000 n -0000214986 00000 n -0000215120 00000 n -0000215253 00000 n -0000215385 00000 n -0000220167 00000 n -0000220558 00000 n -0000220692 00000 n -0000220826 00000 n -0000220960 00000 n -0000221094 00000 n -0000221228 00000 n -0000221362 00000 n -0000221496 00000 n -0000221630 00000 n -0000221764 00000 n -0000221898 00000 n -0000222032 00000 n -0000222166 00000 n -0000222300 00000 n -0000222434 00000 n -0000222568 00000 n -0000222702 00000 n -0000222836 00000 n -0000222970 00000 n -0000223104 00000 n -0000223238 00000 n -0000223372 00000 n -0000223507 00000 n -0000228216 00000 n -0000228447 00000 n -0000228582 00000 n -0000228717 00000 n -0000233361 00000 n -0000233564 00000 n -0000238118 00000 n -0000238341 00000 n -0000238476 00000 n -0000243155 00000 n -0000243358 00000 n -0000247953 00000 n -0000248176 00000 n -0000248311 00000 n -0000253009 00000 n -0000253212 00000 n -0000257722 00000 n -0000257925 00000 n -0000262760 00000 n -0000262983 00000 n -0000263118 00000 n -0000267531 00000 n -0000267734 00000 n -0000272610 00000 n -0000272833 00000 n -0000272968 00000 n -0000277431 00000 n -0000277634 00000 n -0000282560 00000 n -0000282783 00000 n -0000282918 00000 n -0000287344 00000 n -0000287547 00000 n -0000292458 00000 n -0000292681 00000 n -0000292816 00000 n -0000297278 00000 n -0000297481 00000 n -0000302360 00000 n -0000302583 00000 n -0000302718 00000 n -0000307275 00000 n -0000307478 00000 n -0000311999 00000 n -0000312230 00000 n -0000312365 00000 n -0000312499 00000 n -0000317203 00000 n -0000317406 00000 n -0000321991 00000 n -0000322194 00000 n -0000326696 00000 n -0000326935 00000 n -0000327070 00000 n -0000327205 00000 n -0000327340 00000 n -0000332035 00000 n -0000332238 00000 n -0000336833 00000 n -0000337056 00000 n -0000337191 00000 n -0000341864 00000 n -0000342067 00000 n -0000346591 00000 n -0000346794 00000 n -0000351599 00000 n -0000351822 00000 n -0000351957 00000 n -0000356458 00000 n -0000356661 00000 n -0000361519 00000 n -0000361742 00000 n -0000361878 00000 n -0000366337 00000 n -0000366540 00000 n -0000371391 00000 n -0000371614 00000 n -0000371750 00000 n -0000376243 00000 n -0000376446 00000 n -0000381316 00000 n -0000381539 00000 n -0000381675 00000 n -0000386152 00000 n -0000386355 00000 n -0000391267 00000 n -0000391490 00000 n -0000391626 00000 n -0000396081 00000 n -0000396284 00000 n -0000401201 00000 n -0000401424 00000 n -0000401560 00000 n -0000406030 00000 n -0000406233 00000 n -0000411071 00000 n -0000411294 00000 n -0000411430 00000 n -0000416043 00000 n -0000416246 00000 n -0000420874 00000 n -0000421097 00000 n -0000421233 00000 n -0000425940 00000 n -0000426143 00000 n -0000430578 00000 n -0000430801 00000 n -0000430937 00000 n -0000435610 00000 n -0000435813 00000 n -0000440486 00000 n -0000440709 00000 n -0000440845 00000 n -0000445531 00000 n -0000445734 00000 n -0000450229 00000 n -0000450432 00000 n -0000455269 00000 n -0000455492 00000 n -0000455628 00000 n -0000460030 00000 n -0000460233 00000 n -0000465140 00000 n -0000465363 00000 n -0000465499 00000 n -0000469962 00000 n -0000470165 00000 n -0000475043 00000 n -0000475266 00000 n -0000475402 00000 n -0000479873 00000 n -0000480076 00000 n -0000485029 00000 n -0000485252 00000 n -0000485388 00000 n -0000489849 00000 n -0000490052 00000 n -0000494952 00000 n -0000495175 00000 n -0000495311 00000 n -0000499924 00000 n -0000500127 00000 n -0000504733 00000 n -0000504956 00000 n -0000505092 00000 n -0000509787 00000 n -0000509990 00000 n -0000514554 00000 n -0000514777 00000 n -0000514913 00000 n -0000519586 00000 n -0000519789 00000 n -0000524467 00000 n -0000524690 00000 n -0000524825 00000 n -0000529495 00000 n -0000529698 00000 n -0000534172 00000 n -0000534375 00000 n -0000539254 00000 n -0000539485 00000 n -0000539621 00000 n -0000539757 00000 n -0000544403 00000 n -0000544606 00000 n -0000548146 00000 n -0000548349 00000 n -0000553088 00000 n -0000553311 00000 n -0000553447 00000 n -0000558117 00000 n -0000558340 00000 n -0000558476 00000 n -0000563207 00000 n -0000563430 00000 n -0000563566 00000 n -0000568236 00000 n -0000568459 00000 n -0000568595 00000 n -0000573022 00000 n -0000573245 00000 n -0000573381 00000 n -0000577861 00000 n -0000578064 00000 n -0000582670 00000 n -0000582893 00000 n -0000583029 00000 n -0000585864 00000 n -0000586067 00000 n -0000590542 00000 n -0000590773 00000 n -0000590909 00000 n -0000591045 00000 n -0000594348 00000 n -0000594551 00000 n -0000598988 00000 n -0000599211 00000 n -0000599347 00000 n -0000603995 00000 n -0000604198 00000 n -0000608477 00000 n -0000608700 00000 n -0000608836 00000 n -0000613550 00000 n -0000613753 00000 n -0000618781 00000 n -0000619004 00000 n -0000619140 00000 n -0000623475 00000 n -0000623678 00000 n -0000626959 00000 n -0000627162 00000 n -0000631154 00000 n -0000631377 00000 n -0000631513 00000 n -0000635731 00000 n -0000635954 00000 n -0000636090 00000 n -0000640224 00000 n -0000640455 00000 n -0000640591 00000 n -0000640727 00000 n -0000644966 00000 n -0000645205 00000 n -0000645341 00000 n -0000645477 00000 n -0000645612 00000 n -0000649726 00000 n -0000649957 00000 n -0000650093 00000 n -0000650229 00000 n -0000653792 00000 n -0000654015 00000 n -0000654151 00000 n -0000659100 00000 n -0000659331 00000 n -0000659467 00000 n -0000659603 00000 n -0000664429 00000 n -0000664660 00000 n -0000664796 00000 n -0000664932 00000 n -0000669366 00000 n -0000669597 00000 n -0000669733 00000 n -0000669869 00000 n -0000674743 00000 n -0000674974 00000 n -0000675110 00000 n -0000675246 00000 n -0000680133 00000 n -0000680364 00000 n -0000680500 00000 n -0000680636 00000 n -0000685548 00000 n -0000685779 00000 n -0000685915 00000 n -0000686050 00000 n -0000690659 00000 n -0000690890 00000 n -0000691026 00000 n -0000691162 00000 n -0000696029 00000 n -0000696252 00000 n -0000696388 00000 n -0000701266 00000 n -0000701497 00000 n -0000701633 00000 n -0000701769 00000 n -0000706695 00000 n -0000706926 00000 n -0000707062 00000 n -0000707198 00000 n -0000712140 00000 n -0000712371 00000 n -0000712507 00000 n -0000712641 00000 n -0000717637 00000 n -0000717840 00000 n -0000722780 00000 n -0000723011 00000 n -0000723147 00000 n -0000723283 00000 n -0000728199 00000 n -0000728430 00000 n -0000728566 00000 n -0000728702 00000 n -0000732382 00000 n -0000732585 00000 n -0000736668 00000 n -0000736871 00000 n -0000742410 00000 n -0000742809 00000 n -0000742945 00000 n -0000743079 00000 n -0000743213 00000 n -0000743347 00000 n -0000743481 00000 n -0000743615 00000 n -0000743749 00000 n -0000743883 00000 n -0000744017 00000 n -0000744152 00000 n -0000744287 00000 n -0000744422 00000 n -0000744557 00000 n -0000744692 00000 n -0000744827 00000 n -0000744962 00000 n -0000745097 00000 n -0000745232 00000 n -0000745367 00000 n -0000745502 00000 n -0000745637 00000 n -0000745772 00000 n -0000745906 00000 n -0000749634 00000 n -0000749921 00000 n -0000750056 00000 n -0000750191 00000 n -0000750326 00000 n -0000750461 00000 n -0000750596 00000 n -0000750731 00000 n -0000750866 00000 n -0000751001 00000 n -0000751137 00000 n -0000755806 00000 n -0000756037 00000 n -0000756173 00000 n -0000756309 00000 n -0000760802 00000 n -0000761033 00000 n -0000761169 00000 n -0000761305 00000 n -0000765773 00000 n -0000766004 00000 n -0000766140 00000 n -0000766276 00000 n -0000770336 00000 n -0000770559 00000 n -0000770695 00000 n -0000775432 00000 n -0000775695 00000 n -0000775831 00000 n -0000775967 00000 n -0000776101 00000 n -0000776235 00000 n -0000776368 00000 n -0000776500 00000 n -0000780731 00000 n -0000781066 00000 n -0000781200 00000 n -0000781334 00000 n -0000781468 00000 n -0000781602 00000 n -0000781737 00000 n -0000781872 00000 n -0000782007 00000 n -0000782142 00000 n -0000782277 00000 n -0000782412 00000 n -0000782547 00000 n -0000782682 00000 n -0000782817 00000 n -0000782952 00000 n -0000783088 00000 n -0000786510 00000 n -0000786713 00000 n -0000789978 00000 n -0000790181 00000 n -0000793251 00000 n -0000793454 00000 n -0000797857 00000 n -0000798060 00000 n -0000798256 00000 n -0000798486 00000 n -0000798612 00000 n -0000798758 00000 n -0000798898 00000 n -0000799095 00000 n -0000799329 00000 n -0000799560 00000 n -0000799816 00000 n -0000800055 00000 n -0000800302 00000 n -0000800532 00000 n -0000800774 00000 n -0000800999 00000 n -0000801243 00000 n -0000801471 00000 n -0000801706 00000 n -0000801924 00000 n -0000802155 00000 n -0000802369 00000 n -0000802604 00000 n -0000802822 00000 n -0000803066 00000 n -0000803293 00000 n -0000803525 00000 n -0000803769 00000 n -0000803971 00000 n -0000804147 00000 n -0000804339 00000 n -0000804544 00000 n -0000804750 00000 n -0000804957 00000 n -0000805211 00000 n -0000805441 00000 n -0000805664 00000 n -0000805875 00000 n -0000806086 00000 n -0000806298 00000 n -0000806514 00000 n -0000806728 00000 n -0000806978 00000 n -0000807193 00000 n -0000807412 00000 n -0000807630 00000 n -0000807846 00000 n -0000808058 00000 n -0000808263 00000 n -0000808470 00000 n -0000808675 00000 n -0000808876 00000 n -0000809103 00000 n -0000809333 00000 n -0000809562 00000 n -0000809779 00000 n -0000809996 00000 n -0000810222 00000 n -0000810458 00000 n -0000810702 00000 n -0000810918 00000 n -0000811131 00000 n -0000811359 00000 n -0000811573 00000 n -0000811782 00000 n -0000811965 00000 n -0000812179 00000 n -0000812383 00000 n -0000812608 00000 n -0000812841 00000 n -0000813054 00000 n -0000813276 00000 n -0000813473 00000 n -0000813647 00000 n -0000813837 00000 n -0000814034 00000 n -0000814226 00000 n -0000814437 00000 n -0000814645 00000 n -0000814849 00000 n -0000815084 00000 n -0000815297 00000 n -0000815506 00000 n -0000815698 00000 n -0000815895 00000 n -0000816078 00000 n -0000816250 00000 n -0000816433 00000 n -0000816625 00000 n -0000816822 00000 n -0000817043 00000 n -0000817261 00000 n -0000817495 00000 n -0000817711 00000 n -0000817956 00000 n -0000818184 00000 n -0000818424 00000 n -0000818657 00000 n -0000818907 00000 n -0000819127 00000 n -0000819300 00000 n -0000819493 00000 n -0000819716 00000 n -0000819931 00000 n -0000820136 00000 n -0000820364 00000 n -0000820581 00000 n -0000820800 00000 n -0000821004 00000 n -0000821252 00000 n -0000821496 00000 n -0000821712 00000 n -0000821932 00000 n -0000822138 00000 n -0000822328 00000 n -0000822525 00000 n -0000822700 00000 n -0000822896 00000 n -0000823075 00000 n -0000823286 00000 n -0000823488 00000 n -0000823674 00000 n -0000823859 00000 n -0000824094 00000 n -0000824322 00000 n -0000824554 00000 n -0000824772 00000 n -0000824965 00000 n -0000825178 00000 n -0000825387 00000 n -0000825585 00000 n -0000825774 00000 n -0000825964 00000 n -0000826158 00000 n -0000826341 00000 n -0000826543 00000 n -0000826710 00000 n -0000826903 00000 n -0000827096 00000 n -0000827333 00000 n -0000827501 00000 n -0000827704 00000 n -0000827935 00000 n -0000828140 00000 n -0000828317 00000 n -0000828381 00000 n -0000836324 00000 n -0000840962 00000 n -0000852820 00000 n -0000865030 00000 n -0000865264 00000 n -0000865690 00000 n -0000866516 00000 n -0000866669 00000 n -0000866900 00000 n -0000867468 00000 n -0000868925 00000 n -0000869075 00000 n -0000869310 00000 n -0000869849 00000 n -0000871086 00000 n -0000871239 00000 n -0000871482 00000 n -0000872077 00000 n -0000873702 00000 n -0000873859 00000 n -trailer -<< -/Size 1025 -/Root 3 0 R -/Info 2 0 R ->> -startxref -873951 -%%EOF diff --git a/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-hardening-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Hardening_Guide.pdf b/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-hardening-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Hardening_Guide.pdf deleted file mode 100644 index 35251edd3d0..00000000000 --- a/versioned_docs/version-2.6/security/hardening-guides/rke2-1.6-hardening-2.6/Rancher_RKE2_v2-6_CIS_v1-6_Hardening_Guide.pdf +++ /dev/null @@ -1,4149 +0,0 @@ -%PDF-1.7 -%🖤 -1 0 obj -<< -/Type /Pages -/Kids [ 6 0 R 8 0 R 26 0 R 39 0 R 41 0 R 49 0 R 56 0 R 59 0 R 72 0 R 81 0 R 85 0 R 125 0 R 165 0 R 205 0 R 245 0 R ] -/Count 15 ->> -endobj -2 0 obj -<< -/Title (RKE2 Hardening Guide with CIS v1.6 Benchmark) -/Creator (pandoc) -/Producer (WeasyPrint 54.3) ->> -endobj -3 0 obj -<< -/Type /Catalog -/Pages 1 0 R -/Outlines 277 0 R -/Names << -/Dests << -/Names [ (TOC) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (api-server-audit-configuration) [ 59 0 R /XYZ 84.259843 315.158799 0 ] (cb1) [ 41 0 R /XYZ 84.259843 617.450787 0 ] (cb1-1) [ 41 0 R /XYZ 101.433071 615.753766 0 ] (cb1-2) [ 41 0 R /XYZ 99.933071 596.806744 0 ] (cb1-3) [ 41 0 R /XYZ 99.933071 577.859723 0 ] (cb1-4) [ 41 0 R /XYZ 99.933071 558.912701 0 ] (cb1-5) [ 41 0 R /XYZ 99.933071 539.965680 0 ] (cb1-6) [ 41 0 R /XYZ 99.933071 521.018658 0 ] (cb2) [ 49 0 R /XYZ 84.259843 687.872079 0 ] (cb2-1) [ 49 0 R /XYZ 101.433071 686.175057 0 ] (cb2-2) [ 49 0 R /XYZ 99.933071 667.228036 0 ] (cb2-3) [ 49 0 R /XYZ 99.933071 648.281014 0 ] (cb2-4) [ 49 0 R /XYZ 99.933071 629.333993 0 ] (cb3) [ 49 0 R /XYZ 84.259843 389.087993 0 ] (cb3-1) [ 49 0 R /XYZ 101.433071 387.390971 0 ] (cb4) [ 56 0 R /XYZ 84.259843 110.200913 0 ] (cb4-1) [ 56 0 R /XYZ 101.433071 108.503892 0 ] (cb5) [ 59 0 R /XYZ 84.259843 692.870079 0 ] (cb5-1) [ 59 0 R /XYZ 101.433071 691.173057 0 ] (cb5-2) [ 59 0 R /XYZ 99.933071 672.226036 0 ] (cb5-3) [ 59 0 R /XYZ 99.933071 653.279014 0 ] (cb5-4) [ 59 0 R /XYZ 99.933071 634.331993 0 ] (cb5-5) [ 59 0 R /XYZ 99.933071 615.384971 0 ] (cb6) [ 59 0 R /XYZ 84.259843 533.634971 0 ] (cb6-1) [ 59 0 R /XYZ 101.433071 531.937950 0 ] (cb6-2) [ 59 0 R /XYZ 99.933071 512.990928 0 ] (cb6-3) [ 59 0 R /XYZ 99.933071 494.043907 0 ] (cb6-4) [ 59 0 R /XYZ 99.933071 456.149864 0 ] (cb6-5) [ 59 0 R /XYZ 99.933071 437.202842 0 ] (cb6-6) [ 59 0 R /XYZ 99.933071 399.308799 0 ] (cb7) [ 72 0 R /XYZ 84.259843 799.370079 0 ] (cb7-1) [ 72 0 R /XYZ 101.433071 797.673057 0 ] (cb7-2) [ 72 0 R /XYZ 99.933071 778.726036 0 ] (cb7-3) [ 72 0 R /XYZ 99.933071 759.779014 0 ] (cb7-4) [ 72 0 R /XYZ 99.933071 740.831993 0 ] (cb7-5) [ 72 0 R /XYZ 99.933071 721.884971 0 ] (cb7-6) [ 72 0 R /XYZ 99.933071 702.937950 0 ] (cb9) [ 81 0 R /XYZ 84.259843 126.824079 0 ] (cb9-1) [ 81 0 R /XYZ 101.433071 125.127057 0 ] (cb9-10) [ 85 0 R /XYZ 99.933071 666.543907 0 ] (cb9-100) [ 165 0 R /XYZ 99.933071 401.285606 0 ] (cb9-101) [ 165 0 R /XYZ 99.933071 382.338585 0 ] (cb9-102) [ 165 0 R /XYZ 99.933071 363.391563 0 ] (cb9-103) [ 165 0 R /XYZ 99.933071 344.444542 0 ] (cb9-104) [ 165 0 R /XYZ 99.933071 325.497520 0 ] (cb9-105) [ 165 0 R /XYZ 99.933071 306.550499 0 ] (cb9-106) [ 165 0 R /XYZ 99.933071 287.603477 0 ] (cb9-107) [ 165 0 R /XYZ 99.933071 268.656456 0 ] (cb9-108) [ 165 0 R /XYZ 99.933071 249.709434 0 ] (cb9-109) [ 165 0 R /XYZ 99.933071 230.762413 0 ] (cb9-11) [ 85 0 R /XYZ 99.933071 647.596885 0 ] (cb9-110) [ 165 0 R /XYZ 99.933071 211.815391 0 ] (cb9-111) [ 165 0 R /XYZ 99.933071 192.868370 0 ] (cb9-112) [ 165 0 R /XYZ 99.933071 173.921348 0 ] (cb9-113) [ 165 0 R /XYZ 99.933071 154.974327 0 ] (cb9-114) [ 165 0 R /XYZ 99.933071 136.027305 0 ] (cb9-115) [ 165 0 R /XYZ 99.933071 117.080284 0 ] (cb9-116) [ 165 0 R /XYZ 99.933071 98.133262 0 ] (cb9-117) [ 205 0 R /XYZ 99.933071 799.173057 0 ] (cb9-118) [ 205 0 R /XYZ 99.933071 780.226036 0 ] (cb9-119) [ 205 0 R /XYZ 99.933071 761.279014 0 ] (cb9-12) [ 85 0 R /XYZ 99.933071 628.649864 0 ] (cb9-120) [ 205 0 R /XYZ 99.933071 742.331993 0 ] (cb9-121) [ 205 0 R /XYZ 99.933071 723.384971 0 ] (cb9-122) [ 205 0 R /XYZ 99.933071 704.437950 0 ] (cb9-123) [ 205 0 R /XYZ 99.933071 685.490928 0 ] (cb9-124) [ 205 0 R /XYZ 99.933071 666.543907 0 ] (cb9-125) [ 205 0 R /XYZ 99.933071 647.596885 0 ] (cb9-126) [ 205 0 R /XYZ 99.933071 628.649864 0 ] (cb9-127) [ 205 0 R /XYZ 99.933071 609.702842 0 ] (cb9-128) [ 205 0 R /XYZ 99.933071 590.755821 0 ] (cb9-129) [ 205 0 R /XYZ 99.933071 571.808799 0 ] (cb9-13) [ 85 0 R /XYZ 99.933071 609.702842 0 ] (cb9-130) [ 205 0 R /XYZ 99.933071 552.861778 0 ] (cb9-131) [ 205 0 R /XYZ 99.933071 533.914756 0 ] (cb9-132) [ 205 0 R /XYZ 99.933071 514.967735 0 ] (cb9-133) [ 205 0 R /XYZ 99.933071 496.020714 0 ] (cb9-134) [ 205 0 R /XYZ 99.933071 477.073692 0 ] (cb9-135) [ 205 0 R /XYZ 99.933071 458.126671 0 ] (cb9-136) [ 205 0 R /XYZ 99.933071 439.179649 0 ] (cb9-137) [ 205 0 R /XYZ 99.933071 420.232628 0 ] (cb9-138) [ 205 0 R /XYZ 99.933071 401.285606 0 ] (cb9-139) [ 205 0 R /XYZ 99.933071 382.338585 0 ] (cb9-14) [ 85 0 R /XYZ 99.933071 590.755821 0 ] (cb9-140) [ 205 0 R /XYZ 99.933071 363.391563 0 ] (cb9-141) [ 205 0 R /XYZ 99.933071 344.444542 0 ] (cb9-142) [ 205 0 R /XYZ 99.933071 325.497520 0 ] (cb9-143) [ 205 0 R /XYZ 99.933071 306.550499 0 ] (cb9-144) [ 205 0 R /XYZ 99.933071 287.603477 0 ] (cb9-145) [ 205 0 R /XYZ 99.933071 268.656456 0 ] (cb9-146) [ 205 0 R /XYZ 99.933071 249.709434 0 ] (cb9-147) [ 205 0 R /XYZ 99.933071 230.762413 0 ] (cb9-148) [ 205 0 R /XYZ 99.933071 211.815391 0 ] (cb9-149) [ 205 0 R /XYZ 99.933071 192.868370 0 ] (cb9-15) [ 85 0 R /XYZ 99.933071 571.808799 0 ] (cb9-150) [ 205 0 R /XYZ 99.933071 173.921348 0 ] (cb9-151) [ 205 0 R /XYZ 99.933071 154.974327 0 ] (cb9-152) [ 205 0 R /XYZ 99.933071 136.027305 0 ] (cb9-153) [ 205 0 R /XYZ 99.933071 117.080284 0 ] (cb9-154) [ 205 0 R /XYZ 99.933071 98.133262 0 ] (cb9-155) [ 245 0 R /XYZ 99.933071 799.173057 0 ] (cb9-156) [ 245 0 R /XYZ 99.933071 780.226036 0 ] (cb9-157) [ 245 0 R /XYZ 99.933071 761.279014 0 ] (cb9-158) [ 245 0 R /XYZ 99.933071 742.331993 0 ] (cb9-159) [ 245 0 R /XYZ 99.933071 723.384971 0 ] (cb9-16) [ 85 0 R /XYZ 99.933071 552.861778 0 ] (cb9-160) [ 245 0 R /XYZ 99.933071 704.437950 0 ] (cb9-161) [ 245 0 R /XYZ 99.933071 685.490928 0 ] (cb9-162) [ 245 0 R /XYZ 99.933071 666.543907 0 ] (cb9-163) [ 245 0 R /XYZ 99.933071 647.596885 0 ] (cb9-164) [ 245 0 R /XYZ 99.933071 628.649864 0 ] (cb9-165) [ 245 0 R /XYZ 99.933071 609.702842 0 ] (cb9-17) [ 85 0 R /XYZ 99.933071 533.914756 0 ] (cb9-18) [ 85 0 R /XYZ 99.933071 514.967735 0 ] (cb9-19) [ 85 0 R /XYZ 99.933071 496.020714 0 ] (cb9-2) [ 81 0 R /XYZ 99.933071 106.180036 0 ] (cb9-20) [ 85 0 R /XYZ 99.933071 477.073692 0 ] (cb9-21) [ 85 0 R /XYZ 99.933071 458.126671 0 ] (cb9-22) [ 85 0 R /XYZ 99.933071 439.179649 0 ] (cb9-23) [ 85 0 R /XYZ 99.933071 420.232628 0 ] (cb9-24) [ 85 0 R /XYZ 99.933071 401.285606 0 ] (cb9-25) [ 85 0 R /XYZ 99.933071 382.338585 0 ] (cb9-26) [ 85 0 R /XYZ 99.933071 363.391563 0 ] (cb9-27) [ 85 0 R /XYZ 99.933071 344.444542 0 ] (cb9-28) [ 85 0 R /XYZ 99.933071 325.497520 0 ] (cb9-29) [ 85 0 R /XYZ 99.933071 306.550499 0 ] (cb9-3) [ 85 0 R /XYZ 99.933071 799.173057 0 ] (cb9-30) [ 85 0 R /XYZ 99.933071 287.603477 0 ] (cb9-31) [ 85 0 R /XYZ 99.933071 268.656456 0 ] (cb9-32) [ 85 0 R /XYZ 99.933071 249.709434 0 ] (cb9-33) [ 85 0 R /XYZ 99.933071 230.762413 0 ] (cb9-34) [ 85 0 R /XYZ 99.933071 211.815391 0 ] (cb9-35) [ 85 0 R /XYZ 99.933071 192.868370 0 ] (cb9-36) [ 85 0 R /XYZ 99.933071 173.921348 0 ] (cb9-37) [ 85 0 R /XYZ 99.933071 154.974327 0 ] (cb9-38) [ 85 0 R /XYZ 99.933071 136.027305 0 ] (cb9-39) [ 85 0 R /XYZ 99.933071 117.080284 0 ] (cb9-4) [ 85 0 R /XYZ 99.933071 780.226036 0 ] (cb9-40) [ 85 0 R /XYZ 99.933071 98.133262 0 ] (cb9-41) [ 125 0 R /XYZ 99.933071 799.173057 0 ] (cb9-42) [ 125 0 R /XYZ 99.933071 780.226036 0 ] (cb9-43) [ 125 0 R /XYZ 99.933071 761.279014 0 ] (cb9-44) [ 125 0 R /XYZ 99.933071 742.331993 0 ] (cb9-45) [ 125 0 R /XYZ 99.933071 723.384971 0 ] (cb9-46) [ 125 0 R /XYZ 99.933071 704.437950 0 ] (cb9-47) [ 125 0 R /XYZ 99.933071 685.490928 0 ] (cb9-48) [ 125 0 R /XYZ 99.933071 666.543907 0 ] (cb9-49) [ 125 0 R /XYZ 99.933071 647.596885 0 ] (cb9-5) [ 85 0 R /XYZ 99.933071 761.279014 0 ] (cb9-50) [ 125 0 R /XYZ 99.933071 628.649864 0 ] (cb9-51) [ 125 0 R /XYZ 99.933071 609.702842 0 ] (cb9-52) [ 125 0 R /XYZ 99.933071 590.755821 0 ] (cb9-53) [ 125 0 R /XYZ 99.933071 571.808799 0 ] (cb9-54) [ 125 0 R /XYZ 99.933071 552.861778 0 ] (cb9-55) [ 125 0 R /XYZ 99.933071 533.914756 0 ] (cb9-56) [ 125 0 R /XYZ 99.933071 514.967735 0 ] (cb9-57) [ 125 0 R /XYZ 99.933071 496.020714 0 ] (cb9-58) [ 125 0 R /XYZ 99.933071 477.073692 0 ] (cb9-59) [ 125 0 R /XYZ 99.933071 458.126671 0 ] (cb9-6) [ 85 0 R /XYZ 99.933071 742.331993 0 ] (cb9-60) [ 125 0 R /XYZ 99.933071 439.179649 0 ] (cb9-61) [ 125 0 R /XYZ 99.933071 420.232628 0 ] (cb9-62) [ 125 0 R /XYZ 99.933071 401.285606 0 ] (cb9-63) [ 125 0 R /XYZ 99.933071 382.338585 0 ] (cb9-64) [ 125 0 R /XYZ 99.933071 363.391563 0 ] (cb9-65) [ 125 0 R /XYZ 99.933071 344.444542 0 ] (cb9-66) [ 125 0 R /XYZ 99.933071 325.497520 0 ] (cb9-67) [ 125 0 R /XYZ 99.933071 306.550499 0 ] (cb9-68) [ 125 0 R /XYZ 99.933071 287.603477 0 ] (cb9-69) [ 125 0 R /XYZ 99.933071 268.656456 0 ] (cb9-7) [ 85 0 R /XYZ 99.933071 723.384971 0 ] (cb9-70) [ 125 0 R /XYZ 99.933071 249.709434 0 ] (cb9-71) [ 125 0 R /XYZ 99.933071 230.762413 0 ] (cb9-72) [ 125 0 R /XYZ 99.933071 211.815391 0 ] (cb9-73) [ 125 0 R /XYZ 99.933071 192.868370 0 ] (cb9-74) [ 125 0 R /XYZ 99.933071 173.921348 0 ] (cb9-75) [ 125 0 R /XYZ 99.933071 154.974327 0 ] (cb9-76) [ 125 0 R /XYZ 99.933071 136.027305 0 ] (cb9-77) [ 125 0 R /XYZ 99.933071 117.080284 0 ] (cb9-78) [ 125 0 R /XYZ 99.933071 98.133262 0 ] (cb9-79) [ 165 0 R /XYZ 99.933071 799.173057 0 ] (cb9-8) [ 85 0 R /XYZ 99.933071 704.437950 0 ] (cb9-80) [ 165 0 R /XYZ 99.933071 780.226036 0 ] (cb9-81) [ 165 0 R /XYZ 99.933071 761.279014 0 ] (cb9-82) [ 165 0 R /XYZ 99.933071 742.331993 0 ] (cb9-83) [ 165 0 R /XYZ 99.933071 723.384971 0 ] (cb9-84) [ 165 0 R /XYZ 99.933071 704.437950 0 ] (cb9-85) [ 165 0 R /XYZ 99.933071 685.490928 0 ] (cb9-86) [ 165 0 R /XYZ 99.933071 666.543907 0 ] (cb9-87) [ 165 0 R /XYZ 99.933071 647.596885 0 ] (cb9-88) [ 165 0 R /XYZ 99.933071 628.649864 0 ] (cb9-89) [ 165 0 R /XYZ 99.933071 609.702842 0 ] (cb9-9) [ 85 0 R /XYZ 99.933071 685.490928 0 ] (cb9-90) [ 165 0 R /XYZ 99.933071 590.755821 0 ] (cb9-91) [ 165 0 R /XYZ 99.933071 571.808799 0 ] (cb9-92) [ 165 0 R /XYZ 99.933071 552.861778 0 ] (cb9-93) [ 165 0 R /XYZ 99.933071 533.914756 0 ] (cb9-94) [ 165 0 R /XYZ 99.933071 514.967735 0 ] (cb9-95) [ 165 0 R /XYZ 99.933071 496.020714 0 ] (cb9-96) [ 165 0 R /XYZ 99.933071 477.073692 0 ] (cb9-97) [ 165 0 R /XYZ 99.933071 458.126671 0 ] (cb9-98) [ 165 0 R /XYZ 99.933071 439.179649 0 ] (cb9-99) [ 165 0 R /XYZ 99.933071 420.232628 0 ] (conclusion) [ 245 0 R /XYZ 84.259843 575.052842 0 ] (configure-default-service-account) [ 56 0 R /XYZ 84.259843 388.198913 0 ] (contentsbox) [ 8 0 R /XYZ 77.509843 756.850394 0 ] (control-1.1.12) [ 72 0 R /XYZ 84.259843 368.389950 0 ] (control-5.1.5) [ 72 0 R /XYZ 84.259843 164.143950 0 ] (control-5.3.2) [ 81 0 R /XYZ 84.259843 520.622079 0 ] (create-the-etcd-user) [ 49 0 R /XYZ 84.259843 500.585993 0 ] (ensure-etcd-is-configured-properly) [ 41 0 R /XYZ 84.259843 480.020658 0 ] (ensure-protect-kernel-defaults-is-set) [ 39 0 R /XYZ 84.259843 289.233496 0 ] (header_bottom_text) [ 6 0 R /XYZ 85.009843 422.718898 0 ] (host-level-requirements) [ 39 0 R /XYZ 84.259843 369.381496 0 ] (known-issues) [ 72 0 R /XYZ 84.259843 463.537950 0 ] (kubernetes-runtime-requirements) [ 49 0 R /XYZ 84.259843 352.740971 0 ] (networkpolicies) [ 56 0 R /XYZ 84.259843 663.033496 0 ] (overview) [ 26 0 R /XYZ 84.259843 283.881496 0 ] (podsecuritypolicies) [ 49 0 R /XYZ 84.259843 257.592971 0 ] (reference-hardened-rke2-template-configuration) [ 81 0 R /XYZ 84.259843 228.224079 0 ] (set-kernel-parameters) [ 49 0 R /XYZ 84.259843 799.370079 0 ] (setting-up-hosts) [ 41 0 R /XYZ 84.259843 237.872658 0 ] (title-block-header) [ 6 0 R /XYZ 84.259843 502.818898 0 ] ] ->> ->> ->> -endobj -4 0 obj -<< -/ExtGState << -/a1.0 << -/ca 1 ->> -/A1.0 << -/CA 1 ->> ->> -/XObject << ->> -/Pattern << ->> -/Shading << ->> -/Font 298 0 R ->> -endobj -5 0 obj -<< -/Filter /FlateDecode -/Length 2585 ->> -stream -xœ½š[‹£Ç†ïõ+tmØvUWõ ‚/B’B–˜r±k›0Xç"?oR4z÷hȈ™QWõ¡¾>ꢤª™0jHØ›Fu8QX¤\ˆ.–,©QlI&‘é ¶8^LN$+µ’Óûé61eº[b,Nu°‹Ï3l‘’p‚Bçc@,%x‹Î «¯^bmÁK1†ØRðÜ -〉B•À¶$ÏŒ¦°Åqr©¶XsÆ‹° Ì`Ktc,0ÐÖ±[ ¸uiÊX`à­‹fÆpa¦0ˆk5;c¹ØJ±ÀÀ\; ÐÅq/ŒêZÊ‘±À€]óš Ü5Wa,pp× -©¶`3€ŽÁ´cƒ»¦R ÜÅ1ŠŒXÕ€}˜ °WB¬U ÜUœ±ÀÁÝXਮœAc,pp7&<óÜànL Ü3c6J„Fà.’x8[XÆø{è¢1 ³–0$pWÜ9Ó UÐÚ2cAwµbù¨®-˜qrn1ËAsnŒ Ü…£2Ƃ±Œ𨑱 »jðÔLîjlÂXÀ]Ä ‰±Û!(Æø· ‚­Ku-H«•± »ÀRd,€RAª+I ã ˆC 2¸ ÷Þ 2¸+ÉŒ± ƒ»â{¨¶XŒˆk Ã±%gÁjR0¸+Šf:pW¤4Æ‚ îv·ÉXKÄÊX¢àÈX«‡VJf,ÈM CÈGu9 œ Š@€,ªƒ-^œ±uhÖ*cA‰°Åbd,(¶ d`,@Dš"ú¦élÁv¡ùÃDŠŒ Y¨Í± ¤Œ| ³Êt9†Z€kª«Ðia,(Å\±2 — -‡ž±€=\b,€Щ3”[pT àŠBˆÌ™Na ‚lÆDºÐ©2Ô[ 2ÔX‘efa,€‡F.‰©f:—žgVÆ‚ê9ôP‘±Ç™&HIu°˜`,Àúôd;1 ùA²‰4‡ê`‹%g,¨5öt³2Ô -[¢DÆìÍžoÆ‚&°cA“z˜ÌXŒC'ÂXд"ߌÎX€sÙóÍÊXÐLo"Å#ç¶Yîùfa,h[Bªƒ-š9·`òMЉé2l‰Í ZÎ=߬Œ3o"¢§Wµç›…^€»©LLî"2ÍŒ( ßDdËr{xSA|Æ•µgœ•ÞЛà[é•€½ðV…ÞàÛs$zi3‘YÖLo àV¡T¡×þ"ó&\oŸö+ªŒíPà3kéÙp,ÑýÌ9V5{Oµëýد?Ÿ¾~ ç{þù?§Ÿ¾:nÊÆK±ùÍsO¬s¿çÁ&ªr~»ËÜø„ZÏOÛÇä[?·5Þ(!?Œv¤é ǥŦÝh>6Ê«÷“†Ÿr~|óðàóñûW'¿J_ôÕBÞ¡Ž­Ú'¸óˆHõüêíéë?~û·ï_þ+öê§Ó?~×3|lÉ7ø­ Ç‘òãý‚ÅIé-¨ƒ%‡>aUürûÿúVÿS½Ê¯õ¾ùçùÕË÷ƒg3¦Ÿ^ßúìm¼õ g!³|-§N5Ø£yùµNÚlÊ׶Ýü«ÝøÿæjÇ·¯0]ׂ½&GV©^ªî¯oZ¬ï'TéÏTÚÚ¦ -Çx»våÛô6z?]ú|Á@êë-qLC¿"†—uªöåúîÏúÃ÷ÿÔåúÜ¥ºMïÿo ÞòáÙõÈî% Ûé׿8úÁúœ¶s&j¸Ž)×c’ôüž–Ç¥ù»Yëv.=µîaÕõ’}+Üê¿; €€'îÏØ£—ë—b8öô\ <ä~Wó( -ã'Š»ðöVf_HAã3Ùå¤Ø}íyM$²r{Ûfç–Æ[œ¯¼Ú§Ñ¬û"„[q”úþ½L„h™õQÜŸ^e^ÅýÞ¸»•ò4Áu›ÂÕ¡ïuW‡«áGÅj² Ó£P¶á–8ú°G{ž1§./á4}Ÿ:Ý–Ôe[Î /' kÏ¥OTÚo«FWcvá͇Ì6£Ú”¦Qs.ˆÏu"¢Ë‰_ÈèÚ±˜S¿­Zù¯Â:6’ÏzmÔ#¢Ë‰Ö»õ–æJ•Y«®¦mÌü2emu«sâ‰ì˜£›´ô¶3"6ÞÞ‹s_±ÖÀÖ¾‰ÂË ñ©?ˆŸN©Úi±BÒØz»Ð¶~§¸ÊÚ/KŠ8õ6U8šCÖ#¦þ÷ŠŠ4¥<Ç$£YÏzVi ÒÏæßOÒ.Ï“:Îf@½¬ºÛti)sÏîó¥UHýÝY{ÎØt›²M^Ú0¯CjÂã^¬s×MqGؘŸÉÊ](à ·Äinå§;ñ²3Í£šd–uÛîiö»Äy²ói—¹âÚSØiïìwÛóCx9›?÷­_Ç Kez»5Ø&\† -K¼0útˆÇitêË·ë1{9ýr:Ü\´[|‘¯!óÚ#&=ÿu^â÷_'?7R€«2i'[ïÄ»'ëŸßÕO÷Ïó†p›M}Ãþk]uÓØ ÓǸñÚWsY`5uT§v¦5‡›8έÕ¶™I^žÍâ d~ëÚ,‡}-Úx8 c=yV¡°?Šuél¹äóÖ%J½êréÐzÜ¢°wŠâ6`[–Ý™Ù7ä>Èœún¿ïKa}¬­°…½hKçËÍî]Ùñ[„À¶öŽ]÷AÛ=Äè/>^¿yÝo&çqºt¢}JŸvé|°.ÀãR;Šù¾8}Ž{aÞ5C³/ÛÎžÍ gZø]aߣ›´®f· -iÔ‡ìnÐá(&. “!›=–aS¾5Ór.Zìø”ÔœÁïe¯Û5Çg·ùð½ÇãíƸ÷ØGÂr7“¢ýmÜ„'(ÚÇ[WãÛn¼YúHŸ7ï½}¤×pz|¥?·ËY,=Uìß`²ôÖþÁk¥×<êwW'Çëï»ô -endstream -endobj -6 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 5 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -7 0 obj -<< -/Filter /FlateDecode -/Length 3356 ->> -stream -xœíOo$·Åïó)úlÀcþ'râ 1`F1Œ ‡Ý×F X篟bO“õjº¨]¤µÖzú ›EÖãäp5»ú󵥿J°çRÖœÂry<}:™sŽ†¾¶âb{úGúÆ?.†st9Æu±ÙžM.9˜åñd?ûB̨?HÝ°.êý§¯Nÿ7YzXbqô0Ú³-Ö·ÄtN«[­_~ÿå Jg(mΩ~ååøà÷_Oß¼§¶/¿þ÷ôñ«­ë)»ójb´nq.Ÿs¶)†­»”EJ¢/¨×{Ç:UßëA}ï.ßä -Á›X§Ê(aö 'J{aÎQQ{àË õ”Ξë½p-‘}¬^DX¯É dÄ­NõÒQ¨ ëvj‚…n¸ŽÈ™Òó-Ûf ²ô!Å[‡ µÄ¸£*|p@_ÏÖuZD2JóÁ|°ÒnuÒQ¨Â;ðÁ¢ÆuZDΔžï !ºúúµ|QîÍãÝ1Š¨£щèDô€è½«("Š-‘½OJ&¢щè!ª£øüî݉èDt"újÝ’uDY—(®N_EQ? Z -ì¦á&Ö%¢¬#\+PTÇ)Ý»x^D= ß^KèÝÚJCû@Ct(èDjĺš`¡®…åLéù–CÍ>déC†u1dÖs:"*}púˆz@ñUéëQÐaHCD¡ -ìÀ£÷åLéù~¢Ð›ÇºcÅh'&¢щèÑ;_‹ -D±å²÷IéÑDt":}#DuŸ¿Ñ¡;ˆND_m£’¾Š².QŒV_EQ¿EÔ‡ »i¸‰u(èWX•C$,-±¯HD pDJ|< VåÐ`]"Ê:ÂXà(Ôˆu;5Á¨sï1"gJÏ·l7š-|HÒ‡ ëbȬgw@ôÆ7ðtšFŽˆ®FóUÙÖ%¢+­ñæˆB>Ø}pD!Sz¾_‚(÷æq€îE1šÁ‰‰èDt"z@ôÞ×¢ˆ(¶Dö>)=šˆND'¢o„¨Žâó7º#t'¢щèkmtU¨! -º@1X«®¢B¿E4˜ »i¸‰u(èW0«rˆ¢!Äv¼ò u8ሔx{ Š¡º@t€ " -5bÝNM0êÜ{ŒÈ™Òó-Ûf ’ôat1dʹ½ñÁ |pèÃz@4D£ùÀªìëQÐqHsD¡ -ìÀ£÷#r¦ô|¿QîÍãÝ1Šb4ƒщèDô€è¯E¢ØÙû¤ôh":ˆ¾¢:ŠÏßèŽÐˆND'¢¯¶ÑMIG”u‰" vuEý€(•³ÚÐ`]"Ê:•Šrˆ¢‘ò?:ôˆÑðîsû@Ct(èDjÀºš`Ô¹÷ˆ(gJÏ·Òh¶ð!I0¬‹!SÎረôÁ |¦‘¢Ñ¬ªëÀ‡Uú°: iˆ(Táƒø`чpD”3¥çûˆBoèŽQY'&¢щèÑ;_‹ -DEËEï“Ò£‰èDt"úFˆê(>£;Bw":ˆ¾ÚF×E}e]¢è¾Š¢~‹htI}+1èQÐ.W”C$,MA}KwLpÂÿà>´/é?ŽºD4å`" -5`ÝNM0êÞÎ9Sz¾e»ÑláC”>4`XC¦(oé¾ñÁ |=+oéŽiU}X>¬Ò‡†h‚£5ÒQ¨Â;ðÁ¢Ç·tC¦ô|¿QîÍãÝ1Š"‹àÄDt":= zïkQDT´\ô>)=šˆND'¢o„¨Žâó7º#t'¢щè«mtKÔe]¢¸}Eý€hIo*âWO10¬#\¥(‡HX šœWßÒôˆÉñîsû@Ct(èDªÇºš`Ô ¼1œåLéù–CÍ>DéC†u1d²ò–îÜÀ‡>ßÒ\Q}(ŠôatÒQ¨Â;ðÀÈÊ[º!Sz¾_€(ôæq€îE‘Epb":ˆ½óµ¨@T´\ô>)=šˆND'¢o„¨Žâó7º#t'¢щè«mtCÐWQÖ%ŠaÕWQÔoM!rq“øÕS ëWÈÊ!–ˆ¯¾¥;8ህpÚWôG]"Z²r0…ê±n§&XèðÆpŽÈ™Òó-Ûf ‚ô¡ú2YyK÷nàèIyKw*Eõ¡ |(Ò‡†h£5ÒQ¨Â;ðÁ¢Ç·tC¦ô|¿QîÍãÝ1Š"‹àÄDt":= zïkQDT´\ô>)=šˆND'¢o„¨Žâó7º#t'¢щè‹6ºŸN×ÏZŧþôîdÓþ­iIÑC±©„ÅÅíõtŽvy÷xúæû¿ýõÏ?ü¼ÐÅÇÓ?ÿ`ŒMü×òî»Ó·ï¨ê/­œ:œñqñvKаò|_å1§dŸ}=aV^îª<‡ä½[Âõcy†•¯÷µÜ¬ôß®¿gyXù‡û*w)X³Äë/ÎV~y~å!³/Ñ™%]ß =¬<зQ€ë·?@«V®ê×ôü$_OüyŠß*ÿË·ÿøỿså.Cm0ÑÒw6&~w ÕÖDWX?‘¯•®{…q|Ù¯ß?U±hk䇽‘éÚ0jŸ ÷ºöõÚøk¬M§¬ÅrÙ5óœJÖ¶>¥ýþ¼'ër­+¼ßc×çüõq¸ióÓ±$z[ŸÙÛ!‡–ãoÿOÜçýÚÚµ÷õus")ÞÚIuzŠá.×X=GÍóýñ–“¿µ1ï: ÂÐÆÉû½Oq¿¯Ý³•{ªr2è¹´û½ï¯·¸—ÝŸ´·«|®ÿr.ØÆÄžÇ}mù ‰=¨cxëGÜûßÊìùØr¯mu¤Ù=g>³Oulmã¾å£Õýªù“ÓÑí$±õéã^w:Ö¹ÏPmÌ‘ÔßÝA ±´:Ò®l.§úâ?Ѷ÷ ŠÔ6æÕŸ©¹ÔÏ&wîíJûÄísÈsáÇ=º]êŸñLUîjç3­ÞêT¦Ø2´ófJpï¹–ÕaبSE³±bäÖë>ùÛºøîen‡×‡áÖ–_+ѧS,d.52Mûwê«ѹÅÖJØôúÉîdf*®åÜnY²ËàÖí#í?õRû§Ü›sôv¥ Öæ ^ìå¯Ë"½pZiGnê×Rº>"™‚Å[™v“i¥6eÚ-º/”«¸?4½®`[Á®Ñ–Ö×môMIÏf¸öÊIܺØzSïí6ÚR‘}­Pá[`E¤;“=ʵ÷õU×U&b9ûý*õ¦ÄÔÚL"W°,WÈ7~V¶Þ€¢p,Ok+ëúõ{Nbo:¦Î‚ý­¬Ë`çSâåDaý­ú ªÎv͵ì:Ó5Z»[ÉnHè>)R} s¿6­ê@föçÁ5z»‹¥ ¤ÐË­­œ"]Nj¹½¶ØʽTá[×–yn -u_zâmËÑ®Ò4ñ—uêš(§ê@óÚ7î ^NuÞ9ȧ˜•Ò‘ç -ÛÐCÑC½].†Ç «¹´TšM«[÷ú÷uªˆ]­3ÏöÀ†>¤rÁ+RÙì²Lê©Ï:AË­—\Òesîcóe‹QÊ×I·—î*¤ ô¼¶æÕIªOR¶}Ôu¹Na-?}®DÑ´FP8–cÊBævÆŽ* ö,Yî±×Ërêsçʹ;nSèàu Á˜oâe[Ø­\‡~iAXv¦¯v DnM -,ó4ú°ÉÖ>;Ùuí2mŽœ~;mËœóÑ­õ”^{ey¾b—ÿQ™ïèûߧ°|ßÎ[®ë¸3}¶p}n2®dÎùfágeçÖ.vl@t¦}–má²±†¾Ž;óuàÛ Oì­¤í3¨íÏ¢9‡ »>tõ™ø„x¹ÉbßȼÔ^°¯—¾uŽÂx»ôU/°;tYø9ÏKòUÒU-ÊK:=ÜHX)]BÀ•[&šY$驯íh…¯±à¶õÒós—Y¬ºi[/ H°ps°¢â`1è*Ú£4ún¼^ìûÞäÔ¨jŸÚ»ú€jïXUû„§«~»Lò²¯9~© ^ÎP¯Ë{¾or ÞZqcÔ·í" MAÛBѧ ÒLÓz¹µ)í·µ´l=.j–rßS°úf:¢+=‰]I‡²µÞ¶âõÝ’ï ˆÃ9sï —ì{É¢h ïîjà’¾iÇØAÆn«íÝÜÄ;S÷ÅCÉ»æ¿{ØQSµRâXÖ~ah¡6{ç—µnwJJ4‡PGèUs(pÎñì{ž>ø8o´ƒŒDvЋvo²¥ñ6hÂ=±~þ ¨jÿ7ËÁm«Q»ô¼(ç:<ÍOÖýÙïÿJ´îôË\_*Ƶ_7½ùj³´ÇÃÖÿGq~ -endstream -endobj -8 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 7 0 R -/Resources 4 0 R -/Annots [ 9 0 R 10 0 R 11 0 R 12 0 R 13 0 R 14 0 R 15 0 R 16 0 R 17 0 R 18 0 R 19 0 R 20 0 R 21 0 R 22 0 R 23 0 R 24 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -9 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 671.061024 504.679134 638.361024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -10 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 489.361263 663.111024 496.429134 648.111024 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -11 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 626.361024 504.679134 593.661024 ] -/BS << -/W 0 ->> -/Dest (host-level-requirements) ->> -endobj -12 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.881526 618.411024 496.429134 603.411024 ] -/BS << -/W 0 ->> -/Dest (host-level-requirements) ->> -endobj -13 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 581.661024 504.679134 548.961024 ] -/BS << -/W 0 ->> -/Dest (setting-up-hosts) ->> -endobj -14 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.893245 573.711024 496.429134 558.711024 ] -/BS << -/W 0 ->> -/Dest (setting-up-hosts) ->> -endobj -15 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 536.961024 504.679134 504.261024 ] -/BS << -/W 0 ->> -/Dest (kubernetes-runtime-requirements) ->> -endobj -16 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.809749 529.011024 496.429134 514.011024 ] -/BS << -/W 0 ->> -/Dest (kubernetes-runtime-requirements) ->> -endobj -17 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 492.261024 504.679134 459.561024 ] -/BS << -/W 0 ->> -/Dest (api-server-audit-configuration) ->> -endobj -18 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.857357 484.311024 496.429134 469.311024 ] -/BS << -/W 0 ->> -/Dest (api-server-audit-configuration) ->> -endobj -19 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 447.561024 504.679134 414.861024 ] -/BS << -/W 0 ->> -/Dest (known-issues) ->> -endobj -20 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 488.869808 439.611024 496.429134 424.611024 ] -/BS << -/W 0 ->> -/Dest (known-issues) ->> -endobj -21 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 402.861024 504.679134 370.161024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke2-template-configuration) ->> -endobj -22 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.053890 394.911024 496.429134 379.911024 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke2-template-configuration) ->> -endobj -23 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 76.423228 358.161024 504.679134 325.461024 ] -/BS << -/W 0 ->> -/Dest (conclusion) ->> -endobj -24 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 485.053890 350.211024 496.429134 335.211024 ] -/BS << -/W 0 ->> -/Dest (conclusion) ->> -endobj -25 0 obj -<< -/Filter /FlateDecode -/Length 4642 ->> -stream -xœí][¯$7~Ÿ_1ÏHÛñ¥|“D -ÒB¤!v'9‰Ð,RÂCþ>ŸÝm»Ü]Ý3sf7D@ŽÎžé*w¹nþ\å™éè³ÂÏ"é)Æüzú꧎÷è³™RòF»óßdÙ)Ä”X ,¥­Àrn -Á8/°¼ž`bJ j¸@†¶¬5(E'± V„–‚¶[V‚&h’XPC'–VÐC¥DQDÖ<í&§{‰gôäc2Iäðt0ÏÚÉÒNK¼4yï]”x]\RZâ9èâ4‘’xÐ…l ÏCë­yÐÅÄ`%^€.ÞI/BdWyÐEy¥%^²“K‘Hä%ðT qË3ÊM.Z«$žÖ“CnZ‘‡… ù ð tñÊ%‘]œUFâYèBø‘xÀ gCŒÂj5yu[eµÄsÐŘ@"º ø]Tð`M—$ 0!L” I `¢(R”PÀÄ4QV‚“ÜD> ¬Òà-UÐÅ‘—ÀjèBX¹"ºØDX]0@Âk¡‹!+aÚ²E ¸%•´„xKJ{ ,j* ,×FOX@.R)IX`¹Ø)aèb¹ ,P×:o$,°€]KÑKX`»–´’°€€»ÖâN‘]À'«£•°€€»V« aw±ŒŒ„ˆê„<ô W&£’°€€»&*’°€€»&` ya´p×8˜ íÜÀ]㔑°€€»†Œ—°‰2”X w!N.  VÂì÷à+a„Me‰„¸«¶?aM­&“—°ÀwuDøD^št€Ç…u /OÚû$aîb£²8à.à3JXŒŸ°£ pW[ìÔ¸«MR8à.ê'aÒaÒ($,Àþ6i…ÔyiR)F p°d$,À.<©$yaB"i Æ“B*aîb{Oxà®rÖJX໊Pöˆ<èb£‘°u xX¶ÂšF±:)¤xÀ]¥a‰ÜU*$ 3JXÉO¹T”°Ë&RäAÀ„„ˆOn¶„h~Ðl¢ÍyÐÅ:’° F“ÛÍ(aAŒÐÅ(#ar3÷›A‚¤  *> ’òS.“%,Œƒ§”„IGô›†$,ÀºÌýf”° Y…~-ž°n“õ¹ß $‚.%ŠÈƒ.(š’°nIè7NÏC“H‚ä}î7£„(3Ðo¢¢bî7ƒx\Üu È$ñ€»¨L½„¸@¿‰ÊVêí€×Ôg23æŽ3Š' -Ðë°·ŠG -Ø‹Ý*ˆg -à›{$ñÐj¢³Œ^<5À¶ -¦Vâ±þ¢£ &̧OüˆÊ#ö̲‘ Ë‚PÝ·ž£³;Ãæó±¾=}ö›ïùÛ^~QNÊê¨[ò¥±ÆºóÉ$Äûà %Ñ”×®Õœ~=yÊ[Ó³žu4"LÕÔ±—£ÔÈÀÎœ·×‘îQG:›PG3ýõÂíaô+è„¢sMGÁØG·ªå²ÙséÍz6#ó”ìïËé+„þûARç„–èR9SÓ:kT7åø†Ô㯱ã,ç™9þ¡˜Ên_ Iœx;æBÚÉ…4æ‚Rk:vóõ\}n©C.è\`ô|ÆÑra™1ÇKÊ¿“ ~Ìy+ºF[ÒF·ê v'½YÏfdž’ý}ùÿšü™¬I<¿?å³ArË=WUåà K¯Šaôë@OªÓ¹N/Û€,L£­àÎdÑlÔ=£@¬‹ýÖ-;ºÄÉ8‰q4 4ÁÜë@çês9³daùÚ[—ßÍ(fÉ¢Ù¨{ÌZïx(ãjvö•ã¤Ý×Îíàr6öÉÂLîГ˧!Å>Y4õûX.äÓ³;ÒÒÞ¢39‡i©Î(ËJ:J"aÌÌ~Ì–ƒ=ûù(-˾µGVí‘E¾Ú¦‡ãÃè×xÞ°GvLă°±¶%õ¯ýõ%áÍ@ßÚ' «ñ’E¾2^ƒJÌ¿!^r¾Þ°Gv€‡<^Ïâa«°†x1ú?úÖ>YX—,ò•ñôPbþ ñ’óõ†=²°|g">¾;¼¼?ì-:“sˆ¾3îóø>س¿¾$üè[{da¾ {˜òþËè×xÞ°Gv€ïLÄÇÃ÷!^ûëKÂϾµO&àûóñôë‹!^r¾Þ°Gv€ï<^ ߇x ¸/×µ{ô­}²0ߟנ‡\_ ñ’óõ†=²°|g"žÂ÷m¯ù›/OÚ/Ÿ†óg¶¤Ñ¢¢ÎWúòÃé³/þø‡ßþé¯g\¼œþöK¥lPŠÞã÷¢”Ëo.X¼ÍüÅ5ôSù*”ÿjü†yŒË¿nçÒ|¾¯Œóã˜J+òÜ2—e•×iSæ~7ÏÙäÑC Þ×¹}i6¾L³=È}¥Óò7Îó<æÂrË,¶†Å—®kË­Ðu©>j6Õ|\rÉ99-ß«}a+«ø¶æÀ ›¿æ5õ|­´æOZr3ŒkÂùC?ÒÚ97Ê|U†c¾Y­¿6†Å®¬åºV¾¹ßÞ²æj.)9Æ8Ást½fM)£7݆8úǯýcvU¼Év]æ¹ÕûY׬C¯.9çy~=ç`ë -R½šäièŽà\y?¦Þ‹Qkü«ùÍbËq”X.ÕyŠßÞmsÐI¾‰r,K ÍÓg}·1aÎ!ök,y>aÚËκdÁ}ÛÖ]Íc¥†=«Ú ®ËÔs½è³òÝ&Ž›øú¯}QãÅó¾ÅøhYåɽ8ÀòºÕ »¥‚5i" µ³yÍeUû¹œ£Øñü­kƒ]cΣ{ëv8¢òùÒæ¼kª¯Z=Uì§>ÏÑÞ[î³=·Ë½uo«¹ŸF}¥ý×f7| ¯ÊØ{ö——CŸùµÏîž#öëÄüë­.¦Qh¿Òå‘ڇɱ9»1ÚÈ1¾1lôÙÄê¦ÿå?£'ùÞZ›žäÐsrçÏÆŒX¥µœ½:Uû2®åܵ6–õ«©ÎwèçÍøy˜ÇͯnZŽ­‡:ÈþârëYG$ätÝߊŸjMÊÖ-¯Qö‡¾W›—½»ÖÙCO•× -h&ÝÆÌ]¼¼»?nûí÷ËŽûçߟ>ûõÒ¥¾(ïVÎN.©(9•§_ó—ØRŠÊ<ý厶CG{¹Ö™)ÎÆ3¬Z¯/³ò[݇òõ»c›¹\Óm68½ÕŠÓ¶™‰G<Žl6µ6^öùî’{±ÛF/·û»õyHíánÛï³ßÚüõ:—×£?e¿9´¿öFEçÚc±c­|õ€†Ç8è‰(.ý)é8Æ`¢[lÖÌŠáͧÉbþ!à¨qúSþñÇþ¡—^¸åD]Ó¼G«vWßç#÷µÜíÏ×Gþ°¾UHNÊ7ñvîèq_á=Š[ð~Ρ»m0/é×&²ŽÓŸ±)cžeý&ßO×gªf¯c=ŠÔ?ÙÐ×CéUøy'ë1>M¾Ž§ŽPײÉsúS¾=ÆÓÁ®Uù -[Ü´¨ Ê+N¿Ó–4å"iù²û›~ÉŠ”•p”³æx·£j¼ò‰±vøŸzAZ+G5qÔkýdçýK\Ú=q¶ãöÙ?ë)Ä^iÿL㹞åÐvíÇmo³#×ÿ<Þ‡øiÞSÈß݉¯î#ÿûßSˆaƒ_O¾§ Ï“4­ã°²§ì©ë3âÀâBK~qŸÒ#ž»j9C,˜@[¿¶‹y7j‚[øUtx×õçgÞcúÏ®ýWûv~FZÏ[k_·>C»+ŸW=!­êä[†üÝ蟿ÀO?’þ’/µ’õîgFœÅ2y-§_f{´:¬S½Ëyß\§ø|ÊÈFÏé×\,¬Ž»Eì_j-ÞñN‰õƒÙyÏ¡ùà¡ýíÞsä˜lî8RþZ8§?ìŸAÌ¡n`Îüññ9·®ÓZmU÷2¡Žê‘”{0¤àÕeœ¬rKŽ–˜ò¾”ù»Jóûûr] ô5ÃÔ†Ïøqü½vàfÃzä ”5ÝóÁƒUQµúºiÔ¦}C¡ø¨…ev m¯ëæ»9üÓÅinË]²ù»ÑËã¶v{,wÜ“­;ŽbŠ·óg[w§ùx‡…Ÿpâã®òN||tö '>>“ú„ÿ§’ëÆ©Ì'œøáäz»|Á78HËÒ¢æß^¾:zÇß.ݘñÒL_>r³c`þ -ßlŸA½‘Bþ2üÞi×z7Û=ÙZ¢b§Z»ØpïâÝ[‘­âŸ|y ƒ.åQ>NÚä§öaåNŸC:ç‡@DeIW—׬ٹ³äOÏ-5§”ÊODÊOÃ(!áËø9ç>œt¢É×Ó£ò¨2UÈÑÔ‹N¾žò£êH £H4w’3qy©š,ÒíD«Ò.'ìKë‘ÖMjyÙ½¬«/«Öäû]½-?BØhêUÎßybˆ;½Þ’³õjÒ 9?î/Nv¹òMÔ€©»@âc»À~ãM²¶ŠÝ–¨Øtl¨ê£óãašë|'6Õ¹ë4 k çñr´vM½ŠÔü±*ªzWi–)•ÕÕ‘- Ôâ$.'øFUÑ„`6>‹Z~TËLŒ5‘¨Kuœ@ºœÄq‹4×"Ú¨ØoMÕó]•žê66Ç ´ ;ùù¥l([_ŽdŸ#Pc?!½„ /ÝN¼œÐ›Ð†|=¹ Œv+”«©Ç‰–Émä¨z¾tjˆÕUXš•–t‘ÿ¡Â5jFžò"o›º -àW}’ˉ‘G'qºo¨C’òWiô† -Ù!´œåþÒQ ã3è¶ÑÍc•¹ŒÑCªêejà1’u˺FÎVýÓ°’UU"±¾‘]Kåë@îzº¶Tj“yÍÒÝ5¹ìv^99´ˆëü䡦o“Ër¾/ec£59§~¬“t²Qm·ë“1bW  ÐÉF¯…\WkC§üú²/2iǽœ¾;•mÎXg^x«óƒôxŤÏ?bÌçøýljÎ_ÔïÁÌû¸Q -LÃÖÌw²üØÕx'9?†µÛ²aDC ö;YÇ>ÖÕlhû¸1 ¯©ß®:°×‘º!¨n\Nt݇ŒlZêm™gÜñ²òb+džMß°çK[Ã4ùáM«ü$¦ .cçÙ¾%Ÿ™H\å¡}K— »\(.Ù„©k6¨™’OÒ\Ÿõ' -›çb¬ŒÈ—¶ó¨o³\t¥+Ø”À–_pÁ¤ù¤iÐGPúÕËëé¸/*ûº2µA{£^9µ–© ðdª-—~¼l{Ž=狺x»‡š,ËÖžmEN_½´ á‚ç(£Æ~Û2ÀñI©Ò†IëFÑà4UiMb¨:ùå¶ê–bq½ZMÑ©ßqO;•æDÇ£â7c³ÜºãµjɶÈñtÝ:ÕG¶Z2 -4ÏïnTê#m¥mç¦qîºÛž™Ôñ½2Uý6·ù*ü{ÍÚÏÉ¥Q醎ýYg>ŸÀkly|½ŠÞC(?4PdÇßs|î±=ݨç|&Œ¬UAçÿ¬ÂŒt›ÁDÕÿI|[R¢I9@8Öé0·=¶*O¢ÆËáN» ¹UÌž·¹èùy¹Aí¼Éá7'Xoÿ Ñ¥€ -endstream -endobj -26 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 25 0 R -/Resources 4 0 R -/Annots [ 27 0 R 28 0 R 29 0 R 30 0 R 31 0 R 32 0 R 33 0 R 34 0 R 35 0 R 36 0 R 37 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -27 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 445.281496 409.271317 430.281496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://releases.rancher.com/documents/security/2.6/Rancher_RKE2_v2-6_CIS_v1-6_Hardening_Guide.pdf) ->> ->> -endobj -28 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 418.281496 162.214732 403.281496 ] -/BS << -/W 0 ->> -/Dest (overview) ->> -endobj -29 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 403.281496 251.801646 388.281496 ] -/BS << -/W 0 ->> -/Dest (host-level-requirements) ->> -endobj -30 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 388.281496 203.586314 373.281496 ] -/BS << -/W 0 ->> -/Dest (setting-up-hosts) ->> -endobj -31 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 373.281496 309.303355 358.281496 ] -/BS << -/W 0 ->> -/Dest (kubernetes-runtime-requirements) ->> -endobj -32 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 358.281496 284.198131 343.281496 ] -/BS << -/W 0 ->> -/Dest (api-server-audit-configuration) ->> -endobj -33 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 343.281496 187.304576 328.281496 ] -/BS << -/W 0 ->> -/Dest (known-issues) ->> -endobj -34 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 328.281496 407.493297 313.281496 ] -/BS << -/W 0 ->> -/Dest (reference-hardened-rke2-template-configuration) ->> -endobj -35 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 107.173228 313.281496 174.285045 298.281496 ] -/BS << -/W 0 ->> -/Dest (conclusion) ->> -endobj -36 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 293.575760 152.481496 483.355790 137.481496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/) ->> ->> -endobj -37 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 84.259843 137.481496 285.368241 122.481496 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/) ->> ->> -endobj -38 0 obj -<< -/Filter /FlateDecode -/Length 4975 ->> -stream -xœí]]¯Ém}Ÿ_1϶¶ªÈúÙ$€ãd`A´cÉFpeÀ΃ÿ¾{ºªØÝœ™;wK–pu§Éú`‘¬C²º§Î¿ ø§rpµ¶’ù|ù|úÓÉ»’<þ,-6 û~J:ÏÅ¥ÐrMçÏB âJK±äóË ÿì.uó—Óo~qúã¶O8G×ZŽ!ÿüQXL®ÔR|2X ,È`¥äJ‰)¬–ؚł©pä#«@ n5Y,ˆÁ1VƒU!q td5ˆK`‹1BKÅ`9BôÞäAÏLÑà…ä2”ž-^ .×›É+à…-‘Ë…C -¯¹œsª!Kj>X¼YR`ö²0Õbñ2d¡LÞäA–X Y¼Y"´Ó ^…,ð®jò ‹Ï>X¼F.µÊlòx¾–zäEŸ\ªDÞâ…à|“LvŒ”‹Á‹%ûÔLdIä£Å#ÈÂøkñ€‰J­Æn²»ÉS°x ²ÄXØäAßB€˜!‹/Ù‚ì '¸da@,Åq‹l@¬ä¸rµP Ö渲` ¶ä8·báù^ ‡,‰³… cçš<ÈB-, YÐÀÂ"È™,,  -Ã[,, À-û,, à-û-, .Äô—jf  Wj0—€@Û½XX@@]J9ZX@€]âš-, à.qð0p—=Md[Xtt*YXÀÀ] -¾XXÀÀ]l£ha¬êà‡ÙÂøŠ‹µz ¸«g ¸ B€É+{,,`ànLX‚¹»1ùhaw#Çlaż™ w!ÉN ÖÂÄ{ð"YX€Á\DZbaAðgìi • µe p7T˜Ïä5 -4nì[hÙ…œ›… ¸‹@E$à.à³ZXŒwˆ¨Ñ‚Ü „Hmñ€»!6oaAî"oHÀ\@`aâ› ®kòšó­V p°-,@v¾IL^qp¤`aÀØyä¡dà.Â{³° w}"²° w=#í1y…j´°y xضƞF²ê|RX<à®°°Åîz_š…¸+aÓ‚\„«…Ð! ŽäÊ®•’-,È̓‡”Ïäe‡ëdaAñ $@–Ƀ,\ØÂ$Ö®Q«”Y(F J„,H,,@FàZ@öm–îbÖ Y)ZX$sµ1[XPRF=­Z¼]-€k“WÁ Å‚RØ! PK¹ŠMoaÞIºdaÄ/°…¥Al Š\ÈÌ-^€,H²-,@¦ ^ÔY ZXPcE•™½…ˆÐ¨%¡j‹Ç^êÌjaAåì$U´°Û•&ÒäAÀ„…°ÛÉÂ?(6Qæ˜<ÈB‰-,¨5J¹Y-,¨²D-,€oJ½Y,,h² ã³° ùì$M¶°0ž÷´PQoF¶°ûRêÍjaA#z%ž±oe©7‹…!KBŠbò ’¦fì[`êM “ÅË%6¶° å,õfµ°iêMdôæ‘@•z³˜ÇÀÝÔ€L¸‹Ì4[X€ Ô›Èl­ÚÞxSA~f3«TœÕ<1ð€Þ„Øjx`/¢U1Ï <ÀWj$óÐb¢²¬Ù<5@X3xóØÀ‘ñ®§Oúˆ*à -bf-²È†mÁÈîGÍ1›Ñf×ó±?ÿþôýßóïÿïôéËIYÿêÄY -k&9“‰ öþ|BJädïRÐô—SfQØž.rŽÖK•{ ¶ÞörRtTô‚â·/[zE±ÐÕŒ¼½µ’OQ/z=Šþ:#éÜÓ‘0ÎÖcÆ 5é±ãÔU›:ÙÐÇêÕŒJS¶¾/§ßÀôÚŽ4¸ŒM³X¢Á™C‰‡A'±oiÓþg=Ïû;F2 ”=~Ø8|âÝÖò _È[_ð~OG4Ÿ­¡S>R7¾nø‚¢C§yøÂ:£ØËò…zÃêÖäíèeÉh=fÜP7¾@7|AÑÇêÕŒJS¶¾/ß“ßÈž4Ás™MŽA©‰(ó(úÆ<Š®‹ÙÔÔÛñ…#öF9!ØÚG3ž#oÔ¸ÿã9òf|µ®—-}hA™IiÌÖ»Š»Î"e¹P¿tS²HÛâÖVüRt…u¢ä1êÆÂ-W0Ï‘7ȶw“ñy3þÎH»Âª…œJc¶Þ/ßšßØÖ4ô‡÷'”Z×Û¼Yv]ïŠz#¢pBFýþóéûÿõWÿü¿EŠüþÓé¿ÿÁ£°ÃOĶ+Ò[Ï ?ŸðSåàèú;ý„ßyýLkÛËÚOúçk[¡ ­æŸÖvyGãëç…–Öq…V×öiÎ/·}–öaåóU¾E¶ËJ/ëhœÚú9åÜË»Žùéú“.kZçÌòóËÿ9¿ÿõ Ý6­ÛE}‰«øCD K« -bšâ-*ýI-QxQ1ÿî8¥r3xÙvNB¿ˆ~ㆴ.áÃué}i M™º«V®yUÓ¢ŽËÎTÝ ~ZûfÕ?®ªZUßÍÚÍÂÖvù:nï»´+¬&!5W7ý"KT®Ð×ÐÍ©i£ÿ]½ñ^o·äïóŽñýu¾ÍÚW›‰½†ŽxºÕ2æ[w²ì¾Åº»ò§Û6Y~ç~ÕÖ áîº lJ!ú¾î˜çšÇ¶¿Ì-²÷Ù´Úz‘y•¥ûÉò¹ËRÖ1׶}Ûk[zºÊú/ï‘\¶4@ Ž#×¼±WåùŒxÍÉVõ£,{KŸGùH+yòy|3ñð¦`b^9C`ó­zÞ ¯@oê³^M0.©ñwc‰ïø·ÿúñ?ßM$&š¦§ÕD‹z»{^V_T[e’åwˆ@± )7×äÖpÛË´Ý­—í\væC)ç(¶š’6EÎXo,Ä–õžîòu—éWq/¬Ê/×}?°ë£R˜Þ•Õ÷ÕË=RôÉRØÓ]¾®Â´¸ò Å+¼ýMcq>Õ¸ŸÇò`3ö@œ'p pë ¿‚k¾Ðƒ÷Œ{n¢wj”Ò×3¯`©déà<¤z·ÒÌR¹ bØAC¼¨çhíÌ­dC°>ìK':àg•ë­kÔkº©·5ÐHnjÀ™£ÁÍ÷ Ó~­kýœw ®I%%÷dï¹ó"SSíïä·K¡rÕ0Ùsà®—O÷íÐѺëhŒÑ}‹Uày Qº+y—<ô½Ôõp´¼‚@ƒŠ“äñ®0à¾Þ‰OwùÊ€WÃw£«à%RÙQß$ŸfÖzì伎ƒ„ëÝf¸në¸ì78ë56€ÎÆ(»WÂ>y­±žîò•s1ªCÜûÆêÑhI¯¥Tá+‡öÈXìQÉç"?>0Ö¡üQ•²eDù=JGU²ì«W^Ûj|IKîîvy|Ê.g‚/:¹[¢¥Ý81+¤•ÏýÝS§J¦· ¬Žp*¢,ãÖ‰ y»½âÅŽJérW'i¯“½ Ëœ£¼•ÍŒSš‹ÚäRoJÔ^Nònœ4*¥éS#âe•-=ˆîËu×ÿÐå]=•½žžµïýr˜šå›w³½’ZOÏþ¼Z«ªá4ðÞªãn•×3¶j0…‡rãõcn÷Ý=Éã­;ßÕ¸ý8êx&»=œnNÝÔº×ëe=}ìUsÌB­£ˆîÀny¸ ±;d/ˆ}æ"÷È$èšØM{¿Ü×=}ׇïéÈæ7ÕÄ°»¢§ŽUfÖ¨;çèb†yy7HÀm÷ûÓ]vZþœ¾d|‡·©·ö{u|¯|–vRÎõ‘ Ûî½’<Í™¯C¼ÒOwù&ì‘RR¿Ñí‘=²<‚*û‡{ÖŠ sÃÃH®Â\9¸ bé²çÖاï‚轧«,³ê5öîáŽÄ \Ý¡úyÇF›?¡!«:ê½wt®t÷º'!e'ÆÞÈUº™P;qÁ¾3µÇØ®ƒ½~¬Û #æZw€Ô)Ã8­ ÞŽºz¦9îþh^ûȽ»c‡nÎA÷7^o¡R¯2öüž¡ïÏkÿ?+øð»uŽSöŽàcL-'ûM%?úª«{ÈZü^c¼¬2t $}3¯LP7v‡þzÆ°FwëƪY•7ƒÍê»3ê]ïDÂQUYÙ‚XVäëûFÒµoæ¥Ö®|E-a¤6öÍÍSø¹³ï"l÷æJÞìØõ2zôŽ»™¿ÿ§Þÿû?þÖŽ £äÔN}à ^oß[ú†ëvµê¦®–â¦-·¼v›qÆŒ)÷Ü[¾‹¨Yð &õç~˜ôq]Yš«×1Ì,z­G¬ƒ­<5·¹U´OÈ°I²Ã²žÐ™Éßxº•ö:ý¢¥·²Ú,›uëC¼}Ÿ›¹†¿{ÐðšDvóüJ›òk(I}ß]þ®.Ó^—Où€>„¹»+ÝN”ïQ |&Ø´IÎ-ÒI·|®¢¬jçZH¾õÿ8é~¶ËWNºq7ºú’I·§T!ý~ŽŸt?yònm¢}Õjß!©O„ÒŠsÌA[™Q\`þl> õt—¯ë‰xˆûÀ1úñm}3 sw‘KAO`[ÍŽ&ßëÅZJC9ÇŽS]¾Æklŧû|q!Ç!v"W3ÜÚ>ˆûd;7òäÆef,t'ã£ü¦Çó~Óc¤¤:6ís–§Óë{dò½Í)p? ;@Îîo1æ ÆÝ£?ÖË-és‚š\ Œ qn™º·Þ?'x¶Ë7áßTËzcŠ·„œþÉpÊ–‹<é±›Ã<øW¹”$r·Ž)Äo½ÎϬ-“Ü­‰ZÒFIî‰íÏvù&ì(ïéR¿ÞŽ§4º/cŒç;í®/¼»q0}ëûcá¾WÇ|ï–oÿÎ9³CêEæܨÁž<ߟ<=œüæ‚O¾}rão¼òí­ù×®üÝúÅë’0¢¼¤) ú{ÜcSÞ»Ì ÎY·ÎŽɼ"¦#Ñ«é&9r—'Èk{†êò$ѵê‚2o‹2ç=âå„iiO}1©òò·>T×nôƒFJ¨6¨©·áa'ƒt9Äï|šaÌÁWV‹ãd±vGâÑ®õvér2Û­£¥a©2ZÕÙµuÍOQ¦«SŠ7hu¦È{eÕñÔ?nÉrnØÚWå7ñ@¼œ8É/§TŒÖib…OÝõ4‘Ô¸ƒ\ýô—IE®³ª -[³Óä$òï*Ò  -ò,äflèè«9Éå¤È[%iz¨Ã–—ÙV©K¾uE:Æ®Þh/ ;Zm¨JeŠ^ZO@j€Ç–†× ²@X×ÏÀJMô]ùºî §áÊ/ò”3­šü˜,åîiŒ;Éy`ç‹&—añ o„òŽq•Ïwâe l¼'‹ë×>É$G?¢ÝœL§`…Iž0ú²ûnè$o¹íç&³"îåô‡Óæ"¥(çK™‚¼àPgLáü´ù5~þ÷Äçûu®q<úq`놬#™¼·¾’,¯Çíım1²‚ýIu¶MÝFQá5Ïî~{o‚†ÁÕÄ4u¨Èq¸n ¤4“î/;-ŽDæçÚfìë%õÅa’w1u©ä &J\ÖÉ£’ÏjH\IÓÒÁå¨:âBŠK5a›’mćԓ Õ‹ü¬MA2—ºPi„\Òäñ ³zèN[V¡š &}¡æ 'my ¡ß¼½~¶ÝW‘sßBÐ>¨/š:&Ôx6•–˼½1‡ÎrÑ7ïÔЋÔÞ£‘äÌ­1S Þ\hUÔ:»­ ’ž”;m3i.äõE6F,]¦¼vëjYV\M-•‘SLê´¦“¶ÊPbÒVɇ¶2nx#[¢‘%íÎe®ÎÏ–#—¬-ëރʳ%uÚqnÞÎÝ£íY-ƒ§ yf¦~vK‡–o¿·ìkŸÝ ‚Õjsªê|5yLiùo|ÍÂòfØÂUs<Ýçþ¹Çñt£Ÿ{è™`ÇD¾ù"l^Àhj¨þŸGØÝš7—ôœŒc sÇ£+' Ëáθ,R*Ê@’ôVyqñ7N²ÊáëÝ_ÌË -endstream -endobj -39 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 38 0 R -/Resources 4 0 R -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -40 0 obj -<< -/Filter /FlateDecode -/Length 4845 ->> -stream -xœí\K‹$É‘¾ç¯È³`Bþ0ÐAha¥eviv@¡CujZb©^tØ¿¿ŸEº¹[DZ¾ªŠé9hššª0ó‡…=>7stø÷Çÿ*ù¥ÖV2O_?¸¥$‡ÿÖ›‹•ý ?%½£²$ßrMǯLˆe)-…’¯üow©›¿þð‹ÃÿnûøcXZËÁ§ã?