From a402a7a71ac285e7025a0f976974f37421cc360e Mon Sep 17 00:00:00 2001 From: Taylor Price Date: Thu, 15 Aug 2019 13:51:22 -0700 Subject: [PATCH] kubelet authorization-mode fix --- content/rancher/v2.x/en/security/benchmark-2.2/_index.md | 9 ++------- content/rancher/v2.x/en/security/hardening-2.2/_index.md | 3 +++ 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md index b5e8902d450..dd26cb24dc3 100644 --- a/content/rancher/v2.x/en/security/benchmark-2.2/_index.md +++ b/content/rancher/v2.x/en/security/benchmark-2.2/_index.md @@ -34,7 +34,6 @@ The following scored controls do not currently pass, and Rancher Labs is working - 1.1.21 - Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored) - 1.4.11 - Ensure that the etcd data directory permissions are set to `700` or more-restrictive (Scored) - 1.4.12 - Ensure that the etcd data directory ownership is set to `etcd:etcd` (Scored) -- 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) - 2.1.8 - Ensure that the `--hostname-override` argument is not set (Scored) ### Controls @@ -1431,19 +1430,15 @@ docker inspect kubelet | jq -e '.[0].Args[] | match("--anonymous-auth=false").st #### 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) -**Notes** - -RKE currently runs the kubelet without the `--authorization-mode` flag. - **Audit** ``` bash docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string' ``` -**Returned Value:** `null` +**Returned Value:** `--authorization-mode=Webhook` -**Result:** Fail +**Result:** Pass #### 2.1.3 - Ensure that the `--client-ca-file` argument is set as appropriate (Scored) diff --git a/content/rancher/v2.x/en/security/hardening-2.2/_index.md b/content/rancher/v2.x/en/security/hardening-2.2/_index.md index 83c191002b0..adf49b5f7e5 100644 --- a/content/rancher/v2.x/en/security/hardening-2.2/_index.md +++ b/content/rancher/v2.x/en/security/hardening-2.2/_index.md @@ -359,6 +359,7 @@ Ensure Kubelet options are configured to match CIS controls. To pass the following controls in the CIS benchmark, ensure the appropriate flags are passed to the Kubelet. - 2.1.1 - Ensure that the `--anonymous-auth` argument is set to false (Scored) +- 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored) - 2.1.6 - Ensure that the `--streaming-connection-idle-timeout` argument is not set to 0 (Scored) - 2.1.7 - Ensure that the `--protect-kernel-defaults` argument is set to true (Scored) - 2.1.8 - Ensure that the `--make-iptables-util-chains` argument is set to true (Scored) @@ -371,6 +372,7 @@ To pass the following controls in the CIS benchmark, ensure the appropriate flag Inspect the Kubelet containers on all hosts and verify that they are running with the following options: - `--streaming-connection-idle-timeout=` +- `--authorization-mode=Webhook` - `--protect-kernel-defaults=false` - `--make-iptables-util-chains=false` - `--event-qps=0` @@ -386,6 +388,7 @@ Inspect the Kubelet containers on all hosts and verify that they are running wit services: kubelet: extra_args: + authorization-mode: "Webhook" streaming-connection-idle-timeout: "" protect-kernel-defaults: "true" make-iptables-util-chains: "true"