Merge pull request #1671 from drpebcak/kubelet-auth-mode

kubelet authorization-mode fix

content/rancher/v2.x/en/security/benchmark-2.2/_index.md

@@ -34,7 +34,6 @@ The following scored controls do not currently pass, and Rancher Labs is working
 - 1.1.21 - Ensure that the `--kubelet-certificate-authority` argument is set as appropriate (Scored)
 - 1.4.11 - Ensure that the etcd data directory permissions are set to `700` or more-restrictive (Scored)
 - 1.4.12 - Ensure that the etcd data directory ownership is set to `etcd:etcd` (Scored)
-- 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored)
 - 2.1.8 - Ensure that the `--hostname-override` argument is not set (Scored)
 
 ### Controls
@@ -1431,19 +1430,15 @@ docker inspect kubelet | jq -e '.[0].Args[] | match("--anonymous-auth=false").st
 
 #### 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored)
 
-**Notes**
-
-RKE currently runs the kubelet without the `--authorization-mode` flag.
-
 **Audit**
 
 ``` bash
 docker inspect kubelet | jq -e '.[0].Args[] | match("--authorization-mode=Webhook").string'
 ```
 
-**Returned Value:** `null`
+**Returned Value:** `--authorization-mode=Webhook`
 
-**Result:** Fail
+**Result:** Pass
 
 #### 2.1.3 - Ensure that the `--client-ca-file` argument is set as appropriate (Scored)
 

content/rancher/v2.x/en/security/hardening-2.2/_index.md

@@ -359,6 +359,7 @@ Ensure Kubelet options are configured to match CIS controls.
 To pass the following controls in the CIS benchmark, ensure the appropriate flags are passed to the Kubelet.
 
 - 2.1.1 -  Ensure that the `--anonymous-auth` argument is set to false (Scored)
+- 2.1.2 - Ensure that the `--authorization-mode` argument is not set to `AlwaysAllow` (Scored)
 - 2.1.6 - Ensure that the `--streaming-connection-idle-timeout` argument is not set to 0 (Scored)
 - 2.1.7 - Ensure that the `--protect-kernel-defaults` argument is set to true (Scored)
 - 2.1.8 - Ensure that the `--make-iptables-util-chains` argument is set to true (Scored)
@@ -371,6 +372,7 @@ To pass the following controls in the CIS benchmark, ensure the appropriate flag
 Inspect the Kubelet containers on all hosts and verify that they are running with the following options:
 
 - `--streaming-connection-idle-timeout=<duration greater than 0>`
+- `--authorization-mode=Webhook`
 - `--protect-kernel-defaults=false`
 - `--make-iptables-util-chains=false`
 - `--event-qps=0`
@@ -386,6 +388,7 @@ Inspect the Kubelet containers on all hosts and verify that they are running wit
 services:
   kubelet:
     extra_args:
+      authorization-mode: "Webhook"
       streaming-connection-idle-timeout: "<duration>"
       protect-kernel-defaults: "true"
       make-iptables-util-chains: "true"
@@ -1035,6 +1038,7 @@ services:
   kubelet:
     extra_args:
       streaming-connection-idle-timeout: "1800s"
+      authorization-mode: "Webhook"
       protect-kernel-defaults: "true"
       make-iptables-util-chains: "true"
       event-qps: "0"