~dÅ¥ÔR\2X ,ç£ÁJi)%¤l°²_p‹­Y,ˆ‘ -ºdˆA­&‹1(„j°*ĈT|¼d5ˆŠ'‹1|KÅ`y9|pÎäAGƒÁóiÉPz¶xÁ/¹¶ÐL^Ï—`ñb\r!Ÿ¼ÅkKÎ9U‹G%5ç-^‚,É9‹Y(Öbñ2d‰9:“YB-ÑâÈ fð*dwU“Y\vÞ⵸¤V‰L^ÏÕR/yÁ¥%ÕÅó~IðÍhòQ0R./@–ìR3y%E,^„,„8‘b©ÕˆÖÀÑ]ô/A– -™<Èã[2dq%[€Z—, ¥,ÔY j\¨RµP Ô¶P)Ñ‚ÐÒB¹ ¢óàoAt%Q¶ zÈBˆ\“Yb# b€,h`aAŒ%P´° m ÞbaAÜ’kÞ‚¼%ç³…€ 1…ˆk& " ®Ô,,ˆÀÜì´° tîÅ‚Ô) "`7RÍDàn$ï,, ànŒèiò Ø ã}p7zW,, à.Â(XX«.ðÃla|e µ: ¸ª# ¸ -–“WÄ`´°€€»!ᬕ¸’ p7PÈÀQà3³à. $ÙédÀZX€õ¼-,À`K@ZbaAîú†åψi ÕâkË$ய0ŸÉk‹/и·Ðòâsn$à.ªhaAî>«…Àø+j°° w}ÄJmñ€»>4gaAî"oHÀÀ¬o‹wp]“××jµ° wKÁ¬‹«@“W8’·°`¼8ä¡dà.–÷faA…¸ëiɃ,± ×€‡°5bÉêâÂâw‡…-p×¹Ò,,ÈÀ]^6-,È… ¡ZXdÁÁ‚\ii¥d rsà!å3yyÁu²° 8 ËäA*daë¥ÅV-,(²Ä,,(² e°°ÁÒ<²o³<€,p³> È‚LÑ ÙR‘…%eÔcЪÅËa©pmò*x¾XXP --XŠ½…¨¥–Š ·°¿pºdaÄÏ“…¥A„Š…XŠ–™[<Yd[X€L<ï-,¨² ´° †Š*3; °B£–„ª-9®3«…•ò©¢…Tš@J“YÀ>\l' Pü ØD™cò KLdaA­ËÍjaA­%¸`a|“ëÍbaAsŸ…Íå…Ód ãà9gaAóõf —\oV Zt¨7QâqÛbæz³XXв$¤(&² ijFÜ“Po,^†,¡‘…-g®7«…H3Po"£7·*×›ÅÜ.î¦d²xÀ]d¦ÙÂ\ ÞDfkÕöÀ› -ò3›Y¹â¬æŽô&¬­æ–öbµ*æžørdn@LT–5›»XVÁôÎÜ6pÀ_äct çÝ'½E•ákf-|“ aAÈîGÍ1›Å+ÍÎûcÿøëá—/X|ýçáË/Ö2ù‡” EFæÂ:qˆ„s=ðĺÑ+ò«M~œxÒx@cà·¶ëJÓ•ž‰­Ó©YZ#[›mõ„[Ér+Šþ -:!ßÜÓÕ«7Ô Ç6Ôôj“'ž€Å¯*«M  ÔÐ\:{ º°QK›FgYû&&e?þ+ÇË?6žGø„¹£íÞvƒü8ñ¤Ø9€¢Ç5?éà\§&ÓÒH[@R·£«W3n¨0Ôôj“'^q¬ÅßO&>" ýh¸R?‹,N"%/G¾ É7uºÇX‚QlÇžE=Ç-æCm·=mæK¨„±tÅl ù|§7 ¹CLŒ,„!̇#ï­ŠU -,#ø(pƒ[Ot¦¬Ïv¹'i\ÿ;^þq)°[ŠܦÎ) -®¡FØ4þÍðA‘â|r5.•ø…¸ã_¿üÍü÷÷ÿõ zúáËáO¿rȬ‘|¢ýˆŸŠë„þ›¾t^é×HTa>—:û¦üë?øýáß ÌÑŸõÏ‚å.2 -¤±¼œö¢|ÿ»ÿíþqŠ‚šÿ<$ßCÃþýÀ±Ž÷h½²xA¿)ZÖ{¶Ç{Œ÷a6‹”DèÛ6;¬6Èl›»6ಔÑè¬nð?ñ<ð“Ï¿Ù>ë´øÛ}9·p™÷ èçS·ãKï÷åü£Ç•qt»uÜϽ»˜?ß’ºåÒ­@Û‘Íp«FÄsÓÙ}ø·÷C+i·ZQ É‘Õålªåá[TV9»qWÝçAùiâêB_¯s¿u7i×¢rm/ªJÛ~©¨>y7)Õïæç¹ÖÈNsoå÷Ð\iùÒfê.tÿ«ÊÿD6‰7¯G?Y=R~Tp¢ì­ýDîOb-n錀w:;ÍlÕGé´6ç]ýe{£è uÛ‹ÏҔ閿>Ÿ×W鉇Wô†ÌÔyâCç®· q6âQ-ɜҖPøl;¬G1k*?³ò®tl)Û‘ä¢þ¹g^^³zìl†]ÍË+4©8ü•$ò;Óv³Ç¼‹Ý/F,¯€Û‹‹¤t¬K*Õ•fÜÑU·©èTùq"(Ú-ÄDø{nóXŸŸÛ4Zªƒ‡ßBƒgݧbåq’ß ¿*Û݇ntrË1úß=8äÔÍqêuÙ{8Û»q™pK°[¶îñŠC‘KK¥D”Ç¡ûülŠ–ÃL Ã<îPO:XÀž%ª»éþ¤rÁ1õ…‰5Ý™¯BXÕÝþö´±oô^€SŽFïs¹•L²ž5TøwG[ßÕ7‘øÂÁ"Ê,ËÄ[§ü¨™_£¸í`õùù8ñÂ\PUü4¶™î–ƒÉvmasîó¢1Înáýöã‹Cw÷H»~cA½Ÿ,³_ú¿Ü«÷!'ÎÉ|å'S.{ßÕ5E~ãÇçbõ÷v÷XUèÚ7ÂÅ™L3/U±—¸F*¾» ²+–U%'Ÿìheµ#§w0ïU„uöÛl‘èû;z‰ß_J9Ä*zŠ»1NšÂ‰“¯~Ý络Ÿ%‘ësʼ´S»’ƒöÌ饧¢*bR45‡lÉ.éØÕßÍÛFe¶¹£·R–ÆÛ—M•?äÖ«6?ùÅú‹G7 -¼ÌI({œ_46óžíò÷òP>‰¸½\®mŒy÷©ª![HûqÍÓͪ¶päøb¿åý¢¥žƒåî1‚s÷OëžuøνÙ"˳¿c'¬ãßrÔÌÏ5o5¹íØ­ã—Ï]Wz¿U¶ÆûÑÇyÛ^9<ç8%a€;ÔúÃ?ÝåÛ:<¿ÔÕÅÝê÷q1Ã!Ó~ÜG^;òpš(=ΧšBÀ½Óß:vîh;6ÜÅiòv\q0d·3ìWq2ê9Æ™N)N;ÚöUg Ü9ïgD¤º÷áHÁÏÎ7\õÊç©Nôpu[e8êžçJ`¾ Æpïüúêʨ®ÐQ øz~…ã‘€{¶Ë7¸’‡¸¾7àøí W Ë~Ü\a.å%5Wúw¸· ýußÇJ[”Ö¼ :}èí^º³½é™ÕçÊÃ"¶LëÛ5A1Ò¸ýAÉ~ÅÔ‡;ïH /ïKŸà­5,ª’|̼£ô@€=ÝåŸà¡¼éâníñΣp!Ê­íǽz„z%y[ðÝt¼è÷+ЮxÀyӢߨù>"ýÓééã©œvfâ7à• <¶Z<Ýå;sòCÜô«?¸ÏoƒÅ´÷ÃW‹+¨r¼²GM}|ýÐ#/–óé´JåÉÊ1Ãuõ“¤É5¿>™äyòKHi}©Íx–ôé>ßÖµøPFä-7q2fµàô† Ÿ"“¬—û»nˆ»…Šq/ÃUL5öˆD½ÀJ9;0¯mÕ0.UÏ/Bº’cJciÓíQND$@äH^RÝ.èØõtzçѬ&jFhÚûX/µM¬§)$ JFúI»k8.¶ìE‚ó1†ŸskLÌiŽ­Ÿn½·¸—o@Í&q¼U‰Õº×–Až¾ÓOÆ\Ü?uÈ -n[]ÞÚéãŠÿë§èÎûf«¬Ò†ùI¨õƒP»]"]_éý"¤˜S¨Õ_aSå¥F™j„à®ä±ùæäéîäøG|Rð†ÉÓí;ÏæäŸúƒ%Ïqy*ÕëPßmr—/ne¼>"Õ_¹I ÉŸ -ÃñËD­ðÛµ>E>ÏøÒO©î—Æð2ýSÚ]+vöûáìïâX¾d÷÷Èw>Àÿòú†·_¿òár]OQ*”aa(+íÈo•WÉ‹ÊÅs®ô\}húWÇŸXá×ëW“è‹Þþìw_|vžî×o¹•\ƒ\Lòë¿}E™Ÿ¬yÌÄþ§cq&°£Þ×ö-cZ\ÿs®Sqn!$¹¿“ŒDV–÷õ­ÜóÄ=³¿$¿®/4ùNæï‡Õ%ö«<xÍ"3ˆs@Òm瀳ã]2?2‰é’èÔt“Häñü½‰¡º<‰Ct­:¯Ì/mCQæ¼E<ÉýNê«Iå¯ÉP¢]”©B‹J¨6¨IZƒÐ°“A: âwN†&sð•Õ‚œÂzÝ‘h´kÒÎ f»>Z–*£U]›h~Š2]=Ö¡xƒvR¹\á"ªqQþÜ’3[@lâ}úM¸ ž‰F$Nòë!£ušXá’¸ž&F5î W7ýeR‘wU!4…ÆoÎóÿÏP‘•‘gýƒOؼ  ¯æ$§ƒ"o•¤éy YðTf[¥.~'^Ð1vuF{ÝÑzhlCU*SôÒD<©[²^7È a¢Ÿ•šèD~…wÓpå× yÊ™F¨&7&Ë^¹{ãNrØùªÉeXÜó§L†¼c\åóB<­ íÉìúU&™d~LÜgL¦ˆS0€Â$O}]É­øóŒòç 2kÅ=þvX—¹Sàº6GÏ_æÒ“?þÚü?ÿs ã÷ò)ˆó:Ü@‹0°uCÖ+DZ>Hæï: -q„"R°?ɾζI¼a¬ã!(¼¦ÙÝM`—–~ ¨\MLS‡Š†ë•fÒ âi§Å‘ȼ×6sÁ>_F¹9Lù#""¿î¯¤Áe¼8—ä£WÜt.éàRPq¡Å¥š°MÉ6b²CêI†êY~Ò¦ˆ<—ºPi_ÆÉ£¹Ìê¡…¶Þ…j‚8ê =0y=iÛÈcýæðz·Ý»ÈY"€©ÚõUSÇ1užMëeÞ^Ž5'ùB‚wjhŒUìÅ‘äÌИ©m.´*jÝzƒ¤'%¡m&•…bÀhNhcÄ"2åÞMÔ²Þq5µTFN1©ÓšNÚ*C‰I[%_´åqeÅÙR PÒî\æݹÙrä’Õ eÝ{Pi¶ŒB»œ›¶sËj{T·AS<3S7»¥‹–o¿·ÄιÏnÁjµÙÕðu~< 5ùC\¿‡íjÎÀâOªj›ãé>·÷=.w7dßCÏs,£+ž¿ln‹ð -F»ÏPCÉWÏínÍ™·ôœŒm s—[Wq|âaÝÜ—…KEþ’uä¤w=(ÎÛ;YõbëÓÿI˜ôÈ -endstream -endobj -41 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 40 0 R -/Resources 4 0 R -/Annots [ 42 0 R 43 0 R 44 0 R 45 0 R 46 0 R 47 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -42 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 615.753766 101.433071 597.003766 ] -/BS << -/W 0 ->> -/Dest (cb1-1) ->> -endobj -43 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 596.806744 99.933071 578.056744 ] -/BS << -/W 0 ->> -/Dest (cb1-2) ->> -endobj -44 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 577.859723 99.933071 559.109723 ] -/BS << -/W 0 ->> -/Dest (cb1-3) ->> -endobj -45 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 558.912701 99.933071 540.162701 ] -/BS << -/W 0 ->> -/Dest (cb1-4) ->> -endobj -46 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 539.965680 99.933071 521.215680 ] -/BS << -/W 0 ->> -/Dest (cb1-5) ->> -endobj -47 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 521.018658 99.933071 502.268658 ] -/BS << -/W 0 ->> -/Dest (cb1-6) ->> -endobj -48 0 obj -<< -/Filter /FlateDecode -/Length 4733 ->> -stream -xœÍ\Y$I ~¯_QÏH›‡ã’ H\ Z1Bˆ‡Ùb„z‘øû|ŽŒÃ™éºfz§5Ý•vÛñ…íÌ,{6øùÂâW&»ä\R¤óå»Ó÷'³¤`ð¯¶Ø\Tö7øŸÂÙJK°%æpþŽ >-©—âùõ„_»KÙüõôÇþ¹ícÏn)%:ÎÿúÀ,òKÊ)™ ° -XÆz…Â’’ QaE»`‰¥h,ˆ9:²Ä ’ƒÆ‚ä\VXbxJÖYb¸dIcA [BRXÖ@ëŒQyÄy§ðlX"”5ž³KÌÅ•—À³Éi<ȫñÊc Yãd ÅX K°DFãAò9i¼Y|ôFåA—“×x ²8h§(¼ Yà]YåAÕxÅ/¡d"•WÀ39å#Ï™°„ì½ÑxÖ.¾éUvŒ“Âs%šPTd Þ8ç! áGã'‚O9+»ÕñîöÆ[ ‹s‰Tdñ5p²˜5ÀZ—4 p)-Ti à²_(SÖPÀå²PJ^ƒWÂB±$ ¼±à9«7%PÔÀ[ÈBع*²øBxYÐ@Ãï!‹#¯aÚ¼Eø%S¬†xKÆF <b <×çHx@.\©hXà¹Ø©aèb»' †9;N7³†9Cgœ†ðMÎ7“†Å@D|“5,ŒƒgŒ†Åf䛎4,À¾ä|3kXP¼A¾‰OÙ·ÅGÎ7“†… K@ˆ¢ò ‚¦¢ì[`òM “Æ‹ÅÒ° ÄÈùfÖ°aòMDôjI s¾™Ôrp7 “Æî"2àù&"[-·7ÞŸéÌÌgV+Ðp¶ª%ìÅi•ÔšørŽ¤ &2ËÕªŽU0­QËø‹xŒ˜°VŸd‰*ÂÎÌœx‘Û‚Ýœc6óWš­õ±ýíôå{¾ç¿ýûôò£Z)ë?Îï)rbÍù>ò”{¯–:ÜÂpt϶Š ?ª‹‘ÊÓ[ÙÅÄaŒ·œÇ»2³ÔáL]m&F²`a-uiŸïô™¤jŠ\'㙃Toœ7LÔTû`ŸÏ®Y9ïT’&ëÓ}>‡¬G—þêÝ Û8›Qþb^ -}r¨ˆxª”ó»ïN_~ý«_þüw ï^Nþ1BOÄ„NP5.ðùC»øo×Ïô²òóiåÕ¿fö}âOþr~÷ëN•µ¢¥,€#( 'aaêüÜ÷Ûµ'RpëœüŸ?‡÷ø|iò¼çvë¿xk8Ç%΋1²Òææl°'aŒU'ÀOwù(û5³-ŽƒNhcñÅñ! äEzehoKú¬«âÆ%»¸ý}ùÕoþðõï¿™Æ 0f¸¬)6ü e âÙ¦}N„Nˆc÷ãï¥(6£ØÕXl6JÈÂ1R3XkWû5¹ª#…æX},#œ‰ÇmEië!´kšRdzÍiº#öyRÓ÷É73¤cv‡ëãlœ46çlsÉ `[ŸýÆ:Œñ£?ºé„ŽínƒpšV‰sµy;/8„ˆDÛ!Ï÷yÛ-I‡¼K¶ß´ê‹ëµ¾mVS²Kq ¾…Š­ª• ' Sd5Uû|Ÿ·U­”7ßD>:xGPßÝ/SÕU•下JH3l@zIûy÷¨dÿ*MÂUÙõpòŠ0!¡­÷(“åyám´1ÉÓ}þ?&¡>몓qi}òºpó@(+`Xû“/,_ûõ/Q»ntº´¿±ýe3¹]IëÛn¸**ß4BòF9ìDeéÜÝÞ‰ïS¦ýB«Ùy-ºá‘iÚè¼á£±Zðȃïþ±>omø)oÀ09Z|ÌðÝ`¥ž„ëç°5ú4j;ešS„$ÀˆþFôic…K7ÊÕEð=8ÀËn·ˆ‡\™(q{[ºê±Þˆ+…c³×\í=—x¬ÏÇ%RÝkÀÌ+ðÜ̸3ÿØߎ€±þ} -3îìcÏ·Æq‘vB>†ëÍ­•Þ¶Iu r\p®ÖZ2ßšz ëóƒ1=$/É þ§¦æ¸hã…û.#Pb»¸gQâØ{ƒW¢õ #ÄÉPê thyÀ>î¶pÛì<‚‰³weÁ‚؈+²6Ù+ÁáÓ}Þ88¤<äݪIMM[JÇA`Mm®ÄݦÆÙkêS?rÌþ¹ƒS¾—Kdmö÷Üc¤¡mÍ#Å¥&ËËL gŠx+UõõžaJÅu‡"Õ©wK!™‡í|c<~¦b;ž÷S®šrF!c_Cئåõ©D¹™î˹Ùtèúeµ£¤ô8ÌtžÇ”)îS”´ÒC•¡ùÔ°½{¤ã4ý(äí¸jnéÏíõGb­#µ¿S{†¿thkÃVU§®Éò~®ß÷2@óÙ^RXK«œT9cöûwFãqjdhòà™Â‹ÛnìEš^ Y¥¹¥±ÀÑTImËT–¢(Ôçs/Âò<~÷†nín¹°^SåÞ°]“n3§çjàç5×ú.ˆ&yµ¢øt—·…mŸÌwc‹#loŒÚ¶+.݃Hâ„*¹èÊ~Ž›UÅž{tïÎÕ*cZÕo”®o80"˜[ÂÎ!+tŠ-È[yTö®9Ž3v±dÃ2Ý `Yoê]­ýl—7.E?ÄÝèìXgcÝäûEžqŽîÆS¤Lœï*Ï™¯¢<{(%‹ó¿—\gt; †S¶3{8Ú®=„f<±q)£²†î¨ã¼‰;ÇŠ±Â‹§$½„Ÿ‰ kNzt¬§»¼­cÅd‡¸·+d½ËɵU†xãæÏÓ]~0åW¸áMÅ|LóSùŽ2úíÇ¿ÉÞ„ÛöWQ ç}çh1F]¸áÑ!Oëª:ÆîøêÒ¾F ´2²üs0yqˆ‹jÝùVàÁ>o]#¥âÈX{Ë}ZnÞkIäî·³mË·ém -Þí&n“EÞ¯Ô!z}¡ÏÙÿ®‰à¶­¤õúCËÕ¸¶Eˆî5 ƒ(í*B’{«0áž%.X+?9¥ëi¬5ŠµºÝ¬]g½:Ûê-vWé5—^Ó×ï}åܼC×ÿ¾FFŸ|­¢R¶°VX‹“‹Íü^‰;îƒðÉ0·ò¬]Mè‘z«mòN'=ÒÇ$1ÏEÐ[[9†¨_©ñd28NJ¬^{Ì!ˆªÑ}©®IÔ¥9‚sÀx 9ás—õNu½sÜžZŽXœyàÊÔ9nå‡PžÐ=¹½žúØ2ì9@+Œë6/µÒROþú]ÿ!«ÃNáCh”>ìæh g]Û¥{—žÈòÈ^7ciŽ9«éá¤ö¤A oêŽöºÛèc—øŠƒïö©²nÚ7›¶]Z@Y›=~Çôë¦ýÙWï~ûSY¦òwÌäoªünü25’6g~ÉîZ¡v_méUžÅÃí´»q‹¬#8h8¿—ù=L9V°üŠÝÕ/žïóÆ•NU›¼[õïã‹Ou‰^„»QqHe)ÎÄtEM&[ˆ¼ÞéœHyxnI†{‰I>·s¿Ü•¹Ôæ¢Ü©i®{sÇ6TþÖÌgƒ¸O™;JYïÉç­$ˆ¤RÈéëÓñŽ’Óä–c¿ÄoæóFé·)úvDß%âÚVêiC]# û·>5R‹s=¼TK«®jI°'ä^Ø©?£Ö í/7mUökQ‹´Z5ª§i®e z‡QÐÞ”+£¢u('F/Ö÷¢Å¾dK[™öÏ›uhs»$Ò7g|%#[z,üÂìØ€Õ—6÷ÉŒš¶iï«ðêB>zÎ\‹¡Çàõù>o\o«ï0¬òn4úðŠÔÖBxhi'Ëÿ^Ŷ“nsž¤+’Ûmék÷àê}Û÷Êøý<(Ð;Õ´æ¡®«Ÿa•nÚ¶÷áÖ‡:¤ÝÔYÙëì. ^æ1'ý ŽH^ë#û#py/¨dŽž”Ýzä÷¹¤îæãÊÆ”úl¦q#[¨¹}SÌp©ôÏIŠŒä›öj7S_ã·”²•oú ¿Ûä^wh;¾r¶»×.¶è‡!ù;y|>;âÊ ¿Æöh–á¾KOB5»ûÁîýô‹Þî~ìUÎû¥ãƒ-šá`‚ïO±¾Jiëëô†ok:þ¾sDêÇ:-g~}3Oã­![•dÏWzÖo)ú~´âß þ.~µšD^´ößWc}‡lç´iùgý’SÉÙõ‹I~=q9›2Ѭ<Ý!3±}4c,²ã„î´ËÉÂûʾ¥‹igµËÏ=ôÕpÿлñËdfVÅþ»N¬Ñ3Ú#™WoÛÈüE=yñí*QêŽNœ’l;œï’ùÉI G¢ÓM²£.¿|Ò?–as‡èRuV˜¿·uI˜óñr´~O}U©üõ }¨®]ÎÒ»|B¨2¨¡·¡a'…t9)Ä/Lš`ÌÁVsýÁX¯9v¥·SH—“Ú®†¥Òh•g×Ò5?E™®îóP¼B»ˆŠpâo{ÄøþqKŽlnk¾ÑÒL0·î$^Nœøȯ§”Öab… Ýõ$Ñ‹q9›é/“ŠÀ°©ŠŸn4~E•¯P•‘§~à—kl@^ÍIxoòVI’ê¦Ki¶겜»+úÂ鯴gЭ‡Æ6T¡2AçbÁ:ðØ’íðºAfëúX)‰¦ é&9 W~ݧœalÕ`ÆdÑ -wcÜIŽ;_%9 ‹[þ΀!ïWø|'^êÁF{2»~î“L²3ã´›“ â  0ÉF_+¹ïÖNü=hýãÜdÚ‰{9ýýT9çƒã|7zË_##&{þÚüÿÿq¢ó×ýëõwf …غ!Ë“Œ É’ù Ô:qlAt$`’mžmC÷†qŽ;'ðšfw3½·´AíàJb˜:d7\×Y/4n/;-Ž@æSm3ìõÒ÷Åñ³ûü¶~— -r9¸Ì“çç‘|C⊛Î#\r¢#.ä ¸–)ÙFLvH9ÉP=ËOÒžç"ŒàK?y4Y9t§ÕUˆ&üt¹¼“•“–<ŠÐ½½>ÙîMäØwS´ꫤŽ…1užNõõ2n/Ç™ãë«!}óN ±¼Ø{~9skÌЂ6ÒG5Ïn­A“R§m&íÅ€ ÐL§S—)¶n]-uÅYÕR1Ťþ]j:H« %i•xhËãöoDK~@Aºsš«3³åˆ%³B‹²÷ Òlé;í87mçî§íY,ƒ¦ qF¦fv ‡–…³wÔ¯aÐZõŸZÕ°y~K j²É;_¿xÖä!Äß–(‹2ÇÓ}n×=ŽÕ^÷3Y~JÆ{“,…°.Â+å>C Õ¿^XïVŒº¤ç ”u&̾4ÃÖïÄ¿VÜ—‰SEþÊXÏAoæoºKÆêï—Mé¤þüe—s -endstream -endobj -49 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 48 0 R -/Resources 4 0 R -/Annots [ 50 0 R 51 0 R 52 0 R 53 0 R 54 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -50 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 686.175057 101.433071 667.425057 ] -/BS << -/W 0 ->> -/Dest (cb2-1) ->> -endobj -51 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 667.228036 99.933071 648.478036 ] -/BS << -/W 0 ->> -/Dest (cb2-2) ->> -endobj -52 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 648.281014 99.933071 629.531014 ] -/BS << -/W 0 ->> -/Dest (cb2-3) ->> -endobj -53 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 629.333993 99.933071 610.583993 ] -/BS << -/W 0 ->> -/Dest (cb2-4) ->> -endobj -54 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 387.390971 101.433071 368.640971 ] -/BS << -/W 0 ->> -/Dest (cb3-1) ->> -endobj -55 0 obj -<< -/Filter /FlateDecode -/Length 5084 ->> -stream -xœí]KäHn¾ç¯Èó£‰ãxlöÚcc° , Ǟܮ]Õz}ðß÷GIÁˆ¤òÑ]³åÃv¡»Rd„‚âã ’RªíÙàç;‹2Ù%ç’"/ŸO_NfIÁàÏ:b8XÙ?ão -gk(-Á–˜Ãù3|ZR .Åóë ÿL‡røëé÷¿9ý÷8ÇžÝRJt6œÿü‰Yä—”S2Aa°Œõ -+„%%¢ÂŠvÁ%–¢± FHäèš• •4Ä ç²ÂÊÃS²þšU †K–4Ä°%$…e ä°Î•A ‘w -φ%BéQã9»Ä\\Qy <›œÆó~‰‰l°¯,1Æ5A–PŒÕx²Kd4d!Ÿ“Æ‹ÅGoTdq9y— ‹ƒvŠÂËÞ•Ud1ÑXWüJ&Ry<“S¾æ9–½7ÏÚ%À7½ÊCDÁH1)<Y¢ EåA–àÓx²~4p"ø”³­Ž£Ûo5^€,Î%RyÆ×ÀEÈbRÔ ´0.iàRZ¨8Ò@Àe¿P¦¬¡€Ëe¡”¼®„…bIxcÁsVo K ¨!·…¹*²øBxY0@Ãï!‹#¯aÚ¼Eø%S¬†xKÆF <b <×çHx@.\©hXà¹Ø©aè"Ü“†¨ëCtxÀ®§5,ðÀ]OÖhX@À]ï1SåA8°†@ÇÅÛì5, à®·&iX@À]„‘Ó°V]à‡QÃøÊâr6p×eCp×%l*/-ˆA¯aw]À%h;7p×ã4, à®#5,€£,À£fÀ]@HÐÓÈ€Õ°û=xÎkX€“-i‰†¸k ¶?%¦V‹Í%jX€»6Ã|*¯,6AãJÜBË‹±hX€»Ø¨¼†¸ øÌãì¨NÂܵ;µÆîZWŒ†¸‹¼!hXwX, °¿-ÖÀuU^YLÉYÂÜ,9 ° /&IT^ZàHVÀñb‡jX»ØÞ‹†¸k‚÷Dà®!¤=*²øì4,@^ÂV‰i$«‹q@ -Ü5ÖxÀ]cRÑ° wyÛÔ° &&¸¬a\; b¦¥¤5,ˆÅ€‡”OåÅÇAÂd@€,•Y(‘†H¬—âKÖ° 9ÈâÓ° 9È‚”AÃdK±È¾Õò²À]Ôú€ 2E €dK.D¤QA«/º%'ÀµÊËàÙ¤aAJ´`+¶ –Z2‚^ÃüÂé’††9;.7³†9Cgœ†ðM®7“†Å@d|N“5,ŒƒgŒ†ÅfÔ›Ž4,@\r½™5,(Þ ÞD‰§Ämñ‘ëͤaA!È¢¨<È‚¤©(q LB½ tÒx²¸B”¹ÞÌ Í@½‰Œ^m d®7“Ú.î†dÒxÀ]d¦QàÞDf«ÕöÀò3™¹âÌjÇÀzöVµe`€½Ø­’Ú30_®‘Ô¦ÄDe™£Ú5À¶ -¦5jÛÀ‘Ñ&lÝ'Ù¢Šp‡„=3'¾È‚° d÷­æèÃüÁ°­?öç?ž¾ÿˆÍ÷üÇÿ9½üfí”Õ P÷¹°"®ÀÜŸOȈ]oùõ‰Õ5‘YÈ:6s…;Ùý6âå$Èά°É.û:Ò‘^lt±œ[x£vÙõ"/EÐ_A'ä›3¹bÝW¨Qž»Ñûå¼Jr¿t±^W’ªçËé÷°ø—á4I•Õ¦´Ñ²0«›`[5•nu‹}fïb²ÕQ÷ãO:_\žðóàI÷€4z€1x UÒL=Àx€ C—±yÀ¾[Iñ€N= Ó7@V7Ñ-ê6º­8Pðº4r¿t±^W’ªçË_ð}PÈ éªGc0‹ vt¡Täª\ÌT¤ªûØÁ4!­m ë'Ó„ÚèÒPà¨mÔÑË:}0 K­öª—çntq=ƒmÄÕ‹…¦t}+ø(¸ qú·ÃÇ+Xdéu(£ìH%èÕX\p®¨ƒØt.Þš4(ŽªÄˆ£4¬ŠÝ:¬õêàþÀ½]½XQhJ×÷寑øÿ$€Ò¶S£¼BþXÔ»54]YPSscͯ™s/œQª”®íƒíqŒå¼]Ö„˜†å‚]xsñQñé9_%✊íDÿñà eévKe&¶¾b …Cᶠž71ž?|>}ÿÓ?ýãßÿë¿cÓü1¨ ý‚¿™›j¨>ð™ÂF øìþ9í¿ã6–ðg^ùÌ[Çâ˜^6~ðÛgh§c˜g¶1õë¹ë¹êunsY¶Ë.Ïe£ñ8zùá?Ï~{ k¥"øÚ×9iÿ+Î×®i—¯:‰›®š\;ßá·çºsÍ~í.m4;m¾¿ܯi×ípí¡ëmý¼Ÿc–¡ê‘¤îÖóßÔ‰çtŠøæ宓0øÃ6÷>°Ÿ—µ‡O6Ÿ­#nÙ—X¸D]b µ?7ëƒ=6žžs/6üúç|ý¡E±Y·,#³Šã0×”lè*\B]|ÓL;äÛàUìAAßÿøÏ¿ûéß~îÑCS´°aV ^öß5bLÓd‹Ü1`ùöl¶>Ù0¯9Gìjm»[߯Ù=bõR–e÷áÕ›°Çn^^½«Fl{žuw­›íuáãµ/)Ö5y"P‚&Ï~éÑÎúä¥ísóú/×Q5DZêhBÕ^—QŽ°£ÕÑz2bÂ}}äYO¡a`EÜ,Ž+Íí6ª6ÙtfmóÃÛqÂÎY–Ex´Ck©^‘Ÿ®Â*euÕ¿ûñÿü­Ü\ÄÆÁfo.‡°ñŠY×ß«»˜5™˜ö·žðC¸‡ôIÝà> -óµ jü(6€_&÷+usÙåÛÍÎöª2³yøT–¶° ¿lüÙ$vÍõEØù°m¼ŽÃ6Œ2É0YÏ•«ë pÜÖL¾ Çž ¡p!¬íÿkp~~Î7äVo€Ê0V•w2ùŒÊ¿žÛñ ÍìJážÛÝÚ…ïz¾ñQ¬³ EÎT‘üyD¢r³qßrÎ7|ÍY* -ڞ׬O]Wë5ˆâ©üðã>G¨êÊ<†CåÝ„,¼êæ]o Em瓺|ðUæ© 2´DŽÚé¦>ã¬OÍÆ­©(ˆ²mQ!H¶0¢¢×¹qXÇï>_[ìG¢-pОŒà2b8µ§üÜz .×Z,TYMVÐÔd÷3nŒIûA,µ‰za'ö»8ùMèë¶vT+znµrIE<ÒP–kî–mÒ½AÓÉñ=¶“Y¤¹éôä~}¨þâKö6›|O Vk=\! ±™µ*¬u÷nAFÌP!}ê;]gNÙ87NHµ fE.ŸÖûPÜ sÖ°ó?;ç½w~ßä4sí»áò˜YíB•ŠÉÜ¡¹¶hEšOû|=º„EÉØ¥D‰f¹UWj(>´"ü¿X~^§›Š¿G -õ¯wžœòÞ†ÜĽc\Ñ’}¬4¢ŸŽñŒ=¯¡ÍŠÓðä,5z³,zzÊ;·LnâÞ1ÂW—Eü˜ÈžC? ‡Qz 8“áo1þæÜ›"º6~ÎÅÏÔ üÌMòá–L•¾‘N“£ñÝÀ”§Šü½ŽGíé)ï]§&î ß7­¿}íÖOk¼í.Š°_ļz#IJA¸vÈ/70ÒìÌq×H «ìU™ ×£&¨Cá8Ý–Éq»ÿY µšT ý¼…î†BKÞѨé¤u¦k·!Ï:”…t+.ô!忺Ÿ¬Êbž»[â·”ƒ›®6Š#b”ýÊÇæBñ" -ßš·ôÅ_qšôõðƒPïD¹ç2N)v´»VGwÏšžÐiÏì~q³È.N›E{º‡úµÞõeštò•:Õ›&2­ä'§“ÍÉ­}h£yzÊ;§•&7qÛ¼áFCüૣݼƯ²Ñ¨ArÓ)©ÌÈLwjxkÏÂwÃöϵ^’Y‘èÚÝË’àûVÝÔnz‹Wz›G|àÚŽnZÇU°ß»”íö¿è`…›`t{ÓlÝ%ñ Ñí› Å¤9ÛÀTíØ>Ø®i™À´nÙþ(äP|Å;4œsqÔÓSÞ Ö‰l⎺K€òüB’Ä“i µþ=º-Hü.)œ x©Ù;Ï;<=ç÷‹ª¼÷ÌñvÏ;¤¼NSÌ#æ‘w-n'qÅ»)–›\ÂÄ­“¼ãŒö4ZO9¿ÝÁš“ íÂŽâ¹ØôX ?;åc2Vq¿e5›ùÑ”³f^ãWI2Œ¹º=sÞyr€Ë½,¹„0W²§·ßÞ²ým~wÐþ=‹Ì¯pI(íÏÙ‹i}ãÇÐèEÏÏù˸ÕU7Õ´CëC“·„›nD?|gYmyÿößnÿmÄç:ÆŽc}Ü~Så‡ý÷ê.;o³õÅGÞÝuRCŸ¦5yìæ(GJñüY¡£RÖ'v9ž§ü~¶¨Ì®(u<»Äºæ7\Ϧ²_Ën zÙ¯Iê¬:ðÏûwéS8›õ½[–®I|5¿yíÝ!wœ´ÂÇô•¡/w¿4„SòK4}>;h $~ï„z‹WÙ \MrCÇ„+†ÄãöÂbNðµG°çgVÙ1ë#Ö¶ìcî>ÇúÃl‚/§¸¾ûÄ®ï¿2ØT¬ãdž#-ì«©œù}+Ù°­w•ÛUIö|0s}­è—6ŠÿÉðËÇøÅ3«IäÁ>þËj¬Ï'[ m;‰ÝÞ -hVrvõ “_OüVHRÈDýi´;d&îM;?\7Ñ.€PìlóHÀ”Ù?¶}xÅ®í£ õjx~¨ÓømdÚ–¹¾¯b[X!bf´×d¾z³ØÌoÖÌ‹ßb%Ä*3?_ÝNHrl?aŸx—l½ÄpM4b¹N^ŸÚǺö±4›ƒØD—ª³Âüuìv+úâå„eýL}U©ü>¿zªª]gÍ ¡J£†:²„šÒ夿3õÔc6¾°š«÷ãa½Ý‘¨+uœBºœÔqûÙB³Tj£rŸZªæ»(ÝÕ}nŠWh«ŽvjâW‹1¾~É‘-PmÍéÉn‚ºx9j‘Øɯ§”Ñ¡c… Õõ$Ñ‹ó6r6Ý_:ñ®*„f¥ñ—"øß *B£2ò¬,5—⌫õE86yT’¤Ç†:¤i€Ÿ ´WTœ;¥æ³R_6e<ƒnÝ46P…Ê=•*ƒT‘l›×52CXÕOÃJI4UþÚv#‡æʯ¹ËZ¨Ó‹V¸{hçíäØ°óU’S³¸å—|5yÛy…ÏWâeÝØh&³ëçºH';Óv»¾˜ vÁ -Üaôu%×hmèÄ/.®{i;îåô§ÓºÍ9'ùÑ[~g¥Ì˜ìù1æ·øû_':ÿT_’´íãü’}}×°u ËŒßpœ$óÛsI µ;Ñ‘€ýN¶¹ ÕÚ>ÎÏT¥‰ÆÓMö:Ò6µ+‰¡ëP]s]g½ÐL¸A¼LZl‰Ì·Ú¦oØÛ¡¯‡eøý4M*~ƒ‡¹ó|ß’Ïâ”8â¡}K—œ˜ˆyRŠK—l“R.ÒTÏò“4…çµÄH#øÐwõmVžºÒÖ«C{y OLV.Zy¡¿:¼¾Ùî»È±FS´7ꫤ¶ cj<ê×Ã8¶=ÇŸù o×P;—±ç[’ÓC£§4HÔܧí‚\”*mX´n .@3•ÖΘªLqŸVÕ²^qVµ”ZNÑ©’šÒ*M‰AZ%^åóÖ¯eK¾%@AºsêWgúÈ–Kf…åìF¥>ÒWÚõÚ4®]wÛ³¸ ê‚Äž™š>-\ü*üûšØÙæLmTýY»6÷× -b£&›¼óëÿarŒÀâ—ý&Ê¢ÍñôœÛ}ëîFí{È•`Ž…¼7Éòÿù¡‹ð -F¹Ï§ªÿˆ>­õ’žS€ÒÖé0g®º:¾½!cmî´ÃÄ¥"ÿž“Þ̯¦NæàKI‡ÖÉúóg‚_ -endstream -endobj -56 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 55 0 R -/Resources 4 0 R -/Annots [ 57 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -57 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 108.503892 101.433071 89.753892 ] -/BS << -/W 0 ->> -/Dest (cb4-1) ->> -endobj -58 0 obj -<< -/Filter /FlateDecode -/Length 5358 ->> -stream -xœÍ]IäƱ¾×¯¨³¥r‰ÜAü@~Þ‚=¥FË€ìƒÿ¾¿H2’Q$«§¥ 4=Œ\Œå‹ˆd2Û\5þ|eðW"£RÊ1ÐõöÓåç‹VÑküWz,.Jó÷ø?ú«Ñ•79$ý‰ .ª˜½áúrÁ_«Ë±ûËåÿ~sùçrŒ¹Z•s°Æ_ÿõÌMäTL1j/4e4iã„&ïUŒÖ¡)…GÌYj>’¥mS”“—šÀY›„¦6Eã¶MlØhHj&û(4 >ŒÕZl#šÈY¡Íx ô µY£BÊ6‹mm&Z©Í9"o¤¶¬B>Im^|ÖFjóàÅ"-µr)Jm¼¸à´Ø^lŠNj‹àÅB:YhKàÖ•Ä6ð¢ƒ6R[vÊçD$¶e´éÓ¶Íj¯|rNKmÆ(Ûtb< -J -Qh³à%hŸÅ6ðâ¶R›/„?Rp»˜’à­–½Ûig¤6^¬$¶(_BÀ‹ŽA‚xb\’0Àƨ([’@À&§(Q’PÀ¦¬(F'Á€Í^QÈQ§ Ú¬‘€Àiðâ)HHà x!x®Ø^\& œ/è asàÅ’“°Àm Ö"aÜ’ÎF¼%m‚„€ 6µ„ˆëR  ¦”%,pÀ\ì”°ÀtáîQÂÔu>X `×Q -8à®#£%, à®s)¶°„@GåLrp×%, à.ÜÈJX­*Øa°¶¢lJZÂîÚ¤IÂîÚˆ ¶Etp×z<‚¹»Ök+aw-Ù a E´˜ w!^NÀ VÂÄ{´Y'a&Si‰„¸k2ŸàÓ@+eRxà®IPŸØ–•‰¸à·²2!d dUi ¤Ú€»Ú@ÃRpWë˜%,À]›„È›$,ƒ -Y°•° $R9Æ aAÈmHùĶ pí%,ˆÈÛÀ E’°‰µÊ.' ¢/ÎZ ¢/H$,@F ²Aö-–àæ"Ö^)JX$S)IX}@=©JmÁª×b[B›‰ÄH -¡ØHX€ZJ%8½„xÅé’„`m†$,ˆ¼ÀU$,@(RÉ"3—Ú xA’-a2]´#aA²àÙ „É&T™AKX€Z¢–ÚHs™$,H§ŠÀMPi)Å6ð˜°úábÛKX€âÅ&ʱ ¼8O¤d¹ÜL¤^¬¶À6¹ÞŒd ^ñIXuPœ&KXG›Öd“PoZ’°~Éõf’° ;z%žà·Ù®7£„™À‹GŠ"¶$MYð[`êM “ÔÀ‹Í$aAëÍ$aÒ Ô›ÈèÅ%Äõf— €»>™¤6à.2Ó a.Po"³•j{ àõù™Ü˜¸âLâŠôzÄVqÉ@{­¢¸f ¾\#‰‹`•e -âªÂ*— 4ðùm0aZ}—¨Ì!"f¦È™á„ì¾Õ½›»ÓmZû×ß._?!ø^ÿöï˧ߔ•²úÇÀø…RXC¶ú^©2Ì– @ZX‡¯ÄlÄÜÙ4ÆyÙÙD0FÀÍ×ö³d<3×éLy6ZÜÅ‚¶\¹}|ÐqÛÅD†sŸà²ÅdJ°O”N¢lÏzsÙŽ7îb¹}|Ð[p»5ëß~¸¿§µãp„³@c¸é‡Ÿ._÷Ç?üî/ÿ9?|ºüð @¸ïQ™û²hƒŸð<ŽæKJø‰ðŒ„¼Ð(t÷åkÇ´2&ÎÿŽs;Úümž—Û>Níu,}½ÞcÛø°ó}gZ¿ñúéμóóðÜe~îÿ„ßæg{šÇ…ÿÛt/¿ýëõßîÈ— W«YŽ,ºÂ’7Ì·3<-ßί¡ÜnîWY.}?­ÄCCßÛªÈFQWÑœâ#I¢›ý÷`Ó("•K—Ž—ÒýÈa1ktŒ!Šï„¬­yÁ£#^å³åÚ‘»CEÊe˹ªTMwðõ®“6Û¥GÞ2s»Pê׿ýóÿ~÷?ßwç jÐyÖFš*6i5G\úŸG˜'‡,me7ÿk¶8+ÇW…Úž=Ç®Ia0€4+ژݹ¼[Íå}•qW|Xùcyn½ôÿ¡W'È;ÆNÇNTïÝçŒ}”BÐÕvMŒ(½b)¡¶æþø˜÷5x”fßèw-~Ç„¨^»Ù3È7f‚ú:>y -ì9ÔÌkžÖ.RMwR¯µNñÖ¢\µF‚,‹6rѤŠMŒêzx̯£.ªwdÒ.ó_fmO]ß~e¾a•L?é6ýtÅcæ6?ÿ Ë>ÞÎ? ~NØp!‹Ç7¼”V õüøíÁhd—)"ë—FæÚ“*5Û¬('¢¢R¨˜Q­©ùܘ÷Vsç—ëüBTóóJuf¾Ž‡ª3…á`¨)—79¥:Ã+F§l„Ѭ:Wjml¹sK«>–ZXcZ>¡wÍ„ç|E)Ž9-'ûVqjÈ—c—v! -#Å”¡bð€V׋öoÕ¨¸³Î!¯ f£Œ¤yE¼¬ÒÂÛ‰èŠÏùrÔDN€zNT{CM,îOçµ -N'd Ëé~½º*­*ø`΄è‰àì0籇cˆÎüBF]’¨¸ô^Ê+.+ýÓ‘Ç:~­—J}ìPÛˊꮑœóÅ oðŒ~v?^¯ü¶ÁŸ>€Âo~%È+€Ú§ ±ï¾a¹È‹¼‰ºÊ)³œ¶ h³}èfŽšÊÂôvôÚ€›áŽ2;H^‡À~©xC¸¾rgdQ»Ôú)L5×ýõ‰Ï¬u/„*€íŽ¢ÊÓb•á­>>2R­óø˜÷­uX•ß¥jÞ´Ö)ª:\°Z¡@ÌF™‰™Ëe»*¥5›©ôÔøÝ\¤ã¨"Ç/(Lyy¸ÕêÃCÞW©ÁØÆî¾R«ÐhB/±Îwü>}zbë²Êeyö Î?9æ½ëüÎoŠ»¶?CÍpúÒŠ~ÆõÇO¿¬8o•Š Zñ{o™¬.û¬—}wáòc‡W]—”ç±T}l€åqÙ¹ä`·ùÞa¹¼Å×÷Ö&È𛳬“?¿6qrÌ{ç:mm‚µï˜˜fqc©9„—‹ØM;­âñlŽF ñy)@Þ/o¸F½ê#Yïvý /ï›z"òÏûQR*{+ö9;7æM^"½iê[v òŸ$#N^¥þ¸²ñ¼“ø=úròSIà°ò±}·Ö ¯-ªÕDq“ Þ/¢)”]˜!ˆœoàði` -p`õZÐeFFºG3d؉ÙJÒ¬ ~«æü·‹„¿ qHš’ph¯|O‘îÉài»€1½‚üLÝ ýFà°´¼®–È!…~æ¶KݬïÕdð‘ÇH=ð§à}Ì’8Â<—(²„Æ»54eDxMD±Ä<±÷"ʹ1ïW¿…>×ÉÉ@’ºYT•9QÿXÂÍôï§ÏXû¦+dÏù4‡9í*R‰Ä¤aËÇ+fp;Ý\i;Ú<FDÉb–F×Ò½ŽßŽ¦qýB4XÞ“ísæ}n.Yþl${`°'Ç|9ë8™È.Ê‘ïÑ•Áåt£ÉÓu‘ŸYÜι@ÂÓQˆ ÚéE0#¼ÃÝÃÊóÍ[Œú:ø pÿ‘¥!á â/ž °€=& -ù@'Åj¼\]xB9,ê§óÊ“c¾§òȃ“E*ü6Nµ˜îJyø£@Jälî7•–Çî1•³¯ñnŒñä:ï«ù_ "„DÔÏod)Å)%z 0‡É™¶ -–íµ¹£¯ölîä³ñ'%äSvâ³e e“ïIæ0ÉÁ)ï2oå,>ÜÒ¨•Œ-_‘XÍ›¬5âPÎùr%ñâêê¼ÿjæÄ;õV“¶Êæ•®8­ª­Œû^ªšV©êMp˜Uš%Þ)¡Ù¶Ïr˜˜B¼&´4ú^ô‚5ð¾o‘šòÇå‰}[;5ä‹15þÈ ÿSc­ßú™A¥çß<þT)jþT^|ót´ÌY—Po}itou½ëÎ×¥RÞÕ'îòß<¡‚IX €ÈP¾‚ƒ.÷wÙ=>æ½ß<™ÆïR5ï·ËÎó7:$ŽÌås6yŠo¥FK?|„úv·?<ä½_·´m•!ú]…¿z#±IÌ_È®ïñØNâî·÷ oZ–ìJß&?òe@Ûiœ—bËÂ[ªÈ_õÚrRÆ4x‘Îñ‹ÐQún‡á©†ï&iÖP9?ÁbCþ -cf]³ëµicvvMGdXF'H¤q&Î]ÅÓùÕ­¯:¿ ´*ÇYþƒ MŽŽ,£ÿôkG»ÓoÐóâµñ¸ {”W}>°ú’¢ÙóZúónï2¶¾zk_›ìíF‘—»ª¡—åúÕë¾­•ÈR_«»§>¾Ú·C»}žâd•ï:úØe¹‘ÙSÞV·Ý‹à»H”b¾Æ€”á><ä}Áß[UvúÛ¾¢Ÿ ²Çb+Ëq4sŠ¿ÍF⽺‡Ír7øÅg?IJjÆýœ6Ñy?JÞ•yǨ¨¬‡‡¼ó~ -dý•Ý}eQè^ÁŽ3¡Žæ#ŸÓ3gi|2Æ´¡s7ÌŸòÞa¾±Ë_ÈïËäÃpnÊ­h3×Æ‚? ´‚œ1,WømÇée0[o «©úÙ¯ÄÚî ßÓ˜2FÚ`FÞ©`rB ´Ð¬SxÚÀªpîá1ï tÞW~ÌAOÿK²Ð‡iô!ø`ÉêìCÓ©•YUÛ˜µ ßYú°…“]g7cvøÚˆ¼Î6Ÿaˆ¼óÜÅ<‡ìu]ÕMLµÂ¥çU*?Wp«çÚdcÆr7sßÏ~J«ß¡ÎnØ\oÈ2θ¡”¥•¬ÑÊÙ–˜yßÙµ{ŸÒç®,ÓF–G™˜°ê°øwä±Ùô¸‚²á[ÂÏýžxÌPëþY?óI~€ÝYÇãŠÇ"så\á˜Çü8@*ß{×F³^Ëõ5vÖtJCÿº?²>GØê¿V)÷ì{ó-õ+ªœIƒm×R÷n†!’̧?üF6[QŽëM¶nÀÛà‡AÐñ¼»bOi>Èn¶ôÔû—gÏ].máJ6¢\ý–Ÿëj[~þ`V•TÝó«àÚɳ¤JÌ Û›Vd¼¥˜tÎŽ?§*²‡‡¼s’ÏkÓ3» ;xÊl´µö’’WWc‚2”øˆ˜Í)E=<ä Œœ»K!ž«ÆÎU)n—Áü¢6‘zØ}ÊóGd©‘bôü–u, -‡¨´,4fù d$ŽyïÂ!7~÷ÕÌçI·d=L×-i1z‘ø–䪶?O43ÓäÂC.Þùð©Z{ñkqOåü±Ýêýä˜/¦|70îCLü§àþèXŽ%^Ýtçxƒïç“©`»ºœbk(&3tÕ´pØå@è•íí)HW³Ú,¾|2LÉGÒ»t-oŽ#Ÿâ&=–Ôí½µ„UBiŸz"YûÝ ð›%÷<ÂâÜÇ÷¾|i¼ŠÎ ê¯}mÔ¹G¼]ø,¤5õE¤òéØuª*]«Í LåFõµgS5= ¤ÛE ~¥ëÔe¶öAk|ÆèDLÕ¨õ˵Ÿ@º]Ä~ól¾i*¶^©ÍUò•nêå[Ê»´Ûðz4ò/Þ|µ¿­zÉUš®uìÆnˆ·‹§æ‰ürñQèí;Vh_Mo$ºaÞFNºÛK§ÆTEL£ñ ü÷¾QyÊ? 5“âïûûU¿ ûf#/…4ÒCC’$`(ö¾ƒ¸x[‰ÛÐ1wÒBÝÖ»IlAD6Ðc®ì1H5ðX’M³ºFf«òiX9ue·ëdßLùeAî|úæª^·›3˜»oóvrhØù2’cÓ¸á#s¿mÞÁæ+ñV­Élú©Þ¤“ùt’j>íf±3Pèä£/…\½µ¡ÿúÏîdRĽ]þ~)aÎ:o9i Îð ðcÆd®ÿAŸ?áÿ\èú]=rtŠã| ä|Û°uA#ÿ¾t’̧Ubs›hi€ýN6©÷õÕZ糟âŠÆÃuöÚÓ45­u$ú.Ãl›éZãÉøâm%Å–È|®nzÀž.]}8þ웫­\áb|\¦ÞæzH¾S⊻öΧ*Ùa .ÆIq9Ü0wÎl²AŽ7i¢gþiT…ã{ CÁ—®·Q³ãÔ•Vžbè‚ØãÄdÆ›æ?Ó¯v¯ÏÖûÌr¨ÀÔíú2RÛƒ1µžLuå2,/[ÌqW¾¨ÎÛ%Ôærƒï¹–ät×è©-.F¨©›;øñ¦Ti‹›Ö@Ñà4]imÆXy -ó°*–òÄI”Rl9E§þ}”´µÒ„èG­„M_ž·F¼–-¹–ùÑœc:Ý{¶\2 ´0ŽnTê=]¥mïMË{×h{ƒ:#¡g¦º󛞯¿×øŽx±Ô«þ)«&õCº¨ùÃnëÊï]Ó)`oJñ‘Ò°Ìñð˜ýuíêF]÷ïu(rNGÿAOfá姶ß0LU»ž<,kñ‘€°¬Óan{^tùJøo^Üi—‘KEþiŽ“ÞÄ¿è%jùühóq±tRþüp¼» -endstream -endobj -59 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 58 0 R -/Resources 4 0 R -/Annots [ 60 0 R 61 0 R 62 0 R 63 0 R 64 0 R 65 0 R 66 0 R 67 0 R 68 0 R 69 0 R 70 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -60 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 691.173057 101.433071 672.423057 ] -/BS << -/W 0 ->> -/Dest (cb5-1) ->> -endobj -61 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 672.226036 99.933071 653.476036 ] -/BS << -/W 0 ->> -/Dest (cb5-2) ->> -endobj -62 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 653.279014 99.933071 634.529014 ] -/BS << -/W 0 ->> -/Dest (cb5-3) ->> -endobj -63 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 634.331993 99.933071 615.581993 ] -/BS << -/W 0 ->> -/Dest (cb5-4) ->> -endobj -64 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 615.384971 99.933071 596.634971 ] -/BS << -/W 0 ->> -/Dest (cb5-5) ->> -endobj -65 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 531.937950 101.433071 513.187950 ] -/BS << -/W 0 ->> -/Dest (cb6-1) ->> -endobj -66 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 512.990928 99.933071 494.240928 ] -/BS << -/W 0 ->> -/Dest (cb6-2) ->> -endobj -67 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 494.043907 99.933071 475.293907 ] -/BS << -/W 0 ->> -/Dest (cb6-3) ->> -endobj -68 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 456.149864 99.933071 437.399864 ] -/BS << -/W 0 ->> -/Dest (cb6-4) ->> -endobj -69 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 437.202842 99.933071 418.452842 ] -/BS << -/W 0 ->> -/Dest (cb6-5) ->> -endobj -70 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 399.308799 99.933071 380.558799 ] -/BS << -/W 0 ->> -/Dest (cb6-6) ->> -endobj -71 0 obj -<< -/Filter /FlateDecode -/Length 4732 ->> -stream -xœÍ\Y$Ém~¯_QÏ66Æ,Ø°-cm¬4€!zè©–`ôXùAß#ã`f±+»gWžÝÙ™î$ã`2ÈGe–»ZüùÆáŸBΔRs¢ëíóåÇ‹59Zü×Fì.û{üÍñê,e]M%^?3!d“kô9]_.øçp)‡¿\þëW—ÿÙÏqWojMÞÅë_?1‹‚É%gV˺ °b49û˜Vr·X«Æ‚1“§{V†TKÔXƒ¼/ -«@Œ@Ù…{V…>;ÒXÃÕ˜–³ÃykU±DÁ+<M‚Ò“ÆóΤR}Uy<—½Æ Á¤L.:WMJ)G%Vë4^„,ÑYY(”¬ñd )X•Y|ÉAãeÈ⡪ð -du•Yl²NãÕ`b-D*¯‚gK.÷4, ஸ-rw}´^ÃîzòIÊþX5îB¢ž@¬†ˆ÷àù a3i‰†¸ë*ŸâÓ@+ãJMDà®+8>•WËиâ·Ð²q)U "p*hX»€Ï¢a0Þ ¢z "p×DjÜu¾Z "pyCÔ°æ` ߌ³0]•W­¥hX»€%¯a¢°±H¢ò²!9 ÆÆ"Õ° wÞ«† ¸kc$à®%¤=*²„â5,@^ÜVñi$«Æz …ÆîZ‡ÖxÀ]ksÕ° w9ljX2|Ñ°dÁ^ÂTÈÔœ“†©Zðò©¼dp5,È„ÈRy…2iX€ÄÚÔP‹†ÙC–ཆÙC¤  #0Õ!ûVËÈsQë‚,È5,’™R‰4,È1¡ƒV5^ò¦dÀµÊ+๬aAÎdŠ†¨¥LÓkX€7œ.iX1Às¤aA®®¢aB‘)™¹ÆsI¶†ÈtÁsNÂâ! ²A Š/¨2“Õ°µ$T­ñÈrY4,(” §ŠÀMPi)UdLhX€óáb;jX€âÅ&Ê•YB$ Jñ\n J,Þz `›\of ª…,Èø4,¨6N“5,Œƒg­†ÕÔ›ž4,€_r½Y4,¨Á¢ÞD‰§øm ‰ëͬaA%È‘¢¨<È‚¤©*~ LB½ tÒx ²øJÔ”¸Þ, Í@½‰Œ^m ®7³Ú.îÆ -dÒxÀ]d¦IÃ\ ÞDf«ÕöÀ3ò3Y¸â,jÇÀz#b«Ú2°À^D«¬ö ,À—k$µi1QY–¤v VÁtVmXà/ò1ºÃ„­û$[T æ3K曬p Bv?kŽ5,¼2lëýõÏ—oŸ|¯þßËó¯Z§lüq0þ@‰ ëÈ.â+ŽpeÚr° -tèÝeß$„€_2‡…Èu 鋽éÆB"#ÜÖëüÅíE†Ä,³C2ÓîŒä¾¨Ž*$]ÖwÏùÙe °y€)Qnì«*äÙàSéÿw½ÿE2Œ}¿Qã üb?†ß®‹—”õS~uB%œ°$Œ -Õ3ÀÃk‘š[Ú þ͇ |½o¿µ‘ç¥ qÈ°DЭ·×Ÿ/ßþæßÿÝ~m?<_þøÎùëo~Æ°ý¤Ûöc©t^ì?Ó~Lôý§ÃÏ?]?üöuy<Ôà89-{yX÷ïO&#º <÷“‘µ¯{èòR>ÈÙ¯ëôOýú㺧É;Ü›÷È“Æ}þó‡½mnu•€‚”&xœ?1§·Mù"sú­hŠ‹¸‚L$#ùÓÍèÓA}NÅãÓuÈ—­Ë‘ãàn“7ن㬠µYuÊl6ŽöJÏ{I©@¼½v¸Œÿ~_+òpQtr¸o›òË9\.» -Í©‡ËÞ‰÷èàk¤ðOÜ9NFÕ–êAyðw‡TƒcDÝï€úVØ=>·Íùå*O€Ý×تm8ó T¶)ØÂÙìn¹?J›ïÀ>÷î5 çàOGÒ„Ç´sb¨VÉ¡žÕd>Eîñ£,õÅ+³Oõ\DåŠ,Ï)³Ç}Ïó,~êfÊÙ’E¯X €‹éÌJß4å—c¤9c6¢×1#¾¢2i*o‡öÝfñÕ4î›JþÐÕºòY(~ãœ_ŒêpbÛšUÕ;{®ZrH”3×ÈûÅÞä+[îgß´H$—¿¼¾v%c+·Œ•µÏ3ÅR´ûÂÿNG´&á0¨YEòy¤¾GºŠ:ÐS2œ°ÕÍø¿û·ý§ÿøÃ:ÆÇè·Q1 Ù)¶ß[Òú¼¡§þ÷ÆÒl¿·y‘¥ÂOžWúï}-þÙÆÈ}xÛ8¾FÒÜ?oýÎS_#Ž3Ù~·Ï#‰ÞËÆüFKƒ..ÂM2…ê -’s”m[Ç„À!"à»KúÛ»§üÿ¸[»n§á¼ú˜†eñ[M5cz÷”¯kL¡¤)îî<îŒ)ÈÃ¥~4®Ï ‹’ãÖgJö¸ÏÑ°œë(‘ûÝ„÷ãÈ$¼áëÖéî¡!Bû%ÁŸÂŒ´^›[–1²á4|îò°¡vk¿û%Oã?õùQ“I7Ö3´Œ¯¡e—¡í3ÖÎ3÷)]ƃ÷{?Ò?–²×—ÿÔ#A²¹$¿×º¹1Šn¼Þ¯KÝ)›n‹'"—rÎÍy7KüÝ¿\¾ýÇÚã:üÓç ?ƒmùY6Aáç+×~׿]~Ïîv×ÂÝÛøny+Š?Ô/BÏA¿ÔÏ/Î[úaºÑú`O4¢ö{fÛ CÜÎÙc®¶zØÑî²™iH?–ÙÂÌ>hÏ—÷0mëé¡ÓQ_â£Îéé|¨q¤æ¼‘ónKØ¥óoœóSZË>-?Çô «Ÿµõ¡É92Ù µD/K«Ç‹¨Ù¼g±NTŠ5­®{únî§ý®Ó[u"›ÉÇ&³ÒxÍÙ‡sý¼wfôãxùælúïËŒfðO"æ>+¾ýÔ}¦¯3±É}Zø9îD÷•BÙ‘çgýøƒÁ¢eTïŸóuS*‚ y÷GwWû~D„ß~=aÉõðþqéäÚhnÐ^1ç%” Ka¨Õk*;î|ÞÅûç|Ý£òærV*Ip^÷ÎN×س¬×“7„Ûõñ¸ÿ«AÝßJUn%zÇò#í2ÿ:öžö}„™ë¥rÔ.V¶¾T(â‡ý.¢†cvQEÑõ•Â,Ç<™rĵŽì)Ð(ãòëYÉÌ£È@FÆølWÆ>²Ë"öp]‘Í^CÕIïA —lë=LìQV`8èð iGù:ËVú”ÕЀ‰!û“€ qN3Èð r8êà˜¹ñºã¼š¿<-ÌjÌuÙÙ†xE?õN?¾ËpÈÒv%þMœñúýPyç³íõrz6#ÏvŸíô$«¬–` _ég33ÐCæ|ìw5˜ïXá­)+Ö¥Ð&*{“œçWcV<ð4ÞÙÑf廟9Ù&“c?´ž”;S¼ø®F›„wýA» m.äèÜÄI?-i¼Lo›u-|<ÔÙw5Šì6Ræ£ðCÕ™R3Ä’Lˆ!²–”nã{§|ånãVŒ²¸ûs¾¡‡Cs?igá22Þó›ǽÞW@gB™U³ S¯wYµáQø©®œ|UÖ{ÕH…M#íF6`q„ 7 ±.HŸð—ë·5z†7æÍ9Ïv¶àeK8À¤’šƒ<Ôc:Þ÷Û=Ý9Ë -[M¦›½kâÌñÇF˜€ü&ûmÝŸœ¯Þ7u}—ÞÇ™?+¼Û^¦–^”­¨ -}¯Up=Ô]9ê®íòýp+‘VÌtêvÐã—_¹šŸ÷ç/Cü áy¿æÎfªg÷iÇÜs4i…·)Ã(‡ò#›eÞo»¬¥Ý -Óa“3u“áý­ú9½‚ñk—Ô^glOÀ¿!(¼{Ê×.qëwF‡ m€>’Oî¸×û‚B¡r0¦0@Ì®Cm |þé翶73ï×}Õ‘åØg²¨F×T8…Ö^{ÊÌ%³³ G°8²¦=ÝáÕÌå½S¾ræÂo*wqwgtb¤§™qöÙsbpXWýŒTDÞ]΢¿Á¼‹ ôdw…ÖL[I‰ºIÇm›,çG\½PzOaQ}4•ì{ -‹r(,~È„ÌË`™{¼³¨š Ñaëø¾Ã~Y*ö=v¥ÝТøàl—³ÚÇöÁXcºåü$þ/gn6­ïûþv@ŽPwàåâäËÓ1O‡œ8âÝçZó±ô«;<¾w…ÚP€ß7öd¨f~“F}êDéÒøB}"¥;¢—ïŸÏ´ãÉBÕ£«Ô¾M[x#-¨ÂÜzŠçEGhtof—¢5SïŽàÇKjos¹öF¯MÅ8Ï_ùqMdès½òdÅ¢t*wMIîúÊÌöE)?ÎQü/HüÆAäWéÚ‘È‹>~ûTóó…ŸEJÃ'Û÷ØF.~\,òË…¿ç‚2Ñê.ž™Øµs-rzívq°¾z (¶ý×ÕÑ ª%iÍc?wð2Uhoàl+DÌLîžÌwÏíéÌßRLèWiŠÓ™_ ˜ ’»\OÉÜ_ÄxO´b»Eö4äqünéT]ZÄ)ºTÇ?Æú,ŽóñvÁ¶áH}Q©ü c©¡]ĉA B¨:©qŒœBóœÒí¢¿±ciÂaN¾85?¢N¯ÍquŒSH·‹:®¯çIå9ª¬©uh~‰²L=”©x…v]ÿÌ_~$|ɯç Éœ‚γ¶EØ¿#Þ.‘¦'.òË%fet\Xaã0=I bÝI.vÙË¢æ2T×4~KŽÿÝ "N*#OûÅÑ4)~Óu]­MØ7'y¯$IOuHÓ€£¼Æ -uñ3½áŽŽµ‹UÆ3èÎÑSc;ªP™ ç:Äcšà±'»iu“Ì6ô3±RíÛ-rœ¦ü²#/9ãtÕhçfÉ ssÝEN;_$9ÏwüÚò”w®+l~o-°Ñ‘̦_Æ&‹ÌÏÑó™› â  °È F_yxëD'þ*¦ñër2-âÞ.¹´0çCô\Ȥàø[8dÆä®Øßâï_èúÝxís‹ãÞN´ð[wdÉø;›ÊÉüNƒ8ÝF= Ø_dWÖØ8¬aÆq~W.h<Ý.`#ÝDP7¹’—ÙOÓõ.ÍÄÄÛA‹3‘ù©g³övÆÍñ{üÂð -òvpY/¬|K⊇®ÎOÜz1rQ\Š ë’l'&¤Üdªžå'y÷"àË°x´Â¬\zÐÚ]ˆ!Hƒ¼ ““›Ö<ŠÐ_ì^?ùÜ»ÈixS'´OꋤÎcê<ÚeÚ_Θ®|1œwih®„ï…™ä,×X©í.¤ -jYÓú€(7¥AÛm:Å„ ~“mÐæŠyÈ”ú´¡–vÇEÕRž9Å¢þEj:ÊS™JŒòTÒÝX^wD¼™-…™EiÎyÝ]#g.YZ’³'•ÖÈ0h÷{Ó~ïm¯â6h ’Vfj×´x7ò‹ðïK|G}2V5þ´®†+단ÉåàCûîK[R†}Q¦"Úïžó¸ïqßÝ}¹ŽÃP6󓯈ðF=gˆ¥Æ7œêÓªUoé} -PÚ: æîŸcn_cמ&mÍy™¹Täo­ œôþ²­lÞ€¿íZ'íÏÿNsTN -endstream -endobj -72 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 71 0 R -/Resources 4 0 R -/Annots [ 73 0 R 74 0 R 75 0 R 76 0 R 77 0 R 78 0 R 79 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -73 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 797.673057 101.433071 778.923057 ] -/BS << -/W 0 ->> -/Dest (cb7-1) ->> -endobj -74 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 778.726036 99.933071 759.976036 ] -/BS << -/W 0 ->> -/Dest (cb7-2) ->> -endobj -75 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 759.779014 99.933071 741.029014 ] -/BS << -/W 0 ->> -/Dest (cb7-3) ->> -endobj -76 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 740.831993 99.933071 722.081993 ] -/BS << -/W 0 ->> -/Dest (cb7-4) ->> -endobj -77 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 721.884971 99.933071 703.134971 ] -/BS << -/W 0 ->> -/Dest (cb7-5) ->> -endobj -78 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 702.937950 99.933071 684.187950 ] -/BS << -/W 0 ->> -/Dest (cb7-6) ->> -endobj -79 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 155.548661 618.187950 248.939042 603.187950 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (https://kubernetes.io/docs/tasks/debug-application-cluster/audit/) ->> ->> -endobj -80 0 obj -<< -/Filter /FlateDecode -/Length 4663 ->> -stream -xœÅ\IÇ ¾¿_ñÎÜ®…µF$œÀˆ€ rž%Á(€œCþ~>V×Âîæ[F#[¤™&ka±ÈdõbÏ¿¶ø/“]r.)Òùòáôñd– þÔ›‹ÊþÿR8[Ci ¶ÄΘàÓ’Jp)žŸNøow)›?þþÕé?Û>öì–R¢³áüË;f‘_RNÉ…UÀ2Ö+¬–”\ˆ -+ÚK,EcAŒÈÑ‘• •4Ä ç²ÂÊÃS²þÈ*Ã%K bØ’²rXgŒÊƒ †È;…gáô¨ñœ]b.®¨¼žMNãy¿ÄD6XW–cÈ K(Æj¼Y‚%2²ÏIãEÈâ£7*²¸œ¼ÆKÅA;EáeÈëÊ*²˜h¬Æ+~ %©¼žÉ)y΄%dïƳv °M¯òàQؤ˜žƒ,Ñ„¢ò KðÆi<Y5p"ø”³â­Ž½Ûo5^€,Î%Ry›¯!€‹Å¤¨Ar½™4,(YR•Y4ÅoI¨7N/BWHÂ#×›Yä¨7‘Ñ«G™ëͤwC2i<à.2Ó¨a.Po"³Õj{à ù™ÎÌ\qfõÄÀzb«zd`€½ˆVI=30_®‘ÔCˆ‰Ê2GõÔaLkÔcüE>FLXOŸäU„9$ÄÌœx‘nAÈîGÍ1›ù+ÍÖó±_~:}óÁ÷üÓO￪'eý¯…ñ{Š\XäeäÕx¤Lf©ãÑ™cÄIOUBø)}XˆT¦°ØÝXH„b„Ûr¿Ø­È˜e¶HfêÊh3/J‹½òQ•õÙ}>‡¬Gµûú|YÏ6ãYh Ž3ç×Nß|ÿ§?þþ/ÿÀ˜¯ßŸþù;>G00ðÅÏ ~¢Š v¥Ñ{ü˯þu~ýÝfìÌv€\¶cópHéŒ{‡!2ºòÐøB2·iøg\Ûßø‡êî«ÈÚ½Žª%Ä67Ï÷fú_×?Ö‘æZ‡Oºµ­µ7ç~7·¿¢7¹ÎîÛC×7dy– V6žv[([ŒÄ’í§ž¯ÏÕ=ê2iµýûÝX7íà¦þÒ^/vµæ^W!\øÉ'Š5ÑÔåh[¦Ÿlö…Ä\R‡B'u’Ðe³Á*—ð±j—aöÙË°ÚÅMý•ƒþ49_ ÓÛöïøÐyÿüÆ~EÌâ{@äGš€äû¡ õì._6jYJCÜ^>cØr|çµ5RÝ¿JÜzŽ3õ¼©Ïó¦'£ƒEŠ·×«‚Nÿ½ä -v7 UÚÎ!ZÀÚ8í•„kj/Ò]—ù]Çê±]Û6ÈŽõwÝ”íüµ]{îÿ¶ñ{!ïeÚÕ¥ƒÎnÖ•àÊ8IBÌ¿ ¿^ŒêHèO&#=P™icU& ÐE’T÷ªé~“ûÛu=Ç@,€Œ<$çóÙ!=k¨·_ -*á5${~Ÿ/ ePJ—w»KG(kðÕÍ·bïþ†+¹nä‡ É8" ˆuÒT‰µ²¦¬GžÛå Ç!.߸½¡üª¬{1Ãz76s;ž3~ïð~&©r3J½ Ì0ÍòS:PWðêf<·ËÞ ¾EÜĽ³-˜×@^­ûn0G~c)ºhÝ5#Ý”7H›¬Ïd¤†o<·Ë>àg+š¸w6å“3-~b ‰ÙœÏRæö—Eûž!µ©e{ÉEsž;Ñ6Å}©z/zŽÓ°Ã¸Îß$çXŽã²¼þ2שEñ:gÏ`úzß·½¹¥óÎøe¦p ¹œ˜÷û4湨:‘º.{¡îÀwjä±À.óÒŽ -d^û¶,—diÚ× ŽF)|™ÙÕÈš¨eN=[v†š…{ÎK¡ ôå§ôb)]¶ÎÀ÷ŠÚÏpKÓÁX¾»"4íúŽE³©?®ÖÂòªå>àiC‹J^îÅáÌþ°­òý\¯ÌÑ7ãJÔêyiÝ•›ºLmuñ²³íãxUþ ¼ÂšCÞ믾¶½àíu_MÁ§µÎ6wcåÙ°þN~gWÖC¢µÏ³;wØ!Ñç¬e¤pf›ÂíáöªV¶ùUmL>“Óë”Ó5>ÂK4Ç´xŸº+G÷Ëû\öz#Õ"®YÃôMŠfs„²yFéÆËHk•Pñèž=tËý"ú5YäcÇòãæc|v¯·»ÏXyåhŽÃg.@ûãxK=ËóóÛ 9S@ø>Î?ÒQ¹Y–¾¯<©¥]¡ß¼!|ØÚ®¤;ÜÆ××"÷ÆöF;¬ïÇ9e®q”åFðÓÄãõ)¿»ÙÎK‰>šröùh úF^jÎ+ï‘>»Ïo“BPŸuU㸴> y¿y5…¼¬í¨_ÖŸ¾šGõö3nÛ(à~M ‡å[~1-ïbì¯îôö†_§‚@Jï5ßIÚ%+BÚ[ÒKz¿^y ¹íg×VÚþD­ÓBn ¯û1Û\VÈe©kí`–Àç¢Ç†[ökëcr÷Ìò±>_Ú,§¼…E ®¯šå»+›’îš'öƦàÝn’‡LÍò\Öäb•Þ=êÛ=²ž¸3é8}‹h/¡¤€ù…uK)[ùNËØ×»MîlcÏ㯓œíîåmª!ùë3üT4R¿°uí}¡§¢ÇàÞÌ» àÊy$+›žö=H•]ñÂmöIÅ[3ïf×sWû-øxŠõ¥A[_70ëøË2çH ç1©œùEÅl<Ù®r[•dÏWzÖïñ|­Ú'z ¿µÏol®ßï­ýǺYP) °êµAýœ†©äìúÅ$?øs*¤‰fq‡ÌÄö«c‘õJ§]2(G÷-_Lûu5~”°.ôÕpÿлñkndÆC#õE¯ub…ˆžÑɼz³ØFæOÒd~l¬^Å! -×ùƒ8$Ùv8;Þ%[o1‰FL7ÉŽº<üðWÿµŒ=qˆ.UgÅö÷¶.‰í¼E¼œ0­ßSŸT*£Õµ»>·Ê'„*ƒz˱!4öI!]N -ñkÓ‡&læà‹]sý1ì^3$íJo§.'µ]-ŒJ£Už]K×üeš:?=zv…âol 1¾ÿº%óaÜØk“…ݸñr -4É$;3¢ÝœL§`…Iž0úTÉÝ[:ñ¿ú¯ÓÉ´ˆ{9ý|ªaÎùà8 ŽÞòÇ^dÆdÏÿC›ïðïß':ßß.^ã¸3-ÜÀÖ YF2þ4X~ÌŸ -ëÄá6‚èHÀþ$Û<Û†n #ŽsY–v4în&°÷–v ¨\I S‡‚ì†éò‹2S3áñ²ÓâHd^º73`¯—¾/Ž+L~/½K… ¹\æÉó3$ŸÅ¸â¦3¤ƒKNtÄ…—bÂ2%ÛˆÉ)'ªgùIn…ç¹Ä…H#øÒOÍ0+‡î´º -Ñ)°—r`²rÒ²‘Gú“ÝëÅûÞDŽÝ˜: }PŸ$u,Œ©ðtª¯—q{9b¿X’†óN ±¼ð=?’œé3µ Í…´QAͳ[kä¤Ôi›I{ pšé´1bê2ÅÖ­«¥®8«ZJ#§˜ÔŸ¥¦ƒÜ•¡Ä w%Úò¸=âlÉ(HsNsuf¶¹dVhQöTš-}§ç¦íÜ=ÚžÅ2h -gfjf·phùIø÷)¾£~ÌAkÕÿÖS ›ç÷8¨É&ï|ýĪɑ_¨ þJV¢,Ž9žÝçö¹Çñt£Ÿ{È™° yo’ååê"> -endobj -82 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 101.433071 125.127057 101.433071 106.377057 ] -/BS << -/W 0 ->> -/Dest (cb9-1) ->> -endobj -83 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 106.180036 99.933071 87.430036 ] -/BS << -/W 0 ->> -/Dest (cb9-2) ->> -endobj -84 0 obj -<< -/Filter /FlateDecode -/Length 4874 ->> -stream -xœÍ]ßä8n~¯¿¢žX(Q¿€Ã> ¹`,²À!ä¡·oæAo€½<äßÏGWI–mº¬î©Ùx=]&E™©O¤$«èjñóá¿Ìdr.)òõõ—˯kR°ø7•X\Lìñ›Â•,'¨Ä®¿Á'“Jp)^ß.øouÙ»üùw—ÿ^ÊÐÕ™R¢£pýûga±7)§dƒÂ*`Yò -+“’ QaE2xÄR4Ô‰oY jpÉAcA v.+¬ 5<'ò[V.k,¨A%$…Ez³VåAËì£`"=jõSTî0fæ$YÐ-Ñ}Ë9æb~§Øm~ìï½üþƒïõ¯ÿsùò»i¦¬þœßs”Ä:Hqæ\™©:†¡ÉLDž4„‚‘%R™•$Àâ}ÒM”ÄPŒá¶\ÛZª EgB03=÷÷E¦@0•º®ï–y–®¾ÞÝé‚7ŒZ á¶èl)ö4Ùiú>‰gè‰ûH$QÊ'ȉ×ò¢ðº Ýo›Ÿm—ÚËMëìõ§_.¿ÿã¿üûÿö#nûӗ˧?X+Ó"œ¿ÿŽäsºýe¾ÿ]]/øÿyýéOû÷Ç@n`K,ËûË-é/ßOÂÿøÓ²}‘3b1<%~‘K¦il{h’1‘Ùä[˜é%".D&ª)Ùã÷ûÇ K£·ýeQÛdKZÙ«Úö JiEËh»©²Új_C¿-’;m…åè ôw½ªŸùûõ—•¿Åe9v(ûrÿüºòÁŸoü&s¯+Ô{ÄUùJ]Ý{í…ÏŽt'@!\³¥”iFÈ–Õ}ÒF°ÕH×F¥€š#¦í}öJü2É ; Pc"ç1!²=Œ–²ìüL€ZV{PNæd³Ì)ŒÔ ÌyZÖvd24Ÿ \DFëSÒÍ^.y>B¨A™ó4{¢†³D-ª{˜ôA²_ÁXˆÀ–›¦‘QT¹÷aö $D\$Ezr±²JòÊåî®Ev•²Öreõôk`Nõ 7Η“Ì—É\¨¬vǘdæó±ï ‰œÆõd'B&à’Þã7Α;çÚåMe@c“£“…?­)Ò-âxÔâƒ2çir‡A!;Œ OéíËê>}Ôÿñ×ûefUëñë”<.ëÙ@z…ú×z¿,Ë·újùÔõm»?U°NëýǦ>dcB($ÍÛ¶¯:ÄzŽ*¬b”õéjE"º•«ÎÑO[ Œ¦¡Tœ¦û¡cÊ>2‚ñ²S¤“Y¹'·îtÏ÷¶ðögñ<ú½Ï²Nƒ„e]sZÜ…ÆdÎÓ…’l>MŸ4Ö,ªë“߆íqå8w¾‹ïŸžuÜ•íœËåÎiêX³cVéÅãíw˜PÌ´Í:+Ϲ°älb°¡/ykX@àh*xPæ4NÄVvXÙùüÌô{Yí'Åy&§Y÷öÔ9ÏpZ²½×{Ò’­ôásvSÍŠôƒÉ›‚kY¾Ñ @àà±C ʜǡ`òˆšÂsjQí§QV‘aŠÖå1JôNµ¹ß»œj#ý.§Ú>kÑ‘7lòøËyÙe­ì²l¼“I±#—“9Ë Ü%„ ¯€ØåÕöfÜ N±Þ<ó»­óØ­ˆäï4éc·r¶L1gMúVEÔpHæÿ‡gLæ<Ž#Û©Bvü«Æ#¨euŸúìy5‘*ƒß:”m}¼fÎ/‡¦Ñjs罘†³¼F ožé”9YƒÅéðéÑòöûñ`Yí"¦ù¹›˜XÅ2SÞ¸†íõ$ç@¼#o¶1sŠ{Ʋý9ò´U™“¼@Iö(Þ”9±å5ŠŒÜmd{Ôèó†™eõú4Ýém¦zðnâ”/ÇFOÓZGæõc>4:£]ÌÎ^s4Åûp8Ë:&r“¡FïGú÷;MßÕËÛ-!Êk2ò"!/¶‰œ§Ùå g[äEѧÂê¢ÚEdŸV=i ‚ïÌ·©w·Çy­Ý9‚¼,™Û4½ÄðØvc2§1^´òVÎô÷·€Éeõ‹…Š×ï—©ÊAšV$6Ëš~UÏÏÛídã¨w,;Já ŠÎÇó®hPB6­"}Ø^~:YåM¥½>œâEŠèK\lßé<$rçõ²3›™Fçλ¨¾_¥8>\lkÙÃDWÆ!'ƒÊA…“‹Gë;ƒ2ç1YÛ‰hgÛƒ²Ûd³û¤FÒ«¥ÉÍ®”ºEàI»Rb”=pÖ¡)dù¹D$»ñ1pPæ˱Û"H(‘SѤ§‹÷§žÚKwÍ(/éË¿;/œG9ºƒäÈgå£.¹ë˜ÌyÜ5Ëyòé¹›–Õ¶ƒÖ[FVâ–ê^/Ê°tñ~áW¯‡÷xºÑ~÷LØ°@/9¥et=|Pæ4.R¬ì ‡#›%Òeõýºx3åë!ªt»\¶õï‘™w¹l¥“U‡‹±k)T Å4×6º†>(sñ²ó9¦øÜ Ëj?‚!ë·KÖÁõÈƉy }«Ï*†¼+…Ãø«Jƒ2ç1zÑ êî Âƒ«nqø›Þ{iiýB’~ƒiã"ÇK‡xa:XΧCœ“9ËdÙ‹,ç}~õªÁæ„U³¯{ºß{Ola?~ÊŽÞnJHŸ®NÞ•—®Žv ÊœÆèÓÑf”08מּŽX}g3ÀîÛõmÁoÓq¼ŸÅ†ÌÃNç6c”ÎÔíÖ wXäÀNSê'•]iu6˜Ø#Þ 1XùdYÓŽ…$çJóÿðÏÿôÿúsó‹Ã»Ï·g(ÜšÄMû¥)¤é¥É¤¤Iî_îå^§oôZnjÒ—{Ùtž§²²ð*Ø{/#G7Ê‚ê£r/º{Å{Æj;]>oLðë%NggÒt~²SðV²wkä]Ñ„4,˹›ž©69MD×Éék)~m¥ä¬^- t“Iú‹{ù_'cýr‘¯ä¥ÜN•·)EX“ß.ò­¬ ¸A²ïm«K–ûW´W ’çuIŒ½,­rêGêÓˆ|¨br†ìú«Wâ¿·+DHFÚ’åéwßÉòÍ ÙøûUlª„Xuq®û²s…³à!YÞ¯š‰aK´Ýíf²U˺ö±4›ƒØT:óײ.uæ|D|½à¶~M}S©r|­ª¶.ò›JóR¥QC-Ù ÂÍN -éõ¢¿³µjÄ°ÔøÕäTÝ1WGâV®Ôr -éõ¢–»×š¥R+•gÑR[~VevuŸ[Ã+´©îÔ$_5ÓõëëÇ%9Šª­‘MÎ~ã6Ä׋lÝß.!)¥ÃŒ6T×뉾«·‘³ýe¦¦\› -]³ÒäLRùÿ¡Qy¦ÄÍ¥ä Åùj¾‰ôÍF^6RO uXkÉ{iCEÝ)5ŸíÛ‹²UÊ è¶Ò­ÅÔ®É:z*U=©K25¯kd°Ú> +{¢­Jàv394W~[g=CëªÁ¶›EêÜ=´zgrlØùÖ“S³8É!ÑMßVoçó•ø: l¼&‹ëçz“™,ûÚªû´›uÄY1€ÂLžaôm"×ÞÚÐI†ëǹ“i#îëåo—i˜s>8‰s£'ù΃>b¢ëÿ¢ÌŸðû_¾þPÙ½ãÎ6´p [ä~$“oÈɃdùÆœJlݦ#:î`&SžË†ê mw®ÃkžÅí ìµ$5¥Æí‰anÃŽìšë:ò]Ë„Ä×U+¶@ækm3Ø·K_N^£”㙫V¸è—yæùyH¾vUâJŠÎC:¸ì:A\ô•â²»a™5[¨)Ùߤ5½èϽ)dú¼¿è¹ô3ça¶¯ºÒ¦§èŠ öýE_1SÓ²ÐGQúÃÝë«í~W9Ö ÔíúÖSÛƒ µžNõÓe\^¶1ÇOoéÖÎ;·P«Ëw}Ï· gîshÁ‹‹ÞG;jžÅîBS®´ÅMë@Ñà4[i­ÆTuŠw±Ú,Ógµ•R‹)fêßú–½UZ#†Þ*qSVê­#^‹–| €BïÎi~:;—l±dVh±—nTžKúJÛÞ›—÷®£íµ{ ž‰sdjg±°)ù!üûH߹ɬf´RõgšÕ <Kš)yç§o´9F`Ë—Å$ÎÝ4Ç»eÏ{lg7ê¼G'˜Ã°÷6‘|g¤®Âå˜ÑUU¿OR“÷v”Gz_(Ó:3ÌÙͬÎô¥aøwŸÜi—IREùŽ@/Ao–¯6J–Ôižiª…Ó'ÓÏÿäGS" -endstream -endobj -85 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 84 0 R -/Resources 4 0 R -/Annots [ 86 0 R 87 0 R 88 0 R 89 0 R 90 0 R 91 0 R 92 0 R 93 0 R 94 0 R 95 0 R 96 0 R 97 0 R 98 0 R 99 0 R 100 0 R 101 0 R 102 0 R 103 0 R 104 0 R 105 0 R 106 0 R 107 0 R 108 0 R 109 0 R 110 0 R 111 0 R 112 0 R 113 0 R 114 0 R 115 0 R 116 0 R 117 0 R 118 0 R 119 0 R 120 0 R 121 0 R 122 0 R 123 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -86 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-3) ->> -endobj -87 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-4) ->> -endobj -88 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-5) ->> -endobj -89 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-6) ->> -endobj -90 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-7) ->> -endobj -91 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-8) ->> -endobj -92 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-9) ->> -endobj -93 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-10) ->> -endobj -94 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-11) ->> -endobj -95 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-12) ->> -endobj -96 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-13) ->> -endobj -97 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-14) ->> -endobj -98 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-15) ->> -endobj -99 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-16) ->> -endobj -100 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-17) ->> -endobj -101 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-18) ->> -endobj -102 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-19) ->> -endobj -103 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-20) ->> -endobj -104 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-21) ->> -endobj -105 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-22) ->> -endobj -106 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-23) ->> -endobj -107 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-24) ->> -endobj -108 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-25) ->> -endobj -109 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-26) ->> -endobj -110 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-27) ->> -endobj -111 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-28) ->> -endobj -112 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-29) ->> -endobj -113 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-30) ->> -endobj -114 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-31) ->> -endobj -115 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-32) ->> -endobj -116 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-33) ->> -endobj -117 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-34) ->> -endobj -118 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-35) ->> -endobj -119 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-36) ->> -endobj -120 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-37) ->> -endobj -121 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-38) ->> -endobj -122 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-39) ->> -endobj -123 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-40) ->> -endobj -124 0 obj -<< -/Filter /FlateDecode -/Length 4375 ->> -stream -xœÕ][ì¶ ~Ÿ_1Ï¢J"© Pä¡h^APAN¶9 ŠM¤ýûýèɲ‡³ã™žº»ØÝ1)Ú´(~"iYŽß_ü*\)5'>¾üpøñà]¯©Åâ`bŸ,Çà9; 59þ Ê.W‰9_øµ:›¿þü³Ã?—2á]­)9þô²˜\.9{1X,È`‰¸œ£$ƒ•‚Ã-Öj± †dŽ|ÉÊPƒk‹58Æb° -Ô Î.YjÄØbAP%¬à¡GˆÞ›<(â™)¼ .¡Ó“Å‹Á¥Rc5y¼£Å#r)s`ñªK)I±x ]¤ú`ñºH`öº0•lñt¡DÞäA—X2Y¼ ]"z§¼]0ºŠÉƒ.>ù`ñ*9©…ÙäUð|Éå’½8)DÞâ…àc“L< -FJÙàEè’¼T“]„|´x]ß8!”K1¼5ªw“§`ñºÄ˜ÙäAßB€˜ ‹ÏÉ‚xS\²0 æì¸F¶@ r\¸X(Kuœ3Y0«8N5[8@>€ƒä¡‹p²€tax®Éƒ.TÙŠР,, ‚.‘ÉÂÚ2F‹…¸e_ƒ…¼e’…À…šÞÂâRIlar1”ª…Ì%`§…Ð…»g ¨K’¢…Ø%.ÉÂîoaw‰ iò  °…@GG¡… ܥ೅ Ü…E `U‡q˜,,ÀXq±oawcñlawcÆ`ò²ƒ’… Ü‚[°fnàn-,`ànä˜,,À@qÀoFÀ]@ˆØátÀZX€ù¼Hàd.",±°@€»¡bú3|håB©ÉÂî†ó™¼êBF~‹^v!¥jaw1Q‘…Ü| €ñ3j´°@€»0S[<ànˆÕ[X À]Ä ba†ƒ ,,Àüæ‚ÇÐ5yÕùZŠ…Ü,E 0 ;_€$&/; ¤`aÀØyÄ¡$à.¦÷jaAîz!²° w=#ì1yÐ…J´°q xp[ç¬:¸ë,lñ€»ÞçjaAîê´iaAÊJˆÅÂ(èG RaWsN¤êÁCÈgò’ñXX=È2yÐ…3[X€ÀÚUªÅ‚¡ ÅhaAŽÐ!ƒ…ˆ\ ˆ¾Íôº`¸˜ùCDŠÉ\©ÌdIÈÇЫ/EW2àÚäðB¶° gv˜Šƒ…È¥\Ó[X€w.YX5À laA®Ð®ba¦"W""s‹  ‚l é‚‚…%BDƒ”Xe&oafhä’èj‹Ç^óÌbaAáä4T´°n‚LHiò  `ÂÂØG“m±°É’M¤9&º°…¥DM7‹…¥@—装›šof ª‡.ˆø,,¨>9 “-,Œƒç½…5䛑-,€_j¾Y,,¨ä‘o"Å3ü¶RÒ|3[XPºB“]4UÃoIÈ7N/A—XÙ‚š’æ›Å„È7Ñ›%¢ùf6ËÀ]©@&‹ÜEdš,,ÀòMD¶Vnï¼’ŸÙÌ¢g1+Ð+˜[Í’öb¶ÊfÍÀ|5G2‹P™eIfÕÓ*˜Á›eüE<Ƙpª>%ª„á1g–¬7YáŒè¾çs3ºÒìTûéÄä{üû¿Ÿ~6UÊÚwÀà'NšX‹ºH¬07àÊM§c:¸‰È“†PðU"×YÉX<ÝTILŘnë±K•¡±êÌLwÆãu‘)˜Š’­ë»ež¥+µëÂý> xCÖÍÈ\ò„¤9öTÀT}§È34Å…4HhE5*vÂ!õz^4þå‡Üè|ùS…¶zc6gtnôÇ?~þËßÿé«?~Ë~øtøæhªs½ýÃùË/ÚŠœþ2Ÿÿ¾œéáô‰œçræÕ3/®dÏü˜‡¶Ÿ–<ÉËãð·³²:g´å›~“^=~øÝá×–¶DöÏüСñ8gb¾aþm"w™ÿ¿auä²ïÝoõµ5ÒùïùÙ÷U <ßb€J¾Ö:Õ=R\ñ7L¶Qf76CÖ€Ä î7Ú§e‡òÊí_R3Ô—vw“Žqšrœ -´B´v«»·É짻‘WE¦èï÷‘Þíß­ìeé­»e¤+åWÌ4=–„ÝXeöcŽ¬%|©>Þm­ò÷‘ßàê[£›Û$”hj¼º4 ?=‹}ÓeöcŽ`§XDþÿ<óÓã5I]·ròôÛ(³ &‹*"÷?­ùl—p˜ØèQ6ÊìÇúH]JäÏçq¤ ÷Ó“MUtÕàX·×$7ÊìÆTâæŸîx2šJ¾=›ch“éVO­:€ ­g{›èbµÄÓ²§õúœo˜p£Ì~L¨‹^ âåûÈ|ŽÊ‰0n;&$§Ûl”Ù)D©‰èoZà¼zªO+3t“ÉÊ<«ðƒò`ª1äX§óOÎýt©³¾ ô-]õåS”[fß&³³ë{j¾êë>w›}]å_U]:x®Ìó¼¥RõEăß'n”Ù¡’×uÔÓ;wwŠ‡z /}à"9n>³šÕÖ¾3µ3’½ÀS¯n}°Qf?F!]"Æð¹2ú?]«!D¡¥g]T:úÈ;œ‰ê-(ß(³ŸaCºþ-åtåQ’éï·†¾é9JX~êlß¼ôº|eç«îùbÈß¼zôÑåêkª†tl(XÅUÝ’u×C>Öʲ‡6Êìg@‰N~Pw Ý9Àbô.è>5eu¹ Ÿh‰}ÚX›xÄ¡×CB©¯ãøõíÆ~CzÚ_@Ý]JOÝz¹r«†Ë8ጶ¡-_®×&ºª%Ö˜ˆ§%FÓo°m2û`E×êÎUŸg€-.÷Ö[?ɹ¨¬ù·c¢õÄÙh—[Ÿ¿ èÕ³ÜuØ< §·ï—õ~1gɺ{7 p]ùˆ V·=¹”¾Ù×Lº,æLKz¶/’vÛª³ÉöÊüF™Ý¸À´eIÈ\øýÏ2µáͳábNûú¼ -Ò??í8—0n¯Ò;ùf“}:u‚¹[È1¬vçоKçNÓIÙéFÈT‚é3EÝ;H»ê«ßþæWøËÜUšˆÄïðSp‹rꖨѬ>×sZb«]£ÝqþûñÜî£È½µ;%Cç¶ùOma’ø¢Ñ°ï)ä…ÀtÅós®•Îù®tùîÂ?Ò´U˜ö0ôi -mkÑ-çœV@ïêžYŇÖåaê¤p¼"9m ýco¥¿Aòº¤>ºšL2œÛÿ8뇃oz:bO;»ú‰¬KÜÖä׃îìËAOÜHVâù£ïçÒß+Ú <>»ºnIâüùcí''i£´»Qyibºã’.kG:~O6ˆLá’¬wØ=“uwäâè|”º*’šÎ Î'ä±í|ÂYð&YÓ“™(—D?\n&ë.­mìk·9ˆ]õ±ëÂ`þÖ6æÁœo_¸,­©¯&U÷dm§j½‹é­ÑhPªvª´–Ý Üíd^ñ ßNX=tþ`5ÝÙîD,m qoW[;ƒôr0ÛÏ&ÝR¹·*³hm=?«2u*½ã ÚÔGgjÖíÞñÔ>.ÉI-Ðl\{7ñ‚ørЕŒä׃d£µÌXᥠ½‘HÃy;¹øy¼ÌÔ\ZWÁ5M÷Óß'¨NUä™>îCJˆÎGóEÔ7;yÙI#=uÔa«ç¹íÐ]Jû˜û+o´WÐí­{-¨C— ô\›z -R<–äÐG]'+„µþéX9}S—›ÉÒ‡òë‚<ë)ÝUÅ÷‹¥0 wéçÉ©cçëHÎÝâA7jìúöóc¾_¦‰×dú¥]d&k ¢ Ÿ~±8+P˜É3Œ¾Näæ­t¡]û8;™5ã¾¾?LÓ\$‰“&„ç±Çˆ)ÿ6¿ÃÏ?|üªmtwšÇ£ïh;¶.ÈãL¦»Ô—dݵ¾»Û ÄÈìÏäPæ¶ÒFCŸÇcðšgq?{k:‚†Î‰2÷á@Ž}èÆ@CÏÈÄ—U/ö@æQÛÌöéÚÍá2¤[$6­p0ÞËÌ£yJ>§Ä‘6§tÝ4%‚8OŠÃá‚uÖl¡¦Èñ"½ëUMAz­á`#ôfÏÓìxêF›îbh‚˜ÆƒñÄÆ‹Ö…>†Òw»×Ãv?«œš(µC{§¾ŽÔ~cJí€gSi:LËÃ>çдKsÞ¹‡ú¹hð=êAÎìshÁ‹ƒqŒÔ2‹ÈxQn´ÅEÛDÑá4ßhýŒ¹é”Îb­[¦;.f/åSÌÔïÇž–Ñ*½e´Jºh«çm3^–¨@2ç<ߟ[öX²´4Jw*Ï-©Ñ.¯ÍËk·Ùö8ÜÏŠ¤92õ³˜\´¼ ÿîñ“̪‚`µjßSU#”ykXLÔ2EšþÛ/)CX7lÏ\†2Ç»eÞ®{\V7ZÝc¼Ìá˜Èç ÿ·ÉVáŒz›1œªýO'[LßÄ0né}`”uf˜óUéwàë\Üé‡YSEý?=¤AoÑ/}0Ë> -endobj -126 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-41) ->> -endobj -127 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-42) ->> -endobj -128 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-43) ->> -endobj -129 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-44) ->> -endobj -130 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-45) ->> -endobj -131 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-46) ->> -endobj -132 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-47) ->> -endobj -133 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-48) ->> -endobj -134 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-49) ->> -endobj -135 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-50) ->> -endobj -136 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-51) ->> -endobj -137 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-52) ->> -endobj -138 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-53) ->> -endobj -139 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-54) ->> -endobj -140 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-55) ->> -endobj -141 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-56) ->> -endobj -142 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-57) ->> -endobj -143 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-58) ->> -endobj -144 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-59) ->> -endobj -145 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-60) ->> -endobj -146 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-61) ->> -endobj -147 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-62) ->> -endobj -148 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-63) ->> -endobj -149 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-64) ->> -endobj -150 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-65) ->> -endobj -151 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-66) ->> -endobj -152 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-67) ->> -endobj -153 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-68) ->> -endobj -154 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-69) ->> -endobj -155 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-70) ->> -endobj -156 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-71) ->> -endobj -157 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-72) ->> -endobj -158 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-73) ->> -endobj -159 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-74) ->> -endobj -160 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-75) ->> -endobj -161 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-76) ->> -endobj -162 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-77) ->> -endobj -163 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-78) ->> -endobj -164 0 obj -<< -/Filter /FlateDecode -/Length 4434 ->> -stream -xœå]ßä¶ ~Ÿ¿bž D‘DêPä!h6EZ= (}Ølï›Iúï÷£Ç’e½£Ý-\ô{3&%™ÅO$%kÝÙâç ‡ÿ2;“sI‘Ï?~>Y“‚Å¿©Äêbb‡ßÎÎr2Á•˜Ãù'!P2©Ÿâùé„ÿ6—}ñ§Ó_~uú纎;{SJô.œù$,&“rJ6(¬–u¤°B0)ùVtXŠÆ‚!±çkV‚\rÐXƒ½Ï -+C âäèšU †OŽ5Äp%$…å,äpÞZ•A,3y…炉èô¨ñ¼31_T^Ï%¯ñˆLLì‚ÓxÅÄCÖx YB±NãȳÕx…)'! E²*²øœHã%ÈâÑ;EáeÈ‚Ñ•Ud±Ñ:WÈ„’™U^Ï支yÞ2‘ÕxΙ€±I*%Ťð%Ãų>“áÌYCŸ‹á”Hƒ_‚áX’†dxÞi@@²Žƒ, ËUy… -kX@² €†DÅ3iX@@[ÆhÑ°€·l‹Ó°€€·l]Ô°€¸ÓjX@@\Ê‘5, @.†RÑ°€€¹ìÔ°€º0÷¤au)D¯av‰sÔ°€€»ÄÎjXÀÀ]"ÔTyXà£!—IÃî’³IÃîÂŒ¼†ЪÁ8Œ`¬Ÿ³Õ°€»>[Ö°€»>a -PyÉÀIÃîú€GÐfnà®ÖkXÀÀ]Ï>jX€b€?Võ€»€ »«aæ{ð`ò=ÿð¯Óç_M™²úã0ø‰£ÖALĨpe¦æŠvf"ò$!¼§Ž‘Ê"¤,ÎI7S1¦Ûrn_ÜZdH,2;83Ó“q_D -ª¢¨Ëúâ:o%+ÕûÂü>Àyƒ•ÂØ0—cðg„ØSþ²“ôe5ÞBNÜG<ˆRT¼ 'Ì>¯åUá¯?œ`Dóí/ùÙvÙ‰¹œÑµÞž?ütúòë?üùÛ?}‡Û~ø|úøk•™ŽF~¿úÛùÃ7§ß~Xw -¢h†Ñ<ú'ËS»ý8V宎|þCL7 îÄÝý'©'毾p(Ïqþü¿—ïÁÍ´|ùôŸ»òaÍãÏ—OŠ:½]ÏüæO?Îí¹¿ëú„±¥”³—,ü'÷g:Xç0…oŽðÝî^ikÕÖ®îUì1¼Ã÷3ŸÖ*¨ª -qýÙ†…_ÊßU<AÏ"I[ùšˆù–êÆêGuˆ„0Ƽ½ß·¿Î^ºU¾ó§jk—ÏêÞZUب¬ZòÃŽŠlû©X`_ ÂVnÁå`ã¨(I">ëßLEÍÚüÚ’ššªø轑³¸ ÁÞÙh'@9ñ–ÇêF^â6ÜñÞ›«±tóÛò&-üi£¦9cBEÉšT«/º·[ƒ†^2Íò]s¯Éž¦h ¶˜ÐgYv‹ß cuŽ3¦›BxízKÛ›hïˆÐŒéÊÈ®kâqOw°ÎqT+Ëë!{Þ±óWzºëæ?VE=®¶ÖºÁ1ìé^ßkÏÓå,ï 88MÞîX•Ã¨5XL7ßv–ƒÞÈÓ]ßæ–§dkZäiYˆ†ñlhãù~¬sœŽ—-®þùÎbΈ§»ãδµ6¯ÃX…¹½Qê#bAôŸŸ^Žà[Æ`ãtj$zý2è{¤“ec±¼záäÝœ€²Ï·T0Vç8*·Âl‘—k^í,l'ÿ‡nOër»Päe>ïOÖ9L÷G+{‘§÷ÖþWRÇÑEƒ©uZ;LdrL.ß²ŠÁ:ÇQ ÉN+f·cw¦Ž×Í~죨ºžüp½–Ì{¡=n—rºtô4n8 -êp©xRäܳQÌõÆß³nzåL^Ju·œ„Á:Ç A¶‹%çv–w^ét¯›.½¼Uø6 &Z_¯Âán@¨ ¸°þ -Ô·åo¬Ë{n.¸¨f ”è5Vç0 -ÊÓ{Ý$‡îÜ­ -$Ü(‡ö¶#oàñÊÚ´¤¤þ– úعÈ1zƒuŽ£,’}‡âïݯ¬~çÛ±¬Î·m -­Š³×sÙv±­9Añ«w²ÌÌr¢Iq‘^ðNÕXã(;Ôç˜î_2‘²óàÚû(4J.Ô‰›9œJ¬s…fÙµè(Ýo½Û5›mªt$õß+ -û´UðΫŒèǵOQ Ö9ŒšŠ•MˆL¯jõÞÔ&pe›Hp4€xm¶¼¸b\LÓa*£^è`㨔dcLñþe¼½7ßÛâ -ã|)Æ-n°ÎqÔ½!îÿ‰ÅÉ1ŠÅc¾šNQóÖ¹tëýáÁ:ÇQi–ý‰r®ÕýwkŸÞƒbqu,×ÎËäͦõ¨OÛÙ®\ms»}lo»ÙvcÏ3s`Õ¦„@rË讋Á:‡<ÓQ .qæû×ü¯Œy@‹CÚøn>…n¹N,tŒ8¢?Ô¤©àf‘=>u‘zFÇÙmNÅžs—FÌwFŽ–ý , Rrbtä·¿ÿÝoþø×¥# ½â?]|./“•¨$®ÒiÒÒ)óçÃ\NbŠ|¡×rSÇ?Ìe…öý\ -ób&s9´÷phÏ•¹Lèî/u/ïÿͲ|új«‚ŸOq:5ÊM'Ú8ùm%ËAoF,8!0Èrâaú›»ÜMäÎ;5§™n¥ä¬Û(Ë “Jú‹¹üÏ“²~:9Xš<£ŒçËyªv"‹ÕmÉO'9O—2¦o?HâüÕ¶¶dùzC{$S¶%);-­q -õ«õi¤~¨Õäœ#ÙÈU¯dü^n¬Q3ºk²<½5n&Ë™ÄÙÐ|›(!V™A\ä¾ìÒàRñ&YÞ\ˆášh»Û-d9£–õíki:±‰ÞwëÔ_ËúÔ©ó9âã ·¥-õI¥ÊI¨µ©Ú»Þ6uB•F µdS7=)¤Ç“BüÂÖ¦áuºÆï´&çÉ]ˆ¹$nåJ-§Oj¹¹µÐ4•Z©¼T-µçQ–¡N¹u¼B›úh¦&9d½³KõëšEU×$—q㯈'Ù]xE~:…¤” VØP‡^O¤®ÝFÎv/ U^¸|ƒiVšœÆ%ÿ_ "4ª ÏôÅqRr¢ÞrµÜDl³‘×ÔÓcCÖzÀqZÊvÝåRjc¶ï/—­R^@·•n=¶¢v]ÖÑS©â H5ðX“]u,Vû§aeO´UÜn!‡6”ŸVäEÎÐL5Øv³èºáZ» 96ì|êÉ©iÜÉñˆMÞÖn7æ+ñqšØxK–¡ŸëM²lè®Ã§Ý¬#.