CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4
CIS 1.6 Kubernetes Benchmark - Rancher v2.5.4 with Kubernetes v1.18#
概述#
本文档是对 Rancher v2.5.4 安全加固指南的补充。加固指南提供了用于加固 Rancher 的生产环境集群的指南，该基准自测指南旨在帮助您针对安全基准中的每个控制，来评估加固集群的安全级别。本指南将逐步介绍各种控制，并提供更新的示例命令以审核 Rancher 创建的集群中的合规性。此文档的适用人群是：Rancher 运维人员、安全团队、审核员和决策者。
加固指南旨在与特定版本的安全加固指南，CIS Kubernetes Benchmark，Kubernetes 和 Rancher 一起使用：
| 自测指南版本 | Rancher 版本 | 安全加固指南版本 | Kubernetes 版本 | CIS Benchmark 版本 |
|---|---|---|---|---|
| 自测指南 v2.5 | Rancher v2.5 | 安全加固指南 v2.5.4 | Kubernetes v1.18 | Benchmark v1.6 |
由于 Rancher 和 RKE 以容器的方式安装 Kubernetes，因此 CIS Kubernetes Benchmark 中的许多控制验证检查均不适用，完成 CIS 扫描后，这些检测对应的结论是Not Applicable（不适用）。
有关每个审核的更多详细信息，包括测试失败的原因和补救措施，您可以参考 CIS Kubernetes Benchmark v1.6 的相应部分。登录CISecurity.org后，可以下载基准测试。
测试控制方法#
Rancher 和 RKE 通过 Docker 容器安装 Kubernetes 服务。配置在初始化时通过给容器传递参数的方式设置，而不是通过配置文件定义。
如果控制审核与原始 CIS 基准不同，则将提供 Rancher Labs 特定的审核命令以进行测试。执行测试时，您将需要访问所有三个 RKE 角色的主机上的 Docker 命令行。这些命令还利用了jq和kubectl（使用有效的 kubeconfig 文件）来测试和评估测试结果。
说明：本文只包含了得分的测试。
Controls#
1.1 Etcd Node Configuration Files#
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)#
Result: pass
Remediation: On the etcd server node, get the etcd data directory, passed as an argument --data-dir, from the below command: ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd
Audit:
Expected Result:
Returned Value:
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)#
Result: pass
Remediation: On the etcd server node, get the etcd data directory, passed as an argument --data-dir, from the below command: ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example, chown etcd:etcd /var/lib/etcd
A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership.
Audit:
Expected Result:
Returned Value:
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the master node. For example, chown -R root:root /etc/kubernetes/pki/
Audit:
Expected Result:
Audit Script:
Returned Value:
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the master node. For example, chmod -R 644 /etc/kubernetes/pki/*.crt
Audit:
Expected Result:
Audit Script:
Returned Value:
1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the master node. For example, chmod -R 600 /etc/kubernetes/ssl/*key.pem
Audit:
Expected Result:
Audit Script:
Returned Value:
1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.
Audit:
1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.
Audit:
1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
Audit:
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
Audit:
1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
Audit:
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
Audit:
1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
Audit:
1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
Audit:
1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)#
Result: warn
Remediation: Run the below command (based on the file location on your system) on the master node. For example, chmod 644 <path/to/cni/files>
Audit:
1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)#
Result: warn
Remediation: Run the below command (based on the file location on your system) on the master node. For example, chown root:root <path/to/cni/files>
Audit:
1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
Audit:
1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
Audit:
1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
Audit:
1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
Audit:
1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
Audit:
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn't require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
Audit:
1.2 API Server#
1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter. --anonymous-auth=false
Audit:
Expected Result:
Returned Value:
1.2.2 Ensure that the --basic-auth-file argument is not set (Automated)#
Result: pass
Remediation:
Follow the documentation and configure alternate mechanisms for authentication. Then,
edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and remove the --basic-auth-file=<filename> parameter.
