From 6c494d553ca9cd69cd0a2089573a1a849ebe9740 Mon Sep 17 00:00:00 2001 From: Nelson Roberts Date: Fri, 13 Mar 2020 09:50:26 -0700 Subject: [PATCH 1/4] updates to benchmark-2.3, hardening-2.3.5 --- .../v2.x/en/security/benchmark-2.3/_index.md | 37 ++++--------------- .../en/security/hardening-2.3.5/_index.md | 1 - 2 files changed, 8 insertions(+), 30 deletions(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md index 74ff4c693a1..95051435f76 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md @@ -34,7 +34,6 @@ When performing the tests, you will need access to the Docker command line on th The following scored controls do not currently pass, and Rancher Labs is working towards addressing these through future enhancements to the product. - 1.1.21 - Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored) -- 2.1.8 - Ensure that the `--hostname-override` argument is not set (Scored) ### Controls @@ -148,7 +147,7 @@ docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--profiling=false"). **Note:** This deprecated flag was removed in 1.14, so it cannot be set. -**Result:** Pass +**Result:** Not Applicable #### 1.1.10 - Ensure that the admission control plugin `AlwaysAdmit` is not set (Scored) @@ -756,17 +755,9 @@ docker inspect kube-controller-manager | jq -e '.[0].Args[] | match("--root-ca-f **Notes** -RKE does not yet support certificate rotation. This feature is due for the 0.1.12 release of RKE. +RKE handles certificate rotation through an external process. -**Audit** - -``` bash -docker inspect kube-controller-manager | jq -e '.[0].Args[] | match("--feature-gates=.*(RotateKubeletServerCertificate=true).*").captures[].string' -``` - -**Returned Value:** `RotateKubeletServerCertificate=true` - -**Result:** Pass +**Result:** Not Applicable #### 1.3.7 - Ensure that the `--address` argument is set to 127.0.0.1 (Scored) @@ -1509,15 +1500,7 @@ docker inspect kubelet | jq -e '.[0].Args[] | match("--make-iptables-util-chains **Notes** This is used by most cloud providers. Not setting this is not practical in most cases. -**Audit** - -``` bash -docker inspect kubelet | jq -e '.[0].Args[] | match("--hostname-override=.*").string' -``` - -**Returned Value:** `--hostname-override=` - -**Result:** Fail +**Result:** Not Applicable #### 2.1.9 - Ensure that the `--event-qps` argument is set to `0` (Scored) @@ -1581,19 +1564,15 @@ docker inspect kubelet | jq -e '.[0].Args[] | match("--rotate-certificates=true" **Returned Value:** `null` -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 2.1.13 - Ensure that the `RotateKubeletServerCertificate` argument is set to `true` (Scored) -**Audit** +**Notes** -``` bash -docker inspect kubelet | jq -e '.[0].Args[] | match("--feature-gates=.*(RotateKubeletServerCertificate=true).*").captures[].string' -``` +RKE handles certificate rotation through an external process. -**Returned Value:** `RotateKubeletServerCertificate=true` - -**Result:** Pass +**Result:** Not Applicable #### 2.1.14 - Ensure that the kubelet only makes use of strong cryptographic ciphers (Not Scored) diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md index 91cb760826f..65532d7465e 100644 --- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md @@ -179,7 +179,6 @@ services: infra_container_image: "" cluster_dns_server: "" fail_swap_on: false - generate_serving_certificate: true kubeproxy: image: "" extra_args: {} From 4373346bdcbb0fcd143d33b6fff87043076228a5 Mon Sep 17 00:00:00 2001 From: Nelson Roberts Date: Tue, 17 Mar 2020 09:19:10 -0700 Subject: [PATCH 2/4] removed Known Scored Control Failures, updated NetworkPolicy, added to cluster.yml example --- content/rancher/v2.x/en/security/benchmark-2.3/_index.md | 6 ------ content/rancher/v2.x/en/security/hardening-2.3.5/_index.md | 4 ++++ content/rancher/v2.x/en/security/hardening-2.3/_index.md | 1 + 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md index 95051435f76..fa11bf78c6b 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md @@ -29,12 +29,6 @@ Scoring the commands is different in Rancher Labs than in the CIS Benchmark. Whe When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the `jq` command to provide human-readable formatting. -#### Known Scored Control Failures - -The following scored controls do not currently pass, and Rancher Labs is working towards addressing these through future enhancements to the product. - -- 1.1.21 - Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored) - ### Controls --- diff --git a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md index 65532d7465e..ef3d4b471bd 100644 --- a/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.3.5/_index.md @@ -118,6 +118,10 @@ metadata: name: default-allow-all spec: podSelector: {} + ingress: + - {} + egress: + - {} policyTypes: - Ingress - Egress diff --git a/content/rancher/v2.x/en/security/hardening-2.3/_index.md b/content/rancher/v2.x/en/security/hardening-2.3/_index.md index 3918cbefa70..dfa51e8eb20 100644 --- a/content/rancher/v2.x/en/security/hardening-2.3/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.3/_index.md @@ -1266,6 +1266,7 @@ services: anonymous-auth: "false" feature-gates: "RotateKubeletServerCertificate=true" tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256" + generate_serving_certificate: true kube-api: pod_security_policy: true extra_args: From e72a0a8c52fb33296d6bdab8796f43aa0afc5509 Mon Sep 17 00:00:00 2001 From: Nelson Roberts Date: Tue, 17 Mar 2020 09:53:51 -0700 Subject: [PATCH 3/4] replace Pass (Not Applicable) with Not Applicable --- .../v2.x/en/security/benchmark-2.3/_index.