‚ò£O¹ZkC'I5Ô¯‹‘i3îãéÇÓ4Íy -^<ÖHNNûí=&wþ7Ê|ƒßœøüm=^î2{ÛÐÂ7l]‘û™LΆσd9+¾›ÙtDÏì/d——²¡Ž†6{ßá5/Õí쵤kê·'†¥;²oC×;êz&> -endobj -166 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-79) ->> -endobj -167 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-80) ->> -endobj -168 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-81) ->> -endobj -169 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-82) ->> -endobj -170 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-83) ->> -endobj -171 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-84) ->> -endobj -172 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-85) ->> -endobj -173 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-86) ->> -endobj -174 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-87) ->> -endobj -175 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-88) ->> -endobj -176 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-89) ->> -endobj -177 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-90) ->> -endobj -178 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-91) ->> -endobj -179 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-92) ->> -endobj -180 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-93) ->> -endobj -181 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-94) ->> -endobj -182 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-95) ->> -endobj -183 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-96) ->> -endobj -184 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-97) ->> -endobj -185 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-98) ->> -endobj -186 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-99) ->> -endobj -187 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-100) ->> -endobj -188 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-101) ->> -endobj -189 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-102) ->> -endobj -190 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-103) ->> -endobj -191 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-104) ->> -endobj -192 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-105) ->> -endobj -193 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-106) ->> -endobj -194 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-107) ->> -endobj -195 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-108) ->> -endobj -196 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-109) ->> -endobj -197 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-110) ->> -endobj -198 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-111) ->> -endobj -199 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-112) ->> -endobj -200 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-113) ->> -endobj -201 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-114) ->> -endobj -202 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-115) ->> -endobj -203 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-116) ->> -endobj -204 0 obj -<< -/Filter /FlateDecode -/Length 4341 ->> -stream -xœå]Q$¹m~ï_ÑÏN–DJ¢€ÀF$.Á! A‡½ñž`.À9ùûùXÝR©«ØÓêÙ»Œì`¶»H©Š%’I•JÎ?ßü'œH-™Ï/?Ÿ~9yW’Ç¿¥ÅÍÁÂþ¿%ƒçâR¨YÒùg%Pq¥¦Xòùõ„ÿ6‡có×ÓïuúïÛ>á]­9†tþóe1¹"¥ød°*X>ÁJÉ•S6X98Üb­ b¤Â‘÷¬1¸J²Xƒcƒ%ƒ¸Ú³*Ĉ%°Å‚¡¦b°‚‡!zoò ˆg¦hðBrƒž-^ .KÕäðB‰ÈåÂ!‹W]Î9‰ÅcÈ’ª/A–˜½Åƒ,LR,^†,”É›<È¥Å+%btªÁÈë“Y|öÁâUr© -³É«ày)²çEŸ\"oñBp ¶I&%åbð"dÉ>U“Yùhñ²0~,p"Q1¼5ªw“§`ñd‰±°Éƒ,P¾…1C_²𠧸da@,Åql@r,, -D©ŽK! bMŽs-àÅ`yÈ’8[H@²0<×äAªlaEÈ‚A–ÈdamÖbanÙ×`aoÙ‡lap!¦·°€€¸$™-, @.L©ZX@À\vZX@]¸{±°€€º”r´°€»Ä’-, à.qð0p—=Md[Xtt„,,`à._,,`à.Ü(ZX­:Øa¶°¶â¢ˆ·°€»Q<[XÀÀÝXL^qðA²°€»1á¬È ÜÉG ¸9f `(øãÍl¸ Iv:Y° ÞƒÉÂœÌE¤%$àn¨†O­\š-,HÀÝ PŸÉ«.Œ¸á·er®$à.YX€»€O±°ïQ£… ¸‘ÚâwC¬Þ‚ÜEÞ,,€9¸€ÀÂÄ7½\NøŸnMI‡y'ô©óriÉûÞ´¾¹.ï²¾0:”ÒÈ.‘…}ˆÑÝœý]FW†6W¥ñË­QQÄ÷«"SÙ´ÙlÊ oµøÍð¶vÇQ<ÊZDÒèï`Ä3ŠÜptéd+`1€ºöëñ㛀¢3R!ÉTý|(˜ìsE}6ƒñŽïWô6à?Pp3ŒP˜hýQá[ËsºÊ%æüHas}£°¨E;.‹bÿÝ -«wr¾ðo¯ } -*AÃë¼GMö9Ž‚P{D÷úõÙÈ€6Ê!²³§-<î¼m“I-°j+K§» 3êe}jªë*£87Ùç8ÊÒÇf:Ï,ïWV‹SŸ‡AÝzV‹mC¢Òç÷±Œ6ÊîIPþ0ÏÌ®…Ì^†bZT1ᑲçúGÙPŸrúË([öÅñ¶í*TŠN*ê„qô:êsL:×ç0 -Õ*•÷{o/3â­BšÇÍ£ñGCa_¶ -¶«H-£œ#|¨:®ø‘ßMö9Žš"‚‚DÄ…w«©ýÎÅWøV ;ÜT‚³ÄÖv‘µå¹Ÿï¨”Ä…xyÄ:›…Nö9ŽJ“Îh#Ìׯ÷<#F~¨Çer$ú à ›ësõ]ÝX8ÿ?ñ8A°J>³,ëâG¹ðè‰ÁdŸÃ¨”½.ðºÐõÝ—o=¥ïÕé³áq-Ö}ò²d³“Óz4NÛù¡];ç¦ß6î³@Û§÷2ãé2‡¹Šc}2+qYlËåñLö9ŽñD„Š’ÒûgëËJ|‡2H—ÖeO2Γ}Ž£Œ„`RSJwúÊè^Y6Ÿ/½´½ÿÕKõ´[0ï¥MÝxr¶•úµ àäôeâùe²ÏqT­«>’Dž÷»€æ[•7`ܪ¶§S­ý˜"5Ïûtk«ûäßµ‰¾¤8bØ4n&ªþQv;Ùç0jKðñíùÇ^:1°›ßNÑ=™ÍÃgÒU“™u…ãôüêdŸã(GW_ 2òùGSéS”îCå½™¡{¾•C3Jåyßšìsõ%¥f¢¿9ßÊÉéûFA_HKÈ8Hâ£çý“}Ž£}ÒW}£ìYåì|Çû݃¤¯MRÕ·Xc ~>;œìsd¯‹ð—6ŸVÁvÖ$)„Å/— ksÅW½U“úá·RiÙ!3X0kv²l²ÏqTJº:‘9Ì{ÕnøêfxùŽŠÛóƒmÙ\né– ôŒ°¾¥+¸XPp=ñw²ÏqT–tI_ áùGEÛä¡©’ê>ZõÄâƒ'ÈrÖE>bx¦k­É>ÇQ™(У÷óƒv·Ôj¹m¼¯%?~CU!‰Œº.ÍŸM3&ûFUÅëj¸ˆ2ëyUmç.7ó€ßJ ˆÀÎç”uœfÕ0Ùç8jÐ¥þ‚K??¥ü—Èö -GGQ0ˆó 5Ùç8*H -²EêójÞRAú `Ý[áõժʺp@_…Ÿ_=2Ùç8ª]làu7‘o–˜oçÍï,Äûk¦ËË¡‰Š¾œceŒ^~´ -l²ÏaT+ËKæ¤;=­Z¹Îo‡£Bæ,瘢ƒ»,¯é¾ý:Ê\Ÿã ?é:2Mݦ‡»x [ÿ°pü‘‡Ä¿êt’°nŽRC¦ùè6Ùç8ŠM -ñ’ËüãBï-)h«E²eíÒûüö9­ ‘¬c–78f§i'ûGu¢kÌ•yŸ<Æ4­`ôªçe#ÒýH¨$ÿH9s}£œêuµ¼ÿù·sR¶b½q3ë5TrYöEᢻýÿ(E˜ìsœ!']–K~ÿ›pãJª¯M *CHüœ.ïÄBühn²Ïq†<)dBÜy+:zÈ0Ôyã›ÕQ JgлǼLzŽîlXcæ'øMö9ŽE×JéVSc‘žâjJÈLç3´É>‡QβûE(,|çÙÄ¢‰G/'ï2yÑ}OnÏ·¼þíù‡ ¨kÅîvåßöÕ‡Oµæž`=ÚL`݉À¸¥Á¸n‚×/ "šI÷éfò°É«Xd4·Î8‡ÍVªý|½§ŒØåtW`]ÇúTC7ÒQeÿOÿø÷ÿò﫲Çç€!]”¯+­uL’> ZÖ{ê¨êH^??_Ûé 1r¡·v "¾¶-­/m¡¡ø¢š¾¶Ñ½„p€ó…zm“†kåKß‹%]eù²SÁ/§¼læ– ý|^r¤*ºÿšÓ姥žu)ñÄ¡ yX)œïô\öIþ¥·ÒÿAòº›¢N¶/*®íY”õó) ôÕG.Ûœú…¬KF·äדnsËa;N’•xýêû¹ôÑÛ†öÌ*®n[Rrþúµö“Sj_cjw£ýSë¦Ûé"”v¤ö{¹°ADÏöd½{[‹£ëQÜdq=!m×®’ù˜öD?\n%ëî­mì_k×9ˆ]ôqè þÖ6–Ao_N¸,m©¯&U7(m§j£}§Ñ TíÔÔZv…pדAz9Äï|;5²ÍÐùƒÖt›· Qš!qoW[;ƒôr2Û]Ï–º¦Jo%k×ÚF~e5u’>ðm£+µèÞçƒxj_oÉY5Ðt|`µ›¸#¾œteÔŽüzJÅhV¬ð©™ÞH¤á¼,~µ—•Z¤ \³Ñt“,ýÿ©Sy–/»IéFwëÑzõÍN¾¤‘ž;ê°5Z†ç.¥Ûì8^A¼Ñ^A··î#vC†l —ÚÄSêàqKÝê:Y!¬OÇʑ蛸ÜJNÝ”_oÈ«œ©»jòýb9 æžúyWrîØù:’K×xÐ] »¼ý¼ƒÍ7âËØxKVÓ—v‘•}vëÅâ*@a%¯0úº›·vtÒ¥?íëêdVÄ}9ýé´„¹H)jV)è&¼cÆÎÿ‹6¿Ãïøü}ÛõíÇ£ïh;¶ÞÇH¦[¶Ë$Y·poÄî61òû+9ÈÚ65kèq<ƯyíîW`o-CGÐй#1­c8c7Ýh™ôñe3Š=‘ùZݬûrHíæpÒý›T8o‡²òh Éçá”8Ò¦kH—ãÐãIq8\°®’݈©9^¤½ÊÏ£*H¯5 i„ÒÊã5ÌŽ§n´å.†&Hi<OÌa¼h½‘ÇúÝîõÕz¿Šœ›(µC{§¾ŽÔ~cJí€gSi9Ì·‡=æвÙEsÞu„ú¹hð=êIÎêkjÁ7£TY»]¤ñ¢Üh7m¢Ãh¾ÑúK“)_»µaYîXÌQ*=§X©G:Z郘F­ä][=o‹x=[¢ž¥ÑœËzw~mÙsI1hyìÝ©¼¶¤FÛ_›o¯Ý¢íy¸ ^Ékfê×ni×ò]ø÷ß¹ôÙÌ X­ÚÏ2«dÝ'šC¡HËŸ¾ñ’30„u÷òÂ2Ls<ÝçíyýìF›÷¯u8&ò%è1²Ex£>f §jàÈî¦+Ë[znŒiæünVgù+øwÜé‡EKEý£5:'¢{íÌižeª¥ÜLŸ,?ÿw -r -endstream -endobj -205 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 204 0 R -/Resources 4 0 R -/Annots [ 206 0 R 207 0 R 208 0 R 209 0 R 210 0 R 211 0 R 212 0 R 213 0 R 214 0 R 215 0 R 216 0 R 217 0 R 218 0 R 219 0 R 220 0 R 221 0 R 222 0 R 223 0 R 224 0 R 225 0 R 226 0 R 227 0 R 228 0 R 229 0 R 230 0 R 231 0 R 232 0 R 233 0 R 234 0 R 235 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -206 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-117) ->> -endobj -207 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-118) ->> -endobj -208 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-119) ->> -endobj -209 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-120) ->> -endobj -210 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-121) ->> -endobj -211 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-122) ->> -endobj -212 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-123) ->> -endobj -213 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-124) ->> -endobj -214 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-125) ->> -endobj -215 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-126) ->> -endobj -216 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-127) ->> -endobj -217 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 590.755821 99.933071 572.005821 ] -/BS << -/W 0 ->> -/Dest (cb9-128) ->> -endobj -218 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 571.808799 99.933071 553.058799 ] -/BS << -/W 0 ->> -/Dest (cb9-129) ->> -endobj -219 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 552.861778 99.933071 534.111778 ] -/BS << -/W 0 ->> -/Dest (cb9-130) ->> -endobj -220 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 533.914756 99.933071 515.164756 ] -/BS << -/W 0 ->> -/Dest (cb9-131) ->> -endobj -221 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 514.967735 99.933071 496.217735 ] -/BS << -/W 0 ->> -/Dest (cb9-132) ->> -endobj -222 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 496.020714 99.933071 477.270714 ] -/BS << -/W 0 ->> -/Dest (cb9-133) ->> -endobj -223 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 477.073692 99.933071 458.323692 ] -/BS << -/W 0 ->> -/Dest (cb9-134) ->> -endobj -224 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 458.126671 99.933071 439.376671 ] -/BS << -/W 0 ->> -/Dest (cb9-135) ->> -endobj -225 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 439.179649 99.933071 420.429649 ] -/BS << -/W 0 ->> -/Dest (cb9-136) ->> -endobj -226 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 420.232628 99.933071 401.482628 ] -/BS << -/W 0 ->> -/Dest (cb9-137) ->> -endobj -227 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 401.285606 99.933071 382.535606 ] -/BS << -/W 0 ->> -/Dest (cb9-138) ->> -endobj -228 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 382.338585 99.933071 363.588585 ] -/BS << -/W 0 ->> -/Dest (cb9-139) ->> -endobj -229 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 363.391563 99.933071 344.641563 ] -/BS << -/W 0 ->> -/Dest (cb9-140) ->> -endobj -230 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 344.444542 99.933071 325.694542 ] -/BS << -/W 0 ->> -/Dest (cb9-141) ->> -endobj -231 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 325.497520 99.933071 306.747520 ] -/BS << -/W 0 ->> -/Dest (cb9-142) ->> -endobj -232 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 306.550499 99.933071 287.800499 ] -/BS << -/W 0 ->> -/Dest (cb9-143) ->> -endobj -233 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 287.603477 99.933071 268.853477 ] -/BS << -/W 0 ->> -/Dest (cb9-144) ->> -endobj -234 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 268.656456 99.933071 249.906456 ] -/BS << -/W 0 ->> -/Dest (cb9-145) ->> -endobj -235 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 249.709434 99.933071 230.959434 ] -/BS << -/W 0 ->> -/Dest (cb9-146) ->> -endobj -236 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 230.762413 99.933071 212.012413 ] -/BS << -/W 0 ->> -/Dest (cb9-147) ->> -endobj -237 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 211.815391 99.933071 193.065391 ] -/BS << -/W 0 ->> -/Dest (cb9-148) ->> -endobj -238 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 192.868370 99.933071 174.118370 ] -/BS << -/W 0 ->> -/Dest (cb9-149) ->> -endobj -239 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 173.921348 99.933071 155.171348 ] -/BS << -/W 0 ->> -/Dest (cb9-150) ->> -endobj -240 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 154.974327 99.933071 136.224327 ] -/BS << -/W 0 ->> -/Dest (cb9-151) ->> -endobj -241 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 136.027305 99.933071 117.277305 ] -/BS << -/W 0 ->> -/Dest (cb9-152) ->> -endobj -242 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 117.080284 99.933071 98.330284 ] -/BS << -/W 0 ->> -/Dest (cb9-153) ->> -endobj -243 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 98.133262 99.933071 79.383262 ] -/BS << -/W 0 ->> -/Dest (cb9-154) ->> -endobj -244 0 obj -<< -/Filter /FlateDecode -/Length 3716 ->> -stream -xœÍ\ÛŠ$Ç}ï¯ègR‘‘70 Û2²‘´`Œñèµ+af ’üû>QUy©ê˜éžÕZ̽ӑ—ȸœŒÈª&ü|êñ_ïJ©9ÉùòþôÓ‰\Ž„K‹ÝÅÂþŸÏž$»èk*ñü^ œ]®1ät~<á¿ÃåÜüñô·ONÿÞ÷ñçàjMÁÇóÏo•%ìrÉ™¢Áª`‘gƒ£Ë9Äd°’wXb­ bÄ,A®YbH-ÑbA ¡¬1X²çkV…!{±XÃט –'Èá‘Ƀ $ÂÁàù蔞,^ð.•ªÉËàù,³KY|ô¯º”R,O K¬ä-^„,ыŃ,Â%[¼Y81™<ÈJf‹—!K€vªÁ+ÞULd¡DÞâUv±“WÁ£’Ë5/Pt±0“ÅóÞEø&›CãFÜBËΧT-,ˆÀ]lTlaAî>‹…Àx‡5XX»ž±S[<க,,ˆÀ]ä ѸƒóH,,Àþæ<ÁuM^uTK±° wKÁÂìÂŽ -ÄäeGòŒ!µ° w±½W p—"³… ¸K‚´ÇäA.ÁÂä5à!l˜F²ê(),p—<,lñ€»D¹ZX€»ºmZX²B±°:dÁÁ‚TÄÕœ“…©xHùL^r¸Žd!²Ld‘, ±v•k±° ÈÂ!XXdAÊ`a2W=²o³<€,p³>È‚LÑ ™+UÄ‚ê1hÕâ¥àJ\›¼žÏä,[±·°µ”+z ðNÓ% x^,,Ȳ T,,ÀVäJ@fnñ¢Jp‡Œ=³d]dEX²û^sŒfüD³õ|ìçNŸ=`ó=ÿðŸÓ»O–“²öãáü,I ë¨!*Ì ¸rËp‚¢µê!ª¥EBø!}Tˆ\‡°¸º©ØŠ±ÝÖsÿâ÷"Cb•Ù#™YV&󼨖¬ÜæEø¡|@ò¶œBæËÔØËæ$ê »| I1‘æ ­¸ÅN²^’]ã/ÞœFÛôë m¿œäÆn.Pn ó›÷§Ï¾øó·_ýõkLûæÝé¿Ñônþ|þÏó›/ŸYù»Qu OŸêot×Í)jõ×ÝoÏŠ]HB4:KÂÜøÃöÛ¯¿¥n¿/ÛÖc2\dcßßêŒ}^ëÜ”>`yp$±p£s|K¨3Ö~ÿf¤°p»ù¾.äÈÿÿEUŽD í¿iø¯H33>eï -1¯¿C™hU«›Ñ/Æí÷æNÍâG¦´Q­XµÖ¿HìC¹¡ô;û¼­£‚AUù›joŸ6HéØTKÃ$þû­MÚ›¦©¿Ekãá 3 gÓýBë°Ì(Y2r¦[f¸¯Ïë1j¿ è¶÷?qòly·©t3ÁG7EÂŽ^‚éÌHDÝV¾iŠûú¼Sd½Å­†Û@”jõ70J“ª¼§¬ïeÓr:Œ“¦,ûqø׈ТÉzEYü‚½¯Ï«q‹ .¦Eeüb·h&9¨¹›jSwÀ¤ÌÛ÷Ëæ67S§÷/½QX¼î©^ëWJ!Þ0Ë}^YP'ÂÇõ†õ½Àù¡æù5"ISÊ"Z‰"!*UPÊÞ2Ù}}^Éôþ’È–Û‘t0E÷~Ù›®›rÜ›7Žhk}[,Dbkχl²õýÞçÆ“Ë,îsí«Ìô#¹U -Žé5¢:U”âå¦[Ý×çõ¸ªÎS*|Û­{nßc£mþù‡½5>öýÖÿíÁEŽnu9¸Çeon9¸ÔSnÙÃ@å³ _²žêY/ë£=Q–£Ýç _ŸWcx}Ö¢x”··ñäfÆO$t—}òÕ®ŸÄZwóg+TƒwÄnàCRxÌ -ºã\Œ¹LÇÐT¼`k×3]¯÷ 9åpÃ1îìóz#`c,{£é¶ÏSYül”‡VUU½·|˜ô¾% -.Wª©½oŸ(!c“‚ÚÑê}Ü0v…asŒ~P­z­.Ð4M¿œž9àr^Sá¯þôÇßýåïC¯fÚºlÈ×›±\m×µ¦mö4O+ÎPBŠµ­N“d”kh/#é [(|§á³•ÇV×6*É"¶Xù’·qòÖWÇÛ CÃXÇUš¶[Æ{w=oŒ+MS‰ðv=„ò±e[›´Î±ô¡Á[µ3ø2yý¾ô©C6isû¶†ÏŸÓõ'q•¿É¼èËoò|wáa[ÿ¦»uŸšt›&Y6›Þb¼Ö±¶mk[æMCßÝÛØêQjkÞøªÛÅqÈØtÐu×Ú¶6Óº–ÔK6¹0–÷Ïê-õÆG_KCwÄc½ÍVË÷‡w‡¯\­÷Ž5,c¥MÏïVømjºmzY>4ÆŒ›]‚åç|¥›Deö1ºÑ5{QâS§ttE”oþpúì·ŒïÆ úŒT†ºßŸRTÝgažéúzÕ³ÊóOßêfquMñksfó -±†O>ëùj­Í&S¼öø•ÁkxÔð¦ÇÓæ? £[^¦ø™bfù.ÃþÍ—:þbFîð™Žo·d}ÒߟÕW½Â›9îòÆ6&M´0Å”³Ïáf‹iøÞ×Û]×!¤>¡é%?ßÄíÙÎÍ&7’›ë[¾ížäÙîîCêë\Î -©YŸP°\Õ„‹ï&³æÉì—í÷Ãsá= ½™Ä‚ }Xß KW&øé”–§düò¤$¥â|ÐW)ÎI«NëYŸÌ)Xh*÷‹’üù‰žË (?õVÛ;)¤©ê#Jë +ÓÅÖ~¤÷'MÝRKq–çÇi!—Ð.ùñ¤ïˆAyÒ ²·¯ÔÇßÓ®F» õή[rt´}¹Çö5Ķí[7}®C¨5âåɆubƒˆžÉ_“uõäüFÖw0Šãí*uQbj2ƒ8”¹ípt¼IöL1^išnõþVkú×Úmb}VŸÌßÚ"½w/'LËGê£IÕ'¿ÛPM»:'¡j§ÆÖ²Dº Òåd?¥6´À˜?YMŸŸ[‰¥9’ôvµµ3H—“Ùn-vKåÞªŒ®µi~ˆ2\KW¼A»LõK֗ʦ!n_÷ä¤h¶¦2ùM¸"^NQz$òã)f£uXA±¹ÞLäiÜN.4üePsiªBh6š>}¤ÿ¯P;U‘gù⥻”>A8®Æ$›¼WÒLOuÄÒ€—<ÚNêò9wŸõå ít{ë®±uRÙDϵ‰§ ÕÁcOöÝë:Y!¬é§cåL¤&¦äØ]ùqGrƪ‘údÉOîû¸ƒœ:v>ÎäÜ-îõqÐ.owòùF¼,›Éêú¥M2ÈzÑܧO6‡`…A0ú¸[´vtÒWÜÚ×dÖŽ{9ýxZ¶¹À1èáPb¯o7Ì“GâOç/ñù×IÎ_µÇéÖ}Š¥b6©p1/—eðxlÉçiH\iÓ±¥ƒ+aꈋyP\NÖ!ÙNLuÈy’®z•_fS°Î5]Li„^òàÉØfç¡mYÅÔ)0ÏóÀâçIëNCè¯_l÷MäÔ"@©Ú;õq¦ö…)µžMåå2í/ûžÃËÍѼCC},žb{’3Bc¤²»˜}t¢–ÑmkçI¥Ñv“¶¢ÃhÔh}ÄÜdJ[·¦–eÅÅÔRî9Å þ8k:ÎVéJŒ³UÒU[·íx=[âžÅÙóX–=—,-ͽ;UFKn´ë¹e?wÛmÏÓ2d’FfJ£[¼jùAø÷!±cjY­ÚÏrªáËxµøÌ—¿)@%%`ˆèkay~2ûå}ž?÷¸>ÝhçóL0‡fÊ^ÿ:„-Â#õ6cªýå»[%sI/SÀ“OòÛGËëÁø·îôˬ¥¢þ5Ö¤·èKŒ™¼y̳µ”ÝñÉòó?1³Šo -endstream -endobj -245 0 obj -<< -/Type /Page -/Parent 1 0 R -/MediaBox [ 0 0 595.275591 841.889764 ] -/Contents 244 0 R -/Resources 4 0 R -/Annots [ 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R ] -/TrimBox [ 0 0 595.275591 841.889764 ] -/BleedBox [ 0 0 595.275591 841.889764 ] ->> -endobj -246 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 799.173057 99.933071 780.423057 ] -/BS << -/W 0 ->> -/Dest (cb9-155) ->> -endobj -247 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 780.226036 99.933071 761.476036 ] -/BS << -/W 0 ->> -/Dest (cb9-156) ->> -endobj -248 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 761.279014 99.933071 742.529014 ] -/BS << -/W 0 ->> -/Dest (cb9-157) ->> -endobj -249 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 742.331993 99.933071 723.581993 ] -/BS << -/W 0 ->> -/Dest (cb9-158) ->> -endobj -250 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 723.384971 99.933071 704.634971 ] -/BS << -/W 0 ->> -/Dest (cb9-159) ->> -endobj -251 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 704.437950 99.933071 685.687950 ] -/BS << -/W 0 ->> -/Dest (cb9-160) ->> -endobj -252 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 685.490928 99.933071 666.740928 ] -/BS << -/W 0 ->> -/Dest (cb9-161) ->> -endobj -253 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 666.543907 99.933071 647.793907 ] -/BS << -/W 0 ->> -/Dest (cb9-162) ->> -endobj -254 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 647.596885 99.933071 628.846885 ] -/BS << -/W 0 ->> -/Dest (cb9-163) ->> -endobj -255 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 628.649864 99.933071 609.899864 ] -/BS << -/W 0 ->> -/Dest (cb9-164) ->> -endobj -256 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 99.933071 609.702842 99.933071 590.952842 ] -/BS << -/W 0 ->> -/Dest (cb9-165) ->> -endobj -257 0 obj -<< -/Type /Annot -/Subtype /Link -/Rect [ 468.550614 515.652842 489.260575 500.652842 ] -/BS << -/W 0 ->> -/A << -/Type /Action -/S /URI -/URI (file:///doc_tools/%7B%7B%3Cbaseurl%3E%7D%7D/rancher/v2.6/en/security/hardening-guides/rke2-1.6-benchmark-2.6/) ->> ->> -endobj -258 0 obj -<< -/Title (RKE2 Hardening Guide with CIS v1.6 Benchmark) -/Dest [ 6 0 R /XYZ 85.009843 502.818898 0 ] -/Count 18 -/First 259 0 R -/Last 276 0 R -/Parent 277 0 R ->> -endobj -259 0 obj -<< -/Title (Overview) -/Dest [ 26 0 R /XYZ 84.259843 283.881496 0 ] -/Count 0 -/Parent 258 0 R -/Next 260 0 R ->> -endobj -260 0 obj -<< -/Title (Host-level requirements) -/Dest [ 39 0 R /XYZ 84.259843 369.381496 0 ] -/Count 2 -/Prev 259 0 R -/First 261 0 R -/Last 262 0 R -/Parent 258 0 R -/Next 263 0 R ->> -endobj -261 0 obj -<< -/Title (Ensure protect-kernel-defaults is set) -/Dest [ 39 0 R /XYZ 84.259843 289.233496 0 ] -/Count 0 -/Parent 260 0 R -/Next 262 0 R ->> -endobj -262 0 obj -<< -/Title (Ensure etcd is configured properly) -/Dest [ 41 0 R /XYZ 84.259843 480.020658 0 ] -/Count 0 -/Prev 261 0 R -/Parent 260 0 R ->> -endobj -263 0 obj -<< -/Title (Setting up hosts) -/Dest [ 41 0 R /XYZ 84.259843 237.872658 0 ] -/Count 2 -/Prev 260 0 R -/First 264 0 R -/Last 265 0 R -/Parent 258 0 R -/Next 266 0 R ->> -endobj -264 0 obj -<< -/Title (Set kernel parameters) -/Dest [ 49 0 R /XYZ 84.259843 799.370079 0 ] -/Count 0 -/Parent 263 0 R -/Next 265 0 R ->> -endobj -265 0 obj -<< -/Title (Create the etcd user) -/Dest [ 49 0 R /XYZ 84.259843 500.585993 0 ] -/Count 0 -/Prev 264 0 R -/Parent 263 0 R ->> -endobj -266 0 obj -<< -/Title (Kubernetes runtime requirements) -/Dest [ 49 0 R /XYZ 84.259843 352.740971 0 ] -/Count 3 -/Prev 263 0 R -/First 267 0 R -/Last 269 0 R -/Parent 258 0 R -/Next 270 0 R ->> -endobj -267 0 obj -<< -/Title (PodSecurityPolicies) -/Dest [ 49 0 R /XYZ 84.259843 257.592971 0 ] -/Count 0 -/Parent 266 0 R -/Next 268 0 R ->> -endobj -268 0 obj -<< -/Title (NetworkPolicies) -/Dest [ 56 0 R /XYZ 84.259843 663.033496 0 ] -/Count 0 -/Prev 267 0 R -/Parent 266 0 R -/Next 269 0 R ->> -endobj -269 0 obj -<< -/Title (Configure default service account) -/Dest [ 56 0 R /XYZ 84.259843 388.198913 0 ] -/Count 0 -/Prev 268 0 R -/Parent 266 0 R ->> -endobj -270 0 obj -<< -/Title (API Server audit configuration) -/Dest [ 59 0 R /XYZ 84.259843 315.158799 0 ] -/Count 0 -/Prev 266 0 R -/Parent 258 0 R -/Next 271 0 R ->> -endobj -271 0 obj -<< -/Title (Known issues) -/Dest [ 72 0 R /XYZ 84.259843 463.537950 0 ] -/Count 3 -/Prev 270 0 R -/First 272 0 R -/Last 274 0 R -/Parent 258 0 R -/Next 275 0 R ->> -endobj -272 0 obj -<< -/Title (Control 1.1.12) -/Dest [ 72 0 R /XYZ 84.259843 368.389950 0 ] -/Count 0 -/Parent 271 0 R -/Next 273 0 R ->> -endobj -273 0 obj -<< -/Title (Control 5.1.5) -/Dest [ 72 0 R /XYZ 84.259843 164.143950 0 ] -/Count 0 -/Prev 272 0 R -/Parent 271 0 R -/Next 274 0 R ->> -endobj -274 0 obj -<< -/Title (Control 5.3.2) -/Dest [ 81 0 R /XYZ 84.259843 520.622079 0 ] -/Count 0 -/Prev 273 0 R -/Parent 271 0 R ->> -endobj -275 0 obj -<< -/Title (Reference Hardened RKE2 Template Configuration) -/Dest [ 81 0 R /XYZ 84.259843 228.224079 0 ] -/Count 0 -/Prev 271 0 R -/Parent 258 0 R -/Next 276 0 R ->> -endobj -276 0 obj -<< -/Title (Conclusion) -/Dest [ 245 0 R /XYZ 84.259843 575.052842 0 ] -/Count 0 -/Prev 275 0 R -/Parent 258 0 R ->> -endobj -277 0 obj -<< -/Count 19 -/First 258 0 R -/Last 258 0 R ->> -endobj -278 0 obj -<< -/Length1 10956 -/Filter /FlateDecode -/Length 7306 ->> -stream -xœÕz \UUöðÞ{}î¹.÷^î‘×åqyˆÁP‹ ¾ÊPÑQË|% øHÑ0S´|$øÈ” ÍÐŒÌô¢d:Q¾²æ?j“eÓ””5¡9ó·š!Ø|ëœ †ý§ùfæ÷û¾ï÷}Ï~µ×^kíµ×ZûÜC(!Ä3‰$dffß¿nʾ털,د¾ÿžìaú´¤ؾ€íÛ/qÖß^}‚êÁöø©³s‹á3 ë°ÛµSÌs’!©„ú#Œ((ž6{Nÿ3‘'>ß;-·¤˜è0Ò@LÓ]T`ý*xV[ñšžŸ›ç ´âXuþ”éØan’±=ÛQÓgÏ{ló[¶/ž›_ey*ràS–ü}ˆ‡-swü$ ÕwÁßáÇjøÁ ß ¸)à¿]ðW3ü¥n¸à»§îáß ¸^ ת¡¥¾m…? øf |W|•_6å_VC36…+_ôãWZá‹~ð¹€? ø,þh‡O«á²€OlðñR¸t>ð!‚¸.^Ê/.… Cáüïƒøy¿‚ÿð;x_À¹jxïl(OÀÙP8“§¼»ÒÊß †wü¡IÀÛ~+à„€ãÞpLÀ›pÄ - å.Þ Àsø(÷8|h2?|/“½áâ‡&»;à[zü^ ¼& ^À«öçÁ+fØ·×Å÷åÁÞ:ßë‚:¼ŒD¿Ü -{¼$`·€]6¨ðâN31všá…<¨AšjØ!`ûó&¾]Àó&Øö\ ß–Ïmµðça«¶`³€MÕ>|“€j¨ÂAUÕ°ñY3ß ÏšaC+¬_w”¯°níd¾î(¬[&­}ÆÅ×N†µné<-`Íê¾|€Õ}á)dó©{ r•‘WÚa•*°£"ÊQRå.Xi…ž\nåO -Xn…',P&ÀÝñøÒ¥üqK—Â’<(ÍvðR,°HÀcfXh‚˜/`^+”´ÂÜV˜Ó -ÅŠ -x4f ˜iMç3Ç Ó—Â4lÈ'`ª€)rBN+±&à7þü7‰0^À8œy\:d;`,µð±=`ŒFðã£dá£î·ðQî·À}Fâ“‘F ·ð~0<ć·À0* ³2ªaˆ€{Y~o+¤…{F‚[@š€»ï²ñ»íp×`_~— òáƒÝ¾0È -Hpç;¿³¤Xø;¤$yŠ’Ð?’| ñ#Op‡úy‚ô3Bß>zÞ×}ôÐ;â{¹x|ôŠ³ñ^.ˆ³AlŒ‹ÇÞ1.ˆvy´/¸Œ% R@„/„#Ÿá6pæAX+„" ¡yâÁ(Á`A­Ð3±( G ¤øã ÿ@p° ð`C›+òjMËRðͳ“?÷`Bh“?,   ˜"@g9$|(¡8{A Õ²pÖ¨ˆê¡y+Ÿ¦ñÿ?\äÿ5ÿô -¡ÉÄCÎb:AêÈ6ºÌ0{jز’ÌÇž·éYZÉú`ßnrƒœGÈ -rê$BG$ì%ägä&Í&G*µÓT:ti”tP#y¤«‰ J¤sRŽTB“`'Ïwã -ï`|sš„ý c‚#ð $A£4D2“ÏàÔ‘/qÕwžÅ(£½·‡Øi)c¥l öœäçÈVLEøüÝNÏ#uGè“ä"Ù F¶Ó‹È×Yòy²Yºç$V€ôŸD\çpüVR"~‘ˆ`ñ؇Ôã\S´<úð‹ZºAÊpælR+{d».gQ%¶›¾M[ägI 9Áø„®”"¥=Ò0²Ö+È!k÷VuŒ\@!ïj*U±³…R­#ßH9º)ˆû•#œó ÃÕ˜­ï…²yDWB%Rª> !çt#¤~81è–"×ãd2k¥d?9@ú@5Y‹˜4~åü¹Múy^KŸf?s0£Ðéºa[ý«¡Âí—]K#Éo¢É¿’ž¦јÓ$¶Šícû í¶tZÊø'ééÍçòËü²ì–—ȵr­.ÓR]ƒbÐÒ=Ê }}‘mí`\J÷Ñ–õ0y’Ñ@ÒC²´µÜAúµ$ HrD~rþ¼÷9Ft“øEb n·#j$VßБ½& £FË…‘õ¾ÙØ}çÄ–&/’Ä›-Z0v™Aú‚¯Ä&·òdW’5Ü.è±…柡#Új뤒aža­ëÊT:L¶»c{A`+—ˆ•s)Ýò‚u£O}½„{‹X Œ‚, ‡XÚFÖ;²GÖûg?8²Þžý RÇïœØt¡åøq«-µ“š›5: ¿¦ã×h}°ÅŠ´¹ÇIãùxÝbi1_T¨Ã(õÄ°,xY ÏïY4/x9)\ÞsyÐòà=dOu2™ìB&’SÈ€””äþÑ‘².9%%)QrØeLp»Ÿh»¯„>”{ÿKåœlñ… _S{ƃâf]]ÝBº~àìMÃV§ßûÞ‰_ÿö¡]Å!â[Œ€×v\‘ª‘{#‰"ÜQ~2ñ)7‘¹&Ø—¥ÆT±>xË¡ õ †ð° .rÖ|±4ßlnk¶\W2ඣ]¢çØ98'åge]mèP6™N¦²Ã¨NÑH<•vâ°“H'±ZHx¢?«]µcÇ*¼©þ¾çî;uÞwÐYŸS.n|!ÚÅušEƒî{ÙùÂÑ£/ì<Ây¢¢Å_Åw¿™,¾ûö+ñgÔåEt -ݪÆôx‘ZPƒbÅý^wd ©2è«lOÐ*Ã+aV£ÂüÃ81ûóÀà¾zl“‘­Ä6T \£Tm‘IËõÔ„¾Y°†käGÞª¸fUöþ˜K‘áôY:äÅçŸQ4Òøë×oF&]m]¶¤j—¸ñSû×ìtû§«×¬dâsŠw­r§Ýyvó©QK:®ð\…@’âîéó‚y¿¡ÊJ_ÀÃJUÀzëšžº@’`·ôTIlÑä®ÑöÃõ„ƒ¾AaA ÉS¥Ú)É”Y¾%VSpuy7¨…’åW f^[!^‹i9[~O¹øÈÃâ¤øH\'~äü°atF§ÓC‘*UŠ«QŠFÒ×í«$VEžPª¤W œêuL$“JÐ…¦¦[ÒJ8æƒÂòCMµvÞ§¡¾½';ÙžÊþÖv7¿X'2ëÚ¯Ôuò¼y!©n'áA´ -‚ªÛ ÖýŽ*ózeM(#ÁÖþRR@£%'jknkºÅ»¸pÝšššà²†'‡[e©‹[) »¤·Å!f›/¾ª;Å|ºš>¼êŠŠÛV‹ëâõ£¶Y{.Òõ»ÛËÆŽ£[èlZH· ËüÃ#9â}ñ_â÷â}—W|&ƒÞn»RÅ^‘ȹçwêi—ð‡"ÜŒ•„YšÐäX“¬‘˜Gž>ÃþxæL{Ä~±}ËkW¥A¼¸é³ˆHßÃäU¦¢“TËbQ-Ñ,›f©Û'»yÏákù.«Ø+âkïÄÃgjöò;w¬bå2×Ye™ƒUâÓì˜ÂyU/s*ÉŠ:‘Ñ»tVUÓ·$¤z-•tM³VÚ-]›q@äƽÁΨÄôŠ?‹å±Ê–Âû+CY&¿WǦ±l!’­âk•ì9å*sÈ çz9uÜ]ˆåñr/]Š”ÂSäd]‚épKÜ-»unÓÈ‘¦óiº…¼Ø´Vóg䵺µ¦­ð¼ü¼î¼¡{ÞÑý>Ô} ßH_ó?Ë?ÂßøßåÞ“çÉsP4œâO“òv*µAOñC{’*ëJ¶°}XÛöAûêY_•R6JÉ-ýkîd½¢ƒl ¸U’ ÃHŽ*½½Êç £Äe°¢]ð7sC` dM³‚MRˆ¶ØMª‰°zÄ`ÕåØRÕtËÔã­ÙùîPUvé‹ý('œr&ƒNrµ3\ÄE],bäh]´­w†¦Ð–I3Ùt>_šÏú­’Wé6Ë›uahü©¿€_$ vGªZåTMµzMj$<}OéÝç.½5bõc—ÏÐS”´=Ù^)6TUm`þëÓiYõ”öJ~ñÞ>Âh¿^ñä“+UÍ©@ë¿÷` yÜ=ØÇÄÌFªè™ÎÀÂÂBÓ ÆÐ0ÉA‰ãûÆUV©Šlt¡AŠ 5Ât$"(ÐÜGhˆµ\njikiF/ ÉEõ š²¼kíR-³*•Î…ã‡Â9×/î8ðÚ/ÍKh5<":&Ù¿ÓgÄÄDG'÷JJô—†•¼÷È®×î^üÅħâêÌï–•¶Ì}¥±bkéghÀ÷3>æµï HY¶`j~X`ü¥C—þ”Ðïw™«/\Ö£Ïñ½ï6G«ºPŠ|÷ÁÈÎ@\¤½~˜1@o&/È f«³<ìHpC¤Çº&ÀD ‡^1†bψÆÕïBKb¢U[ú¦æ›mh‰ÞUªƒêÿ -BBÂœ á i1îw¨;Ìít‡»#²B²B³Â²œYáYY1Å1+C*B+Â*œá+#ÖÅÔÄ܈ íÚ5¨k@NhNXŽ3'¼8´8¬ØY¾,tYØ2ç²ð·yÖäÖÈd´û(©”¤ðî!‚?;öÙ¾'Š¶4x惩–¼ßÖöþ’©vש˗O¼|ù[ñ…ø&$ôõÞ½Þ|ëÁ©Sè@ -T¢§L­S5ùÆ3y¨3~¤¿;ôÌT®0[=¦MÊ2JÝé™vÕÆßlÑÜ"Òmµ¡ý:ãÐBÀH«—d¬$Yµ%åy–,©Ú×Ðþúüï²Úö‡ØöÛÕ¶WÈööíùyß©ò;“/’Õ·Ì:ï6ËǤ×H#ãT‘H¦bi¬EÍ;¸½[Ÿ¥ÏÑë¹DàDŽÈ¼¤œŸjdû7]|lC|´]q¿îïɦ.‡¯ÌÛ~ó¯:|‹IuZHÌ€Þ>†Åñxe<+`Ó”ôòËY%Fy–UóMʋ̦zyfD 1’êããÑŸO‡S%¬”*ùÓèÉ·Â&]¼ÄéÞÑ}¨ûnÀÒ ©§ê½UçD)FÔ‘G˜ëÛöýlÖö“ ²½m½Ò~³}‹lÿÔ˯.õ/‚LrGË6}_"‡è¦Š'x‚-:bõU9˪øf÷PzfFjŽº­­Å{<¸ùæখDm1Ý~ QYQÅQë¢j0½õYTG”WW[OG÷5þy±ÞÅŽË8¾üÕc sç¯ÝÝ0wáÓ»Òê-Þ •K|ÿ…ºô/lS—žmßùÜ[/¶WH9û§MYrKó?ŒïoӼƬyÍ]šw0ÇñƒýR÷ÿÝÉUÕóZ£ùÚÎ Àë'7ØHƒÉc[ÓCoó 6GFÍøtZm4Ø‘i¥¤T.Ó•)eú2C™±ÔTæSf.ó-³”YKm57­·ŸçbU;ãµä¬dã¾½UÏîÛ÷ì j×oüE|G­ðÙÕÓ§¯~}êä7ÛÄ)Ñ"®¡éIE c§wz%#B+Áã£lÄ•4B…Ù£oÔd…(™6Õ”hûmä…÷T£x0Ëo‡Ÿ*“è_$F„ ï½í¥††GVúõ †ƒ6ëÙcíPS9ÇيЗÄÙbÈÕÎxglg¸3öçp}\¥d/wTöP}œËós¼3&H1ë{DF¬JÕ…Ûâ´pß«NÏv{¼Óîu[Í6ƒM}Ñt÷6ö6 Ò2 22ÄI£X¬!ÖØ˯Ÿ½Ÿ£—lhlXœ3.<*¦ÜPn,7•ûØðH@“ ²Làfð BO‚`)DÓ/.-²¸eqëâjânÄõÀ°qÎ/+5@øe`¥ÊVÚ3©²rÊÆ´¦]?~4éíG ÞÍ]¾&¯{ïæ?½_pPJÛ›ínîµ¥rÛ¡ÈÈcÉÉGÌrùFU-ß¾/TÕòhìþÊ·£–£G6sÅ^&VÚ¨TŒ(côÉ›YÕòÁMøKô²½ûýÂW½6V=6¢n¡ÙÃH½3‰…´T¬Yòæ›wVTðíâ·kÛk*GmÝñ{–³–Þ­ZØý¨ç´ýe'ƒÜÁ?ï°5Úh÷˜pÙ£p§e:T…OõjTsâ­mVä8®n3?´ë^žDÓýê6{Åã¹÷µù'NÑ趻=wÇŽcµ¬ô§š}SoÀ•û»p—I9D&?¹c:m1e\-€É£uBätä-4ØÀ(—ˆN}e¸uÚS_%©ï•Ô×ID{à}“Ôíl¡tÞüšú"é™al&+ee¬œ-cëY-SÔ‰ô ×Î=¡§M¢iÄIN%™$Ó0PJP2I&Ã¥L>Lv+ãÉx:&JYJ) 3`†4O—s”ùd-…R<‰,–W’•´*Ѧ—ËÕ¤šnb[a³´™o’÷ð—äzå¸ò™Ò¡Ü=Y5êzä]oÓ‡éÃo‹‡Z¥œ¶lØ÷S Jh< - %d¢ßº‡óq2×ôÒ8ƒÆŒ6Ž2£Od:E‡'2®(:Up&„FÁ™Ò èÒdžQ1 zÅûÇ(Ú ¯ GÖ[Õwq65óS3£WŒª\éÈzø¨Ý–Ÿ¥û^@çá÷Öé÷vß*½UUÞœù3aH6 gÃy¦Ámx=ÈDz …¬áZ,âe¼‚ma›ùFC#käﳓðáL²däŨÇÂä`à/õäAJÞnt˜Ôó`$‹pÉÅ#äK‰ÑG‘¦TÀ“³’jJ0g²a)¹¥tïÙY¢bbt›Ýfudz,i4#Ñe)cõÙ†qÆ©$æ³™/Íä3噺B}®qš©È<ŸÌ§‹ØRxLZŠ«[&/Ö•éSéËô¥†Æ¥¦ -õ4oÞD6ÑìYØ&=ÇÕsèÅݯڴü›ì¦µ¬öJ{ùËò˺½J­éUóì5xS:Ê=ú·ÌMìmxO:Ãiá§ýh$@äxÏW_^úêKøäÒ_þz u£fª÷O5PÝ6Sý ŸLRÿ—ô¸¥´ÿçÕ:%þØòÖQhfgºõKÝêœô £:ë2±Ór/)"Åd™Kfid:™GœÍN%qX&’LIX›‚N’Ž0óH ÞsI>É%³IoìN -¾/Öî!br’1·p•h­|,óqÌÌóÒð/ÌšrkÖlœiÎ¥þ;PˆÐ*¹8æß›qÖfâ¸ñd>BLEØ\ [¾6"WãȉX -1/F˜)ˆwÂ9q|Ξ«=û%ž±–¤Odöª³– l‘†)çNBûß}T×ï74¤ã#õ[žx1õ뜎 Rû&âãŠ"í•®oy´R}bº5¡կ6¬˜(Z}æ˜(žè£1ÅDI/\9Š´õÅ<eM‘Â!˜g’a˜ ÷a> -%Y(MJÆ!´“ -ŽLØÌû²‰ùÑÜy…¤‡öUѾüèªiгòçªßuŽ•´/K¨Ê{H…dKØûÄŒ4z%qY½ÕüÿöõïÍÙ±®û¨Ž­­_–‡»ÕÏkymgëåÿé«“ÎÃ?Ó¥•'þ3<ÿäÛZçqUÏw®îùÛ±täþg8ÿÉEQ£T]ïEâQSU톚<õx™ˆz̈>ÖvA/lÅcm/HŒ62“Œ£†¡ÕUw‚£G=bƒÚ?“1MÄ]7 “âèÜoè«°¥b ;×°KÝ°KØÕý¦Ãý–‰Ø‡bÒkópïDì÷a2áÞ˺:·6·Y›Û­Èxb!¿Ád%0Ù4jü4jì{tÙHìÚ]œ;7w -Y‘;wv!Y1enî ²bjna æÓóçb¾hî£dÅ´ü"¬O››?‹¬˜ž[ˆ0Óó§`ϬÜÂ\²âÑÜ"§šã^_1;wÞt²¢p–ÚS4-w6Y1w~!BÎ+(œ†ùt7{Ð}]TºþD¾F®›ˆîSµ“-G“‘C¿èRëݯ®6ÞY÷/(€ñ.ø4e’V³¿]õn8nëŸÔ­=÷ç:»“ŸT›<øÖÐXäÒp‹cò¿£Q -endstream -endobj -279 0 obj -<< -/Length1 7012 -/Filter /FlateDecode -/Length 4216 ->> -stream -xœíYyxSG’¯î'K†`À6²Aœ²„øÖ“d|ɲ%ëö%ÙÆ’md|ËÆ'8†` ɲ’’ì&!áH&a¾“d6Î$L®/™I˜r !™0Ù96ÙÍds~Úê'Û„dÿÞo÷=·úuwuWÕ¯««ê=€90˜lU•Ë÷f€Å °w…Íã+]nׄ°­Ãvv¥'K[/Ù@ìØÞ°±'ØWZ{n9@ÌlßÜÞ=ÒvË?¸dn€„Ù­Á…d|>ŽÇbèÀŽX·çK°­îèºöö‰¸KØ>Àµt÷n ¾å:µ ×Û‡}Oõ¯í#åÐÏ«˜<›‚=­*u°¨ûîîë -?ZÅWl˜."ÝçH{¡i^áÇýöÀé~qŒÕ~ý·áó—Ü1îQlÊ€BäÂy…pZ$ÒðyˆåŽ‰+M¿Îˆ=g@‡8-ÄyË2b_ Ö–pr Ä`cEéÀ©I#hE´ØLñ›º^k%¼+V¤De襃+þ‰Q5}VÔLB¾š6ýšh­\yyº±(ÅZx5,P äÃ[N΂ž‘˜ •OË!‡n†UØç Û°¤€’C!Ý8 éß[?zÑÃH× -åœÒèËPN ”“o±=ÛOA9|…ÑÕbÿãÑçßàxŽ›£í 8Ïyt)¤ˆí ‰;ÉⳈw”6 K9më4Ú iÄÉâó˜Èß߆ÏS."‹DŠ´cb‰ÌC:²ëÙEºAývšs8Ì!„8Êcý¬þ1þÿúßu‘{ÁóCcx>ܬÂÂaY€¿D¬%p-Ö -˜=³ñ$¦ MäãÙpCxñl­‡­+RÂaqLiP.¨€j¨Á±  zµû£Ç¾çe~èJ¼|¯€"ðãÝ£°î…£p>#s‰›t»ÉÛä3ª¥!:<㾕þŽ~Ã)¸lÎÂ]ËÝÊ݇÷3Ükx ™+ÉÄ»Fr§äx“œÅûï3ï˜Õ1M1{b^ˆùJ/­•n•Þ)}^zRú‰l¡,OÖ%;({Wö·ØôXglOìŽØý±ÿûûØOþÜßN¿gÅ õ¨¨·mE†Û&Six,#×Ïù ·ä5¼pב -¶‰T"Ͷ9Åql GºÃVòsîA˜Dõº„\^.¥ò ÉrÕ©PgS_¨½)@RŽ%iÁY™÷êš…3•8³>23YoHÐë¨FÏ'%ÈPYv{¨¿¯©³?´áÙY]DqÏ¢éœN="|ØÈ¢Q-ôRíŒ+D%WéUz^ÏËyê;é{çßIb;}ºüÌ á~xm%ÏåT‰ô9F…¿“8ÀOìäwävDáôçlÕôðx¶°U“Rõ:¯M’/ªªÔjÅ"•j‘T­P¨Ya´úp 9„Q×%DEÈ!áózÏ=zñˆ¤ŽJ#þè釸ÖbÌ,&—JIÕ«SSU)R©|AR¯5ôƾ›oêë»éæ>²?Ùf¶Ø’“m³-™.}ñÅ£½ôÒcµ#NçHmýV§sk=òMÅÓõ }›çD=¯ŠO}.@Ç<ðKÐ0âƒwƒq’© QîR™R®Ôÿò–ÅV‹‹«“Œµ¶lm&uÂòÇ®ß[VâòÙú¶´xöWºK˜Ž9á‹t>ý=DD¶ˆL.VL /ªÀØ þÃ$?óX›e#oË+që:]?‰­“y­VGKkòÂ@c™Éè–­§#9^½±>.f~£;ϯëm+t;ò]¥nR`Ô›LÄó'ZG£Ãì-WOøx^Îv:‘(W‘¦ž––z ÛÆCeäO‚ºòÐ!r\¸žÉìÀÌ!¾ƒ~ˆRn˜û -y™˜ñJzp(¹^çéÈ0ôVwîš»>Îkª¬ªªÐW&Ô'é çV¬.ë)²”v×癚**||:Ù‡²1Fú ¢¼wK¾ 1²IÕÏWj“’UsñLò#¿\_G’C¥íÛô!wûP&æ¾ÙÞ'ÝYuÕVOU9½ãÆýº‚±~K·)px˜ôv­»]eãÝMµÎŠõL+ÌŒÈEú&Ëߘµ)õJrQøK€(„Qò½ybˆ^_Áâ@aøo´­n1úuÌ:˜_Þ¹¤) u†\5C!*¡T:%êžBCÈíå F‡i³Û=h²ɼ*kY•§Ôìù¨Ñ_^^p‘Ÿy µ<_kȯ•'6™K‚z}°Ä¼!áti©q­¥líËee¦Š -“Ù&â¦:´#³^c¤¹,ÇnšË&Ä„yÞaôTRys¡¹³ðº›û3B m±Þ5^·ÕS]q£q×Ý|n—+tý¯ž} f“ï6ͨ³;êØÉO2f†),oÆ_r%AéNú4öÌX©”©ùD•†ãÈŸ…k7\꼸¡ztôž{èÓ®ódƒpaŠ™J?Žk(Äì5 -£2~ו“‡ !RÉyr¢x¥¡Ý*\º`kÑšsá.“ÕZzçyw•ù¾C$¨u®ÑûrèxV•Ö¸.ae¡^_8ñ)/ßü5Ûë´ðú:} –²SÇðIVÍp¹|¼´ÀàÀÚž¥=nÇPiéÚ‡‚äåû›Z‹-–í^Ïv‹¹¸¥Ç¸ õgºìC]f‹¹jTU<•<ž'ûZ¿þ¡3gþñg{wŽÒqß}¡Ð~Ÿ¸mïÎ]·Mœeâ*äÌóÑO&ÊÙ±D¿¯”²D¸‘ ÓÞ?»þÃEŸuEiO!ÇYX#R£Ï"§„7¿þÚOÇu -¯âhDë?ÒEKŸ©.»|.š‹ˆmXºÉáØl6ov´Ýpð2¸#<ØÐp0Øûˆ†|Qd6o¯®¾Î¼µÃi­ÙëAÝÛî÷oj‰ÊNÛ#‹(‰ ¿´Í/ì÷ûÉFÔÔF -…Wè¸ð¯DGp‹}H}ÄÏHD™ÙZFMPq!ÂB^>Æ•V -¯bb^Â¥ž'fá~á(÷âôß*шŽ|%<áw:±+ºb?"‹h)Uâ’$ž§ý~á6\q“Ÿ¦Mœ¤ÏN¼K×à^¦…¿£Ÿ!bóßg%©ÓºT%zÿ)É*œæƒÀÁf†ÜÓ9Äð“ùïgØø··öWZF=Þí¢ÑŒZ¢Ö²\Ô/1`†¢bF/—¢µ0c¡Ë‡·îö¼eÛÏíÿ¼{7¹cPø€ŽÔï(-Ú†èüÕ8.{CRrÑéâ™I$“‡†<÷à&ÿÇ•=ç1aÇn§ÓáÚM– -ŸÒqC À¾)A8KÚEF ¢“‡'àÉHgñyš;OÕdÒIÛˆœ¦tò2*Bq¾ÇH‚16K‰+½tm™§ ¿ÓÒ¼=¶%ÆY”gO+Î+CGÖe—åÔæå˜KøUZżuyI^]vóºUEúÔìEóW–—òõkQ|ë#P#³f¦JO.óÿ-yâVÚëd{˜„Zÿi¢¾šOL¤?¾ë¾ ¾ÿ~Ät&¢¢WO‡¹q¤œƒ NÅq2‰ñ½íð‘Ö—ƒûŽ´¼Kœ“3ñ‚;ÿ­œx߀ ;¿˜_ŒC,›‹‚°©Tÿ©ÿ\ëÑ£hpÂwDF~) AmåZK3pS.{–=裮äʤ$Í2ì°w)Å!›c‹…œÐúxÞ«ÕzyÞ§%;¬Æ¬–‰³mÙÅö]ž¢@NvÀXÜ“Ó`wyÐs“¼¦`9;#’+x½Ò]æÜbA†¶Ðb´ò!dŸù´ŒÕFë¯g—ݘÝJÏ ïu²sŠŒŒWqÄW~CyÔkñ¾2Φ<¥e¤¢õzyóÜu…6TVÍkNºacň…©Ò\«Í5oì^«ó¶ZÇj.£unZñ?Ž–Ó´i)¢Ões _­‚l’2±¤=ç{pEx•  YÆ2åL?y¤3)KY”´„œ1­ö‚Êù¨@sÅ6«e[Uŵ%™•ÙeA©'qK×ùs3+7Zwú|ce–a—Í¥©«`¶†p¥ÓKb$Œ.Ï¢¯±Âx•>è·Ùš: sÉACθ4Ÿ;Ë mGøR´åÅb³›™ù”~š°IW@C¶„Ópe÷-qõóK]Mˆp·O‰f0ƒ:áÚ\ÚV§-jô f›*ïëÙéhEüãZÜ™‘è…zDÑù"{rOK^}µÍîóû7ÐL}—}¯¡º¶¾Fx èË5™‘Üž¡ßa ˜Í‘¢éy2®ÓÍöÓýtûd¿~â,ŬŸ†Ï —à×âÌä™3± ¤ˆF<ߢR)X2œ6}jêòiëLÌqXÊ—©é]“Qô"ê¢Gädä²è±ã”ßÿö ¥Ü—_¢Äå¾þ}*›‡ÎM,Á¶8£™“ÙÉtT¦à‰äÂ,SåV´äׯ+³yÅDÊŸ[Ö¥Hî*™†—¿Fxk²¦êÊ´Lca¾ .ï@f$ø>òÜu“ø7 ÙÈÀ4øÕ"úÌâ}hObÜJúñ¸õÅv›c´¢bÔá«È©Ñë¼9Z6§:gÚ·wgY٘ϷÓZ•(- ddJÍ Ñ —Ðe\͉r^é^EmÒZò=ôyqÄg wr«Z{fx v:.]Õ³Æÿˆ¯°…Šn»ýjžµ8³åÒiÒ™iºÒWD,f=b¨•\•ý…õ¦…w¡Üt -ïRµ[²Âß`Þ•ÁÞÝfÄÊ -•É  -ù\£¤l­®Ðd.*ÏÕ -ü}?W¬ÏÉWé³ -œz¢õÌJ+×®ÖeªÔªøùÊýëê@UšnMÊb•>ú¢..e¹Úí¶Ùü{Ñã<¿JYn­"fמ=,g´‡¿E¯®f§œLy]< ‘—”xÊû kMmhj/UOœ]·& M—”o¬C[# 9â×h5‹Ã+yŒ¯én›×Ùíº·±²Ùt¼Ià&vò>¹]ünÁ}_è'·—‹_·QªzöQ‚á°ø]‘=ÌßGŸ)>?}Æ·M8}–À2¸}ŽÙdaôY -ËH -˜¡ú` Ú¡†0Öi![,+À‹=­XW‰T}H³ ÅöötáØFqF lƺûÄñUâJC8cò16eáÚ"Åfh†LœÕ =ØËúÚðy3®Û‚sG°o&¯ÕW´«‘g;ÒwCé(¡*¡à*2Τd:䜷eXû?ÐOÑΤ˸‚.ò…¯ðÓìGWûPŒe6,Á] «Û‹Y¡D¤ÏOG~œ8¾ ¥u‹–áoç̤Åë¿‘iJ -endstream -endobj -280 0 obj -<< -/Length1 15596 -/Filter /FlateDecode -/Length 11081 ->> -stream -xœÝ{y|TEöoU»õíNoéNgíltÂ’°¤‰ì»À@Ø·°¯ -ˆÀ0À0!`Á„ JdÄ # b à„ :ÈHÜ‘aÄè8€ -IñNÝî°øßûãýñ>Ÿ×7uoÕ]NsªÎ9ßS÷†PBˆw‰ëÝ{Ġǧì}†®žîÓ³Woö!«Çv+lö:dxÏG.ÁözlÇõþ›ü¡SÂölçžš>çƒwÒ¡¢=rê¼É á_R[BàØÞ1õ‘ÅqW*T !æ¯aiÓΘ7–͹ˆÇáõ½3&/ZHTÜH—&l[fÌ]6ýÖ¾LˆõBÚ•Îœ6¹0¦ÜáGúíñzÖL.®Êr%6½#¼O¦3'>`VL IŒIþîþ†NïUHü$Ž¬T\ÜE·«óèg“½xûb—™-w -î¤sLž†aa©Ã¸Æìx¾Ë8<·KAà<-ÄrÛÓ±a¹e– Ašeâ|°¾˪Àýt‹ ÑRîáÁ¤_"h`9‰¥…¾hŸ -Þ'êïc¼w‰¸÷ž>ŹT,¢Ÿœ€æïþ°ÿ³Áã˜ÙƒG!ÃkXN`Y,'î9ÀrK#–*,ó‚ç7õ…G: Ayŵ€nÉÀ}ãñÂ=G1S‹ ÷Ô8JDÌQ/Î Vâ#íHÉ"ÝI?2”ŒÂ9:žL$ËÈ -²òöm1WI2I!™¤3éAaÁë“×oöëÛÿ˜‰¿ø½¢*²Œ’öqöýÌׯp¿ÿÁ‚¸7Gǧ´ÿE3ήÆí'C÷‡,‹«½}{h%Þ/G_ò%^úµ‹—RÚZWK=½zÉöšÔO/Àªhái<ß«§qMôº_öá_¿Iûã¦ÎŒ{ÌþXbîcöi¹)‡Øjê>°u¼Ü#šºI9ܯ&uŽõPcï$NÜ;ŒºÝØÛÈvÜ[zÈoúÈ=|4„¬Ä–ÕÔLÒq¯ôLÆ]PÕ¨+Æ=²Q—Œó`œaÆêÍsh^ Mnq¸™?ŸVÂ7Jå9üxLºq}´|£n¬–®_K’¯†ë~éZüç‡Tù?7á‡Tø7‡ï9|—W]ðm94"‹koŸóß–¾é__)”¿.‡+…ð‡/¿ˆ’¿äðE|ÎáòøŒÃ¿ŽÀ¥FÈ—nÂ?#àb9|Êá‡O>vËŸpøØ •Ã‡¸å9|°Ñ,à†÷WÂ{¹Ð€†\8ÏáÝèò»þ¡Ã9ïp8û˜C> ƒ·9¼UgJ|ò§9œZ orxƒÃëNn‘ë9œàpœÃkŽ!½c.8jº¿‘ë8üíÕñòߎÀßVK¯ñɯŽ‡WýÒæp¨jËzȯp¨ÁCÍMxiäðR!(„¿Za¿öqx‘û›á/örø³ª9¼°Ç*¿{¬ðün‡ü|kØí€?=—"ÿi%<—䰋óªvFÈU…°ó»¼3ž±ÃÓ:ìàðvò‡í!P¹­ƒ\Éa[¨Àþ+Ê¡üÉ#r9‡'qn=yž\-m}Ü'o[ýÒOpØŒíÍGàq”¡2ÊzÀ&”v“ 6š¡O”B *­Ä9`‡õŠ9¬+rÈë89àÖrø½#_þýpXÃaõ£°êw+åU~·Vzá·VXa9‡¥á°d±E^bƒ%µ”ø?’[`ñ1i‘ù¥‡9<Äa!‡ó‡Ë Êaþ¼Öòüá0¯5Ìå0'fs˜•3oÂŒ#0Ã4…¦NñÊS9L!vyŠ&s˜Äa"‡ cÌò+Œ/„qoÂXlŒuÁ3àŒ.pÁ(#9ü&*BþM:Œà0œÃ0®„¡†¸`0‡A4EÄaàÐú÷ —ûgC¿œr¿pèÛ+\îË¡¶úBolõ>½Â¡'žè™ ä;äœð@-óûMR~›œï€üZF°ÕÃo•{Ø G-=†-žEö[Á_KWc+Ïb’ó,WKýþB©;‡nÈB·›Ð•C—ÖË!œS;FÊ@6‡¬—œÅ!stJ‹”; € TNqAJ-ݶ·;äö¡Ð^°[.µkë“Ûqh‹w¶õA–+·áКC2‡$øÂòe_/heƒD 6›œÀ!>.EŽ_ q);¼Ø³—C ‡hÔm4‡(•¨ˆäÁ!œƒ)xzC˜;EË·Ë.»SÀe‡P¼/ÔN|ÞÉÁ’;òÁŽ=Ø`èÎfµÈ6غ³†è²ÕÖ€îBPw!:„ îJXÄÜÊ–Ìt”Dç` -Í*I+d -718¤È,(2@S€ØÖÒ¢´Ýÿ??òÿšÿËBÏZrÆ(Õt3§q¦˜­BäѲՒx÷ÕÒ3t=Œõݤ ÷kÉT‡7h6ÖêðÙ)Ï–‘Æ“eð%Y¯’w›}Œµ/ià³ô]O/"µ w{:lÀý -¨ƒKç‘çè‹Hqö¹€¬bxdÃòÛ"{›㶅¿‚Œ€qð|L‹¤Di)\!eŒÀ$2›œ•)SI™2.“&Û -![*M¢Õä -Òœ?a;9ÛaHLÈA6L,(Ïí0öe½b'oÃMÔûfÆi_©7äá•Ò@²ìÂ'“Q3„,€Lì}Y!o l¤·y#”#}C4ƒu#;ØtZ‚ÜÞ@m.€ž$ûˆ‘¯’"zù&êJ²Hnðóž_é‹ÒûèÜŽÒo˜‡²ÇqÛÍŽ°Ø'¤(i9noʉ¸•Ê_(ªÒQ¥<ªì›*©êÓê{hmµÚníœvÎÔÙ4ÂtPgz}9nÿ4O0¯2×›¹å±àögÜÞÂí’åRÈÈgBþemkýõ-Ú6¶ÞvÂÞÃ>ÏþG[ÇtÇ>ÇOÎ<çAçÕP_è—ÝUäºéºéžˆÛëÄȆŽ æM&ë·A±²Ž¬×$P)(D·ŸïÚ˜ž“Ó‘¤^njL£HG†;‘IgÜϺϜ‘šâOÑi͵gÕ0¨œˆÇUƒaˆn@Œ®‰)’¤ÙÏ7~Òؑد!Å4êH46Xõ⹑Î5QŒÙI¤·å:EbIZ´G-!S¯ÛTj3;Bb½1ÑQ‘áž°P§Ãn³†Xt“à‘Š+Î~þ-`·ëù®]›ºŠ}}zc:v¡áŽ7Jbh"–øÌx£ÐDÈ`{g^ŸU5ëÿrÄM~qfÕ¬³vÎ䜶ÁoÐÔ™T»>âB²Ét'Ÿ¼¨äSè3¢TÒÁÛéÎæ7ø”ºŽ¿+ÁY¢’J -ý9ZëVDm.ù\©vO(õ•´ÚÛºÌë* ÝDˬñ^»¤´ÒÚËĬD…ʭ㬨8¯Çjšý¼§k£'½©k£½éòU”çõôú«7®Ú¯¾~ãªÃ™ãÈq8=XrP‘YY™’’Šâv…¡XIIÉ™aaGRRf§¬ìÌ 6ÜxÒæv)*;8ÿ· ?¹dÞùB:ýÔ”Â3Sß<ýîÑB:d׈ß<;ôï\y•õäƒaqáøçèÓÒ # oÃðÕ¡ÍÁîùŒžŽ­)úˆõ›odoä_Ú¥JüÁØãÛ·ÿÝ„I·È‚¥ýè#Ì$³²¶$‡Œô§z³cZ'DÛ¢Àô„-á‰ì-­Ÿè°Ù¶žŽj‡#©èn3Ñ->½“9Vogɵןolj´_åWs„xb$¯¢Ü%wRç™]aéBêÄE픕‘æ1„KLH¢ÉÔãûõˬvÖàAsæ<«¸vQ‡釋××𾉒³M“gÖAsç4§¸¶Ø¿$%¥ãáuŵ4oðì9ƒÍ=¤øPZ‡ÔÅyE‡_¡‘“è®IŸ™…æÌŒRR–ôXw¨–ÊìPÍê p¾BÉz g¿„S_LüzcÚ³ºà„Ç»i5ÿ–(Nœ/h{Êò”5D%àTH¸nŧÒBva{ -s»œžÄ$–ÙÉ™ KŠÖ®-ªªØºµBq^æ]¾øœç~q•žøçEZ߈tÇ!Ý亪 «R³FÂ%§é65¦ß¥›æt»˜š˜åÌìÄè8ƒfRWœ¼ëÅK¼kãWôõÏ.Ó×ŪÉnÖ_j‡ÞßAûÛÛCÌ‘Šjð´ì°<­Sk¹S³è`R˜ç1a“̦ˆÅi8’O°xŒ©+Ô!ÎÔ‹ØN£²¬úP;r²Ï—-;2>©ßN§çðý‹øþ:oÏ¡CÑ¡ÒÅã'¦œáÅtÙ™)'ŽO=C—ñâ3ÈYyHZ&mÁÙ—ìw‘gM´J~V ‹”H´©+ÁÚö¨à`Ä»ã±Ktö*ý`ïI_Å|¥gµ¨TÓWQ“…ô"Ìckq<5¤ŠI”àpÖ *H ÐBfjþ‘­}ïëjŸÓŽx¯½†ìb4††>Õp‰ôJSíÈÏ"·ÓoçKÙÆ, ÷›Nê%Ì âö;s%ýÒ²º¦«G冟çáE·?“¢îÍÄC©î„?™œ^KEx¹·²•Û¥Ä“¨›7>¶,Ò±£ã°_¾†ÇóWÓü勒TšÊR!UJ•S•T5UK5¥ê©æ<’GóXäIyrž’§æiy¦<=Ï<„ ¡CØ}ˆy"™H'²‰úDóN²“îd;a§´SÞ©ìTwj;M;õæ}dÝÇöÁ>iŸ¼OÙ§îÓö™öéûÌGÉQz”…£ÒQù¨rT=ª5Õš{ÿ3Á®`¢4Qž¨LT'jM¢ã_#Ôj<O #XxhsØéX²±O4ÎÐÏeu:$§ó€¢%%7•”lúîúõï¾»v]Í:4»óàl‡Ÿâ§ù;4fÑlšVÅåkøïù£t=ý]E×ãÈÝ@/×GN'I~TH¬B^¯’ -“–¨xÇÅŒCXßd zú5„4_¼CÎôeˆÉF­4—¿H‡ž¦YMoVKKÖö¿ÙP-ìjRMı&úÛhŸ¬Èá‘à‰ò)Šœow<Rá*—H#vQÝëI°C«{ötìzÅ`w×ÞJ0¼@µËß:<9âàIàÞ3³HvV‹OÌÌB}I"( -]Â^lZr„†göÞ²zì› g¼1ùcj]ع¡ººú$íÐ}yÅ•›òx«cú•¿M:¶¸‡X&p.f#¿­Iä7´Â­—˜v‡T(±%q»£+Ë•J÷ mÂB ¸"¼Iv/$ĺL±m_dø|£Ãp85Åäa €ðÑŽ _Aÿ˜yבßa´-;ø7×g¼7cúëSv8°mûö’›×®›¹ìoý>¢òˆM~ãÉ¿“ÔêTf§ò¿¯Ü½|Þ¢­[Ž‹ûøåÏ îËûÃÒÍŸ ©1‘ª£Ä¾ÉUÂ*ÈúJµÚ ^âñR=Øc½BÍõAkºä˜×c -DðEÜ.r?ëÈñYv­¹¾Ý¨ö_Q;ÿìÇ¥';<ùù—<ÿàvœ?Õ|³ÝƯ~ÝÈ¿‹{;½ãþ]U|>D?-VNZ!w‰jlD…[a×ÿ,!,Ý$U„•Û+} ^’’ *Ñ44Ö'Œ½ércÀÖ‘½ÏíF´L£öÅä -Ÿ‡†@âÓÃh‚À -FábÞ¦AÇ^O«žÿÁ·×.ð¦h"uõßÊ/¬Ùºuͺõë僇}Éü"ÿ²pÿñ?? ZB7ÓåtclóÜÃÏ=wø¯yq?ú¦µÈõ`Ã7%"òyÀï ·Šd¥Â›RáDï”üBZ¸¥U[¯»•×fòº£Àk‹MCÅ6šü¶L ÑÊAîïaÒg€™€«ÁyÒ -Ï„ÞéÙÌâ-O­ßò$?½fóïœûaóšòœ_¾Ìoï´zÙòÕ«V,[ÍNV<öXeEé†m#â®:pîÜUããßÜyúòg§ªNÑ)þîw._½F¬6¯B‰zµ"]ü ¡ -©û³=¤Ä²É^‘ TD—'TúB ± &¯%)B Ãe„.-.çÈucZDiÀ˜NÄj8.Æ3âœbD—ŒX³e ª»ø’“©b4þó)•~àø7ý¶²òU7oÀá ñ4¢pÕ¯ý›šøc|/æ‹b‘ç@ü‘’ üåa»È^i—"Ó‰hFnâZ 9‚©©IJæçx†%¤°…_b? ‘ øü¡Ú.þHv){uH U¯!zÀí-!¦jHËPµM'·O Á—z–¯¡«à ~Ž‘y#F楈ŠãýNYB .ËÊ_TÊHk)YÅé›nàF„&榙TZÖô" »uQŠ‡×ø1~âºk7Ý%F¥€N’–Á® „©JaUD“i@Àút#.£Ó5, fá‚Ì­‹Ì²—åWÿ’EFŒ"K/Ò¿¨ -k-ÁM×Æ;Ü„fRÁŽA†Ák5|Ân>áÚ 9ñ¡ÇÞ‹>„a$ØæïA| P8Ÿ,©XŸ,K&èêÓA'>L€AÏ' VÐý°Þ$›4U1ò“œª›íŸ4T+ºÃkß -®þî©iߎN8 ¥ãý‘:±a¶[F$ f&E2©Š¶Žn`Úx2žB¼#0ãa3mþõ:=un~óõ¹çäÄf ^¼ÙŽñâÍÊn”ç!”GCl'T¸ûõ—7<ã -;[uF §´ËŽh—¤ƒ?2â%r ¬B^²°W˜Ê¡224ÝB:*i‘‚µ».­1 #ib x@OÐ5 -¤•-u´k,¿ÄOÐ<3v× þÕ#OÖן,x¡_f›6´œ.¤óie›6g»ù ¼ÍÿÎßñ‹°56,¨±Ö~·RaZO*l -±™TH·tT½ö4'²Ñ$0|@=hz¾ô,‡=)>Ñà%ÞAÞ>}ê6™THGÒžüU^ÍÏí¾EûÒ·n-•SùV¾È“ØïîÐË6 OjãSöÀôºBú«NeSGCV†Å’úú;ƒqÇD9 4`›šfG›–ŠÔ»ºù3 ç -²‰´ò‡)KEÃ2ÈvÒd2ÜK4ñ -,hǦ5?uFÐë[Ýœm ÛϤ¡8F1¤«?>"’„AdEô}ãäŠðZHVhº’é:ªăƒÅÏRÜÿ͈93㥡žy„_æõÔOc&ìú`õÄ“'¾þÀ´6Òí+ ¢t¸Ì¬³ƒúñ³8l§xCl<ݼ[à”·¯¡IDqZû«DÖë -Ê*w4!O èÑp˜]/c%-œp™¸OÜp†µ9s¦ù}±ú±ƒÞlÇÞhÎZ<…Tƒ*úNÝ©ýo6xU’m²ˆŒ.@T€µô;jÄ$þtãoÐœ¦4‡¿º¼µªºZZC‚¼ž2¨Vøã5ŸICp¨új2 uE¬(ô.ãöcW"’+ÓÜqš$œÆ@U“=Z’œ¤e±Þì7l”V`*dËåeÚ -“••T™(L7%Ëí•vj’– ý ÒG £ä¥@¥Íåð¨êA7ƒÊA7ƒÈA5”³ôÛæ#lä5±]hh&ÛÖüLÓFÖø\s-Jó>J³ÈXo -÷[ŒiF½Ð‘tRìFðL½е;þý3ì\S¡ÜDÈ#ñ¹eøœ…ùÛk ˜ -Àtʨ‰1š¯« ˆ†Ê0£[EŸ*ëŠ"¥ê -I ˜`‹BêA•ØåSª] -ùêƦS2ÞßJÖt“‡†ƒG 7%Ñ6¤µ1eÑÈÒ:›¬670é§Td(µ#q$"{F%j;ÂoTòë‡Qlýt³œÜô-„ÞüPø­`Þ`"óüÑû(Cø/Ø>ˆJUæ:ª’¦·¸Œ¿9Anœ"—*F0ÉÃÂÕ6,Ií¬Žb…l¶º„-WõpVzÓ~Ê(:ƒÎTD@>qÞâ.±„úÓ‰Û„k'ä†[ÒÛ7ÛIoßÊ@O¶íu\Kfé5UØ Â]n« 'é–,%Ý™n0ÕmÒhKV…`&ôž:l(Þ^Y\\¹½øÝ››oüØ„‰ñÚFò/ø+¼–A#h?¾œ¯Ælj=-¦«ùjì]xµ%† %íüá´ÂŽéÔz§]טDäôÎâ5e¸H#±¢÷I`ÂDÄ e_—>½c#HÞ¤Œß¾õõi9µùìÖ¢¢-»?ûø¿š÷Q&¾*ÀC1ßšíïŒtÅÈ>I‚|E"nÜ&LÖ›%ÙfR@‰¶‚‘.9:ºt¯%-&àKŽc'†L°&V©Zb¸0=«HÇF'`Šã1V觃iåŽì§Áó‡ùðÀ S_;C«nPåÙæw.lÞTñ8{͵`7ŸI—=;¾yƒÜðé?¶a£›¯þ~Ýš ÁxØÇ.™üÁß-ĬfŸ7Ö«™˜ªûbc½ùºÙ+Q÷K®çÃ+ô%ò¼Tá+wT¶öêæØ(•$EåX;ºÔœ„´Ö(fg—Ų›Æï„Î;&c ¤•AqhLLE]%*N_PˆÃðÓìz<ÿ3£KNH¾"y¸6îЄ²Ýóžœýcü§¦Yçç,z{feõ’Ísßy•†\Y'ïz»K×¢‡¦ÎL ïø—þ™’ò~¿žV,|$."µ®êÍ'£ì©8Ž»pUí·*g’‹ñ*W«ÍF~ÇÍ¢ÂS¥E<å o‡Þõfƒ,ÖßÈÔ^7#lã÷ØÀI$jª¯´Óõ^›×Ñ‘¡GõÞ™ûè³…*BÑž\bMQD"LªES¤ÒBÒ¤¤-g,¶¸e#G=o³œÎé_={Võ½rY7ØÖd™7>¢K×®]"ÆÍ…M3?-¯Knn—î''@¤mȉBúÛP:8âS1² ²4e>‘éA@Ôˆš¥Êi<{Éÿ=ÓMû¶:bò/ðÍ`3éÄs|Àu>à\µÜSCð(Ã,ä’¿'F“n’tèfÝ“ÙŒ6¡j*Ú„¬i*ó³ õK¾ŽG½­f1ë&-ðŒY%©ÁÅ÷¦®wüìý áÑp·ªð¾šðgá&1‰&ÄB¬«‹õ vºXŠê¬acd³ÇœÄÚ‚Oj+·ÖÚ™|æ$K&Ë…L)Wî¢åš:™³,#È:†À(i¤*=¸}p¿-ãÿrøÈÞIÛzä´kG;SnÛ¶­Gî?ß9{©Kw¡—ȇY²ô"Wd©ÕUªUZëèSà‘Ëõq8Í}…^Ā߯k‘ Dñ°{_¯À˜ÚÚ•…g®|}zÚvn[_TTRRT´α~nÜ8|킲ƒfâæ÷>úä|ÃǵðS€zq#?½üIˆÿ©^bÚ¨„ÕP¥4„¾QZR,Ún -SH¿h§=È[}à¥PÕe1í×®©Îù ~Ü-šÃT“L*húìè‹ÇæÍ:1–ßâѸïßû±VÚ¼¾h¯M£¼òfçœWPy94”Z¨Ÿzr× ûwˆñCÿ—Œz %PkvjÑjZJž²*Çuªbb®„ØÌ.±²€-ø4],{¤;…æÜbØÜwÞ"ˆ‰/%Ÿ›:ˆ®á«jym÷ÂKŠ«òÁSËšRá\ÙàÚ íð¾’3h¯}ýÉoT² œ%¡a¦RoX© ÐZ½¶­·MŽ Š¥âtÆ÷Ec­Žýòåú€¡ÚD¦”óËÙêbw£n7vÏÐz23`LñšâMeëW×^ýràîáSªxr}ûmóê¿þº~nyj-Ë9ûþûgÏ~ø¿ÐÄ›¢£j:´ßµ_[9aÍ¥*ÕhîÈ1›IPwQ†îÚûÃMV_ú•:ê,O!&WHÿ“bîívh˜a×F#væoÀ¬KP†{¢Í~hMImmÇ=‹þü«iîÏj*6½òçæbÅÕüܤ©—„Ö`=±? ÁÌ?B«!–zý)r\a5 4SEHèªërà=ÅàÕ$‹f¸¿Oç5ͧóø%[[+MjJ-+ƒ|ö€ñYôa>ìØOfõý12¡z©FkÀ^o} -Žk'œf™˜MR¬$ðR«¾>8eÎ6%/•\J`Ûxa^ÀOÐë/ý‰=MÊŸ—Ý*=ñʟ®m6¢t ÏvÒŸ«y9žGÁì¦yTÌid‚a—IÄÔï8y*˜û™¨¢ô$½,¨ïÆô–\ç²ç~L€RK6rAUDÞa -Ó´0.‡k™¬“œ¥õfÓÙöˆŒÎUÓ"Ð{„ËJ¤®µ†d¹µÚºHÙrŽš­õ‡~êhe´:fI³”Yê2xT^¦,S£‘6ÖÑÏþÉûP~‰OÙP§¸šVÐs|Lso–¿†ç¡ìU(»®Ä¢Æ“0÷  ×XNBŒ0‡(æ&ñ´é­ÀŠ‘ïQ¥i„šÙª±£ß¿ò§—ù‡ô"-ÿíïvœ???Žtç!Ýhg äþäp§Í$©$&JQÝ–Ò8¨‹:aW‰Ã¦ R;ÙG‡Šì•h¿6`¿eÄ€ýŽc ‘ÈÛÇ:nêj$dÆ;–®]/‹ÏD€ˆ?Íß'MJ“Ó”45MK3¥éiæ¼°©”:I©E “ÓÖœîîᆳ¿›OÞ³ÖïK;6³ôñÇK7>þøÆ+?ÞøúÊpñ£÷>þ¸á½vððáŒz—¦ÐXꥄíÖñ‘ÒìWÄÁ ô8Xg­¤'àx ÆÀ>F4¼! ÝÞ …¾;R±Á}˜aé¡C"~ùÕéé•ôûâ^(ÞØ|Jшâ¯ó¯œE¯!ƒàh&ÅJK Ä‚ÝA,u¶Ê¨Çc ¼Ò‘K÷»±ù^ŽîÅô~GŽÉîÀ⢢ ŠŠŠYdJå´SW¾: åÐ!ÖNp€±¸ù±á£i6Æç0š;jxÙÏ7™ÎÆ™°uä CpdT3TXëLÇU]Qˆ†>­ÞX¡Bο%&zšßg'vjwÄ‘8çH#i4Þæð?}Àîw %CéPûP‡sñÑé1»¥œƒ:<8|@ÿDk䎕»$&ÖefN½º#³ÆnYõì¾x”t-ê]“ŸA ìè·ÊfÄAk5ºf61œ”v§õ~¤Ñx­k½ñ¡FðK…û¼žƒM§»ø„ KÎ^:[- †ü ?^Ö\õÛ)[vŸa“Êh÷ >’&üÂê+uzÜ",¾?š¾aõ5É`~Û’à -܆I'jç,üýc‡u|᡽{èaöÂèÙ²[»öL.¼$Ʋ%œ'M vš¿ Æ YbÊdqÀ\ˆ(ÔCˆ’Ï€—Å{*KýH/ÕxÓbôþ+ìd&Öå¬b™AM’dæcL¬Àa€Áä¶ð(íE{å‹‘|ì½UÕ’Ù"/êð÷2cØÔMºX/4ëÈ– yR<"µõR[O µõÜ“ÚÿµÔöÚ¯§¶œ¶%Ž³¢Xj6IæXKcX$DKr´)J4ÇZ’HmÃ’ä6J5QkoÉaYrŽ’£fh]-½´~¦Þæþ–‘Zi”y´e:›Ó¥YòlÓ4ó#l¹ü¨ö[ÓÃæ›ÁDê!Çê±z;ÖNîκË]õ¾úh}6›%ÏÔW°U°LZ%-—«¯ÒÃQo-™0™p͉ª§w¨á7÷¿t`?*p)Ëo®ƒ ·ªØôæíbT¢&‹P“fò‚¿/bUA"©â K”Qð0ÔïÔ=&ŠƒYGÝš<¨Ù|]•¨¤áˆ³`õÓSê›êƒ8årºç¿Žü™ ª¡O/¢u:¥>B—©ŠJ‘Ý­çJô1ÒH]C M,Q`@¤ |­màµüP­å Þ¢mh²4©ù«æZúÏc}Y8ŸCŸ’ÎÄè±%u’*¯5DL33Yârxœˆ÷<6;‡=ÄbóX­!ùöÐb5•ª'Öã¡»-D¬‡95g?k¯P‘`¾u0l+ç¾EÁû%5Ö XÖÙi¼×“ìØ™æÐœ–ˆ$k’­³£Ÿ£Ÿstˆ.VÙ•‰'^f 9×wè35¡Ãcã¶Î{p\>äHûœ 3—å?å¼}B½4¸i+Ì’^àà¢ÍVdº?3Âæ6+>S¤Ýc–ãâ˜kL¤†¾nzÃ]ú²ÏbÒåVa$F—C™‹ÄEtÓm²ï®£r+ÁõìM¼ý­ÓÀH‹i²á·î~Òa,²§ÀKAbášÿçæ”vï¾qö ?û{—þfìüc~SZ÷øÖ ßU,.{¸üû [ÊFmúééMQ›vüT6ò>Ifû³c}Qa›evGØ$9HDM©I|=ê [ãe_tD¤Û&ÞGº‰Œuw³³dÈ’.V¬œ¿.M Í -H”æ ŠtW¦€wdJL¼ÐsãÈ1 æ¹±g÷Ÿ÷ÌÙè÷oœ³ççîuÚ±)*bÓÓ?m,(Ûráûò‡ËW|wa«pY*#þ»M2a½Îø7Q§$[:#ù4X‡{ÎK÷ÔeN¾ÖÄœ<@…dy˜Ì"3ÈL²ïnM¦bþGÒ Ft’µ)xGÉÇ{“EX&ÓÈdDÑíñl?2ïd.nqdØZ‹ŒÖ4> -stream -xœÍ9iXU×µkŸuö¹óĸÌ÷—A@à"z5¨5AAƒFQ™D©!JÕª1|mHâK ±j¬M õ™”DÛ¦Õ~‰Íàó‹¾41ÖÒøš¾|„gúÙ65px뜋ÆtzýÚï}öÙÃÚ{í5ì½ÖÚ÷€úˆà™3§taoÕó"QoäÜ¢Ùs„g¨zŽÚKæßWR´iÁF€(7µ=sK–Î*ÎZóµ§R{Ö}%éþ&ËE#Sæ/[ÓTÙŠå¢Û©½cͦvÏ©yß› {ŠÆì¨m­kZŸ·–à„¾SW¹¡4” ’à`¬kì¬ýøÐÆaÃæÏêk*«£·]¡¹©ŸROÆ. v5µãë›Ú7wå›ô5Y{c˚ʹC ^£ùê8ÓT¹¹ULdl·BseSMlô´$€ðK -Í­-ÚǯÀ´þƒ -¼µ­¦uÁâg²H8‡)Š¬„Uƒ—¼¿lZm)øÄhAyÞÿäà.¥üÅ¡Ÿ½ //JÝ4V«’¡<4OÓ$GŽ‹J“¾ ¾ü”«=å41G+à ,>ˆC¼Hšà<‹?IÍè`‰ïB­B J¢ ˆÁõ¾xŠkgWƒÒ SrÈv@ÓÄ>¬vmüÚ-õðO<âE–öÏÌÿs|àýætL”‡îê림âÀµj¢<¦Ì§¼’ò‰»à=å‰ øÊÏS®¢Ü„±¸‰¾Êý”‹ƒšWçMƒàEÊú2µ¡•J7éIïi0A1”B%ÔBÁ: s|œF܆”d AÖA›ÿð/¥?Ûgwžïk$.¢À Õc|óª‹Ë<¯/÷¦¥þIÓcÕx xÀÔé/.#øò9€>í€è‹úkÀ¡´ÔùÅežWgM`]QD}%eTUZÔMý³‹T˜²è÷Ñ;¯bÀ³¦Þó°õá¸ü‡­5ùi0(l ´ÿPÆÓ§ñ•Óøò-üþ-|éŹü¥Óøâ\<åÇëÓ~ü^5ôá 'ìü…uxÂŽÏÛñ;2ÿ¶‰¿…ß6á±çáÇd<öªøÜÑåü¹Gð¹mâÑ# üèr<$àa¿åÇCN|¶.VÆgÇ/ÆÅþgfòþ¹øÌL<ø´Ÿ\‡Oûñ)ÿõ¸…OÊøD>îÃ>7~CÆ‘q¿Œ½2öÔXyO>ºÏÁuá¾G¬|Ÿ±âÞÚh¾×qÏîÓ|Œ»w•óݧq÷6q××}|W9î -ˆ_÷áξ3 wXp{~MÆnÂ×íÇm[í|[5nµãC}ØU–à¸Å_¥_õc§7SÇæjìq“ŒíL|ƒ ÛÖOæm2®ŸŒ­míÂ767æÍ265–ó¦ÓØ´MllðñÆrl ˆëÖáZj¬= qÖÓœúj¬£¢®ki¥Úh¬±bµŒkd¬’±² +d\U+pð•2>àÀ~\ž—»°Ì…÷C¿_Æe~\*ci‰—Z±Ä€K»ø’>\\lå‹]XlÅûd\´°š/êÃ…Õ¸@Æù2Þ;ÏÎïíÃyvüÊ-œ{ çtáì";ŸÝ…Ev¼Ç3Í8ÃÓmXX`æ…2L3ð3N3`~^(Ïïü©žŠyÛÄ©œs§¸yn.N!⦸1'ÛÍsæcv–ƒg»1ËþL7÷Wc&3ݘ‘î¸xF¦»q2uMŽÆ´TO Á´A!Љ©)žjÃÔA¨•2ÉÌS,˜2È^¥Ö$IÏ'™qÒ Û¸_LžILœ ñnž>*|ó1žDïÆ8ÆF:x¬½žlîŽê÷dcL„ƒÇ„c4Ñ2FÑ(?F:0"ÜÎ#¨PΆN ³ñp;†i -ÓZx˜ ÚîÝ .BçêCg.:rÑNÞÃ~ Cüh³ú¹íZ jõ£Å\Æ-]h¦–¹ M„ÆFƒ…£Ñ`A=õk5F®µ 6È¡†8ÔQ£p¨%®ã’¥A8%ròA0QìCL£é‹Œp°h„dƒ¬zç>–òÿúÿõ£X‹c'Ø>x‰üE0°E°¶à‚$R£¬%edqðA‚£VB‡†g–{ Š`2eZu“h¤zŸhÄ!*wÂa| ·«Bð–ÐäÈ› -°|ß+pž€307™zÏ2Ë„ƒ,°Þ ‘éì2Ó³<¨Â·` Q{ÃO°ÃL‚ "ðËp†àá—ùpˆ¾—ù XÏ”X%J”š8â¬nÁ2Bßà dKð)öø¡T+ΊjÚB3F„•Âá ‰ì8\“´Þv8-ÄU¼…¹âø ‚þ6‘88Ž9|_0ÝZx‡_ -a‹B%QуEPH#½pAsH2³tÍV>B³7(N~ýw„ ®¿3=òWÓÛð6Ó©i+{æ¯%!‚Òjá;ˆ8]Më)½€ˆ+ÄÇÄw¸‡Òrþ‘ä•Žh¼”ÆÒØ<,\£˜Âú"‰‡h½ôf&Ð'ƒym^–&tŒí®ÉWINw‰¤+ôð½À4ŠD. -\Ôp:Ù\dz2 êu¨×Rè©gaµŽë´I&tš— é×G‡Cò2(ÐXùy ½Víyµ:Ñ ö,eT‹Ç -,CÈÐdh5À,‚ˆz1‡å ùšíö °õ§ØiÁ\å ½ŒRê÷²PùUÖÀ¾!¿·RÞ¸B~O|mìi\+…­—{¼/ŠeÄ«J‘&0AÒH>€P­åÓ bŒ&¢ôÖÑáÑa[^xÞíây%/=¹‹1V0Z¦“œlÛ#‰D‹ÝËlŠtmÞVÈú™(ÿT^%òËŸŸ o¥ˆ…ŸŸ%IR¬*n!´`‡Ô@(kµB«®:D+XõÀ½¦Xt‘"À¯R ÒpsøÒp³eù§äd'Äù¼Ñé½q´ÖùÎý7î—+Øc,‡YäOå7š‰í«ò½UUŸ}ð‡?|0vQá¼{üCqíûDh Lw9…PG"$š-V[7ÑM-Ñg§QÝÕâm ×wëZL­Rsx[R¢ÝñV]R¼+4ÆêŠÂØ$ëè9Îu[H8ëõ›Ã7‡­#¿±…NÈÉ|žª)5!!';>Ëï -µ%$ÄÅJN‡+4ÔåR8ˆMH´¹\A¶™|í ?¬{»fõ¹Šum%;¶ž:.ÿNþm˵úMW›6/z–ž>øÆoÒ'Ë¿¼gβâé‹33f½ôW×r²Yfé’5Ë爫Rx¥è_ì k <`”„V±š.PdZë¥s£çTqú3¼^›š„Qù=y§Eù&È2ihɪ”lŽ|°3®“ ,&Ôl” P*ÕÙb(J¬‹Ûck Ýi„¸ÈPD·Iç2LŽA—#94÷&)ÏO¼+ª»>!ëHI,øfÒ²£3b2<ÙÞB›³Íµv³Ýúng·«úY¿®_ÔqÔÙïìwõ‡ö»]åL•š"§ŸÍ›#Iq±$Ó)Þ,e;ÄJšœ)S²<.áÌᯭXؾÅÉWsŽVÿè²ÌôoÔU7üt]åë­ÌvU0—Ö.XñÂÓŽõcÝ]÷ÿìÅs§3çÎËÉ¿•”ð EnLjoŸØa09¶:]õhÚkì´Öëö`[¸Ýe„\)'\ÙšÃwë=ÃGyÀfïÝJ&rsE߽ǫä1ù–ÀpÅs%'—ô8гô›³òRRØTæ`N–7)U¾™;í¥cÇNåå+w¤DÇ4²ïVˆ„)(7s†×›õÚ6óÖŽ¡"¸¿ÍeHŽRªßO‚¾®P3!`õ ªrlÖÚ{Ì1±Íˆ6 eñòéÕ¼zéÝ×VôÈW¯nn^½º,”üqøheËfnÉ2ÊeË¡ÁÁC”ºV]]´/ qF§É±œ=&[=t¢éQ·*¦H§ Œ“Í®—”IÔ Ói -kØúëe¨ÀpÁxÁtÁ|Áy!‚—ß‘_–lN¯z"rQ•£F\T{i“ü‘ü.‹þÙ}LÇ©›l¬ &œF½¶z%¡G¿ADsqÐkÌÊ’ÊšŠÚ†ý¤··3ì´“–"›FùªPÄGÖ$±擯ˆ£ÝCCÂAäã0ÁÛ âÍ€W«#ëÍéjëÓr±Úõ’–î¹’Ž¹¤ÉcTô HÅœ_Ÿ0S·­L.„^Í{‚B… -¶F.c¯Êgä·ªå+’côë’WÍŒrémû2‡Ö6/ÂAËz°]Û£×t¢K³jeTa}ˆ²‰/Ú€YN²xl»ü®°hIÕÇò¹‹/±w°bèóíhú¹‚y aÞN;,¾Ht‡X(Ô†¨Iã4Ö{pODo˜U6K¤;?¼Ð¢Í— --ù¶8ë%ò¸¥ó ¥×µ©^—t(¼MMa¸à׿/ñÛòˆÅB³@®G¤°Aòhkábâýyâ=x·CF L‡Ìl&ÕÛö{õLpA®bbs&ü¢ê–o+4¶U¬8V^ûŽr¦«èL·Ðª…¸€]ªwB½e³Í­s…LF—1Ù­Z˜à ¶Žd|a‰³XðÀZ!.„ú†Í›ÖnÞ<ÖËÂ>aaòG#ŸÈá¾—yYÉò!fa…òYrÑŸÊgY!­Ý'/;hmÅÎåbî¶s{Ìml?öF‘ó«Ö.C±t~’ëw›:ßžClVËþ³WÈôÆOî›0u¬ê¶©;86(éUVÉoÊ¿‘¯Ëÿ^Î>½céÅ÷ nU-]rÀav N ê‚Ô'íñaÅè!—ÎÙ‚&7h¯¤»•*nÍè^X¾7Ám—¯0_ÊÉŽ‚ Ù˜’š:szBcóبXq¢¢!*RÑ>é!…VL„#B“Q0b¢µ:A£Ž‰öéô¢Þ#2ç^G§»ÞÆÈ7‰õ>òÀIÑ:CL„¦G¸Ì¹—#6ço†'¶/E(ÊÉ$/ƒò@Š<,^HÖ&ë’õɆdc²)ÙœjOw¤;S]É‘ÉQÉÑÉ1Éž$o|¢³œÝvs1‚Ê(ù®P&Q yàµÅ/”UUÿ‡¡´ÿ±¯×\jª<¿ªníü}‹øøÒꈅã“7µØŽ„o÷~÷»qq ró ò¦Ć$Ú}èT ɦ…´‘ÉÒÉÈ ¸¹™îá=`c½A“£XqkˆùËV|øfégâh8'l3¨–H8ɶÊÝó–ý~ô¤ü+ÍÊ?™?sèÙ÷qˆM§5ûÕX âOOc›žõ•“˜KGR=£Á}àÿâ4Úmê‚$‰;N8¡ŸùŠî»o¹bÉckèÿÛ%¼7VÚYÿÈCÂöÏû–×^¢5‹‰ÏnZS‚†€O¢.rF_‰Œ:]Pðq„^&Ñõ„qÈÄt ­ôZ_Ü.Ô«EðzAª-“”HÝ…|)(¾FÒ -XŠKÅå’V¹?(·»]ì–Ÿ’—ŸbÉÿ}C¬ø¼ŸÜM® þŽ*^$šŒð£@€(Ñéu¢r2èéò`0è%–.J\«¥K„`#£OOôjQ‚^ƒÖhÐë´ÁŸ\ H3è‚H;¶/9¡/îCÚów]‘ˆþzBÀ¡g1Ãb„ ×Eè# 1Æd– %j“ylŠ´N·ÆЛ5µÆ]°[óuíããð8{BzBÓ§}ÒMœÚ²ìv奫zoîìü¤c×Í7äwï’?&n -9coàŠÏû…9c¯ßÓä2ñ âÛ™Ä-XˆSä:‹Ù“ÑD5“ÙD #‰Ág2è¬`à=¸ßl赚MF½NBÐZDK¦!ÝJz:§º_ëíò¦då`*¬sÚ8q9J$”K:²{…צÙôÛŽ¥).yhð;–ÝypÿµÂ–q&™öwIUòÍL$2á‡êoíJ‡ZÁº@÷®_LÔ&ÑM?Xïªsp3ëD]‚–÷Ðl…Nhƒ¨ƒzh'ŒI°’©ôC¥,ªUÑÌ¢1í°rÔ@%4A*õ΃f?