Audit:
Expected Result:
Returned Value:
1.2.3 Ensure that the --token-auth-file parameter is not set (Automated)#
Result: pass
Remediation:
Follow the documentation and configure alternate mechanisms for authentication. Then,
edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and remove the --token-auth-file=<filename> parameter.
Audit:
Expected Result:
Returned Value:
1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --kubelet-https parameter.
Audit:
Expected Result:
Returned Value:
1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the kubelet client certificate and key parameters as below. --kubelet-client-certificate=<path/to/client-certificate-file> --kubelet-client-key=<path/to/client-key-file>
Audit:
Expected Result:
Returned Value:
1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)#
Result: pass
Remediation:
Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
Audit:
Expected Result:
Returned Value:
1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to values other than AlwaysAllow. One such example could be as below. --authorization-mode=RBAC
Audit:
Expected Result:
Returned Value:
1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes Node. --authorization-mode=Node,RBAC
Audit:
Expected Result:
Returned Value:
1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example: --authorization-mode=Node,RBAC
Audit:
Expected Result:
Returned Value:
1.2.10 Ensure that the admission control plugin EventRateLimit is set (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set the desired limits in a configuration file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml and set the below parameters. --enable-admission-plugins=...,EventRateLimit,... --admission-control-config-file=<path/to/configuration/file>
Audit:
Expected Result:
Returned Value:
1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and either remove the --enable-admission-plugins parameter, or set it to a value that does not include AlwaysAdmit.
Audit:
Expected Result:
Returned Value:
1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)#
Result: warn
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,...
Audit:
1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)#
Result: warn
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --enable-admission-plugins parameter to include SecurityContextDeny, unless PodSecurityPolicy is already in place. --enable-admission-plugins=...,SecurityContextDeny,...
Audit:
1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)#
Result: pass
Remediation: Follow the documentation and create ServiceAccount objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and ensure that the --disable-admission-plugins parameter is set to a value that does not include ServiceAccount.
Audit:
Expected Result:
Returned Value:
1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --disable-admission-plugins parameter to ensure it does not include NamespaceLifecycle.
Audit:
Expected Result:
Returned Value:
1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated)#
Result: pass
Remediation: Follow the documentation and create Pod Security Policy objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --enable-admission-plugins parameter to a value that includes PodSecurityPolicy: --enable-admission-plugins=...,PodSecurityPolicy,... Then restart the API Server.
Audit:
Expected Result:
Returned Value:
1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --enable-admission-plugins parameter to a value that includes NodeRestriction. --enable-admission-plugins=...,NodeRestriction,...
Audit:
Expected Result:
Returned Value:
1.2.18 Ensure that the --insecure-bind-address argument is not set (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --insecure-bind-address parameter.
Audit:
Expected Result:
Returned Value:
1.2.19 Ensure that the --insecure-port argument is set to 0 (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter. --insecure-port=0
Audit:
Expected Result:
Returned Value:
1.2.20 Ensure that the --secure-port argument is not set to 0 (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and either remove the --secure-port parameter or set it to a different (non-zero) desired port.
Audit:
Expected Result:
Returned Value:
1.2.21 Ensure that the --profiling argument is set to false (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter. --profiling=false
Audit:
Expected Result:
Returned Value:
1.2.22 Ensure that the --audit-log-path argument is set (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example: --audit-log-path=/var/log/apiserver/audit.log
Audit:
Expected Result:
Returned Value:
1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days: --audit-log-maxage=30
Audit:
Expected Result:
Returned Value:
1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate value. --audit-log-maxbackup=10
Audit:
Expected Result:
Returned Value:
1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB. For example, to set it as 100 MB: --audit-log-maxsize=100
Audit:
Expected Result:
Returned Value:
1.2.26 Ensure that the --request-timeout argument is set as appropriate (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml and set the below parameter as appropriate and if needed. For example, --request-timeout=300s
Audit:
Expected Result:
Returned Value:
1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated)#
Result: pass
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter. --service-account-lookup=true Alternatively, you can delete the --service-account-lookup parameter from this file so that the default takes effect.