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md index fa11bf78c6b..cdec02df08b 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md @@ -773,7 +773,7 @@ docker inspect kube-controller-manager | jq -e '.[0].Args[] | match("--address=1 RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.2 - Ensure that the API server pod specification file ownership is set to `root:root` (Scored) @@ -781,7 +781,7 @@ RKE doesn't require or maintain a configuration file for kube-apiserver. All con RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.3 - Ensure that the controller manager pod specification file permissions are set to `644` or more restrictive (Scored) @@ -789,7 +789,7 @@ RKE doesn't require or maintain a configuration file for kube-apiserver. All con RKE doesn't require or maintain a configuration file for `kube-controller-manager`. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.4 - Ensure that the controller manager pod specification file ownership is set to `root:root` (Scored) @@ -797,7 +797,7 @@ RKE doesn't require or maintain a configuration file for `kube-controller-manage RKE doesn't require or maintain a configuration file for `kube-controller-manager`. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.5 - Ensure that the scheduler pod specification file permissions are set to `644` or more restrictive (Scored) @@ -805,7 +805,7 @@ RKE doesn't require or maintain a configuration file for `kube-controller-manage RKE doesn't require or maintain a configuration file for `kube-scheduler`. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.6 - Ensure that the scheduler pod specification file ownership is set to `root:root` (Scored) @@ -813,7 +813,7 @@ RKE doesn't require or maintain a configuration file for `kube-scheduler`. All c RKE doesn't require or maintain a configuration file for kube-scheduler. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.7 - Ensure that the `etcd` pod specification file permissions are set to `644` or more restrictive (Scored) @@ -821,7 +821,7 @@ RKE doesn't require or maintain a configuration file for kube-scheduler. All con RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.8 - Ensure that the `etcd` pod specification file ownership is set to `root:root` (Scored) @@ -829,7 +829,7 @@ RKE doesn't require or maintain a configuration file for etcd. All configuration RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.9 - Ensure that the Container Network Interface file permissions are set to `644` or more restrictive (Not Scored) @@ -950,7 +950,7 @@ stat -c %U:%G /var/lib/rancher/etcd RKE does not store the kubernetes default kubeconfig credentials file on the nodes. It's presented to user where RKE is run. We recommend that this kube_config_cluster.yml file be kept in secure store. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.14 - Ensure that ownership of `admin.conf` is set to `root:root` (Scored) @@ -958,7 +958,7 @@ RKE does not store the kubernetes default kubeconfig credentials file on the nod RKE does not store the default `kubectl` config credentials file on the nodes. It presents credentials to the user when `rke` is first run, and only on the device where the user ran the command. Rancher Labs recommends that this `kube_config_cluster.yml` file be kept in secure store. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 1.4.15 - Ensure that the file permissions for `scheduler.conf` are set to `644` or more restrictive (Scored) @@ -1692,7 +1692,7 @@ stat -c %U:%G /etc/kubernetes/ssl/kubecfg-kube-node.yaml RKE doesn't require or maintain a configuration file for kubelet. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 2.2.4 - Ensure that the kubelet service file ownership is set to `root:root` (Scored) @@ -1701,7 +1701,7 @@ RKE doesn't require or maintain a configuration file for kubelet. All configurat RKE doesn't require or maintain a configuration file for kubelet. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 2.2.5 - Ensure that the proxy kubeconfig file permissions are set to `644` or more restrictive (Scored) @@ -1757,7 +1757,7 @@ stat -c %U:%G /etc/kubernetes/ssl/kube-ca.pem RKE doesn't require or maintain a configuration file for kubelet. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable #### 2.2.10 - Ensure that the kubelet configuration file permissions are set to `644` or more restrictive (Scored) @@ -1765,4 +1765,4 @@ RKE doesn't require or maintain a configuration file for kubelet. All configurat RKE doesn't require or maintain a configuration file for kubelet. All configuration is passed in as arguments at container run time. -**Result:** Pass (Not Applicable) +**Result:** Not Applicable From 2f4701ba586cf2214949080e0b23b4df7db420b0 Mon Sep 17 00:00:00 2001 From: Nelson Roberts Date: Tue, 17 Mar 2020 10:02:57 -0700 Subject: [PATCH 4/4] update result for 1.1.21 --- content/rancher/v2.x/en/security/benchmark-2.3/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md index cdec02df08b..f383707019f 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.3/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.3/_index.md @@ -319,7 +319,7 @@ docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--kubelet-certificat **Returned Value:** none -**Result:** Fail (See Mitigation) +**Result:** Pass #### 1.1.22 - Ensure that the `--kubelet-client-certificate` and `--kubelet-client-key` arguments are set as appropriate (Scored)