™j3¡‘’‡|ým\ÔV •54g}«i¤Š¨¶–0,ƒ4b ­$,uêHÕüÂÒLßVSExhœ‡æ·Ðº•*ìOñ”¨X iT3åY”iÎÿ6Îsgä2•Ò „¿E]ÝOôfAî—0Üž{vÚÙüeüçêÿ4é¿ -EKÂø¸:R…¿¿«Eýÿåönj©@ŒwfÈZ©/žƒLJŒhʢmEôCš`°€ƒED#ƒ¥Dƒ•”ØÄjzòÇÑÀŠæ,(%:D•Öñ‰u‚ðéI…'T¶UVAƚζFȨk«Y•-åÛÞLûâ˳Õç³kƾ -endstream -endobj -282 0 obj -<< -/Type /FontDescriptor -/FontName /FEVNJS+DejaVuSans -/FontFamily (DejaVu Sans) -/Flags 4 -/FontBBox [ 0 -14 472 560 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 560 -/StemV 80 -/StemH 80 -/FontFile2 278 0 R ->> -endobj -283 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /FEVNJS+DejaVuSans -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 317 ] 17 [ 317 ] 20 [ 636 636 ] 25 [ 636 ] 37 [ 686 698 ] 40 [ 631 ] 42 [ 774 751 294 ] 46 [ 655 ] 53 [ 694 634 ] 68 [ 612 ] 70 [ 549 634 615 ] 74 [ 634 633 277 ] 78 [ 579 ] 80 [ 974 633 611 ] 85 [ 411 520 392 633 591 817 ] ] -/FontDescriptor 282 0 R ->> -endobj -284 0 obj -<< -/Length 758 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -31 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0015> <0032> -<0003> <0020> -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0052> <006f> -<0056> <0073> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -285 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /FEVNJS+DejaVuSans -/Encoding /Identity-H -/DescendantFonts [ 283 0 R ] -/ToUnicode 284 0 R ->> -endobj -286 0 obj -<< -/Type /FontDescriptor -/FontName /MIHDNY+Poppins -/FontFamily (Poppins) -/Flags 4 -/FontBBox [ -27 -170 413 547 ] -/ItalicAngle 0 -/Ascent 1049 -/Descent -349 -/CapHeight 547 -/StemV 80 -/StemH 80 -/FontFile2 279 0 R ->> -endobj -287 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /MIHDNY+Poppins -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 266 ] 5 [ 291 ] 10 [ 158 453 453 ] 14 [ 682 197 550 209 475 627 319 574 588 628 627 634 545 630 629 212 ] 36 [ 673 612 771 706 512 503 777 691 245 ] 46 [ 598 431 ] 49 [ 702 785 578 ] 53 [ 607 586 540 ] 57 [ 675 975 ] 60 [ 583 ] 68 [ 675 675 606 675 619 328 675 639 245 247 514 245 1029 639 639 675 675 372 521 363 639 560 819 478 562 454 ] 209 [ 411 ] ] -/FontDescriptor 286 0 R ->> -endobj -288 0 obj -<< -/Length 1276 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -68 beginbfchar -<0035> <0052> -<002e> <004b> -<0028> <0045> -<0015> <0032> -<0003> <0020> -<002b> <0048> -<0044> <0061> -<0055> <0072> -<0047> <0064> -<0048> <0065> -<0051> <006e> -<004c> <0069> -<004a> <0067> -<002a> <0047> -<0058> <0075> -<005a> <0077> -<0057> <0074> -<004b> <0068> -<0026> <0043> -<002c> <0049> -<0036> <0053> -<0059> <0076> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0025> <0042> -<0046> <0063> -<0050> <006d> -<004e> <006b> -<0016> <0033> -<0017> <0034> -<0018> <0035> -<001b> <0038> -<001c> <0039> -<0013> <0030> -<0032> <004f> -<0052> <006f> -<0056> <0073> -<0010> <002d> -<004f> <006c> -<0054> <0071> -<0053> <0070> -<0045> <0062> -<0024> <0041> -<0033> <0050> -<0049> <0066> -<0037> <0054> -<005c> <0079> -<000b> <0028> -<000c> <0029> -<000f> <002c> -<001d> <003a> -<0039> <0056> -<000e> <002b> -<0027> <0044> -<0029> <0046> -<0005> <0022> -<004d> <006a> -<00d1> <2022> -<005b> <0078> -<003c> <0059> -<000a> <0027> -<0012> <002f> -<003a> <0057> -<002f> <004c> -<0031> <004e> -<001a> <0037> -<005d> <007a> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -289 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /MIHDNY+Poppins -/Encoding /Identity-H -/DescendantFonts [ 287 0 R ] -/ToUnicode 288 0 R ->> -endobj -290 0 obj -<< -/Type /FontDescriptor -/FontName /BKSMOQ+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 4 -/FontBBox [ 0 -14 502 728 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 728 -/StemV 80 -/StemH 80 -/FontFile2 280 0 R ->> -endobj -291 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /BKSMOQ+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 3 [ 602 602 602 602 602 602 ] 10 [ 602 602 602 602 601 ] 16 [ 601 601 601 601 601 601 602 ] 24 [ 601 601 ] 27 [ 602 601 602 602 602 602 602 ] 36 [ 602 602 602 602 602 602 602 602 602 ] 46 [ 602 602 602 601 602 601 ] 53 [ 602 601 602 601 602 602 ] 62 [ 602 ] 64 [ 602 ] 66 [ 602 ] 68 [ 601 601 601 601 601 601 602 602 601 602 601 601 602 601 601 601 602 601 601 601 601 602 601 601 601 ] 94 [ 602 ] 96 [ 602 ] ] -/FontDescriptor 290 0 R ->> -endobj -292 0 obj -<< -/Length 1416 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -78 beginbfchar -<0033> <0050> -<0052> <006f> -<0047> <0064> -<0036> <0053> -<0048> <0065> -<0046> <0063> -<0058> <0075> -<0055> <0072> -<004c> <0069> -<0057> <0074> -<005c> <0079> -<004f> <006c> -<0056> <0073> -<0031> <004e> -<005a> <0077> -<004e> <006b> -<0053> <0070> -<0049> <0066> -<0010> <002d> -<0014> <0031> -<0011> <002e> -<0019> <0036> -<0018> <0035> -<0051> <006e> -<0044> <0061> -<001d> <003a> -<0003> <0020> -<0026> <0043> -<004a> <0067> -<0050> <006d> -<004b> <0068> -<005b> <0078> -<0012> <002f> -<001c> <0039> -<0013> <0030> -<0045> <0062> -<0059> <0076> -<0042> <005f> -<0020> <003d> -<0038> <0055> -<0005> <0022> -<0030> <004d> -<0024> <0041> -<0037> <0054> -<0039> <0056> -<000e> <002b> -<0006> <0023> -<0004> <0021> -<0007> <0024> -<000b> <0028> -<004d> <006a> -<005e> <007b> -<003e> <005b> -<000d> <002a> -<0040> <005d> -<000a> <0027> -<0060> <007d> -<000c> <0029> -<001e> <003b> -<0015> <0032> -<001b> <0038> -<001f> <003c> -<0021> <003e> -<0028> <0045> -<0054> <0071> -<0016> <0033> -<002f> <004c> -<0035> <0052> -<002a> <0047> -<0025> <0042> -<0027> <0044> -<0032> <004f> -<0008> <0025> -<002b> <0048> -<003a> <0057> -<0029> <0046> -<002e> <004b> -<002c> <0049> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -293 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /BKSMOQ+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 291 0 R ] -/ToUnicode 292 0 R ->> -endobj -294 0 obj -<< -/Type /FontDescriptor -/FontName /CBTLAY+DejaVuSansMono -/FontFamily (DejaVu Sans Mono) -/Flags 5 -/FontBBox [ 0 -207 558 728 ] -/ItalicAngle 0 -/Ascent 928 -/Descent -235 -/CapHeight 728 -/StemV 80 -/StemH 80 -/FontFile2 281 0 R ->> -endobj -295 0 obj -<< -/Type /Font -/Subtype /CIDFontType2 -/BaseFont /CBTLAY+DejaVuSansMono -/CIDSystemInfo << -/Registry (Adobe) -/Ordering (Identity) -/Supplement 0 ->> -/W [ 16 [ 601 ] 36 [ 601 ] 49 [ 601 ] 51 [ 601 ] 54 [ 601 601 ] 68 [ 601 ] 70 [ 601 601 601 601 ] 76 [ 601 ] 78 [ 601 601 601 601 601 601 ] 85 [ 601 601 601 601 601 601 ] 92 [ 601 ] ] -/FontDescriptor 294 0 R ->> -endobj -296 0 obj -<< -/Length 674 ->> -stream -/CIDInit /ProcSet findresource begin -12 dict begin -begincmap -/CIDSystemInfo -<< /Registry (Adobe) -/Ordering (UCS) -/Supplement 0 ->> def -/CMapName /Adobe-Identity-UCS def -/CMapType 2 def -1 begincodespacerange -<0000> -endcodespacerange -25 beginbfchar -<0053> <0070> -<0055> <0072> -<0052> <006f> -<0057> <0074> -<0048> <0065> -<0046> <0063> -<0010> <002d> -<004e> <006b> -<0051> <006e> -<004f> <006c> -<0047> <0064> -<0049> <0066> -<0044> <0061> -<0058> <0075> -<0056> <0073> -<0033> <0050> -<0036> <0053> -<004c> <0069> -<005c> <0079> -<0031> <004e> -<005a> <0077> -<0050> <006d> -<0059> <0076> -<0024> <0041> -<0037> <0054> -endbfchar -endcmap -CMapName currentdict /CMap defineresource pop -end -end -endstream -endobj -297 0 obj -<< -/Type /Font -/Subtype /Type0 -/BaseFont /CBTLAY+DejaVuSansMono -/Encoding /Identity-H -/DescendantFonts [ 295 0 R ] -/ToUnicode 296 0 R ->> -endobj -298 0 obj -<< -/FEVNJS 285 0 R -/MIHDNY 289 0 R -/BKSMOQ 293 0 R -/CBTLAY 297 0 R ->> -endobj -xref -0 299 -0000000000 65535 f -0000000015 00000 n -0000000176 00000 n -0000000297 00000 n -0000011596 00000 n -0000011729 00000 n -0000014387 00000 n -0000014586 00000 n -0000018015 00000 n -0000018337 00000 n -0000018471 00000 n -0000018607 00000 n -0000018757 00000 n -0000018908 00000 n -0000019051 00000 n -0000019195 00000 n -0000019353 00000 n -0000019512 00000 n -0000019669 00000 n -0000019827 00000 n -0000019966 00000 n -0000020106 00000 n -0000020279 00000 n -0000020453 00000 n -0000020590 00000 n -0000020728 00000 n -0000025444 00000 n -0000025734 00000 n -0000025989 00000 n -0000026125 00000 n -0000026276 00000 n -0000026420 00000 n -0000026579 00000 n -0000026737 00000 n -0000026877 00000 n -0000027051 00000 n -0000027189 00000 n -0000027456 00000 n -0000027722 00000 n -0000032771 00000 n -0000032972 00000 n -0000037891 00000 n -0000038146 00000 n -0000038279 00000 n -0000038410 00000 n -0000038541 00000 n -0000038672 00000 n -0000038803 00000 n -0000038934 00000 n -0000043741 00000 n -0000043989 00000 n -0000044122 00000 n -0000044253 00000 n -0000044384 00000 n -0000044515 00000 n -0000044648 00000 n -0000049806 00000 n -0000050026 00000 n -0000050158 00000 n -0000055590 00000 n -0000055880 00000 n -0000056013 00000 n -0000056144 00000 n -0000056275 00000 n -0000056406 00000 n -0000056537 00000 n -0000056670 00000 n -0000056801 00000 n -0000056932 00000 n -0000057063 00000 n -0000057194 00000 n -0000057325 00000 n -0000062131 00000 n -0000062393 00000 n -0000062526 00000 n -0000062657 00000 n -0000062788 00000 n -0000062919 00000 n -0000063050 00000 n -0000063181 00000 n -0000063404 00000 n -0000068141 00000 n -0000068368 00000 n -0000068501 00000 n -0000068631 00000 n -0000073579 00000 n -0000074082 00000 n -0000074213 00000 n -0000074344 00000 n -0000074475 00000 n -0000074606 00000 n -0000074737 00000 n -0000074868 00000 n -0000074999 00000 n -0000075131 00000 n -0000075263 00000 n -0000075395 00000 n -0000075527 00000 n -0000075659 00000 n -0000075791 00000 n -0000075923 00000 n -0000076056 00000 n -0000076189 00000 n -0000076322 00000 n -0000076455 00000 n -0000076588 00000 n -0000076721 00000 n -0000076854 00000 n -0000076987 00000 n -0000077120 00000 n -0000077253 00000 n -0000077386 00000 n -0000077519 00000 n -0000077652 00000 n -0000077785 00000 n -0000077918 00000 n -0000078051 00000 n -0000078184 00000 n -0000078317 00000 n -0000078450 00000 n -0000078583 00000 n -0000078716 00000 n -0000078849 00000 n -0000078981 00000 n -0000079112 00000 n -0000083562 00000 n -0000084081 00000 n -0000084214 00000 n -0000084347 00000 n -0000084480 00000 n -0000084613 00000 n -0000084746 00000 n -0000084879 00000 n -0000085012 00000 n -0000085145 00000 n -0000085278 00000 n -0000085411 00000 n -0000085544 00000 n -0000085677 00000 n -0000085810 00000 n -0000085943 00000 n -0000086076 00000 n -0000086209 00000 n -0000086342 00000 n -0000086475 00000 n -0000086608 00000 n -0000086741 00000 n -0000086874 00000 n -0000087007 00000 n -0000087140 00000 n -0000087273 00000 n -0000087406 00000 n -0000087539 00000 n -0000087672 00000 n -0000087805 00000 n -0000087938 00000 n -0000088071 00000 n -0000088204 00000 n -0000088337 00000 n -0000088470 00000 n -0000088603 00000 n -0000088736 00000 n -0000088869 00000 n -0000089001 00000 n -0000089132 00000 n -0000093641 00000 n -0000094160 00000 n -0000094293 00000 n -0000094426 00000 n -0000094559 00000 n -0000094692 00000 n -0000094825 00000 n -0000094958 00000 n -0000095091 00000 n -0000095224 00000 n -0000095357 00000 n -0000095490 00000 n -0000095623 00000 n -0000095756 00000 n -0000095889 00000 n -0000096022 00000 n -0000096155 00000 n -0000096288 00000 n -0000096421 00000 n -0000096554 00000 n -0000096687 00000 n -0000096820 00000 n -0000096953 00000 n -0000097087 00000 n -0000097221 00000 n -0000097355 00000 n -0000097489 00000 n -0000097623 00000 n -0000097757 00000 n -0000097891 00000 n -0000098025 00000 n -0000098159 00000 n -0000098293 00000 n -0000098427 00000 n -0000098561 00000 n -0000098695 00000 n -0000098829 00000 n -0000098963 00000 n -0000099096 00000 n -0000099228 00000 n -0000103644 00000 n -0000104163 00000 n -0000104297 00000 n -0000104431 00000 n -0000104565 00000 n -0000104699 00000 n -0000104833 00000 n -0000104967 00000 n -0000105101 00000 n -0000105235 00000 n -0000105369 00000 n -0000105503 00000 n -0000105637 00000 n -0000105771 00000 n -0000105905 00000 n -0000106039 00000 n -0000106173 00000 n -0000106307 00000 n -0000106441 00000 n -0000106575 00000 n -0000106709 00000 n -0000106843 00000 n -0000106977 00000 n -0000107111 00000 n -0000107245 00000 n -0000107379 00000 n -0000107513 00000 n -0000107647 00000 n -0000107781 00000 n -0000107915 00000 n -0000108049 00000 n -0000108183 00000 n -0000108317 00000 n -0000108451 00000 n -0000108585 00000 n -0000108719 00000 n -0000108853 00000 n -0000108987 00000 n -0000109120 00000 n -0000109252 00000 n -0000113043 00000 n -0000113354 00000 n -0000113488 00000 n -0000113622 00000 n -0000113756 00000 n -0000113890 00000 n -0000114024 00000 n -0000114158 00000 n -0000114292 00000 n -0000114426 00000 n -0000114560 00000 n -0000114694 00000 n -0000114828 00000 n -0000115096 00000 n -0000115272 00000 n -0000115397 00000 n -0000115580 00000 n -0000115734 00000 n -0000115885 00000 n -0000116061 00000 n -0000116199 00000 n -0000116336 00000 n -0000116527 00000 n -0000116663 00000 n -0000116809 00000 n -0000116959 00000 n -0000117120 00000 n -0000117292 00000 n -0000117423 00000 n -0000117567 00000 n -0000117697 00000 n -0000117874 00000 n -0000118002 00000 n -0000118064 00000 n -0000125460 00000 n -0000129765 00000 n -0000140937 00000 n -0000146172 00000 n -0000146404 00000 n -0000146824 00000 n -0000147635 00000 n -0000147785 00000 n -0000148014 00000 n -0000148559 00000 n -0000149889 00000 n -0000150036 00000 n -0000150277 00000 n -0000150882 00000 n -0000152352 00000 n -0000152506 00000 n -0000152748 00000 n -0000153121 00000 n -0000153848 00000 n -0000154002 00000 n -trailer -<< -/Size 299 -/Root 3 0 R -/Info 2 0 R ->> -startxref -154089 -%%EOF diff --git a/versioned_docs/version-2.7/backups/docker-installs/docker-installs.md b/versioned_docs/version-2.7/backups/docker-installs/docker-installs.md deleted file mode 100644 index cc211cee5e0..00000000000 --- a/versioned_docs/version-2.7/backups/docker-installs/docker-installs.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -title: Backup and Restore for Rancher Installed with Docker ---- - -- [Backups](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/back-up-docker-installed-rancher.md) -- [Restores](../../how-to-guides/new-user-guides/backup-restore-and-disaster-recovery/restore-docker-installed-rancher.md) \ No newline at end of file diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md index bc5cc83d471..300e152bb22 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/helm-charts-in-rancher/create-apps.md @@ -109,20 +109,23 @@ This reference contains variables that you can use in `questions.yml` nested und | label | string | true | Define the UI label. | | description | string | false | Specify the description of the variable.| | type | string | false | Default to `string` if not specified (current supported types are string, multiline, boolean, int, enum, password, storageclass, hostname, pvc, and secret).| -| required | bool | false | Define if the variable is required or not (true \| false)| | default | string | false | Specify the default value. Only used if there is no corresponding value in the `values.yml` file. | | group | string | false | Group questions by input value. | -| min_length | int | false | Min character length.| -| max_length | int | false | Max character length.| -| min | int | false | Min integer length. | -| max | int | false | Max integer length. | | options | []string | false | Specify the options when the variable type is `enum`, for example: options:
- "ClusterIP"
- "NodePort"
- "LoadBalancer"| -| valid_chars | string | false | Regular expression for input chars validation. | -| invalid_chars | string | false | Regular expression for invalid input chars validation.| | subquestions | []subquestion | false| Add an array of subquestions.| | show_if | string | false | Show current variable if conditional variable is true. For example `show_if: "serviceType=Nodeport"` | | show\_subquestion_if | string | false | Show subquestions if is true or equal to one of the options. for example `show_subquestion_if: "true"`| + + :::note `subquestions[]` cannot contain `subquestions` or `show_subquestions_if` keys, but all other keys in the above table are supported. diff --git a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md index b65d7aa9b4b..f176acc177b 100644 --- a/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md +++ b/versioned_docs/version-2.7/how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/set-up-clusters-from-hosted-kubernetes-providers/aks.md @@ -8,7 +8,6 @@ title: Creating an AKS Cluster You can use Rancher to create a cluster hosted in Microsoft Azure Kubernetes Service (AKS). - ## Prerequisites in Microsoft Azure :::caution @@ -65,6 +64,14 @@ az ad sp create-for-rbac \ --role Contributor ``` +### Setting Up the Service Principal with the Azure Command Line Tool + +Create the Resource Group by running this command: + +``` +az group create --location AZURE_LOCATION_NAME --resource-group AZURE_RESOURCE_GROUP_NAME +``` + ### Setting Up the Service Principal from the Azure Portal You can also follow these instructions to set up a service principal and give it role-based access from the Azure Portal. @@ -124,6 +131,17 @@ When provisioning an AKS cluster in the Rancher UI, RBAC is not configurable bec RBAC is required for AKS clusters that are registered or imported into Rancher. +### Setting Up the Role Assignment to Service Principal with the Azure Command Line Tool + +Assign the Rancher AKSv2 role to the service principal with the Azure Command Line Tool: + +``` +az role assignment create \ +--assignee CLIENT_ID \ +--scope "/subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP_NAME" \ +--role "Rancher AKSv2" +``` + ## AKS Cluster Configuration Reference For more information about how to configure AKS clusters from the Rancher UI, see the [configuration reference.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md) @@ -146,12 +164,114 @@ Please be aware that when registering an existing AKS cluster, the cluster might For more information about connecting to an AKS private cluster, see the [AKS documentation.](https://docs.microsoft.com/en-us/azure/aks/private-clusters#options-for-connecting-to-the-private-cluster) +## Setting Up the Minimum Permission Role with the Azure Command Line Tool + +1. Create the Minimum Rancher AKSv2 Permission Role by running this command: + + ``` + cat >> rancher-azure.json << EOF + + { + "Name": "Rancher AKSv2", + "IsCustom": true, + "Description": "Everything needed by Rancher AKSv2 operator", + "Actions": [ + "Microsoft.Compute/disks/delete", + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/diskEncryptionSets/read", + "Microsoft.Compute/locations/DiskOperations/read", + "Microsoft.Compute/locations/vmSizes/read", + "Microsoft.Compute/locations/operations/read", + "Microsoft.Compute/proximityPlacementGroups/write", + "Microsoft.Compute/snapshots/delete", + "Microsoft.Compute/snapshots/read", + "Microsoft.Compute/snapshots/write", + "Microsoft.Compute/virtualMachineScaleSets/manualUpgrade/action", + "Microsoft.Compute/virtualMachineScaleSets/delete", + "Microsoft.Compute/virtualMachineScaleSets/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/networkInterfaces/ipconfigurations/publicipaddresses/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualmachines/instanceView/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/read", + "Microsoft.Compute/virtualMachineScaleSets/virtualMachines/write", + "Microsoft.Compute/virtualMachineScaleSets/write", + "Microsoft.Compute/virtualMachines/read", + "Microsoft.Compute/virtualMachines/write", + "Microsoft.ContainerService/managedClusters/read", + "Microsoft.ContainerService/managedClusters/write" + "Microsoft.ContainerService/managedClusters/delete", + "Microsoft.ContainerService/managedClusters/accessProfiles/listCredential/action", + "Microsoft.ContainerService/managedClusters/agentPools/read", + "Microsoft.ContainerService/managedClusters/agentPools/write", + "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", + "Microsoft.Network/applicationGateways/read", + "Microsoft.Network/applicationGateways/write", + "Microsoft.Network/loadBalancers/write", + "Microsoft.Network/loadBalancers/backendAddressPools/join/action", + "Microsoft.Network/loadBalancers/delete", + "Microsoft.Network/loadBalancers/read", + "Microsoft.Network/networkInterfaces/join/action", + "Microsoft.Network/networkInterfaces/read", + "Microsoft.Network/networkInterfaces/write", + "Microsoft.Network/networkSecurityGroups/read", + "Microsoft.Network/networkSecurityGroups/write", + "Microsoft.Network/publicIPAddresses/delete", + "Microsoft.Network/publicIPAddresses/join/action", + "Microsoft.Network/publicIPAddresses/read", + "Microsoft.Network/publicIPAddresses/write", + "Microsoft.Network/publicIPPrefixes/join/action", + "Microsoft.Network/privatednszones/*", + "Microsoft.Network/routeTables/read", + "Microsoft.Network/routeTables/routes/delete", + "Microsoft.Network/routeTables/routes/read", + "Microsoft.Network/routeTables/routes/write", + "Microsoft.Network/routeTables/write", + "Microsoft.Network/virtualNetworks/read", + "Microsoft.Network/virtualNetworks/subnets/join/action", + "Microsoft.Network/virtualNetworks/subnets/read", + "Microsoft.Network/virtualNetworks/joinLoadBalancer/action", + "Microsoft.OperationalInsights/workspaces/sharedkeys/read", + "Microsoft.OperationalInsights/workspaces/read", + "Microsoft.OperationsManagement/solutions/write", + "Microsoft.OperationsManagement/solutions/read", + "Microsoft.Resources/subscriptions/resourcegroups/read", + "Microsoft.Resources/subscriptions/resourcegroups/write", + "Microsoft.Storage/operations/read", + "Microsoft.Storage/storageAccounts/listKeys/action", + "Microsoft.Storage/storageAccounts/delete", + "Microsoft.Storage/storageAccounts/read", + "Microsoft.Storage/storageAccounts/write" + ], + "NotActions": [], + "DataActions": [], + "NotDataActions": [], + "AssignableScopes": [ + "/subscriptions/SUBSCRIPTION_ID" + ] + } + EOF + ``` + +2. Apply the Rancher AKSv2 Role: + + ``` + az role definition create --role-definition rancher-azure.json + ``` + +3. Verify if the Rancher AKSv2 Role was created: + + ``` + az role definition list | grep "Rancher AKSv2" + ``` + ## Syncing The AKS provisioner can synchronize the state of an AKS cluster between Rancher and the provider. For an in-depth technical explanation of how this works, see [Syncing.](../../../../reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md) For information on configuring the refresh interval, see [this section.](../../../../pages-for-subheaders/gke-cluster-configuration.md#configuring-the-refresh-interval) + ## Programmatically Creating AKS Clusters -The most common way to programmatically deploy AKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here.](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster) \ No newline at end of file +The most common way to programmatically deploy AKS clusters through Rancher is by using the Rancher2 Terraform provider. The documentation for creating clusters with Terraform is [here](https://registry.terraform.io/providers/rancher/rancher2/latest/docs/resources/cluster). diff --git a/versioned_docs/version-2.7/pages-for-subheaders/k3s-hardening-guide.md b/versioned_docs/version-2.7/pages-for-subheaders/k3s-hardening-guide.md index e44593ec790..285577fbca5 100644 --- a/versioned_docs/version-2.7/pages-for-subheaders/k3s-hardening-guide.md +++ b/versioned_docs/version-2.7/pages-for-subheaders/k3s-hardening-guide.md @@ -702,7 +702,6 @@ spec: - config: kubelet-arg: - make-iptables-util-chains=true # CIS 4.2.7 - protect-kernel-defaults: true # CIS 4.2.6 ``` @@ -734,6 +733,7 @@ spec: - config: kubelet-arg: - make-iptables-util-chains=true # CIS 4.2.7 + protect-kernel-defaults: true # CIS 4.2.6 ``` diff --git a/versioned_docs/version-2.7/pages-for-subheaders/rancher-hardening-guides.md b/versioned_docs/version-2.7/pages-for-subheaders/rancher-hardening-guides.md index a7ffa3ce2e1..5db6c192945 100644 --- a/versioned_docs/version-2.7/pages-for-subheaders/rancher-hardening-guides.md +++ b/versioned_docs/version-2.7/pages-for-subheaders/rancher-hardening-guides.md @@ -27,25 +27,25 @@ Each self-assessment guide is accompanied by a hardening guide. These guides wer | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |--------------------|-----------------------|-----------------------|------------------| | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](rke1-hardening-guide.md) | -| Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](rke1-hardening-guide.md) | -| Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](rke1-hardening-guide.md) | +| Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](rke1-hardening-guide.md) | +| Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke1-hardening-guide.md) | ### RKE2 Guides | Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |------|--------------------|-----------------------|-----------------------|------------------| | Rancher provisioned RKE2 | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](rke2-hardening-guide.md) | -| Rancher provisioned RKE2 | Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](rke2-hardening-guide.md) | -| Rancher provisioned RKE2 | Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](rke2-hardening-guide.md) | -| Standalone RKE2 | Kubernetes v1.25 | CIS v1.23 | [Link](https://docs.rke2.io/security/cis_self_assessment123) | [Link](https://docs.rke2.io/security/hardening_guide) | +| Rancher provisioned RKE2 | Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](rke2-hardening-guide.md) | +| Rancher provisioned RKE2 | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](rke2-hardening-guide.md) | +| Standalone RKE2 | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](https://docs.rke2.io/security/cis_self_assessment123) | [Link](https://docs.rke2.io/security/hardening_guide) | ### K3s Guides | Type | Kubernetes Version | CIS Benchmark Version | Self Assessment Guide | Hardening Guides | |------|--------------------|-----------------------|-----------------------|------------------| | Rancher provisioned K3s cluster | Kubernetes v1.23 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md) | [Link](k3s-hardening-guide.md) | -| Rancher provisioned K3s cluster | Kubernetes v1.24 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md) | [Link](k3s-hardening-guide.md) | -| Rancher provisioned K3s cluster | Kubernetes v1.25 | CIS v1.23 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md) | [Link](k3s-hardening-guide.md) | +| Rancher provisioned K3s cluster | Kubernetes v1.24 | CIS v1.24 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md) | [Link](k3s-hardening-guide.md) | +| Rancher provisioned K3s cluster | Kubernetes v1.25/v1.26/v1.27 | CIS v1.7 | [Link](../reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md) | [Link](k3s-hardening-guide.md) | | Standalone K3s | Kubernetes v1.22 up to v1.24 | CIS v1.23 | [Link](https://docs.k3s.io/security/self-assessment) | [Link](https://docs.k3s.io/security/hardening-guide) | ## Rancher with SELinux diff --git a/versioned_docs/version-2.7/reference-guides/about-the-api/api-tokens.md b/versioned_docs/version-2.7/reference-guides/about-the-api/api-tokens.md index eccd4d962b1..5fe8a0eb5a4 100644 --- a/versioned_docs/version-2.7/reference-guides/about-the-api/api-tokens.md +++ b/versioned_docs/version-2.7/reference-guides/about-the-api/api-tokens.md @@ -3,7 +3,7 @@ title: API Tokens --- - + By default, some cluster-level API tokens are generated with infinite time-to-live (`ttl=0`). In other words, API tokens with `ttl=0` never expire unless you invalidate them. Tokens are not invalidated by changing a password. diff --git a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/backup-configuration.md b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/backup-configuration.md index 2a792778e0a..e7ef2b056bf 100644 --- a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/backup-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/backup-configuration.md @@ -3,7 +3,7 @@ title: Backup Configuration --- - + The Backup Create page lets you configure a schedule, enable encryption and specify the storage location for your backups. diff --git a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/examples.md b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/examples.md index 4336a204d98..bab7533302e 100644 --- a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/examples.md +++ b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + This section contains examples of Backup and Restore custom resources. diff --git a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/restore-configuration.md b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/restore-configuration.md index 5e958fcd674..b162a6ef873 100644 --- a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/restore-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/restore-configuration.md @@ -3,7 +3,7 @@ title: Restore Configuration --- - + The Restore Create page lets you provide details of the backup to restore from diff --git a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/storage-configuration.md b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/storage-configuration.md index 3ad8b94487f..b1b8bad0896 100644 --- a/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/storage-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/backup-restore-configuration/storage-configuration.md @@ -3,7 +3,7 @@ title: Backup Storage Location Configuration --- - + Configure a storage location where all backups are saved by default. You will have the option to override this with each backup, but will be limited to using an S3-compatible object store. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md index 9fc13c9ce70..dc200ae62b1 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/logging-best-practices.md @@ -3,7 +3,7 @@ title: Logging Best Practices --- - + In this guide, we recommend best practices for cluster-level logging and application logging. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md index 9255c76a28b..a6e34b03a50 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/monitoring-best-practices.md @@ -3,7 +3,7 @@ title: Monitoring Best Practices --- - + Configuring sensible monitoring and alerting rules is vital for running any production workloads securely and reliably. This is not different when using Kubernetes and Rancher. Fortunately the integrated monitoring and alerting functionality makes this whole process a lot easier. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md index 3012223f423..9d24fb3c5db 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/rancher-managed-clusters-in-vsphere.md @@ -3,7 +3,7 @@ title: Best Practices for Rancher Managed vSphere Clusters --- - + This guide outlines a reference architecture for provisioning downstream Rancher clusters in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md index 1298ff18b87..0cec0a91864 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-managed-clusters/tips-to-set-up-containers.md @@ -3,7 +3,7 @@ title: Tips for Setting Up Containers --- - + Running well-built containers can greatly impact the overall performance and security of your environment. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md index c19ac243d98..74243559753 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/on-premises-rancher-in-vsphere.md @@ -3,7 +3,7 @@ title: Installing Rancher in a vSphere Environment --- - + This guide outlines a reference architecture for installing Rancher on an RKE Kubernetes cluster in a vSphere environment, in addition to standard vSphere best practices as documented by VMware. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md index cc8811dc77e..99583f75579 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/rancher-deployment-strategy.md @@ -3,7 +3,7 @@ title: Rancher Deployment Strategy --- - + There are two recommended deployment strategies for a Rancher instance that manages downstream Kubernetes clusters. Each one has its own pros and cons. Read more about which one would fit best for your use case. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md index 1863ff82503..1ed05696fa2 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-running-rancher.md @@ -3,7 +3,7 @@ title: Tips for Running Rancher --- - + This guide is geared toward use cases where Rancher is used to manage downstream Kubernetes clusters. The high-availability setup is intended to prevent losing access to downstream clusters if the Rancher server is not available. diff --git a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md index 691ef18f576..e8e919bde9b 100644 --- a/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md +++ b/versioned_docs/version-2.7/reference-guides/best-practices/rancher-server/tips-for-scaling-rancher.md @@ -3,7 +3,7 @@ title: Tips for Scaling Rancher --- - + This guide aims to introduce the approaches that should be considered to scale Rancher setups, and associated challenges with doing so. As systems grow performance will naturally reduce, but there are steps we can take to minimize the load put on Rancher, as well as optimize Rancher's ability to handle these larger setups. diff --git a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/kubectl-utility.md b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/kubectl-utility.md index 45502753a08..fefa1a66b1b 100644 --- a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/kubectl-utility.md +++ b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/kubectl-utility.md @@ -3,7 +3,7 @@ title: kubectl Utility --- - + ## kubectl diff --git a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md index 44024172658..0c9a27c1694 100644 --- a/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md +++ b/versioned_docs/version-2.7/reference-guides/cli-with-rancher/rancher-cli.md @@ -4,7 +4,7 @@ description: Interact with Rancher using command line interface (CLI) tools from --- - + The Rancher CLI (Command Line Interface) is a unified tool that you can use to interact with Rancher. With this tool, you can operate Rancher using a command line rather than the GUI. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md index 6043df8f1ba..4640d142697 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Machine Configuration Reference --- - + For more details about EC2 nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md index 98d299762b0..ba7e806295e 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Machine Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md index 1d62fe9d9d7..634c7f48561 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/machine-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Machine Configuration --- - + For more details about DigitalOcean, Droplets, refer to the [official documentation](https://docs.digitalocean.com/products/compute/). diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md index ffe36cf7723..bd79dabbed5 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/amazon-ec2.md @@ -3,7 +3,7 @@ title: EC2 Node Template Configuration --- - + For more details about EC2, nodes, refer to the official documentation for the [EC2 Management Console](https://aws.amazon.com/ec2). diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md index e8fa8b382ee..e747dbbb547 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/azure.md @@ -3,7 +3,7 @@ title: Azure Node Template Configuration --- - + For more information about Azure, refer to the official [Azure documentation.](https://docs.microsoft.com/en-us/azure/?product=featured) diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md index 0e679ae7d13..87b5fccdcfb 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/digitalocean.md @@ -3,7 +3,7 @@ title: DigitalOcean Node Template Configuration --- - + Account access information is stored as a cloud credential. Cloud credentials are stored as Kubernetes secrets. Multiple node templates can use the same cloud credential. You can use an existing cloud credential or create a new one. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md index cbecb1be01b..4e44d5ceca7 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/nutanix.md @@ -3,7 +3,7 @@ title: Nutanix Node Template Configuration --- - + ## Account Access diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md index 4ff462b1d1c..ace79a39ca7 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/downstream-cluster-configuration/node-template-configuration/vsphere.md @@ -3,7 +3,7 @@ title: VSphere Node Template Configuration --- - + ## Account Access diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md index 136c71a45a2..67cd280e470 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/aks-cluster-configuration.md @@ -3,7 +3,7 @@ title: AKS Cluster Configuration Reference --- - + ## Changes in Rancher v2.6 diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index b6110f8cafc..4a9bbe4f0ef 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -3,7 +3,7 @@ title: EKS Cluster Configuration Reference --- - + ### Account Access @@ -86,9 +86,11 @@ Amazon EKS managed node groups automate the provisioning and lifecycle managemen For more information about how node groups work and how they are configured, refer to the [EKS documentation.](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html) -#### Bring your own launch template +#### User-provided Launch Templates -A launch template ID and version can be provided in order to easily configure the EC2 instances in a node group. If a launch template is provided, then none of the settings below will be configurable in Rancher. Therefore, using a launch template would require that all the necessary and desired settings from the list below would need to be specified in the launch template. Also note that if a launch template ID and version is provided, then only the template version can be updated. Using a new template ID would require creating a new managed node group. +You can provide your own launch template ID and version to configure the EC2 instances in a node group. If you provide the launch template, none of the template settings will be configurable from Rancher. You must set all of the required options listed below in your launch template. + +Also, if you provide the launch template, you can only update the template version, not the template ID. To use a new template ID, create a new managed node group. | Option | Description | Required/Optional | | ------ | ----------- | ----------------- | @@ -97,9 +99,9 @@ A launch template ID and version can be provided in order to easily configure th | Node Volume Size | The launch template must specify an EBS volume with the desired size | Required | | SSH Key | A key to be added to the instances to provide SSH access to the nodes | Optional | | User Data | Cloud init script in [MIME multi-part format](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html#launch-template-user-data) | Optional | -| Instance Resource Tags | Tag each EC2 instance in the node group | Optional | +| Instance Resource Tags | Tag each EC2 instance and its volumes in the node group | Optional | -#### Rancher-managed launch templates +#### Rancher-managed Launch Templates If you do not specify a launch template, then you will be able to configure the above options in the Rancher UI and all of them can be updated after creation. In order to take advantage of all of these options, Rancher will create and manage a launch template for you. Each cluster in Rancher will have one Rancher-managed launch template and each managed node group that does not have a specified launch template will have one version of the managed launch template. The name of this launch template will have the prefix "rancher-managed-lt-" followed by the display name of the cluster. In addition, the Rancher-managed launch template will be tagged with the key "rancher-managed-template" and value "do-not-modify-or-delete" to help identify it as Rancher-managed. It is important that this launch template and its versions not be modified, deleted, or used with any other clusters or managed node groups. Doing so could result in your node groups being "degraded" and needing to be destroyed and recreated. @@ -150,4 +152,3 @@ The syncing interval can be changed by running `kubectl edit setting eks-refresh If the `eks-refresh-cron` setting was previously set, the migration will happen automatically. The shorter the refresh window, the less likely any race conditions will occur, but it does increase the likelihood of encountering request limits that may be in place for AWS APIs. - diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md index 60228c3fb97..120be47a641 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/gke-cluster-configuration/gke-private-clusters.md @@ -3,7 +3,7 @@ title: Private Clusters --- - + In GKE, [private clusters](https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept) are clusters whose nodes are isolated from inbound and outbound traffic by assigning them internal IP addresses only. Private clusters in GKE have the option of exposing the control plane endpoint as a publicly accessible address or as a private address. This is different from other Kubernetes providers, which may refer to clusters with private control plane endpoints as "private clusters" but still allow traffic to and from nodes. You may want to create a cluster with private nodes, with or without a public control plane endpoint, depending on your organization's networking and security requirements. A GKE cluster provisioned from Rancher can use isolated nodes by selecting "Private Cluster" in the Cluster Options (under "Show advanced options"). The control plane endpoint can optionally be made private by selecting "Enable Private Endpoint". diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md index 0d03db56bb1..b0047715921 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/rke1-cluster-configuration.md @@ -127,7 +127,7 @@ ACE is available on RKE, RKE2, and K3s clusters that are provisioned or register ::: -ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters.md) on RKE2 and K3s clusters. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. +ACE must be set up [manually](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md#authorized-cluster-endpoint-support-for-rke2-and-k3s-clusters) on RKE2 and K3s clusters. In RKE, ACE is enabled by default in Rancher-launched Kubernetes clusters, using the IP of the node with the `controlplane` role and the default Kubernetes self-signed certificates. For more detail on how an authorized cluster endpoint works and why it is used, refer to the [architecture section.](../../../reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md#4-authorized-cluster-endpoint) diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md index 9ccc2cfe9f0..63fa8df3511 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/sync-clusters.md @@ -3,7 +3,7 @@ title: Syncing --- - + Syncing allows Rancher to update cluster values so that they're up to date with the corresponding cluster object hosted in AKS, EKS or GKE. This enables sources other than Rancher to own a hosted cluster’s state. diff --git a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md index a0e092fee87..3c363d053cf 100644 --- a/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md +++ b/versioned_docs/version-2.7/reference-guides/cluster-configuration/rancher-server-configuration/use-existing-nodes/rancher-agent-options.md @@ -3,7 +3,7 @@ title: Rancher Agent Options --- - + Rancher deploys an agent on each node to communicate with the node. This pages describes the options that can be passed to the agent. To use these options, you will need to [create a cluster with custom nodes](../../../../pages-for-subheaders/use-existing-nodes.md) and add the options to the generated `docker run` command when adding a node. diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/examples.