Audit:
Expected Result:
Returned Value:
1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated)#
Result: pass
Remediation:
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the master node and set the --service-account-key-file parameter
to the public key file for service accounts:
--service-account-key-file=<filename>
Audit:
Expected Result:
Returned Value:
1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate and key file parameters. --etcd-certfile=<path/to/client-certificate-file> --etcd-keyfile=<path/to/client-key-file>
Audit:
Expected Result:
Returned Value:
1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the TLS certificate and private key file parameters. --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file>
Audit:
Expected Result:
Returned Value:
1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the client certificate authority file. --client-ca-file=<path/to/client-ca-file>
Audit:
Expected Result:
Returned Value:
1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd certificate authority file parameter. --etcd-cafile=<path/to/ca-file>
Audit:
Expected Result:
Returned Value:
1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>
Audit:
Expected Result:
Returned Value:
1.2.34 Ensure that encryption providers are appropriately configured (Automated)#
Result: pass
Remediation: Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file, choose aescbc, kms or secretbox as the encryption provider.
Audit:
Expected Result:
Audit Script:
Returned Value:
1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)#
Result: warn
Remediation: Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter. --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM _SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM _SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM _SHA384
Audit:
1.3 Controller Manager#
1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Automated)#
Result: pass
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, for example: --terminated-pod-gc-threshold=10
Audit:
Expected Result:
Returned Value:
1.3.2 Ensure that the --profiling argument is set to false (Automated)#
Result: pass
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the below parameter. --profiling=false
Audit:
Expected Result:
Returned Value:
1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)#
Result: pass
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node to set the below parameter. --use-service-account-credentials=true
Audit:
Expected Result:
Returned Value:
1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)#
Result: pass
Remediation:
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the master node and set the --service-account-private-key-file parameter
to the private key file for service accounts.
--service-account-private-key-file=<filename>
Audit:
Expected Result:
Returned Value:
1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)#
Result: pass
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --root-ca-file parameter to the certificate bundle file`. --root-ca-file=<path/to/file>
Audit:
Expected Result:
Returned Value:
1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)#
Result: notApplicable
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true
Cluster provisioned by RKE handles certificate rotation directly through RKE.
Audit:
1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)#
Result: pass
Remediation: Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and ensure the correct value for the --bind-address parameter
Audit:
Expected Result:
Returned Value:
1.4 Scheduler#
1.4.1 Ensure that the --profiling argument is set to false (Automated)#
Result: pass
Remediation: Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file on the master node and set the below parameter. --profiling=false
Audit:
Expected Result:
Returned Value:
1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)#
Result: pass
Remediation: Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml on the master node and ensure the correct value for the --bind-address parameter
Audit:
Expected Result:
Returned Value:
2 Etcd Node Configuration Files#
2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)#
Result: pass
Remediation: Follow the etcd service documentation and configure TLS encryption. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. --cert-file=</path/to/ca-file> --key-file=</path/to/key-file>
Audit:
Expected Result:
Returned Value:
2.2 Ensure that the --client-cert-auth argument is set to true (Automated)#
Result: pass
Remediation: Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. --client-cert-auth="true"
Audit:
Expected Result:
Returned Value:
2.3 Ensure that the --auto-tls argument is not set to true (Automated)#
Result: pass
Remediation: Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and either remove the --auto-tls parameter or set it to false. --auto-tls=false
Audit:
Expected Result:
Returned Value:
2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)#
Result: pass
Remediation: Follow the etcd service documentation and configure peer TLS encryption as appropriate for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameters. --peer-client-file=</path/to/peer-cert-file> --peer-key-file=</path/to/peer-key-file>
Audit:
Expected Result:
Returned Value:
2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)#
Result: pass
Remediation: Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. --peer-client-cert-auth=true
Audit:
Expected Result:
Returned Value:
2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)#
Result: pass
Remediation: Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and either remove the --peer-auto-tls parameter or set it to false. --peer-auto-tls=false
Audit:
Expected Result:
Returned Value:
2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)#
Result: pass
Remediation: [Manual test] Follow the etcd documentation and create a dedicated certificate authority setup for the etcd service. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master node and set the below parameter. --trusted-ca-file=</path/to/ca-file>
Audit:
Expected Result:
Returned Value:
3.1 Authentication and Authorization#
3.1.1 Client certificate authentication should not be used for users (Manual)#
Result: warn
Remediation: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates.