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/examples.md index 7c586657eb2..c65722cfa97 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/examples.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/examples.md @@ -3,7 +3,7 @@ title: Examples --- - + ### ServiceMonitor diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/helm-chart-options.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/helm-chart-options.md index fabd9fc222f..112c41c9ea0 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/helm-chart-options.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/helm-chart-options.md @@ -3,7 +3,7 @@ title: Helm Chart Options --- - + ## Configuring Resource Limits and Requests diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md index eb3a029b45b..dc459f34378 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/receivers.md @@ -3,7 +3,7 @@ title: Receiver Configuration --- - + The [Alertmanager Config](https://prometheus.io/docs/alerting/latest/configuration/#configuration-file) Secret contains the configuration of an Alertmanager instance that sends out notifications based on alerts it receives from Prometheus. diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/routes.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/routes.md index 31424a3815b..3f538d92112 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/routes.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/routes.md @@ -3,7 +3,7 @@ title: Route Configuration --- - + The route configuration is the section of the Alertmanager custom resource that controls how the alerts fired by Prometheus are grouped and filtered before they reach the receiver. diff --git a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md index 780d13c2673..30fccb634c8 100644 --- a/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md +++ b/versioned_docs/version-2.7/reference-guides/monitoring-v2-configuration/servicemonitors-and-podmonitors.md @@ -3,7 +3,7 @@ title: ServiceMonitor and PodMonitor Configuration --- - + ServiceMonitors and PodMonitors are both pseudo-CRDs that map the scrape configuration of the Prometheus custom resource. diff --git a/versioned_docs/version-2.7/reference-guides/prometheus-federator/rbac.md b/versioned_docs/version-2.7/reference-guides/prometheus-federator/rbac.md index 47887415d85..8b54ce9559f 100644 --- a/versioned_docs/version-2.7/reference-guides/prometheus-federator/rbac.md +++ b/versioned_docs/version-2.7/reference-guides/prometheus-federator/rbac.md @@ -2,6 +2,10 @@ title: Role-Based Access Control --- + + + + This section describes the expectations for Role-Based Access Control (RBAC) for Prometheus Federator. As described in the section on [namespaces](../../pages-for-subheaders/prometheus-federator.md#namespaces), Prometheus Federator expects that Project Owners, Project Members, and other users in the cluster with Project-level permissions (e.g. permissions in a certain set of namespaces identified by a single label selector) have minimal permissions in any namespaces except the Project Registration Namespace (which is imported into the project by default) and those that already comprise their projects. Therefore, in order to allow Project Owners to assign specific chart permissions to other users in their Project namespaces, the Helm Project Operator will automatically watch the following bindings: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/architecture-recommendations.md b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/architecture-recommendations.md index d68f5b9320c..1ece990ff8c 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/architecture-recommendations.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/architecture-recommendations.md @@ -2,6 +2,10 @@ title: Architecture Recommendations --- + + + + If you are installing Rancher on a single node, the main architecture recommendation that applies to your installation is that the node running Rancher should be [separate from downstream clusters.](#separation-of-rancher-and-user-clusters) ## Separation of Rancher and User Clusters diff --git a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md index 3a198c8ea94..8abfd0c9f6c 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/communicating-with-downstream-user-clusters.md @@ -2,6 +2,10 @@ title: Communicating with Downstream User Clusters --- + + + + This section describes how Rancher provisions and manages the downstream user clusters that run your apps and services. The below diagram shows how the cluster controllers, cluster agents, and node agents allow Rancher to control downstream clusters. @@ -24,7 +28,7 @@ the pods. Bob is authenticated through Rancher's authentication proxy. The authentication proxy forwards all Kubernetes API calls to downstream clusters. It integrates with authentication services like local authentication, Active Directory, and GitHub. On every Kubernetes API call, the authentication proxy authenticates the caller and sets the proper Kubernetes impersonation headers before forwarding the call to Kubernetes masters. -Rancher communicates with Kubernetes clusters using a [service account,](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) which provides an identity for processes that run in a pod. +Rancher communicates with Kubernetes clusters using a [service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/). Each user account in Rancher correlates with an equivalent service account in the downstream cluster. Rancher uses the service account to [impersonate](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) the user, which provides all the permissions the user is intended to have. By default, Rancher generates a [kubeconfig file](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) that contains credentials for proxying through the Rancher server to connect to the Kubernetes API server on a downstream user cluster. The kubeconfig file (`kube_config_rancher-cluster.yml`) contains full access to the cluster. @@ -75,6 +79,87 @@ With this endpoint enabled for the downstream cluster, Rancher generates an extr You will need to use a context defined in this kubeconfig file to access the cluster if Rancher goes down. Therefore, we recommend exporting the kubeconfig file so that if Rancher goes down, you can still use the credentials in the file to access your cluster. For more information, refer to the section on accessing your cluster with [kubectl and the kubeconfig file.](../../how-to-guides/new-user-guides/manage-clusters/access-clusters/use-kubectl-and-kubeconfig.md) +## Impersonation + +Users technically exist only on the upstream cluster. Rancher creates [RoleBindings and ClusterRoleBindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding) that refer to Rancher users, even though there is [no actual User resource](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#users-in-kubernetes) on the downstream cluster. + +When users interact with a downstream cluster through the authentication proxy, there needs to be some entity downstream to serve as the actor for those requests. Rancher creates service accounts to be that entity. Each service account is only granted one permission, which is to **impersonate** the user they belong to. If there was only one service account that could impersonate any user, then it would be possible for a malicious user to corrupt that account and escalate their privileges by impersonating another user. This issue was the basis for a [CVE](https://github.com/rancher/rancher/security/advisories/GHSA-pvxj-25m6-7vqr). + +### Impersonation Troubleshooting + +On the downstream cluster, five resources handle impersonation: + +- namespace: `cattle-impersonation-system` +- service account: `cattle-impersonation-system/cattle-impersonation-` +- account token secret: `cattle-impersonation-system/cattle-impersonation--token-` +- cluster role: `cattle-impersonation-` +- cluster role binding: `cattle-impersonation-` + +In this example of a typical impersonation cluster role, the system is configured to use `github` as the auth provider: + +```yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: "2021-10-06T18:20:13Z" + labels: + authz.cluster.cattle.io/impersonator: "true" + cattle.io/creator: norman + name: cattle-impersonation-user-abcde + resourceVersion: "3528" + uid: a7478731-72a0-4343-b09f-c3bf12552d77 +rules: +# allowed to impersonate user user-abcde +- apiGroups: + - "" + resourceNames: + - user-abcde + resources: + - users + verbs: + - impersonate +# allowed to impersonate listed groups +- apiGroups: + - "" + resourceNames: + - github_team://123 # group from GitHub auth provider + - system:authenticated # automatic group from Kubernetes + - system:cattle:authenticated # automatic group from Rancher + resources: + - groups + verbs: + - impersonate +# allowed to impersonate principal ID github_user://098 +- apiGroups: + - authentication.k8s.io + resourceNames: + - github_user://098 # principal ID from GitHub auth provider + resources: + - userextras/principalid + verbs: + - impersonate +# allowed to impersonate username example +- apiGroups: + - authentication.k8s.io + resourceNames: + - example # username from GitHub auth provider + resources: + - userextras/username + verbs: + - impersonate +``` + +When you troubleshoot impersonation issues, check whether these resources exist for the user, and whether the rules in the cluster role look similar to the above. For example: + +```bash +kubectl --namespace cattle-impersonation-system get serviceaccount cattle-impersonation- +kubectl --namespace cattle-impersonation-system get secret cattle-impersonation--token- +kubectl get clusterrole cattle-impersonation- --output yaml +kubectl get clusterrolebinding cattle-impersonation- +``` + +If you see an error related to "impersonation" in the UI, pay close attention to the *end* of the error message, which should indicate the real reason that the request failed. + ## Important Files The files mentioned below are needed to maintain, troubleshoot and upgrade your cluster: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/rancher-server-and-components.md b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/rancher-server-and-components.md index bb1cf170e7a..e9fec332622 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/rancher-server-and-components.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-manager-architecture/rancher-server-and-components.md @@ -2,6 +2,10 @@ title: Rancher Server and Components --- + + + + The majority of Rancher 2.x software runs on the Rancher Server. Rancher Server includes all the software components used to manage the entire Rancher deployment. The figure below illustrates the high-level architecture of Rancher 2.x. The figure depicts a Rancher Server installation that manages two downstream Kubernetes clusters: one created by RKE and another created by Amazon EKS (Elastic Kubernetes Service). diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index ddf9809440a..d0ddba7d1e7 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: K3s Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index 8944de04c27..00000000000 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3148 +0,0 @@ ---- -title: K3s Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. - -Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. - -These are the possible results for each control: - -- **Pass** - The K3s cluster passes the audit outlined in the benchmark. -- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. -- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. - -This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /etc/kubernetes/manifests/etcd.yaml - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /etc/kubernetes/manifests/etcd.yaml - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.1.11 -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root controllermanager - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit:** - -```bash -find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/pki/*.key - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep containerd | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 521 1 0 22:09 ? 00:00:00 /usr/bin/containerd root 802 1 0 22:09 ? 00:00:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 3970 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 836d5508918bf22689e12f2885aeb9de5c2420beb956f6dc587d11b049e4edf4 -address /run/k3s/containerd/containerd.sock root 4088 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 6148f976b57db791da86119c599700f683df838df56b1382d428ec38402caa64 -address /run/k3s/containerd/containerd.sock root 4109 1 0 22:13 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id b0e22b39e80606c4ad5d7fdafe21a771a27a5dce8f06155af579a9fad8158219 -address /run/k3s/containerd/containerd.sock root 5321 1 0 22:14 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id f60b96ef6beaf1b7903aba944af101a7d401082969ad8b5aea633bda1043b165 -address /run/k3s/containerd/containerd.sock root 5395 1 0 22:14 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id df001d7d85239f1cfdd8e041db801a6383bc18e5e10d0cd8e8e4e6ca9b7ce036 -address /run/k3s/containerd/containerd.sock root 6366 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id a900df9f736ca35b5dbd603034588a461d706ae6c83529136a81ec13e0ecedc0 -address /run/k3s/containerd/containerd.sock root 7859 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id b3c1510cafad33b31758db1b7c771efe98f0d395d5d52caf90db7bd379966299 -address /run/k3s/containerd/containerd.sock root 7896 1 0 22:15 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id e5720fc8f9e95f2fd8b8e87c93f25213315d78b630fc889b2a5cb8b18f2a1442 -address /run/k3s/containerd/containerd.sock root 9773 9761 4 22:22 ? 00:00:16 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 10275 1 0 22:22 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 8b29d2205c5f7d47d0ecd4f95b7b96062454233e66450f9163058647e7b5c390 -address /run/k3s/containerd/containerd.sock root 11185 1 0 22:23 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9581871a145dd1c0bbff06cddea0030a30de2760e90c5fa9154cccb250f05faa -address /run/k3s/containerd/containerd.sock root 13605 1 0 22:27 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id e05825dc2a33d576c35cc1b56610d3e4459d209524645f95f163c100f6e5df46 -address /run/k3s/containerd/containerd.sock root 13770 1 0 22:27 ? 00:00:00 /var/lib/rancher/k3s/data/4cdfcad9f220e885cbc32cf86c6cb0d26b496e3949efb0aa33fb37692e11d521/bin/containerd-shim-runc-v2 -namespace k8s.io -id 74d10151f05f78b0d38deb2b1ee045bf7b72e7b879e6a15112c8495f98d230b8 -address /run/k3s/containerd/containerd.sock -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, --request-timeout=300s - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.2.29 -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -grep aescbc /path/to/encryption-config.json -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** warn - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.1 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.2 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.3 -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.4 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.5 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.6 -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.7 -``` - -**Expected Result**: - -```console -'trusted-ca-file' is present -``` - -**Returned Value**: - -```console -trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Manual) - - -**Result:** warn - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt -``` - -**Expected Result**: - -```console -'644' is equal to '644' OR '640' is present OR '600' is present OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:02 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:02Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 22:22:03 ip-172-31-25-2 k3s[9761]: time="2023-02-27T22:22:03Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-25-2 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=995abdc2-f967-4bd6-936e-f3c26594573c --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Manual) - - -**Result:** warn - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..1d348069a2a --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3208 @@ +--- +title: K3s Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. + +Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. + +These are the possible results for each control: + +- **Pass** - The K3s cluster passes the audit outlined in the benchmark. +- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. + +This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.1.11 +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit:** + +```bash +find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.crt + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.key + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 539 1 0 Sep11 ? 00:00:09 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 45213 45195 3 Sep11 ? 00:45:14 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 47188 1 0 Sep11 ? 00:01:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 02b8fdd94b7628d575ace92f337dcc93202151d07f33858341cfcb0178fea586 -address /run/k3s/containerd/containerd.sock root 47235 1 0 Sep11 ? 00:00:33 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id eb0f03c4bc1125ae34e5de77c7eaeb9c2c1e46bec0bb106b99281df7353f9ded -address /run/k3s/containerd/containerd.sock root 47948 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5eece7110bd3876414f890ed1b7158eb91f60d1f14450a9f8c77a0fc62b73c4a -address /run/k3s/containerd/containerd.sock root 48047 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4ef831f4bb8830a0a7b46a1e8be58197be00846ea0caa094014ea7ce3adf008e -address /run/k3s/containerd/containerd.sock root 48220 1 0 Sep11 ? 00:00:33 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id f8d5d3791ad2b1a8534476aa2fbdf8da1e4f0b9fdcdd26b1ae161142458a5336 -address /run/k3s/containerd/containerd.sock root 48878 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 41b93a6581e272b0852257b3d7c44ab4cadcdf465a3579a8b29b493ea75feaf7 -address /run/k3s/containerd/containerd.sock root 49870 1 0 Sep11 ? 00:00:30 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id be329cdccda4049f048c759a2b1915cd72526473ff7768e895bcfc153a66c125 -address /run/k3s/containerd/containerd.sock root 50271 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id cceb5d26eba7d7d3c474a2dc842b72495689f4e40055505ea2598e4ac6849d40 -address /run/k3s/containerd/containerd.sock root 50571 1 0 Sep11 ? 00:00:32 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3a26e691e0d0186165d523bef22b0af71f175c39df82845b32ce7b4e3d652d4a -address /run/k3s/containerd/containerd.sock root 96693 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9ed77e6e58410f1295f730ba4a8f8daf7aff8f4e896e24219a8fa710729c2287 -address /run/k3s/containerd/containerd.sock root 97726 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1be4fe50e6bb29d4549f8b03102b5dc15b7669fe56b32beae3f701cf6d2e58cc -address /run/k3s/containerd/containerd.sock root 97923 1 1 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/484bf694b486d93cc93bcf90f74d5c77628550d4456f21760fd720b88c93881e/bin/containerd-shim-runc-v2 -namespace k8s.io -id 7c65c47376f36a8980a5bebad7ffdc1abe1853821cf6c4a1d45f1b6be3452062 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.2.29 +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +grep aescbc /path/to/encryption-config.json +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.1 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.2 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.3 +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.4 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.5 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.6 +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.7 +``` + +**Expected Result**: + +```console +'trusted-ca-file' is present +``` + +**Returned Value**: + +```console +trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Manual) + + +**Result:** warn + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'600' is equal to '600' +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:31:58 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:31:58Z" level=info msg="Running kube-apiserver --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--event-qps' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:32:02 ip-172-31-3-32 k3s[45195]: time="2023-09-11T20:32:02Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-3-32 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=cc5faddd-9c87-4a04-97c2-dcf4cbcbe10f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 410 1 0 Sep11 ? 00:01:50 /usr/bin/containerd root 45213 45195 3 Sep11 ? 00:45:15 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** warn + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..e7373288b35 --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,3215 @@ +--- +title: K3s Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. + +Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. + +These are the possible results for each control: + +- **Pass** - The K3s cluster passes the audit outlined in the benchmark. +- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. +- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. + +This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml +Not Applicable. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml +Not Applicable. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 +Not Applicable. + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root +Not Applicable. + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.1.11 +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd +Not Applicable. + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /var/lib/rancher/k3s/server/tls + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.crt + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/pki/*.key + +**Audit:** + +```bash +stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= +Permissive - When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' is present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... +Permissive - Enabling Pod Security Policy can cause applications to unexpectedly fail. + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log +Permissive. + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 +Permissive. + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 +Permissive. + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 +Permissive. + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s +Permissive. + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 1.2.29 +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= +Permissive - Enabling encryption changes how data can be recovered as data is encrypted. + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. +Permissive - Enabling encryption changes how data can be recovered as data is encrypted. + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true" +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true +Not Applicable. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep containerd | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 663 1 0 Sep11 ? 00:00:08 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 3021 1 0 Sep11 ? 00:00:29 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4790d392966915d995e666002c56ed4cce6dd86f305ce2ee390547a1fcbf6c82 -address /run/k3s/containerd/containerd.sock root 3035 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9d73e6a160ccde6c7c7d4ba0df3b9f696e3de2ebfc0f19a1dcbdf13aea496427 -address /run/k3s/containerd/containerd.sock root 3235 1 0 Sep11 ? 00:00:31 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 587f6221ee9f36c877231ada8d816a799dfda186332c33378d1eb16c72cdc87d -address /run/k3s/containerd/containerd.sock root 4435 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a74c9ec7d99785c2f2d4e6826aa80c22eb8b38249e8f99679ece00a818e9b7b3 -address /run/k3s/containerd/containerd.sock root 4985 1 0 Sep11 ? 00:00:53 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b0c9784dbe0fcbe8be10c857976e70ec84a208cb814e87b5ca085a02d434f8c -address /run/k3s/containerd/containerd.sock root 5056 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id f3231ff35f18056e74eda14907f296be15f7ea1c6ae5ab7904e27d4d18183301 -address /run/k3s/containerd/containerd.sock root 5868 1 0 Sep11 ? 00:00:27 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3e908c4d0b10df275bdef6f72fbcfa09517d11cf749236ad020364e14d77bc93 -address /run/k3s/containerd/containerd.sock root 6158 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id bec5780a5c73fa3154aa3b5ee26cdf23202db821205893e7e66ae17e6103e97b -address /run/k3s/containerd/containerd.sock root 7366 1 0 Sep11 ? 00:00:28 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id a81b78845bdcaef710314c93e5ea0d0617f37a8929472f7b570ab90c6667f57f -address /run/k3s/containerd/containerd.sock root 97274 1 0 16:13 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id c90652c935d9e79af45b9a9ac2b4fe315e2a761a0525737fdb95c680123a164c -address /run/k3s/containerd/containerd.sock root 98309 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 431a2763636488efd7d104c228d41f4f2ecd8c06a7fc375d8977ab0d238936a8 -address /run/k3s/containerd/containerd.sock root 98493 1 0 16:16 ? 00:00:00 /var/lib/rancher/k3s/data/3cdacaf539fc388d8e542a8d643948e3c7bfa4a7e91b7521102325e0ce8581b6/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5b480d2fa55c8cc0105ec1902887040c017f03d5b1eb6c73c24bb9d523ad9b37 -address /run/k3s/containerd/containerd.sock +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.1 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.2 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.3 +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.4 +``` + +**Expected Result**: + +```console +'cert-file' is present AND 'key-file' is present +``` + +**Returned Value**: + +```console +cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.5 +``` + +**Expected Result**: + +```console +'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +client-cert-auth: true +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.6 +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit Script:** `check_for_k3s_etcd.sh` + +```bash +#!/bin/bash + +# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) +# before it checks the requirement +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + + +if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then + case $1 in + "1.1.11") + echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; + "1.2.29") + echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; + "2.1") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.2") + echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.3") + echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.4") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; + "2.5") + echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; + "2.6") + echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; + "2.7") + echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; + esac +else +# If another database is running, return whatever is required to pass the scan + case $1 in + "1.1.11") + echo "700";; + "1.2.29") + echo "--etcd-certfile AND --etcd-keyfile";; + "2.1") + echo "cert-file AND key-file";; + "2.2") + echo "--client-cert-auth=true";; + "2.3") + echo "false";; + "2.4") + echo "peer-cert-file AND peer-key-file";; + "2.5") + echo "--client-cert-auth=true";; + "2.6") + echo "--peer-auto-tls=false";; + "2.7") + echo "--trusted-ca-file";; + esac +fi + +``` + +**Audit Execution:** + +```bash +./check_for_k3s_etcd.sh 2.7 +``` + +**Expected Result**: + +```console +'trusted-ca-file' is present +``` + +**Returned Value**: + +```console +trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Manual) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable. + All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml +Not Applicable. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +Sep 11 20:52:00 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:00Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:15 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:15Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-12-34 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=af02ecbc-1e4e-422e-8b4d-4b2aa24a9d46 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +Sep 11 20:52:15 ip-172-31-12-34 k3s[2340]: time="2023-09-11T20:52:15Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-12-34 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=af02ecbc-1e4e-422e-8b4d-4b2aa24a9d46 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is present OR '--event-qps' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** Not Applicable + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Permissive - When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/kubelet/config.yaml +``` + +**Expected Result**: + +```console +'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC containerd +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--pod-max-pids' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 527 1 0 Sep11 ? 00:01:28 /usr/bin/containerd root 2361 2340 3 Sep11 ? 00:40:19 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md deleted file mode 100644 index 16614a7e520..00000000000 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ /dev/null @@ -1,3148 +0,0 @@ ---- -title: K3s Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 ---- - -This document is a companion to the [K3s Hardening Guide](../../../../pages-for-subheaders/k3s-hardening-guide.md), which provides prescriptive guidance on how to harden K3s clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide. - -Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing. - -These are the possible results for each control: - -- **Pass** - The K3s cluster passes the audit outlined in the benchmark. -- **Not Applicable** - The control is not applicable to K3s because of how it is designed to operate. The remediation section explains why. -- **Warn** - The control is manual in the CIS benchmark and it depends on the cluster's use-case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s doesn't prevent their implementation, but no further configuration or auditing of the cluster has been performed. - -This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary. Adjust the "audit" commands to fit your scenario. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /etc/kubernetes/manifests/etcd.yaml - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /etc/kubernetes/manifests/etcd.yaml - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.1.11 -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root controllermanager - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit:** - -```bash -find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** warn - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/pki/*.key - -**Audit:** - -```bash -stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth' -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep containerd | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 519 1 0 22:09 ? 00:00:00 /usr/bin/containerd root 801 1 0 22:09 ? 00:00:00 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock root 3864 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id d00174abbc275f6bb85c7f0be1d3154b9c91982a10b9dba6b5cb280f4d4c531d -address /run/k3s/containerd/containerd.sock root 4105 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 7c2b546b4d2380bcb51278661f34cff94fad2ba06978e13f8f1b92dafcc89d43 -address /run/k3s/containerd/containerd.sock root 4206 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 68d8a55ff4663985be004608dbf78b0362f5522e18490c81d4c8dc9963de1556 -address /run/k3s/containerd/containerd.sock root 5374 1 0 22:31 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id ca0ae9e0b37dfd7b1ce05f72e1bc5a1be8f5cb08f2b4543081536de3bdbc925d -address /run/k3s/containerd/containerd.sock root 5443 1 0 22:31 ? 00:00:01 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 3ea3c1cdbbd5adb8efd5c67a46aadd0fca9918dc0ad1f7cafe38b83171e3dc1b -address /run/k3s/containerd/containerd.sock root 7130 1 0 22:32 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4d838297d35a31003106ac5989c3547433985bb2964b47baad12cee6e375645e -address /run/k3s/containerd/containerd.sock root 7639 1 0 22:32 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 341cb9bcd8486aa2f1acb8e1ae51baebd630ac6ed266643266c34d677f61c7d0 -address /run/k3s/containerd/containerd.sock root 10308 1 0 23:17 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id c534fbee8e0d06fd9b29bf8fc70a138975c6b18db25f1faf2615677dfdb4199e -address /run/k3s/containerd/containerd.sock root 11370 1 0 23:18 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4ff4b8776dac7a35b83616d341dbe4d5a689ac7fb9b8eee8db5978e3968380ea -address /run/k3s/containerd/containerd.sock root 13736 13723 2 23:21 ? 00:00:10 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 16022 1 0 23:29 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 9027256349086e458119478e5e00384b1b76fbf5e6dbee23699f596a88d9f2bc -address /run/k3s/containerd/containerd.sock root 16159 1 0 23:29 ? 00:00:00 /var/lib/rancher/k3s/data/630c40ff866a3db218a952ebd4fd2a5cfe1543a1a467e738cb46a2ad4012d6f1/bin/containerd-shim-runc-v2 -namespace k8s.io -id 929bf369fc5881654f4c1925624151ddb7cea51073267b8d213d966ba45406f3 -address /run/k3s/containerd/containerd.sock -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority' -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode' -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount' -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins' -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port' -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path' -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage' -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup' -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize' -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameter as appropriate and if needed. -For example, --request-timeout=300s - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'request-timeout' -``` - -**Expected Result**: - -```console -'--request-timeout' is not present OR '--request-timeout' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-lookup' -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file' -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 1.2.29 -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile' -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config' -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -grep aescbc /path/to/encryption-config.json -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** warn - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold' -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling' -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials' -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file' -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file' -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true" -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address' -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259" -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.1 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.2 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.3 -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.4 -``` - -**Expected Result**: - -```console -'cert-file' is present AND 'key-file' is present -``` - -**Returned Value**: - -```console -cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.5 -``` - -**Expected Result**: - -```console -'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -client-cert-auth: true -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.6 -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Manual) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit Script:** `check_for_k3s_etcd.sh` - -```bash -#!/bin/bash - -# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3) -# before it checks the requirement -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - - -if [[ "$(journalctl -D /var/log/journal -u k3s | grep 'Managed etcd cluster initializing' | grep -v grep | wc -l)" -gt 0 ]]; then - case $1 in - "1.1.11") - echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);; - "1.2.29") - echo $(journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-');; - "2.1") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.2") - echo $(grep -A 5 'client-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.3") - echo $(grep 'auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.4") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep -E 'cert-file|key-file');; - "2.5") - echo $(grep -A 5 'peer-transport-security' /var/lib/rancher/k3s/server/db/etcd/config | grep 'client-cert-auth');; - "2.6") - echo $(grep 'peer-auto-tls' /var/lib/rancher/k3s/server/db/etcd/config);; - "2.7") - echo $(grep 'trusted-ca-file' /var/lib/rancher/k3s/server/db/etcd/config);; - esac -else -# If another database is running, return whatever is required to pass the scan - case $1 in - "1.1.11") - echo "700";; - "1.2.29") - echo "--etcd-certfile AND --etcd-keyfile";; - "2.1") - echo "cert-file AND key-file";; - "2.2") - echo "--client-cert-auth=true";; - "2.3") - echo "false";; - "2.4") - echo "peer-cert-file AND peer-key-file";; - "2.5") - echo "--client-cert-auth=true";; - "2.6") - echo "--peer-auto-tls=false";; - "2.7") - echo "--trusted-ca-file";; - esac -fi - -``` - -**Audit Execution:** - -```bash -./check_for_k3s_etcd.sh 2.7 -``` - -**Expected Result**: - -```console -'trusted-ca-file' is present -``` - -**Returned Value**: - -```console -trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Manual) - - -**Result:** warn - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file' -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt -``` - -**Expected Result**: - -```console -'644' is equal to '644' OR '640' is present OR '600' is present OR '444' is present OR '440' is present OR '400' is present OR '000' is present -``` - -**Returned Value**: - -```console -644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/sh -c 'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:42 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:42Z" level=info msg="Running kube-apiserver --admission-control-config-file=/etc/rancher/k3s/config/rancher-psact.yaml --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,ServiceAccount --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --request-timeout=300s --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-lookup=true --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout' -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'protect-kernel-defaults' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'make-iptables-util-chains' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -Feb 27 23:21:44 ip-172-31-31-124 k3s[13723]: time="2023-02-27T23:21:44Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-124 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-labels=cattle.io/os=linux,rke.cattle.io/machine=5c42d922-ed1e-4e15-8414-d399d179d897 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC containerd -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Manual) - - -**Result:** warn - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 34bb63f89f0..9c6d1369a90 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index 25108b848b5..00000000000 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3084 +0,0 @@ ---- -title: RKE Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=600 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit Script:** `check_files_owner_in_dir.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/!(*key).pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit Script:** `check_encryption_provider_config.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` - -**Audit Execution:** - -```bash -./check_encryption_provider_config.sh aescbc -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -- aescbc: true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5056 5035 2 18:52 ? 00:00:05 kube-controller-manager --cloud-provider= --terminated-pod-gc-threshold=1000 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --node-monitor-grace-period=40s --allow-untagged-cloud=true --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --configure-cloud-routes=false --leader-elect=true --profiling=false --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --pod-eviction-timeout=5m0s --v=2 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --enable-hostpath-provisioner=false --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5209 5190 0 18:53 ? 00:00:01 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5209 5190 0 18:53 ? 00:00:01 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 4 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-26-105 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem ETCDCTL_ENDPOINTS=https://172.31.26.105:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/root -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 3 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-26-105 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem ETCDCTL_ENDPOINTS=https://172.31.26.105:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/root -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -root 4720 4700 3 18:52 ? 00:00:08 /usr/local/bin/etcd --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --advertise-client-urls=https://172.31.26.105:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --listen-peer-urls=https://172.31.26.105:2380 --initial-cluster=etcd-ip-172-31-26-105=https://172.31.26.105:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-26-105-key.pem --heartbeat-interval=500 --data-dir=/var/lib/rancher/etcd/ --listen-client-urls=https://172.31.26.105:2379 --name=etcd-ip-172-31-26-105 --initial-cluster-state=new --client-cert-auth=true --election-timeout=5000 --initial-advertise-peer-urls=https://172.31.26.105:2380 root 4882 4861 15 18:52 ? 00:00:42 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false root 18033 17938 2 18:57 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 4882 4861 15 18:52 ? 00:00:43 kube-apiserver --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --api-audiences=unknown --audit-log-maxsize=100 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-servers=https://172.31.26.105:2379 --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --anonymous-auth=false --secure-port=6443 --runtime-config=policy/v1beta1/podsecuritypolicy=true --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --service-node-port-range=30000-32767 --service-account-issuer=rke --service-account-lookup=true --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --authentication-token-webhook-cache-ttl=5s --advertise-address=172.31.26.105 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-maxbackup=10 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --requestheader-username-headers=X-Remote-User --requestheader-group-headers=X-Remote-Group --authorization-mode=Node,RBAC --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --cloud-provider= --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --bind-address=0.0.0.0 --audit-log-maxage=30 --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allow-privileged=true --profiling=false -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--event-qps' is equal to '0' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 5796 5377 2 18:53 ? 00:00:06 kubelet --anonymous-auth=false --cloud-provider= --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --root-dir=/var/lib/kubelet --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --fail-swap-on=false --hostname-override=ip-172-31-26-105 --authentication-token-webhook=true --cgroups-per-qos=True --cluster-dns=10.43.0.10 --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --address=0.0.0.0 --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-26-105.pem --streaming-connection-idle-timeout=30m --v=2 --protect-kernel-defaults=true --container-runtime=remote --event-qps=0 --feature-gates=RotateKubeletServerCertificate=true --authorization-mode=Webhook --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --cluster-domain=cluster.local --pod-infra-container-image=rancher/mirrored-pause:3.6 --read-only-port=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --node-ip=172.31.26.105 --resolv-conf=/etc/resolv.conf --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Automated) - - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** `check_for_default_ns.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` - -**Audit Execution:** - -```bash -./check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): replicationcontrollers is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicationcontrollers" in API group "" in the namespace "default" Error from server (Forbidden): services is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "services" in API group "" in the namespace "default" Error from server (Forbidden): daemonsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "daemonsets" in API group "apps" in the namespace "default" Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "deployments" in API group "apps" in the namespace "default" Error from server (Forbidden): replicasets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicasets" in API group "apps" in the namespace "default" Error from server (Forbidden): statefulsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "statefulsets" in API group "apps" in the namespace "default" Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "default" Error from server (Forbidden): cronjobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "cronjobs" in API group "batch" in the namespace "default" Error from server (Forbidden): jobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "jobs" in API group "batch" in the namespace "default" true -``` - diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..5f3c20fb37f --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3047 @@ +--- +title: RKE Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the master node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=644 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /etc/kubernetes/ssl/*key.pem + +**Audit Script:** `check_files_permissions.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the file permissions are set to 644 or +# more restrictive for all files in a given directory or a wildcard +# selection of files +# +# inputs: +# $1 = /full/path/to/directory or /path/to/fileswithpattern +# ex: !(*key).pem +# +# $2 (optional) = permission (ex: 600) +# +# outputs: +# true/false + +# Turn on "extended glob" for use of '!' in wildcard +shopt -s extglob + +# Turn off history to avoid surprises when using '!' +set -H + +USER_INPUT=$1 + +if [[ "${USER_INPUT}" == "" ]]; then + echo "false" + exit +fi + + +if [[ -d ${USER_INPUT} ]]; then + PATTERN="${USER_INPUT}/*" +else + PATTERN="${USER_INPUT}" +fi + +PERMISSION="" +if [[ "$2" != "" ]]; then + PERMISSION=$2 +fi + +FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) + +while read -r fileInfo; do + p=$(echo ${fileInfo} | cut -d' ' -f2) + + if [[ "${PERMISSION}" != "" ]]; then + if [[ "$p" != "${PERMISSION}" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then + echo "false" + exit + fi + fi +done <<< "${FILES_PERMISSIONS}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit Script:** `check_encryption_provider_config.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to check the encrption provider config is set to aesbc +# +# outputs: +# true/false + +# TODO: Figure out the file location from the kube-apiserver commandline args +ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" + +if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then + echo "false" + exit +fi + +for provider in "$@" +do + if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then + echo "true" + exit + fi +done + +echo "false" +exit + +``` + +**Audit Execution:** + +```bash +./check_encryption_provider_config.sh aescbc +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +- aescbc: true +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 3690 3671 1 Sep11 ? 00:20:42 kube-controller-manager --service-cluster-ip-range=10.43.0.0/16 --configure-cloud-routes=false --enable-hostpath-provisioner=false --terminated-pod-gc-threshold=1000 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --v=2 --pod-eviction-timeout=5m0s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --cluster-cidr=10.42.0.0/16 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --allocate-node-cidrs=true --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --feature-gates=RotateKubeletServerCertificate=true --leader-elect=true --profiling=false --node-monitor-grace-period=40s --allow-untagged-cloud=true --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 3859 3838 0 Sep11 ? 00:03:44 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 3859 3838 0 Sep11 ? 00:03:44 kube-scheduler --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:08 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 5 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:08 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 4 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-7-100 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-7-100 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 3369 3348 2 Sep11 ? 00:26:05 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-cluster-token=etcd-cluster-1 --initial-cluster=etcd-ip-172-31-7-100=https://172.31.7.100:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --client-cert-auth=true --election-timeout=5000 --name=etcd-ip-172-31-7-100 --listen-client-urls=https://0.0.0.0:2379 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-state=new --advertise-client-urls=https://172.31.7.100:2379 --heartbeat-interval=500 --initial-advertise-peer-urls=https://172.31.7.100:2380 --listen-peer-urls=https://0.0.0.0:2380 --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-7-100-key.pem --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 root 3528 3509 7 Sep11 ? 01:24:09 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s root 1057543 1057522 2 16:15 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.24-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 3528 3509 7 Sep11 ? 01:24:10 kube-apiserver --service-cluster-ip-range=10.43.0.0/16 --anonymous-auth=false --profiling=false --advertise-address=172.31.7.100 --audit-log-maxsize=100 --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --etcd-prefix=/registry --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-username-headers=X-Remote-User --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --audit-policy-file=/etc/kubernetes/audit-policy.yaml --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --storage-backend=etcd3 --service-node-port-range=30000-32767 --bind-address=0.0.0.0 --api-audiences=unknown --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --runtime-config=policy/v1beta1/podsecuritypolicy=true --allow-privileged=true --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,PodSecurityPolicy,EventRateLimit --service-account-issuer=rke --requestheader-allowed-names=kube-apiserver-proxy-client --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-format=json --authorization-mode=Node,RBAC --etcd-servers=https://172.31.7.100:2379 --service-account-lookup=true --secure-port=6443 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --audit-log-maxage=30 --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --audit-log-maxbackup=10 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --authentication-token-webhook-cache-ttl=5s +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml + +Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is equal to '0' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4429 4031 3 Sep11 ? 00:38:25 kubelet --read-only-port=0 --event-qps=0 --root-dir=/var/lib/kubelet --pod-infra-container-image=rancher/mirrored-pause:3.7 --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100-key.pem --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --cloud-provider= --address=0.0.0.0 --protect-kernel-defaults=true --hostname-override=ip-172-31-7-100 --resolv-conf=/etc/resolv.conf --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-7-100.pem --make-iptables-util-chains=true --feature-gates=RotateKubeletServerCertificate=true --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --container-runtime=remote --v=2 --anonymous-auth=false --authentication-token-webhook=true --fail-swap-on=false --cgroups-per-qos=True --authorization-mode=Webhook --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): roles.rbac.authorization.k8s.io "default-psp-role" is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot get resource "roles" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=1 +``` + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do + policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') + if [[ ${policy_count} -eq 0 ]]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Automated) + + +**Result:** pass + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + +**Audit Script:** `check_for_default_ns.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) +if [[ ${count} -gt 0 ]]; then + echo "false" + exit +fi + +echo "true" + + +``` + +**Audit Execution:** + +```bash +./check_for_default_ns.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..9fe9ca2045f --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,2863 @@ +--- +title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /etc/kubernetes/manifests/etcd.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /etc/kubernetes/manifests/etcd.yaml +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. +All configuration is passed in as arguments at container run time. + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +'permissions' is present +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -ef | grep kubelet | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c %a /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'700' is equal to '700' +``` + +**Returned Value**: + +```console +700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +**Audit:** + +```bash +stat -c %U:%G /node/var/lib/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf +Not Applicable - Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf +Not Applicable - Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. +All configuration is passed in as arguments at container run time. + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root controllermanager +Not Applicable - Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. +All configuration is passed in as arguments at container run time. + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit Script:** `check_files_owner_in_dir.sh` + +```bash +#!/usr/bin/env bash + +# This script is used to ensure the owner is set to root:root for +# the given directory and all the files in it +# +# inputs: +# $1 = /full/path/to/directory +# +# outputs: +# true/false + +INPUT_DIR=$1 + +if [[ "${INPUT_DIR}" == "" ]]; then + echo "false" + exit +fi + +if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then + echo "false" + exit +fi + +statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) +while read -r statInfoLine; do + f=$(echo ${statInfoLine} | cut -d' ' -f1) + p=$(echo ${statInfoLine} | cut -d' ' -f2) + + if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then + if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then + echo "false" + exit + fi + else + if [[ "$p" != "root:root" ]]; then + echo "false" + exit + fi + fi +done <<< "${statInfoLines}" + + +echo "true" +exit + +``` + +**Audit Execution:** + +```bash +./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*.pem' ! -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=644 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +find /node/etc/kubernetes/ssl/ -name '*key.pem' -exec chmod -R 600 {} + + +**Audit:** + +```bash +find /node/etc/kubernetes/ssl/ -name '*key.pem' | xargs stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= +When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers. + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi +``` + +**Expected Result**: + +```console +'provider' is present +``` + +### 1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true +Cluster provisioned by RKE handles certificate rotation directly through RKE. + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 4184 4163 1 Sep11 ? 00:20:06 kube-controller-manager --configure-cloud-routes=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --service-cluster-ip-range=10.43.0.0/16 --cluster-cidr=10.42.0.0/16 --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --node-monitor-grace-period=40s --v=2 --profiling=false --cloud-provider= --allow-untagged-cloud=true --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 4339 4318 0 Sep11 ? 00:03:28 kube-scheduler --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --profiling=false --v=2 --leader-elect=true +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is present OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 4339 4318 0 Sep11 ? 00:03:28 kube-scheduler --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --profiling=false --v=2 --leader-elect=true +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--cert-file' is present AND '--key-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 2 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-4-224 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-cert-file' is present AND '--peer-key-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 2 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--peer-client-cert-auth' is equal to 'true' +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-4-224 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem ETCDCTL_ENDPOINTS=https://127.0.0.1:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'--trusted-ca-file' is present +``` + +**Returned Value**: + +```console +etcd 3847 3824 2 Sep11 ? 00:29:36 /usr/local/bin/etcd --peer-client-cert-auth=true --initial-advertise-peer-urls=https://172.31.4.224:2380 --initial-cluster=etcd-ip-172-31-4-224=https://172.31.4.224:2380 --initial-cluster-state=new --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --client-cert-auth=true --heartbeat-interval=500 --listen-client-urls=https://0.0.0.0:2379 --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --listen-peer-urls=https://0.0.0.0:2380 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-4-224-key.pem --data-dir=/var/lib/rancher/etcd/ --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-4-224 --advertise-client-urls=https://172.31.4.224:2379 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --election-timeout=5000 root 4018 3998 5 Sep11 ? 01:03:21 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml root 1034677 1034607 1 16:16 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.7-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 4018 3998 5 Sep11 ? 01:03:22 kube-apiserver --advertise-address=172.31.4.224 --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxbackup=10 --requestheader-allowed-names=kube-apiserver-proxy-client --service-cluster-ip-range=10.43.0.0/16 --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --requestheader-extra-headers-prefix=X-Remote-Extra- --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --storage-backend=etcd3 --anonymous-auth=false --bind-address=0.0.0.0 --cloud-provider= --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem --service-node-port-range=30000-32767 --profiling=false --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --runtime-config=authorization.k8s.io/v1beta1=true --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --service-account-lookup=true --etcd-servers=https://172.31.4.224:2379 --api-audiences=unknown --requestheader-group-headers=X-Remote-Group --service-account-issuer=rke --audit-log-maxsize=100 --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --secure-port=6443 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --authorization-mode=Node,RBAC --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit-log-maxage=30 --audit-log-format=json --etcd-prefix=/registry --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --authentication-token-webhook-cache-ttl=5s --admission-control-config-file=/etc/kubernetes/admission.yaml --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --requestheader-username-headers=X-Remote-User --allow-privileged=true --audit-policy-file=/etc/kubernetes/audit-policy.yaml +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. +All configuration is passed in as arguments at container run time. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. + All configuration is passed in as arguments at container run time. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit:** + +```bash +stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit:** + +```bash +stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/kubelet/config.yaml +Not Applicable - Clusters provisioned by RKE do not require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/kubelet/config.yaml +Not Applicable - Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. +All configuration is passed in as arguments at container run time. + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable - Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--event-qps' is greater or equal to 0 OR '--event-qps' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--rotate-certificates' is present OR '--rotate-certificates' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable - Clusters provisioned by RKE handles certificate rotation directly through RKE. + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' +``` + +**Expected Result**: + +```console +'--pod-max-pids' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 4903 4499 3 Sep11 ? 00:36:52 kubelet --v=2 --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224-key.pem --event-qps=0 --address=0.0.0.0 --cgroups-per-qos=True --pod-infra-container-image=rancher/mirrored-pause:3.7 --root-dir=/var/lib/kubelet --container-runtime=remote --make-iptables-util-chains=true --authorization-mode=Webhook --resolv-conf=/etc/resolv.conf --cloud-provider= --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --authentication-token-webhook=true --anonymous-auth=false --read-only-port=0 --volume-plugin-dir=/var/lib/kubelet/volumeplugins --protect-kernel-defaults=true --feature-gates=RotateKubeletServerCertificate=true --cluster-dns=10.43.0.10 --fail-swap-on=false --hostname-override=ip-172-31-4-224 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --cluster-domain=cluster.local --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-4-224.pem --streaming-connection-idle-timeout=30m --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md deleted file mode 100644 index 084568cc402..00000000000 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ /dev/null @@ -1,3085 +0,0 @@ ---- -title: RKE Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 ---- - -This document is a companion to the [RKE Hardening Guide](../../../../pages-for-subheaders/rke1-hardening-guide.md), which provides prescriptive guidance on how to harden RKE clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Control Plane Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. -All configuration is passed in as arguments at container run time. - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. -All configuration is passed in as arguments at container run time. - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=600 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c %a /node/var/lib/etcd -``` - -**Expected Result**: - -```console -'700' is equal to '700' -``` - -**Returned Value**: - -```console -700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** Not Applicable - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes. - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. -All configuration is passed in as arguments at container run time. - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. -All configuration is passed in as arguments at container run time. - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chown -R root:root /etc/kubernetes/pki/ - -**Audit Script:** `check_files_owner_in_dir.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the owner is set to root:root for -# the given directory and all the files in it -# -# inputs: -# $1 = /full/path/to/directory -# -# outputs: -# true/false - -INPUT_DIR=$1 - -if [[ "${INPUT_DIR}" == "" ]]; then - echo "false" - exit -fi - -if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then - echo "false" - exit -fi - -statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) -while read -r statInfoLine; do - f=$(echo ${statInfoLine} | cut -d' ' -f1) - p=$(echo ${statInfoLine} | cut -d' ' -f2) - - if [[ $(basename "$f" .pem) == "kube-etcd-"* ]]; then - if [[ "$p" != "root:root" && "$p" != "etcd:etcd" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "root:root" ]]; then - echo "false" - exit - fi - fi -done <<< "${statInfoLines}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_owner_in_dir.sh /node/etc/kubernetes/ssl -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the master node. -For example, -chmod -R 644 /etc/kubernetes/pki/*.crt - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/!(*key).pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /etc/kubernetes/ssl/*key.pem - -**Audit Script:** `check_files_permissions.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to ensure the file permissions are set to 644 or -# more restrictive for all files in a given directory or a wildcard -# selection of files -# -# inputs: -# $1 = /full/path/to/directory or /path/to/fileswithpattern -# ex: !(*key).pem -# -# $2 (optional) = permission (ex: 600) -# -# outputs: -# true/false - -# Turn on "extended glob" for use of '!' in wildcard -shopt -s extglob - -# Turn off history to avoid surprises when using '!' -set -H - -USER_INPUT=$1 - -if [[ "${USER_INPUT}" == "" ]]; then - echo "false" - exit -fi - - -if [[ -d ${USER_INPUT} ]]; then - PATTERN="${USER_INPUT}/*" -else - PATTERN="${USER_INPUT}" -fi - -PERMISSION="" -if [[ "$2" != "" ]]; then - PERMISSION=$2 -fi - -FILES_PERMISSIONS=$(stat -c %n\ %a ${PATTERN}) - -while read -r fileInfo; do - p=$(echo ${fileInfo} | cut -d' ' -f2) - - if [[ "${PERMISSION}" != "" ]]; then - if [[ "$p" != "${PERMISSION}" ]]; then - echo "false" - exit - fi - else - if [[ "$p" != "644" && "$p" != "640" && "$p" != "600" ]]; then - echo "false" - exit - fi - fi -done <<< "${FILES_PERMISSIONS}" - - -echo "true" -exit - -``` - -**Audit Execution:** - -```bash -./check_files_permissions.sh '/node/etc/kubernetes/ssl/*key.pem' -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -true -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is equal to 'true' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 1.2.31 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit Script:** `check_encryption_provider_config.sh` - -```bash -#!/usr/bin/env bash - -# This script is used to check the encrption provider config is set to aesbc -# -# outputs: -# true/false - -# TODO: Figure out the file location from the kube-apiserver commandline args -ENCRYPTION_CONFIG_FILE="/node/etc/kubernetes/ssl/encryption.yaml" - -if [[ ! -f "${ENCRYPTION_CONFIG_FILE}" ]]; then - echo "false" - exit -fi - -for provider in "$@" -do - if grep "$provider" "${ENCRYPTION_CONFIG_FILE}"; then - echo "true" - exit - fi -done - -echo "false" -exit - -``` - -**Audit Execution:** - -```bash -./check_encryption_provider_config.sh aescbc -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -- aescbc: true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -Cluster provisioned by RKE handles certificate rotation directly through RKE. - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5506 5484 2 22:01 ? 00:00:05 kube-controller-manager --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --pod-eviction-timeout=5m0s --terminated-pod-gc-threshold=1000 --v=2 --allocate-node-cidrs=true --enable-hostpath-provisioner=false --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --root-ca-file=/etc/kubernetes/ssl/kube-ca.pem --service-account-private-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --allow-untagged-cloud=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --cluster-cidr=10.42.0.0/16 --node-monitor-grace-period=40s --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-controller-manager.yaml --cloud-provider= --service-cluster-ip-range=10.43.0.0/16 --profiling=false --configure-cloud-routes=false --leader-elect=true --feature-gates=RotateKubeletServerCertificate=true --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 5671 5649 0 22:01 ? 00:00:01 kube-scheduler --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is present OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 5671 5649 0 22:01 ? 00:00:01 kube-scheduler --authorization-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml --leader-elect=true --profiling=false --v=2 --authentication-kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-scheduler.yaml -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--cert-file' is present AND '--key-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 5 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 4 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-51 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem ETCDCTL_ENDPOINTS=https://172.31.31.51:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-cert-file' is present AND '--peer-key-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 2 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--peer-client-cert-auth' is equal to 'true' -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 3 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-51 ETCDCTL_API=3 ETCDCTL_CACERT=/etc/kubernetes/ssl/kube-ca.pem ETCDCTL_CERT=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem ETCDCTL_KEY=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem ETCDCTL_ENDPOINTS=https://172.31.31.51:2379 ETCD_UNSUPPORTED_ARCH=x86_64 HOME=/ -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'--trusted-ca-file' is present -``` - -**Returned Value**: - -```console -etcd 5188 5167 3 22:01 ? 00:00:08 /usr/local/bin/etcd --client-cert-auth=true --data-dir=/var/lib/rancher/etcd/ --initial-advertise-peer-urls=https://172.31.31.51:2380 --listen-peer-urls=https://172.31.31.51:2380 --initial-cluster=etcd-ip-172-31-31-51=https://172.31.31.51:2380 --initial-cluster-state=new --peer-trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --peer-cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --peer-client-cert-auth=true --listen-client-urls=https://172.31.31.51:2379 --cert-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51.pem --advertise-client-urls=https://172.31.31.51:2379 --initial-cluster-token=etcd-cluster-1 --name=etcd-ip-172-31-31-51 --trusted-ca-file=/etc/kubernetes/ssl/kube-ca.pem --key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --peer-key-file=/etc/kubernetes/ssl/kube-etcd-172-31-31-51-key.pem --election-timeout=5000 --cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 --heartbeat-interval=500 root 5354 5332 14 22:01 ? 00:00:33 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem root 19036 18926 2 22:05 ? 00:00:00 kube-bench run --targets etcd --scored --nosummary --noremediations --v=0 --config-dir=/etc/kube-bench/cfg --benchmark rke-cis-1.23-hardened --json --log_dir /tmp/sonobuoy/logs --outputfile /tmp/sonobuoy/etcd.json -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-policy-file' is present -``` - -**Returned Value**: - -```console -root 5354 5332 14 22:01 ? 00:00:34 kube-apiserver --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,NodeRestriction,Priority,TaintNodesByCondition,PersistentVolumeClaimResize,EventRateLimit --runtime-config=authorization.k8s.io/v1beta1=true --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxsize=100 --etcd-certfile=/etc/kubernetes/ssl/kube-node.pem --requestheader-group-headers=X-Remote-Group --storage-backend=etcd3 --proxy-client-cert-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client.pem --authentication-token-webhook-cache-ttl=5s --etcd-prefix=/registry --service-node-port-range=30000-32767 --tls-private-key-file=/etc/kubernetes/ssl/kube-apiserver-key.pem --authentication-token-webhook-config-file=/etc/kubernetes/kube-api-authn-webhook.yaml --profiling=false --audit-log-format=json --admission-control-config-file=/etc/kubernetes/admission.yaml --etcd-cafile=/etc/kubernetes/ssl/kube-ca.pem --encryption-provider-config=/etc/kubernetes/ssl/encryption.yaml --allow-privileged=true --requestheader-username-headers=X-Remote-User --anonymous-auth=false --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --api-audiences=unknown --etcd-servers=https://172.31.31.51:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/kube-apiserver.pem --advertise-address=172.31.31.51 --audit-log-maxage=30 --tls-cert-file=/etc/kubernetes/ssl/kube-apiserver.pem --kubelet-certificate-authority=/etc/kubernetes/ssl/kube-ca.pem --requestheader-extra-headers-prefix=X-Remote-Extra- --bind-address=0.0.0.0 --service-account-lookup=true --authorization-mode=Node,RBAC --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --kubelet-client-key=/etc/kubernetes/ssl/kube-apiserver-key.pem --requestheader-allowed-names=kube-apiserver-proxy-client --service-account-issuer=rke --service-account-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --secure-port=6443 --audit-log-maxbackup=10 --audit-policy-file=/etc/kubernetes/audit-policy.yaml --cloud-provider= --etcd-keyfile=/etc/kubernetes/ssl/kube-node-key.pem --service-cluster-ip-range=10.43.0.0/16 --service-account-signing-key-file=/etc/kubernetes/ssl/kube-service-account-token-key.pem --proxy-client-key-file=/etc/kubernetes/ssl/kube-apiserver-proxy-client-key.pem --requestheader-client-ca-file=/etc/kubernetes/ssl/kube-apiserver-requestheader-ca.pem -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. -All configuration is passed in as arguments at container run time. - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; then stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml' is not present -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c permissions=%a /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; then stat -c %U:%G /node/etc/kubernetes/ssl/kubecfg-kube-node.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit:** - -```bash -stat -c permissions=%a /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit:** - -```bash -stat -c %U:%G /node/etc/kubernetes/ssl/kube-ca.pem -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /var/lib/kubelet/config.yaml - -Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. -All configuration is passed in as arguments at container run time. - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--event-qps' is equal to '0' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -Clusters provisioned by RKE handles certificate rotation directly through RKE. - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then /bin/cat /var/lib/kubelet/config.yaml; fi' -``` - -**Expected Result**: - -```console -'--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 6239 5834 2 22:02 ? 00:00:04 kubelet --authorization-mode=Webhook --v=2 --root-dir=/var/lib/kubelet --container-runtime-endpoint=unix:///var/run/cri-dockerd.sock --tls-private-key-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51-key.pem --cgroups-per-qos=True --streaming-connection-idle-timeout=30m --tls-cert-file=/etc/kubernetes/ssl/kube-kubelet-172-31-31-51.pem --kubeconfig=/etc/kubernetes/ssl/kubecfg-kube-node.yaml --address=0.0.0.0 --cluster-domain=cluster.local --fail-swap-on=false --make-iptables-util-chains=true --volume-plugin-dir=/var/lib/kubelet/volumeplugins --client-ca-file=/etc/kubernetes/ssl/kube-ca.pem --pod-infra-container-image=rancher/mirrored-pause:3.6 --node-ip=172.31.31.51 --resolv-conf=/etc/resolv.conf --event-qps=0 --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 --protect-kernel-defaults=true --cluster-dns=10.43.0.10 --container-runtime=remote --authentication-token-webhook=true --anonymous-auth=false --feature-gates=RotateKubeletServerCertificate=true --cloud-provider= --read-only-port=0 --hostname-override=ip-172-31-31-51 --cgroup-driver=cgroupfs --resolv-conf=/run/systemd/resolve/resolv.conf -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "ingress-nginx" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** fail - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console -error: the server doesn't have a resource type "psp" --count=0 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** warn - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) - - -**Result:** warn - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in $(kubectl get namespaces --all-namespaces -o json | jq -r '.items[].metadata.name'); do - policy_count=$(kubectl get networkpolicy -n ${namespace} -o json | jq '.items | length') - if [[ ${policy_count} -eq 0 ]]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Automated) - - -**Result:** pass - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. - -**Audit Script:** `check_for_default_ns.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count=$(kubectl get all -n default -o json | jq .items[] | jq -r 'select((.metadata.name!="kubernetes"))' | jq .metadata.name | wc -l) -if [[ ${count} -gt 0 ]]; then - echo "false" - exit -fi - -echo "true" - - -``` - -**Audit Execution:** - -```bash -./check_for_default_ns.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): replicationcontrollers is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicationcontrollers" in API group "" in the namespace "default" Error from server (Forbidden): services is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "services" in API group "" in the namespace "default" Error from server (Forbidden): daemonsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "daemonsets" in API group "apps" in the namespace "default" Error from server (Forbidden): deployments.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "deployments" in API group "apps" in the namespace "default" Error from server (Forbidden): replicasets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "replicasets" in API group "apps" in the namespace "default" Error from server (Forbidden): statefulsets.apps is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "statefulsets" in API group "apps" in the namespace "default" Error from server (Forbidden): horizontalpodautoscalers.autoscaling is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "horizontalpodautoscalers" in API group "autoscaling" in the namespace "default" Error from server (Forbidden): cronjobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "cronjobs" in API group "batch" in the namespace "default" Error from server (Forbidden): jobs.batch is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "jobs" in API group "batch" in the namespace "default" true -``` - diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md index 83cac7d6e59..3099612cacb 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23.md @@ -2,6 +2,10 @@ title: RKE2 Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.23 --- + + + + This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md deleted file mode 100644 index ffb7755d7ad..00000000000 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24.md +++ /dev/null @@ -1,3196 +0,0 @@ ---- -title: RKE2 Self-Assessment Guide - CIS Benchmark v1.23 - K8s v1.24 ---- - -This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. - -This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: - -| Rancher Version | CIS Benchmark Version | Kubernetes Version | -|-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.23 | Kubernetes v1.24 | - -This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. - -This document is for Rancher operators, security teams, auditors and decision makers. - -For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.23. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). - -## Testing Methodology - -RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. - -Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. - -:::note - -This guide only covers `automated` (previously called `scored`) tests. - -::: - -### Controls - -## 1.1 Master Node Configuration Files -### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the -control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -644 -``` - -### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'permissions' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 644 - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 permissions=644 -``` - -### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root - -**Audit:** - -```bash -ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root root:root -``` - -### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). For example, -chmod 700 /var/lib/etcd - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -permissions has permissions 700, expected 700 or more restrictive -``` - -**Returned Value**: - -```console -permissions=700 -``` - -### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) - - -**Result:** pass - -**Remediation:** -On the etcd server node, get the etcd data directory, passed as an argument --data-dir, -from the command 'ps -ef | grep etcd'. -Run the below command (based on the etcd data directory found above). -For example, chown etcd:etcd /var/lib/etcd - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd -``` - -**Expected Result**: - -```console -'etcd:etcd' is present -``` - -**Returned Value**: - -```console -etcd:etcd -``` - -### 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chmod 600 /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, chown root:root /etc/kubernetes/admin.conf - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 scheduler - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root scheduler - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod 644 controllermanager - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chown -R root:root /var/lib/rancher/rke2/server/tls/ - -**Audit:** - -```bash -stat -c %U:%G /var/lib/rancher/rke2/server/tls -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 -``` - -### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the control plane node. -For example, -chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key - -**Audit:** - -```bash -stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key -``` - -**Expected Result**: - -```console -'permissions' is equal to '600' -``` - -**Returned Value**: - -```console -permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 -``` - -## 1.2 API Server -### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---anonymous-auth=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and configure alternate mechanisms for authentication. Then, -edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --token-auth-file= parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--token-auth-file' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the `DenyServiceExternalIPs` -from enabled admission plugins. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and remove the --kubelet-https parameter. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-https' is present OR '--kubelet-https' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the -apiserver and kubelets. Then, edit API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the -kubelet client certificate and key parameters as below. ---kubelet-client-certificate= ---kubelet-client-key= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and setup the TLS connection between -the apiserver and kubelets. Then, edit the API server pod specification file -/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the ---kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. ---kubelet-certificate-authority= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--kubelet-certificate-authority' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. -One such example could be as below. ---authorization-mode=RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes Node. ---authorization-mode=Node,RBAC - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'Node' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, -for example `--authorization-mode=Node,RBAC`. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--authorization-mode' has 'RBAC' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and set the desired limits in a configuration file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -and set the below parameters. ---enable-admission-plugins=...,EventRateLimit,... ---admission-control-config-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'EventRateLimit' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a -value that does not include AlwaysAdmit. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) - - -**Result:** warn - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -AlwaysPullImages. ---enable-admission-plugins=...,AlwaysPullImages,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'AlwaysPullImages' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to include -SecurityContextDeny, unless PodSecurityPolicy is already in place. ---enable-admission-plugins=...,SecurityContextDeny,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create ServiceAccount objects as per your environment. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and ensure that the --disable-admission-plugins parameter is set to a -value that does not include ServiceAccount. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --disable-admission-plugins parameter to -ensure it does not include NamespaceLifecycle. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --enable-admission-plugins parameter to a -value that includes NodeRestriction. ---enable-admission-plugins=...,NodeRestriction,... - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--enable-admission-plugins' has 'NodeRestriction' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and either remove the --secure-port parameter or -set it to a different (non-zero) desired port. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--secure-port' is greater than 0 OR '--secure-port' is not present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.18 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-path parameter to a suitable path and -file where you would like audit logs to be written, for example, ---audit-log-path=/var/log/apiserver/audit.log - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-path' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxage parameter to 30 -or as an appropriate number of days, for example, ---audit-log-maxage=30 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxage' is greater or equal to 30 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:34 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate -value. For example, ---audit-log-maxbackup=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxbackup' is greater or equal to 10 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. -For example, to set it as 100 MB, --audit-log-maxsize=100 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--audit-log-maxsize' is greater or equal to 100 -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---service-account-lookup=true -Alternatively, you can delete the --service-account-lookup parameter from this file so -that the default takes effect. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-lookup' is not present OR '--service-account-lookup' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --service-account-key-file parameter -to the public key file for service accounts. For example, ---service-account-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-key-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate and key file parameters. ---etcd-certfile= ---etcd-keyfile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-certfile' is present AND '--etcd-keyfile' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the TLS certificate and private key file parameters. ---tls-cert-file= ---tls-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection on the apiserver. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the client certificate authority file. ---client-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the etcd certificate authority file parameter. ---etcd-cafile= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--etcd-cafile' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml -on the control plane node and set the --encryption-provider-config parameter to the path of that file. -For example, --encryption-provider-config= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep -``` - -**Expected Result**: - -```console -'--encryption-provider-config' is present -``` - -**Returned Value**: - -```console -root 3484 3419 16 23:45 ? 00:01:35 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml -on the control plane node and set the below parameter. ---tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, -TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, -TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, -TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, -TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, -TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 - -### 1.2.33 Ensure that encryption providers are appropriately configured (Automated) - - -**Result:** pass - -**Remediation:** -Follow the Kubernetes documentation and configure a EncryptionConfig file. -In this file, choose aescbc, kms or secretbox as the encryption provider. - -**Audit:** - -```bash -/bin/sh -c 'if grep aescbc /var/lib/rancher/rke2/server/cred/encryption-config.json; then echo 0; fi' -``` - -**Expected Result**: - -```console -'0' is present -``` - -**Returned Value**: - -```console -{"kind":"EncryptionConfiguration","apiVersion":"apiserver.config.k8s.io/v1","resources":[{"resources":["secrets"],"providers":[{"aescbc":{"keys":[{"name":"aescbckey","secret":"LdLeqCPN/HfmgnUBXVPkDtUfeOPHwcQzDiLYG3nzFI4="}]}},{"identity":{}}]}]} 0 -``` - -## 1.3 Controller Manager -### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, -for example, --terminated-pod-gc-threshold=10 - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--terminated-pod-gc-threshold' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.2 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node to set the below parameter. ---use-service-account-credentials=true - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--use-service-account-credentials' is not equal to 'false' -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --service-account-private-key-file parameter -to the private key file for service accounts. ---service-account-private-key-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--service-account-private-key-file' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. ---root-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--root-ca-file' is present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. ---feature-gates=RotateKubeletServerCertificate=true - -### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-controller-manager | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 3645 3538 1 23:45 ? 00:00:10 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true -``` - -## 1.4 Scheduler -### 1.4.1 Ensure that the --profiling argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file -on the control plane node and set the below parameter. ---profiling=false - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--profiling' is equal to 'false' -``` - -**Returned Value**: - -```console -root 3652 3523 0 23:45 ? 00:00:03 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) - - -**Result:** pass - -**Remediation:** -Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml -on the control plane node and ensure the correct value for the --bind-address parameter - -**Audit:** - -```bash -/bin/ps -ef | grep kube-scheduler | grep -v grep -``` - -**Expected Result**: - -```console -'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present -``` - -**Returned Value**: - -```console -root 3652 3523 0 23:45 ? 00:00:03 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 -``` - -## 2 Etcd Node Configuration -### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure TLS encryption. -Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml -on the master node and set the below parameters. ---cert-file= ---key-file= - -### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---client-cert-auth="true" - -### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --auto-tls parameter or set it to false. ---auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Follow the etcd service documentation and configure peer TLS encryption as appropriate -for your etcd cluster. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameters. ---peer-client-file= ---peer-key-file= - -### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and set the below parameter. ---peer-client-cert-auth=true - -### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) - - -**Result:** pass - -**Remediation:** -Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master -node and either remove the --peer-auto-tls parameter or set it to false. ---peer-auto-tls=false - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Expected Result**: - -```console -'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) - - -**Result:** pass - -**Remediation:** -[Manual test] -Follow the etcd documentation and create a dedicated certificate authority setup for the -etcd service. -Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the -master node and set the below parameter. ---trusted-ca-file= - -**Audit:** - -```bash -/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep -``` - -**Audit Config:** - -```bash -cat /var/lib/rancher/rke2/server/db/etcd/config -``` - -**Expected Result**: - -```console -'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' -``` - -**Returned Value**: - -```console -PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-31-102 ETCD_UNSUPPORTED_ARCH= FILE_HASH=755e8914c854015cfb808b8456f808644387876672add1f9e19564c58f754595 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=78088791fd2612fad13ce760ef91a0ee HOME=/ -``` - -## 3.1 Authentication and Authorization -### 3.1.1 Client certificate authentication should not be used for users (Manual) - - -**Result:** warn - -**Remediation:** -Alternative mechanisms provided by Kubernetes such as the use of OIDC should be -implemented in place of client certificates. - -## 3.2 Logging -### 3.2.1 Ensure that a minimal audit policy is created (Automated) - - -**Result:** pass - -**Remediation:** -Create an audit policy file for your cluster. - -**Audit:** - -```bash -/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -o audit-policy-file -``` - -**Expected Result**: - -```console -'audit-policy-file' is equal to 'audit-policy-file' -``` - -**Returned Value**: - -```console -audit-policy-file -``` - -### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) - - -**Result:** warn - -**Remediation:** -Review the audit policy provided for the cluster and ensure that it covers -at least the following areas, -- Access to Secrets managed by the cluster. Care should be taken to only - log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in - order to avoid risk of logging sensitive data. -- Modification of Pod and Deployment objects. -- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. - For most requests, minimally logging at the Metadata level is recommended - (the most basic level of logging). - -## 4.1 Worker Node Configuration Files -### 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) - - -**Result:** Not Applicable - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf - -### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 644, expected 644 or more restrictive OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is present OR '/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig' is not present -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chmod 644 /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'644' is equal to '644' -``` - -**Returned Value**: - -```console -permissions=644 -``` - -### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the below command (based on the file location on your system) on the each worker node. -For example, -chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig - -**Audit:** - -```bash -/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the file permissions of the ---client-ca-file chmod 644 - -**Audit Script:** `check_cafile_permissions.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_permissions.sh -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) - - -**Result:** pass - -**Remediation:** -Run the following command to modify the ownership of the --client-ca-file. -chown root:root - -**Audit Script:** `check_cafile_ownership.sh` - -```bash -#!/usr/bin/env bash - -CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') -CAFILE=/node$CAFILE -if test -z $CAFILE; then CAFILE=$kubeletcafile; fi -if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi - -``` - -**Audit Execution:** - -```bash -./check_cafile_ownership.sh -``` - -**Expected Result**: - -```console -'root:root' is equal to 'root:root' -``` - -**Returned Value**: - -```console -root:root -``` - -### 4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chmod 644 /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c permissions=%a /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -permissions has permissions 600, expected 644 or more restrictive -``` - -**Returned Value**: - -```console -permissions=600 -``` - -### 4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated) - - -**Result:** pass - -**Remediation:** -Run the following command (using the config file location identified in the Audit step) -chown root:root /etc/rancher/rke2/rke2.yaml - -**Audit:** - -```bash -/bin/sh -c 'if test -e /etc/rancher/rke2/rke2.yaml; then stat -c %U:%G /etc/rancher/rke2/rke2.yaml; fi' -``` - -**Expected Result**: - -```console -'root:root' is present -``` - -**Returned Value**: - -```console -root:root -``` - -## 4.2 Kubelet -### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to -`false`. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -`--anonymous-auth=false` -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--anonymous-auth' is equal to 'false' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If -using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---authorization-mode=Webhook -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--authorization-mode' does not have 'AlwaysAllow' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to -the location of the client CA file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_AUTHZ_ARGS variable. ---client-ca-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--client-ca-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---read-only-port=0 -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--read-only-port' is equal to '0' OR '--read-only-port' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a -value other than 0. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---streaming-connection-idle-timeout=5m -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. ---protect-kernel-defaults=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--protect-kernel-defaults' is equal to 'true' -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove the --make-iptables-util-chains argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) - - -**Result:** Not Applicable - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and remove the --hostname-override argument from the -KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -### 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.eventRecordQPS}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to set `tlsCertFile` to the location -of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` -to the location of the corresponding private key file. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the below parameters in KUBELET_CERTIFICATE_ARGS variable. ---tls-cert-file= ---tls-private-key-file= -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'--tls-cert-file' is present AND '--tls-private-key-file' is present -``` - -**Returned Value**: - -```console -UID PID PPID C STIME TTY TIME CMD root 3221 3096 3 23:44 ? 00:00:19 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-31-102 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=499dafa1-6719-45d4-a0c6-66109f61b011 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key -``` - -### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) - - -**Result:** pass - -**Remediation:** -If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or -remove it altogether to use the default value. -If using command line arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS -variable. -Based on your system, restart the kubelet service. For example, -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) - - -**Result:** pass - -**Remediation:** -Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf -on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. ---feature-gates=RotateKubeletServerCertificate=true -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) - - -**Result:** warn - -**Remediation:** -If using a Kubelet config file, edit the file to set `TLSCipherSuites` to -TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -or to a subset of these values. -If using executable arguments, edit the kubelet service file -/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and -set the --tls-cipher-suites parameter as follows, or to a subset of these values. ---tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 -Based on your system, restart the kubelet service. For example: -systemctl daemon-reload -systemctl restart kubelet.service - -**Audit:** - -```bash -/bin/ps -fC kubelet -``` - -**Audit Config:** - -```bash -/bin/cat /etc/rancher/rke2/rke2.yaml -``` - -**Expected Result**: - -```console -'{range .tlsCipherSuites[:]}{}{','}{end}' is present -``` - -**Returned Value**: - -```console -apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxYTmwKY25abGNpMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTF6WlhKMlpYSXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJIZXg2aVo0Q09SYmlTd1pyYmRHa2ZIaHNKb2RZaGRScDFjNklkMngKS05ITHZzZEdxeEc0V2xySVp6WTEwTDlLWDJCVk9Senp0RUZ4cDc3MTlFTnVnNDZqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCU1pFWGkwbDNsS3dXS1U3S0x6CkgwZG5aTzVEOWpBS0JnZ3Foa2pPUFFRREFnTkhBREJFQWlCK2NQUUhLdXBJc05zU3BLVEg2NHJibFpKYTIyZ0oKdlh4TmNxb0dQSEdhUlFJZ1JJdU1hcFVKOHVyVEdxblZGckFldy81aFdOZFdRUjNyN3FXQmlrYnk0aEk9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K server: https://127.0.0.1:6443 name: default contexts: - context: cluster: default user: default name: default current-context: default kind: Config preferences: {} users: - name: default user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRpZ0F3SUJBZ0lJUnIzVlVFbTY4Yll3Q2dZSUtvWkl6ajBFQXdJd0pERWlNQ0FHQTFVRUF3d1oKY210bE1pMWpiR2xsYm5RdFkyRkFNVFkzTnpRMU5UQXpOekFlRncweU16QXlNall5TXpRek5UZGFGdzB5TkRBeQpNall5TXpRek5UZGFNREF4RnpBVkJnTlZCQW9URG5ONWMzUmxiVHB0WVhOMFpYSnpNUlV3RXdZRFZRUURFd3h6CmVYTjBaVzA2WVdSdGFXNHdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUTE5SWdKZVJyUldOVGUKZC9UUWcwNWdNcWFMSU9oUU1HSUZKRytTSFJUTVl1RkxBUHhydGozV1g3T3hIRDFDaE5nM2p6VnJKbjcwYitpUApIRzJRNS9XTW8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUhBd0l3Ckh3WURWUjBqQkJnd0ZvQVViNGJ3aEFWMitabXd0MWlaN2pKMGVDTytGRWd3Q2dZSUtvWkl6ajBFQXdJRFJ3QXcKUkFJZ2ZjNHJWdWJwUWVRMmxiVUJPNkxhK0hKNWVHbUFqSTRHMTV6K1pEZmZqQ1lDSUZGVkFTd1ZzVFRsUXlvMQpicmpsdnJzVW9rRmNxN3RIYjJxZk51dTV2aTB1Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlVENDQVIrZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWtNU0l3SUFZRFZRUUREQmx5YTJVeUxXTnMKYVdWdWRDMWpZVUF4TmpjM05EVTFNRE0zTUI0WERUSXpNREl5TmpJek5ETTFOMW9YRFRNek1ESXlNekl6TkRNMQpOMW93SkRFaU1DQUdBMVVFQXd3WmNtdGxNaTFqYkdsbGJuUXRZMkZBTVRZM056UTFOVEF6TnpCWk1CTUdCeXFHClNNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJLTzZGUG4xd3dqbWFYdzc1T1l1blI1QytMbkpiRlpNYlgyWDRVR0kKMWFKK0tXb0tMZExmRnlZbVdvbHoyV3IzUnBhNGVxRXYySTg1bndINWp1NDZnNXlqUWpCQU1BNEdBMVVkRHdFQgovd1FFQXdJQ3BEQVBCZ05WSFJNQkFmOEVCVEFEQVFIL01CMEdBMVVkRGdRV0JCUnZodkNFQlhiNW1iQzNXSm51Ck1uUjRJNzRVU0RBS0JnZ3Foa2pPUFFRREFnTklBREJGQWlCeWR6VWRaMm5IZU56UHY2RkwzYUdabXMrZ2VuTmoKLzNaditGR1dhZi9nK3dJaEFNMnVCVE9maW9vQUptRXBpSi92WUFrQmRMdkdyWEdOY2R6UzdJRzRJR3BXCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUQ4MXVnTGVmd0EvekE2U2l0V3czeDNiQWRHQ3A2eXJqYmNSRE14eFgwd3FvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFTmZTSUNYa2EwVmpVM25mMDBJTk9ZREttaXlEb1VEQmlCU1J2a2gwVXpHTGhTd0Q4YTdZOQoxbCt6c1J3OVFvVFlONDgxYXlaKzlHL29qeHh0a09mMWpBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= -``` - -## 5.1 RBAC and Service Accounts -### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) - - -**Result:** warn - -**Remediation:** -Identify all clusterrolebindings to the cluster-admin role. Check if they are used and -if they need this role or if they could use a role with fewer privileges. -Where possible, first bind users to a lower privileged role and then remove the -clusterrolebinding to the cluster-admin role : -kubectl delete clusterrolebinding [name] - -### 5.1.2 Minimize access to secrets (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove get, list and watch access to Secret objects in the cluster. - -### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) - - -**Result:** warn - -**Remediation:** -Where possible replace any use of wildcards in clusterroles and roles with specific -objects or actions. - -### 5.1.4 Minimize access to create pods (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove create access to pod objects in the cluster. - -### 5.1.5 Ensure that default service accounts are not actively used. (Automated) - - -**Result:** pass - -**Remediation:** -Create explicit service accounts wherever a Kubernetes workload requires specific access -to the Kubernetes API server. -Modify the configuration of each default service account to include this value -automountServiceAccountToken: false - -**Audit Script:** `check_for_default_sa.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) -if [[ ${count_sa} -gt 0 ]]; then - echo "false" - exit -fi - -for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") -do - for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[].kind=="ServiceAccount" and .subjects[].name=="default") or (.subjects[].kind=="Group" and .subjects[].name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') - do - read kind name <<<$(IFS=","; echo $result) - resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[] != "podsecuritypolicies")' | wc -l) - if [[ ${resource_count} -gt 0 ]]; then - echo "false" - exit - fi - done -done - - -echo "true" -``` - -**Audit Execution:** - -```bash -./check_for_default_sa.sh -``` - -**Expected Result**: - -```console -'true' is equal to 'true' -``` - -**Returned Value**: - -```console -Error from server (Forbidden): serviceaccounts is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "serviceaccounts" in API group "" at the cluster scope Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "calico-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-fleet-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-impersonation-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cattle-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "cis-operator-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "default" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-node-lease" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-public" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "kube-system" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "local" Error from server (Forbidden): clusterrolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope Error from server (Forbidden): rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:cis-operator-system:cis-serviceaccount" cannot list resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "tigera-operator" true -``` - -### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) - - -**Result:** warn - -**Remediation:** -Modify the definition of pods and service accounts which do not need to mount service -account tokens to disable it. - -### 5.1.7 Avoid use of system:masters group (Manual) - - -**Result:** warn - -**Remediation:** -Remove the system:masters group from all users in the cluster. - -### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) - - -**Result:** warn - -**Remediation:** -Where possible, remove the impersonate, bind and escalate rights from subjects. - -## 5.2 Pod Security Standards -### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that either Pod Security Admission or an external policy control system is in place -for every namespace which contains user workloads. - -### 5.2.2 Minimize the admission of privileged containers (Manual) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of privileged containers. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r '.spec.runAsUser.rule' -``` - -**Expected Result**: - -```console -'MustRunAsNonRoot' is present -``` - -**Returned Value**: - -```console -MustRunAsNonRoot -``` - -### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostPID` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=5 -``` - -### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostIPC` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=5 -``` - -### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of `hostNetwork` containers. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=2 -``` - -### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=4 -``` - -### 5.2.7 Minimize the admission of root containers (Automated) - - -**Result:** pass - -**Remediation:** -Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` -or `MustRunAs` with the range of UIDs not including 0, is set. - -**Audit:** - -```bash -kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=4 -``` - -### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) - - -**Result:** pass - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with the `NET_RAW` capability. - -**Audit:** - -```bash -kubectl get psp global-restricted-psp -o json | jq -r .spec.requiredDropCapabilities[] -``` - -**Expected Result**: - -```console -'ALL' is present -``` - -**Returned Value**: - -```console -ALL -``` - -### 5.2.9 Minimize the admission of containers with added capabilities (Automated) - - -**Result:** warn - -**Remediation:** -Ensure that `allowedCapabilities` is not present in policies for the cluster unless -it is set to an empty array. - -### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) - - -**Result:** warn - -**Remediation:** -Review the use of capabilites in applications running on your cluster. Where a namespace -contains applicaions which do not require any Linux capabities to operate consider adding -a PSP which forbids the admission of containers which do not drop all capabilities. - -### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. - -### 5.2.12 Minimize the admission of HostPath volumes (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers with `hostPath` volumes. - -### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) - - -**Result:** warn - -**Remediation:** -Add policies to each namespace in the cluster which has user workloads to restrict the -admission of containers which use `hostPort` sections. - -## 5.3 Network Policies and CNI -### 5.3.1 Ensure that the CNI in use supports Network Policies (Automated) - - -**Result:** pass - -**Remediation:** -If the CNI plugin in use does not support network policies, consideration should be given to -making use of a different plugin, or finding an alternate mechanism for restricting traffic -in the Kubernetes cluster. - -**Audit:** - -```bash -kubectl get pods --all-namespaces --selector='k8s-app in (calico-node, canal, cilium)' -o name | wc -l | xargs -I {} echo '--count={}' -``` - -**Expected Result**: - -```console -'count' is greater than 0 -``` - -**Returned Value**: - -```console ---count=1 -``` - -### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) - - -**Result:** pass - -**Remediation:** -Follow the documentation and create NetworkPolicy objects as you need them. - -**Audit Script:** `check_for_rke2_network_policies.sh` - -```bash -#!/bin/bash - -set -eE - -handle_error() { - echo "false" -} - -trap 'handle_error' ERR - -for namespace in kube-system kube-public default; do - policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') - if [ ${policy_count} -eq 0 ]; then - echo "false" - exit - fi -done - -echo "true" - -``` - -**Audit Execution:** - -```bash -./check_for_rke2_network_policies.sh -``` - -**Expected Result**: - -```console -'true' is present -``` - -**Returned Value**: - -```console -true -``` - -## 5.4 Secrets Management -### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) - - -**Result:** warn - -**Remediation:** -If possible, rewrite application code to read Secrets from mounted secret files, rather than -from environment variables. - -### 5.4.2 Consider external secret storage (Manual) - - -**Result:** warn - -**Remediation:** -Refer to the Secrets management options offered by your cloud provider or a third-party -secrets management solution. - -## 5.5 Extensible Admission Control -### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and setup image provenance. - -## 5.7 General Policies -### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) - - -**Result:** warn - -**Remediation:** -Follow the documentation and create namespaces for objects in your deployment as you need -them. - -### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) - - -**Result:** warn - -**Remediation:** -Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. -An example is as below: -securityContext: -seccompProfile: -type: RuntimeDefault - -### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) - - -**Result:** warn - -**Remediation:** -Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a -suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker -Containers. - -### 5.7.4 The default namespace should not be used (Manual) - - -**Result:** warn - -**Remediation:** -Ensure that namespaces are created to allow for appropriate segregation of Kubernetes -resources and that all new resources are created in a specific namespace. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md new file mode 100644 index 00000000000..ba80c0a516a --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24.md @@ -0,0 +1,3202 @@ +--- +title: RKE2 Self-Assessment Guide - CIS Benchmark v1.24 - K8s v1.24 +--- + + + + + +This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.24 | Kubernetes v1.24 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.24. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 644 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +644 +``` + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'permissions' is equal to '600' +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 644 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'644' is equal to '644' +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +permissions has permissions 700, expected 700 or more restrictive +``` + +**Returned Value**: + +```console +permissions=700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +'etcd:etcd' is present +``` + +**Returned Value**: + +```console +etcd:etcd +``` + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 scheduler + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root scheduler + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 controllermanager + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /var/lib/rancher/rke2/server/tls/ + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Automated) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key +``` + +**Expected Result**: + +```console +'permissions' is equal to '600' +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.4 Ensure that the --kubelet-https argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --kubelet-https parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-https' is present OR '--kubelet-https' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.18 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.19 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxsize' is greater or equal to 100 +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true root 1017917 2489 83 16:16 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz root 1017945 2489 75 16:16 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/livez +``` + +### 1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 2548 2489 10 Sep11 ? 02:10:01 kube-apiserver --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 + +### 1.2.33 Ensure that encryption providers are appropriately configured (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +/bin/sh -c 'if grep aescbc /var/lib/rancher/rke2/server/cred/encryption-config.json; then echo 0; fi' +``` + +**Expected Result**: + +```console +'0' is present +``` + +**Returned Value**: + +```console +{"kind":"EncryptionConfiguration","apiVersion":"apiserver.config.k8s.io/v1","resources":[{"resources":["secrets"],"providers":[{"aescbc":{"keys":[{"name":"aescbckey","secret":"akmMjUAq94YvsUftJpiA3b+9SClu0ESPBeckAI7KZBY="}]}},{"identity":{}}]}]} 0 +``` + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2743 2649 2 Sep11 ? 00:28:36 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2707 2593 0 Sep11 ? 00:06:20 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2707 2593 0 Sep11 ? 00:06:20 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Audit Config:** + +```bash +cat /var/lib/rancher/rke2/server/db/etcd/config +``` + +**Expected Result**: + +```console +'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-10-113 ETCD_UNSUPPORTED_ARCH= NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=560b915d9afb672c20c2c1e8664bdf8f FILE_HASH=166aebdce42ff62fcdd2cefc9e7ed8f7c5b562d219ca6afec8f73adc654f65e7 HOME=/ +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep | grep -o audit-policy-file +``` + +**Expected Result**: + +```console +'audit-policy-file' is equal to 'audit-policy-file' +``` + +**Returned Value**: + +```console +audit-policy-file +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--protect-kernel-defaults=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--protect-kernel-defaults' is equal to 'true' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.8 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +### 4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Automated) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.eventRecordQPS}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2291 2246 4 Sep11 ? 00:50:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-10-113 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=6685035f-32be-4d1b-a06d-7ea5f42467f5 --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{range .tlsCipherSuites[:]}{}{','}{end}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Automated) + + +**Result:** pass + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +**Audit Script:** `check_for_default_sa.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +count_sa=$(kubectl get serviceaccounts --all-namespaces -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true))' | jq .metadata.namespace | wc -l) +if [[ ${count_sa} -gt 0 ]]; then + echo "false" + exit +fi + +for ns in $(kubectl get ns --no-headers -o custom-columns=":metadata.name") +do + for result in $(kubectl get clusterrolebinding,rolebinding -n $ns -o json | jq -r '.items[] | select((.subjects[]?.kind=="ServiceAccount" and .subjects[]?.name=="default") or (.subjects[]?.kind=="Group" and .subjects[]?.name=="system:serviceaccounts"))' | jq -r '"\(.roleRef.kind),\(.roleRef.name)"') + do + read kind name <<<$(IFS=","; echo $result) + resource_count=$(kubectl get $kind $name -n $ns -o json | jq -r '.rules[] | select(.resources[]? != "podsecuritypolicies")' | wc -l) + if [[ ${resource_count} -gt 0 ]]; then + echo "false" + exit + fi + done +done + + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_default_sa.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +**Audit:** + +```bash +kubectl get psp global-restricted-psp && kubectl get psp global-restricted-psp -o json | jq -r ".spec.runAsUser.rule" || kubectl get psp restricted-noroot-psp && kubectl get psp restricted-noroot-psp -o json | jq -r ".spec.runAsUser.rule" +``` + +**Expected Result**: + +```console +'MustRunAsNonRoot' is equal to 'MustRunAsNonRoot' +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ Error from server (NotFound): podsecuritypolicies.policy "global-restricted-psp" not found Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES restricted-noroot-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,csi,persistentVolumeClaim Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ MustRunAsNonRoot +``` + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=5 +``` + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=5 +``` + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=2 +``` + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=4 +``` + +### 5.2.7 Minimize the admission of root containers (Automated) + + +**Result:** pass + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +**Audit:** + +```bash +kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ --count=4 +``` + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated) + + +**Result:** pass + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +**Audit:** + +```bash +kubectl get psp global-restricted-psp && kubectl get psp global-restricted-psp -o json | jq -r .spec.requiredDropCapabilities[] || kubectl get psp restricted-noroot-psp && kubectl get psp restricted-noroot-psp -o json | jq -r .spec.requiredDropCapabilities[] +``` + +**Expected Result**: + +```console +'ALL' is equal to 'ALL' +``` + +**Returned Value**: + +```console +Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ Error from server (NotFound): podsecuritypolicies.policy "global-restricted-psp" not found Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES restricted-noroot-psp false RunAsAny MustRunAsNonRoot MustRunAs MustRunAs false configMap,emptyDir,projected,secret,downwardAPI,csi,persistentVolumeClaim Warning: policy/v1beta1 PodSecurityPolicy is deprecated in v1.21+, unavailable in v1.25+ ALL +``` + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports Network Policies (Automated) + + +**Result:** pass + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +**Audit:** + +```bash +kubectl get pods --all-namespaces --selector='k8s-app in (calico-node, canal, cilium)' -o name | wc -l | xargs -I {} echo '--count={}' +``` + +**Expected Result**: + +```console +'count' is greater than 0 +``` + +**Returned Value**: + +```console +--count=1 +``` + +### 5.3.2 Ensure that all Namespaces have Network Policies defined (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +**Audit Script:** `check_for_rke2_network_policies.sh` + +```bash +#!/bin/bash + +set -eE + +handle_error() { + echo "false" +} + +trap 'handle_error' ERR + +for namespace in kube-system kube-public default; do + policy_count=$(/var/lib/rancher/rke2/bin/kubectl get networkpolicy -n ${namespace} -o json | jq -r '.items | length') + if [ ${policy_count} -eq 0 ]; then + echo "false" + exit + fi +done + +echo "true" + +``` + +**Audit Execution:** + +```bash +./check_for_rke2_network_policies.sh +``` + +**Expected Result**: + +```console +'true' is equal to 'true' +``` + +**Returned Value**: + +```console +true +``` + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md new file mode 100644 index 00000000000..b7d4a36ea4b --- /dev/null +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27.md @@ -0,0 +1,2967 @@ +--- +title: RKE2 Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25/v1.26/v1.27 +--- + + + + + +This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. + +This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: + +| Rancher Version | CIS Benchmark Version | Kubernetes Version | +|-----------------|-----------------------|--------------------| +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25/v1.26/v1.27 | + +This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. + +This document is for Rancher operators, security teams, auditors and decision makers. + +For more information about each control, including detailed descriptions and remediations for failing tests, refer to the corresponding section of the CIS Kubernetes Benchmark v1.7. You can download the benchmark, after creating a free account, at [Center for Internet Security (CIS)](https://www.cisecurity.org/benchmark/kubernetes/). + +## Testing Methodology + +RKE2 launches control plane components as static pods, managed by the kubelet, and uses containerd as the container runtime. Configuration is defined by arguments passed to the container at the time of initialization or via configuration file. + +Where control audits differ from the original CIS benchmark, the audit commands specific to Rancher are provided for testing. When performing the tests, you will need access to the command line on the hosts of all RKE2 nodes. The commands also make use of the [kubectl](https://kubernetes.io/docs/tasks/tools/) (with a valid configuration file) and [jq](https://stedolan.github.io/jq/) tools, which are required in the testing and evaluation of test results. + +:::note + +This guide only covers `automated` (previously called `scored`) tests. + +::: + +### Controls + +## 1.1 Control Plane Node Configuration Files +### 1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the +control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then find /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml -name '*etcd*' | xargs stat -c permissions=%a; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=644 +``` + +### 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root + +**Audit:** + +```bash +ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root root:root +``` + +### 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) + + +**Result:** pass + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). For example, +chmod 700 /var/lib/etcd + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd +``` + +**Expected Result**: + +```console +permissions has permissions 700, expected 700 or more restrictive +``` + +**Returned Value**: + +```console +permissions=700 +``` + +### 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) + + +**Result:** Not Applicable + +**Remediation:** +On the etcd server node, get the etcd data directory, passed as an argument --data-dir, +from the command 'ps -ef | grep etcd'. +Run the below command (based on the etcd data directory found above). +For example, chown etcd:etcd /var/lib/etcd + +### 1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chmod 600 /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, chown root:root /etc/kubernetes/admin.conf + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod 600 /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'600' is present +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chown -R root:root /etc/kubernetes/pki/ + +**Audit:** + +```bash +stat -c %U:%G /var/lib/rancher/rke2/server/tls +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 permissions=644 +``` + +### 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the control plane node. +For example, +chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key + +**Audit:** + +```bash +stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 +``` + +## 1.2 API Server +### 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--anonymous-auth=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +### 1.2.2 Ensure that the --token-auth-file parameter is not set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and configure alternate mechanisms for authentication. Then, +edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the --token-auth-file= parameter. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--token-auth-file' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and remove the `DenyServiceExternalIPs` +from enabled admission plugins. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the +apiserver and kubelets. Then, edit API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +kubelet client certificate and key parameters as below. +--kubelet-client-certificate= +--kubelet-client-key= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and setup the TLS connection between +the apiserver and kubelets. Then, edit the API server pod specification file +/var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the control plane node and set the +--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. +--kubelet-certificate-authority= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--kubelet-certificate-authority' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. +One such example could be as below. +--authorization-mode=RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes Node. +--authorization-mode=Node,RBAC + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'Node' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, +for example `--authorization-mode=Node,RBAC`. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--authorization-mode' has 'RBAC' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and set the desired limits in a configuration file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameters. +--enable-admission-plugins=...,EventRateLimit,... +--admission-control-config-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'EventRateLimit' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a +value that does not include AlwaysAdmit. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +AlwaysPullImages. +--enable-admission-plugins=...,AlwaysPullImages,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'AlwaysPullImages' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) + + +**Result:** warn + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to include +SecurityContextDeny, unless PodSecurityPolicy is already in place. +--enable-admission-plugins=...,SecurityContextDeny,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the documentation and create ServiceAccount objects as per your environment. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and ensure that the --disable-admission-plugins parameter is set to a +value that does not include ServiceAccount. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true root 1018768 2419 99 16:17 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz +``` + +### 1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --disable-admission-plugins parameter to +ensure it does not include NamespaceLifecycle. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --enable-admission-plugins parameter to a +value that includes NodeRestriction. +--enable-admission-plugins=...,NodeRestriction,... + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--enable-admission-plugins' has 'NodeRestriction' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and either remove the --secure-port parameter or +set it to a different (non-zero) desired port. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--secure-port' is greater than 0 OR '--secure-port' is not present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.17 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.18 Ensure that the --audit-log-path argument is set (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-path parameter to a suitable path and +file where you would like audit logs to be written, for example, +--audit-log-path=/var/log/apiserver/audit.log + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-path' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxage parameter to 30 +or as an appropriate number of days, for example, +--audit-log-maxage=30 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxage' is greater or equal to 30 +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate +value. For example, +--audit-log-maxbackup=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-log-maxbackup' is greater or equal to 10 +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. +For example, to set it as 100 MB, --audit-log-maxsize=100 + +### 1.2.22 Ensure that the --request-timeout argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +and set the below parameter as appropriate and if needed. +For example, --request-timeout=300s + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--request-timeout' is not present OR '--request-timeout' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--service-account-lookup=true +Alternatively, you can delete the --service-account-lookup parameter from this file so +that the default takes effect. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-lookup' is not present OR '--service-account-lookup' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --service-account-key-file parameter +to the public key file for service accounts. For example, +--service-account-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-key-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate and key file parameters. +--etcd-certfile= +--etcd-keyfile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-certfile' is present AND '--etcd-keyfile' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the TLS certificate and private key file parameters. +--tls-cert-file= +--tls-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection on the apiserver. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the client certificate authority file. +--client-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the etcd certificate authority file parameter. +--etcd-cafile= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--etcd-cafile' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +Then, edit the API server pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml +on the control plane node and set the --encryption-provider-config parameter to the path of that file. +For example, --encryption-provider-config= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--encryption-provider-config' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.2.30 Ensure that encryption providers are appropriately configured (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and configure a EncryptionConfig file. +In this file, choose aescbc, kms or secretbox as the encryption provider. + +**Audit:** + +```bash +ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi +``` + +**Expected Result**: + +```console +'provider' is present +``` + +### 1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml +on the control plane node and set the below parameter. +--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, +TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, +TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, +TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, +TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, +TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384 +Not Applicable. + +## 1.3 Controller Manager +### 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, +for example, --terminated-pod-gc-threshold=10 + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--terminated-pod-gc-threshold' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.2 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node to set the below parameter. +--use-service-account-credentials=true + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--use-service-account-credentials' is not equal to 'false' +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --service-account-private-key-file parameter +to the private key file for service accounts. +--service-account-private-key-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--service-account-private-key-file' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. +--root-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--root-ca-file' is present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. +--feature-gates=RotateKubeletServerCertificate=true + +### 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Controller Manager pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-controller-manager | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +## 1.4 Scheduler +### 1.4.1 Ensure that the --profiling argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml file +on the control plane node and set the below parameter. +--profiling=false + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--profiling' is equal to 'false' +``` + +**Returned Value**: + +```console +root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +### 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) + + +**Result:** pass + +**Remediation:** +Edit the Scheduler pod specification file /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml +on the control plane node and ensure the correct value for the --bind-address parameter + +**Audit:** + +```bash +/bin/ps -ef | grep kube-scheduler | grep -v grep +``` + +**Expected Result**: + +```console +'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present +``` + +**Returned Value**: + +```console +root 2645 2538 0 Sep11 ? 00:05:26 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 +``` + +## 2 Etcd Node Configuration +### 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure TLS encryption. +Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml +on the master node and set the below parameters. +--cert-file= +--key-file= +Not Applicable. + +### 2.2 Ensure that the --client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--client-cert-auth="true" +Not Applicable. + +### 2.3 Ensure that the --auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --auto-tls parameter or set it to false. + --auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +### 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Follow the etcd service documentation and configure peer TLS encryption as appropriate +for your etcd cluster. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameters. +--peer-client-file= +--peer-key-file= +Not Applicable. + +### 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and set the below parameter. +--peer-client-cert-auth=true +Not Applicable. + +### 2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated) + + +**Result:** pass + +**Remediation:** +Edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the master +node and either remove the --peer-auto-tls parameter or set it to false. +--peer-auto-tls=false + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Expected Result**: + +```console +'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +### 2.7 Ensure that a unique Certificate Authority is used for etcd (Automated) + + +**Result:** pass + +**Remediation:** +[Manual test] +Follow the etcd documentation and create a dedicated certificate authority setup for the +etcd service. +Then, edit the etcd pod specification file /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml on the +master node and set the below parameter. +--trusted-ca-file= + +**Audit:** + +```bash +/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep +``` + +**Audit Config:** + +```bash +cat /var/lib/rancher/rke2/server/db/etcd/config +``` + +**Expected Result**: + +```console +'ETCD_TRUSTED_CA_FILE' is present OR '{.peer-transport-security.trusted-ca-file}' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt' +``` + +**Returned Value**: + +```console +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin HOSTNAME=ip-172-31-14-226 ETCD_UNSUPPORTED_ARCH= FILE_HASH=e9ca6f328e70dd3c17ba78c302ee32927a4961198e95d1d948114a5d7e350d99 NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16 POD_HASH=aa1658a59ab75324ef67c786d08307e3 HOME=/ +``` + +## 3.1 Authentication and Authorization +### 3.1.1 Client certificate authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be +implemented in place of client certificates. + +### 3.1.2 Service account token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of service account tokens. + +### 3.1.3 Bootstrap token authentication should not be used for users (Manual) + + +**Result:** warn + +**Remediation:** +Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented +in place of bootstrap tokens. + +## 3.2 Logging +### 3.2.1 Ensure that a minimal audit policy is created (Automated) + + +**Result:** pass + +**Remediation:** +Create an audit policy file for your cluster. + +**Audit:** + +```bash +/bin/ps -ef | grep kube-apiserver | grep -v grep +``` + +**Expected Result**: + +```console +'--audit-policy-file' is present +``` + +**Returned Value**: + +```console +root 2489 2419 8 Sep11 ? 01:41:54 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --admission-control-config-file=/etc/rancher/rke2/config/rancher-psact.yaml --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2652 2539 2 Sep11 ? 00:24:53 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/rke2/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true +``` + +### 3.2.2 Ensure that the audit policy covers key security concerns (Manual) + + +**Result:** warn + +**Remediation:** +Review the audit policy provided for the cluster and ensure that it covers +at least the following areas, +- Access to Secrets managed by the cluster. Care should be taken to only + log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in + order to avoid risk of logging sensitive data. +- Modification of Pod and Deployment objects. +- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`. +For most requests, minimally logging at the Metadata level is recommended +(the most basic level of logging). + +## 4.1 Worker Node Configuration Files +### 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not Applicable. + +### 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated) + + +**Result:** Not Applicable + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +Not applicable. + +### 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual) + + +**Result:** warn + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the below command (based on the file location on your system) on the each worker node. +For example, +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the file permissions of the +--client-ca-file chmod 600 + +**Audit Script:** `check_cafile_permissions.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_permissions.sh +``` + +**Expected Result**: + +```console +permissions has permissions 600, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=600 +``` + +### 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual) + + +**Result:** pass + +**Remediation:** +Run the following command to modify the ownership of the --client-ca-file. +chown root:root + +**Audit Script:** `check_cafile_ownership.sh` + +```bash +#!/usr/bin/env bash + +CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}') +CAFILE=/node$CAFILE +if test -z $CAFILE; then CAFILE=$kubeletcafile; fi +if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi + +``` + +**Audit Execution:** + +```bash +./check_cafile_ownership.sh +``` + +**Expected Result**: + +```console +'root:root' is equal to 'root:root' +``` + +**Returned Value**: + +```console +root:root +``` + +### 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated) + + +**Result:** fail + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +permissions has permissions 644, expected 600 or more restrictive +``` + +**Returned Value**: + +```console +permissions=644 +``` + +### 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated) + + +**Result:** pass + +**Remediation:** +Run the following command (using the config file location identified in the Audit step) +chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig + +**Audit:** + +```bash +/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi' +``` + +**Expected Result**: + +```console +'root:root' is present +``` + +**Returned Value**: + +```console +root:root +``` + +## 4.2 Kubelet +### 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to +`false`. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +`--anonymous-auth=false` +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--anonymous-auth' is equal to 'false' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If +using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--authorization-mode=Webhook +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--authorization-mode' does not have 'AlwaysAllow' +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to +the location of the client CA file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_AUTHZ_ARGS variable. +--client-ca-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--client-ca-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `readOnlyPort` to 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--read-only-port=0 +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--read-only-port' is equal to '0' OR '--read-only-port' is not present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a +value other than 0. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +--streaming-connection-idle-timeout=5m +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.streamingConnectionIdleTimeout}' is present OR '{.streamingConnectionIdleTimeout}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove the --make-iptables-util-chains argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.makeIPTablesUtilChains}' is present OR '{.makeIPTablesUtilChains}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.7 Ensure that the --hostname-override argument is not set (Manual) + + +**Result:** Not Applicable + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and remove the --hostname-override argument from the +KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service +Not Applicable. + +### 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.eventRecordQPS}' is present OR '{.eventRecordQPS}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to set `tlsCertFile` to the location +of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile` +to the location of the corresponding private key file. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the below parameters in KUBELET_CERTIFICATE_ARGS variable. +--tls-cert-file= +--tls-private-key-file= +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'--tls-cert-file' is present AND '--tls-private-key-file' is present +``` + +**Returned Value**: + +```console +UID PID PPID C STIME TTY TIME CMD root 2236 2075 4 Sep11 ? 00:47:51 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --alsologtostderr=false --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=ip-172-31-14-226 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --log-file=/var/lib/rancher/rke2/agent/logs/kubelet.log --log-file-max-size=50 --logtostderr=false --node-labels=cattle.io/os=linux,rke.cattle.io/machine=1adcc1f7-66f1-4503-b9bc-dfb6e808f27b --pod-infra-container-image=index.docker.io/rancher/pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --stderrthreshold=FATAL --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key +``` + +### 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated) + + +**Result:** pass + +**Remediation:** +If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or +remove it altogether to use the default value. +If using command line arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS +variable. +Based on your system, restart the kubelet service. For example, +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.rotateCertificates}' is present OR '{.rotateCertificates}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual) + + +**Result:** pass + +**Remediation:** +Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf +on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. +--feature-gates=RotateKubeletServerCertificate=true +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.featureGates.RotateKubeletServerCertificate}' is present OR '{.featureGates.RotateKubeletServerCertificate}' is not present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) + + +**Result:** warn + +**Remediation:** +If using a Kubelet config file, edit the file to set `TLSCipherSuites` to +TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +or to a subset of these values. +If using executable arguments, edit the kubelet service file +/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and +set the --tls-cipher-suites parameter as follows, or to a subset of these values. +--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 +Based on your system, restart the kubelet service. For example: +systemctl daemon-reload +systemctl restart kubelet.service + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{range .tlsCipherSuites[:]}{}{','}{end}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +### 4.2.13 Ensure that a limit is set on pod PIDs (Manual) + + +**Result:** warn + +**Remediation:** +Decide on an appropriate level for this parameter and set it, +either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting. + +**Audit:** + +```bash +/bin/ps -fC kubelet +``` + +**Audit Config:** + +```bash +/bin/cat /var/lib/rancher/rke2/agent/kubelet.kubeconfig +``` + +**Expected Result**: + +```console +'{.podPidsLimit}' is present +``` + +**Returned Value**: + +```console +apiVersion: v1 clusters: - cluster: server: https://127.0.0.1:6443 certificate-authority: /var/lib/rancher/rke2/agent/server-ca.crt name: local contexts: - context: cluster: local namespace: default user: user name: Default current-context: Default kind: Config preferences: {} users: - name: user user: client-certificate: /var/lib/rancher/rke2/agent/client-kubelet.crt client-key: /var/lib/rancher/rke2/agent/client-kubelet.key +``` + +## 5.1 RBAC and Service Accounts +### 5.1.1 Ensure that the cluster-admin role is only used where required (Manual) + + +**Result:** warn + +**Remediation:** +Identify all clusterrolebindings to the cluster-admin role. Check if they are used and +if they need this role or if they could use a role with fewer privileges. +Where possible, first bind users to a lower privileged role and then remove the +clusterrolebinding to the cluster-admin role : +kubectl delete clusterrolebinding [name] + +### 5.1.2 Minimize access to secrets (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove get, list and watch access to Secret objects in the cluster. + +### 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) + + +**Result:** warn + +**Remediation:** +Where possible replace any use of wildcards in clusterroles and roles with specific +objects or actions. + +### 5.1.4 Minimize access to create pods (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to pod objects in the cluster. + +### 5.1.5 Ensure that default service accounts are not actively used. (Manual) + + +**Result:** warn + +**Remediation:** +Create explicit service accounts wherever a Kubernetes workload requires specific access +to the Kubernetes API server. +Modify the configuration of each default service account to include this value +automountServiceAccountToken: false + +### 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual) + + +**Result:** warn + +**Remediation:** +Modify the definition of pods and service accounts which do not need to mount service +account tokens to disable it. + +### 5.1.7 Avoid use of system:masters group (Manual) + + +**Result:** warn + +**Remediation:** +Remove the system:masters group from all users in the cluster. + +### 5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove the impersonate, bind and escalate rights from subjects. + +### 5.1.9 Minimize access to create persistent volumes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove create access to PersistentVolume objects in the cluster. + +### 5.1.10 Minimize access to the proxy sub-resource of nodes (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the proxy sub-resource of node objects. + +### 5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. + +### 5.1.12 Minimize access to webhook configuration objects (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects + +### 5.1.13 Minimize access to the service account token creation (Manual) + + +**Result:** warn + +**Remediation:** +Where possible, remove access to the token sub-resource of serviceaccount objects. + +## 5.2 Pod Security Standards +### 5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that either Pod Security Admission or an external policy control system is in place +for every namespace which contains user workloads. + +### 5.2.2 Minimize the admission of privileged containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of privileged containers. + +### 5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostPID` containers. + +### 5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostIPC` containers. + +### 5.2.5 Minimize the admission of containers wishing to share the host network namespace (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of `hostNetwork` containers. + +### 5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. + +### 5.2.7 Minimize the admission of root containers (Manual) + + +**Result:** warn + +**Remediation:** +Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` +or `MustRunAs` with the range of UIDs not including 0, is set. + +### 5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with the `NET_RAW` capability. + +### 5.2.9 Minimize the admission of containers with added capabilities (Automated) + + +**Result:** warn + +**Remediation:** +Ensure that `allowedCapabilities` is not present in policies for the cluster unless +it is set to an empty array. + +### 5.2.10 Minimize the admission of containers with capabilities assigned (Manual) + + +**Result:** warn + +**Remediation:** +Review the use of capabilites in applications running on your cluster. Where a namespace +contains applicaions which do not require any Linux capabities to operate consider adding +a PSP which forbids the admission of containers which do not drop all capabilities. + +### 5.2.11 Minimize the admission of Windows HostProcess containers (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. + +### 5.2.12 Minimize the admission of HostPath volumes (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers with `hostPath` volumes. + +### 5.2.13 Minimize the admission of containers which use HostPorts (Manual) + + +**Result:** warn + +**Remediation:** +Add policies to each namespace in the cluster which has user workloads to restrict the +admission of containers which use `hostPort` sections. + +## 5.3 Network Policies and CNI +### 5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual) + + +**Result:** warn + +**Remediation:** +If the CNI plugin in use does not support network policies, consideration should be given to +making use of a different plugin, or finding an alternate mechanism for restricting traffic +in the Kubernetes cluster. + +### 5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create NetworkPolicy objects as you need them. + +## 5.4 Secrets Management +### 5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual) + + +**Result:** warn + +**Remediation:** +If possible, rewrite application code to read Secrets from mounted secret files, rather than +from environment variables. + +### 5.4.2 Consider external secret storage (Manual) + + +**Result:** warn + +**Remediation:** +Refer to the Secrets management options offered by your cloud provider or a third-party +secrets management solution. + +## 5.5 Extensible Admission Control +### 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and setup image provenance. + +## 5.7 General Policies +### 5.7.1 Create administrative boundaries between resources using namespaces (Manual) + + +**Result:** warn + +**Remediation:** +Follow the documentation and create namespaces for objects in your deployment as you need +them. + +### 5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual) + + +**Result:** warn + +**Remediation:** +Use `securityContext` to enable the docker/default seccomp profile in your pod definitions. +An example is as below: + securityContext: + seccompProfile: + type: RuntimeDefault + +### 5.7.3 Apply SecurityContext to your Pods and Containers (Manual) + + +**Result:** warn + +**Remediation:** +Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a +suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker +Containers. + +### 5.7.4 The default namespace should not be used (Manual) + + +**Result:** warn + +**Remediation:** +Ensure that namespaces are created to allow for appropriate segregation of Kubernetes +resources and that all new resources are created in a specific namespace. + diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md index 5c324f64898..2450938a61e 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25.md @@ -2,13 +2,17 @@ title: RKE2 Self-Assessment Guide - CIS Benchmark v1.7 - K8s v1.25 --- + + + + This document is a companion to the [RKE2 Hardening Guide](../../../../pages-for-subheaders/rke2-hardening-guide.md), which provides prescriptive guidance on how to harden RKE2 clusters that are running in production and managed by Rancher. This benchmark guide helps you evaluate the security of a hardened cluster against each control in the CIS Kubernetes Benchmark. This guide corresponds to the following versions of Rancher, CIS Benchmarks, and Kubernetes: | Rancher Version | CIS Benchmark Version | Kubernetes Version | |-----------------|-----------------------|--------------------| -| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | +| Rancher v2.7 | Benchmark v1.7 | Kubernetes v1.25 | This guide walks through the various controls and provide updated example commands to audit compliance in Rancher created clusters. Because Rancher and RKE2 install Kubernetes services as Docker containers, many of the control verification checks in the CIS Kubernetes Benchmark don't apply. These checks will return a result of `Not Applicable`. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/kubernetes-security-best-practices.md b/versioned_docs/version-2.7/reference-guides/rancher-security/kubernetes-security-best-practices.md index a863dd44e52..ace8bd95fab 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/kubernetes-security-best-practices.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/kubernetes-security-best-practices.md @@ -2,6 +2,10 @@ title: Kubernetes Security Best Practices --- + + + + ### Restricting cloud metadata API access Cloud providers such as AWS, Azure, DigitalOcean or GCP often expose metadata services locally to instances. By default, this endpoint is accessible by pods running on a cloud instance, including pods in hosted Kubernetes providers such as EKS, AKS, DigitalOcean Kubernetes or GKE, and can contain cloud credentials for that node, provisioning data such as kubelet credentials, or other sensitive data. To mitigate this risk when running on a cloud platform, follow the [Kubernetes security recommendations](https://kubernetes.io/docs/tasks/administer-cluster/securing-a-cluster/#restricting-cloud-metadata-api-access): limit permissions given to instance credentials, use network policies to restrict pod access to the metadata API, and avoid using provisioning data to deliver secrets. diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md b/versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md index 2373ec352c4..0f35551cf31 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/psa-restricted-exemptions.md @@ -2,6 +2,10 @@ title: Sample PodSecurityConfiguration --- + + + + The following PodSecurityConfiguration contains the required Rancher namespace exemptions for a `rancher-restricted` cluster to run properly. ```yaml diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/security-advisories-and-cves.md b/versioned_docs/version-2.7/reference-guides/rancher-security/security-advisories-and-cves.md index 872a908f633..8f3649e7a85 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/security-advisories-and-cves.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/security-advisories-and-cves.md @@ -2,6 +2,10 @@ title: Security Advisories and CVEs --- + + + + Rancher is committed to informing the community of security issues in our products. Rancher will publish security advisories and CVEs (Common Vulnerabilities and Exposures) for issues we have resolved. New security advisories are also published in Rancher's GitHub [security page](https://github.com/rancher/rancher/security/advisories). | ID | Description | Date | Resolution | diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md b/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md index d7358c29b62..1d9d46c75d4 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rancher-selinux.md @@ -2,6 +2,10 @@ title: About rancher-selinux --- + + + + To allow Rancher to work with SELinux, some functionality has to be manually enabled for the SELinux nodes. To help with that, Rancher provides a SELinux RPM. The `rancher-selinux` RPM only contains policies for the [rancher-logging application.](https://github.com/rancher/charts/tree/dev-v2.5/charts/rancher-logging) diff --git a/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md b/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md index fe124221e5f..c5edf5e0017 100644 --- a/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md +++ b/versioned_docs/version-2.7/reference-guides/rancher-security/selinux-rpm/about-rke2-selinux.md @@ -2,6 +2,10 @@ title: About rke2-selinux --- + + + + `rke2-selinux` provides policies for RKE2. It is installed automatically when the RKE2 installer script detects that it is running on an RPM-based distro. The `rke2-selinux` GitHub repository is [here.](https://github.com/rancher/rke2-selinux) diff --git a/versioned_docs/version-2.7/troubleshooting/other-troubleshooting-tips/logging.md b/versioned_docs/version-2.7/troubleshooting/other-troubleshooting-tips/logging.md index d4d6353442e..f4ba45226bc 100644 --- a/versioned_docs/version-2.7/troubleshooting/other-troubleshooting-tips/logging.md +++ b/versioned_docs/version-2.7/troubleshooting/other-troubleshooting-tips/logging.md @@ -6,7 +6,7 @@ title: Logging -## Log levels +## Log Levels The following log levels are used in Rancher: @@ -16,9 +16,9 @@ The following log levels are used in Rancher: | `debug` | Logs more detailed messages that can be used to debug. | | `trace` | Logs very detailed messages on internal functions. This is very verbose and can contain sensitive information. | -### How to configure a log level +### How to Configure a Log Level -#### Kubernetes install +#### Kubernetes Install * Configure debug log level @@ -58,7 +58,7 @@ $ docker exec -ti loglevel --set info OK ``` -## Rancher machine debug logs +## Rancher Machine Debug Logs If you need to troubleshoot the creation of objects in your infrastructure provider of choice, `rancher-machine` debug logs might be helpful to you. @@ -78,3 +78,19 @@ possible to enable debug logs in `rancher-machine` when provisioning RKE1, RKE2 Just like the `trace` log level above, `rancher-machine` debug logs can contain sensitive information. ::: + + +## Cattle-cluster-agent Debug Logs + +The `cattle-cluster-agent` log levels can be set when you initialize downstream clusters. + +When you create a cluster under **Cluster Configuration > Agent Environment Vars** you can set variables to define the log level. +- Trace-level logging: Set `CATTLE_TRACE` or `RANCHER_TRACE` to `true` + +- Debug-level logging: Set `CATTLE_DEBUG` or `RANCHER_DEBUG` to `true` + +:::caution + +The `cattle-cluster-agent` debug logs may contain sensitive information. + +::: diff --git a/versioned_sidebars/version-2.7-sidebars.json b/versioned_sidebars/version-2.7-sidebars.json index 3c543404682..5625fdaf67d 100644 --- a/versioned_sidebars/version-2.7-sidebars.json +++ b/versioned_sidebars/version-2.7-sidebars.json @@ -1029,8 +1029,8 @@ }, "items": [ "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25" + "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/rke1-hardening-guide/rke1-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27" ] }, { @@ -1042,8 +1042,8 @@ }, "items": [ "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25" + "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/rke2-hardening-guide/rke2-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27" ] }, { @@ -1055,8 +1055,8 @@ }, "items": [ "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.23", - "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.23-k8s-v1.24", - "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25" + "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.24-k8s-v1.24", + "reference-guides/rancher-security/hardening-guides/k3s-hardening-guide/k3s-self-assessment-guide-with-cis-v1.7-k8s-v1.25-v1.26-v1.27" ] } ]
v2.7.6DocumentationRelease NotesSupport Matrix
v2.7.5 Documentation