Audit:
3.2 Logging#
3.2.1 Ensure that a minimal audit policy is created (Automated)#
Result: pass
Remediation: Create an audit policy file for your cluster.
Audit:
Expected Result:
Returned Value:
3.2.2 Ensure that the audit policy covers key security concerns (Manual)#
Result: warn
Remediation: Consider modification of the audit policy in use on the cluster to include these items, at a minimum.
Audit:
4.1 Worker Node Configuration Files#
4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
Audit:
4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Cluster provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
Audit:
4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the each worker node. For example, chmod 644 $proykubeconfig
Audit:
Expected Result:
Returned Value:
4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the each worker node. For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-proxy.yaml
Audit:
Expected Result:
4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the each worker node. For example, chmod 644 /etc/kubernetes/ssl/kubecfg-kube-node.yaml
Audit:
Expected Result:
4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)#
Result: pass
Remediation: Run the below command (based on the file location on your system) on the each worker node. For example, chown root:root /etc/kubernetes/ssl/kubecfg-kube-node.yaml
Audit:
Expected Result:
Returned Value:
4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated)#
Result: pass
Remediation:
Run the following command to modify the file permissions of the
--client-ca-file chmod 644 <filename>
Audit:
Expected Result:
Audit Script:
4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Automated)#
Result: pass
Remediation:
Run the following command to modify the ownership of the --client-ca-file.
chown root:root <filename>
Audit:
Expected Result:
Audit Script:
4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)#
Result: notApplicable
Remediation: Run the following command (using the config file location identified in the Audit step) chmod 644 /var/lib/kubelet/config.yaml
Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.
Audit:
4.1.10 Ensure that the kubelet --config configuration file ownership is set to root:root (Automated)#
Result: notApplicable
Remediation: Run the following command (using the config file location identified in the Audit step) chown root:root /var/lib/kubelet/config.yaml
Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.
Audit:
4.2 Kubelet#
4.2.1 Ensure that the anonymous-auth argument is set to false (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --anonymous-auth=false Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --authorization-mode=Webhook Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to the location of the client CA file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --client-ca-file=<path/to/client-ca-file> Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.4 Ensure that the --read-only-port argument is set to 0 (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set readOnlyPort to 0. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --read-only-port=0 Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a value other than 0. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --streaming-connection-idle-timeout=5m Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
Returned Value:
4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set protectKernelDefaults: true. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --protect-kernel-defaults=true Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and remove the --make-iptables-util-chains argument from the KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.8 Ensure that the --hostname-override argument is not set (Manual)#
Result: notApplicable
Remediation: Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and remove the --hostname-override argument from the KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Clusters provisioned by RKE set the --hostname-override to avoid any hostname configuration errors
Audit:
4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. --tls-cert-file=<path/to/tls-certificate-file> --tls-private-key-file=<path/to/tls-key-file> Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to add the line rotateCertificates: true or remove it altogether to use the default value. If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS variable. Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
Returned Value:
4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)#
Result: notApplicable
Remediation: Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. --feature-gates=RotateKubeletServerCertificate=true Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Clusters provisioned by RKE handles certificate rotation directly through RKE.
Audit:
4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated)#
Result: pass
Remediation: If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 or to a subset of these values. If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the --tls-cipher-suites parameter as follows, or to a subset of these values. --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service
Audit:
Expected Result:
5.1 RBAC and Service Accounts#
5.1.1 Ensure that the cluster-admin role is only used where required (Manual)#
Result: warn
Remediation: Identify all clusterrolebindings to the cluster-admin role. Check if they are used and if they need this role or if they could use a role with fewer privileges. Where possible, first bind users to a lower privileged role and then remove the clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]
Audit:
5.1.2 Minimize access to secrets (Manual)#
Result: warn
Remediation: Where possible, remove get, list and watch access to secret objects in the cluster.
Audit:
5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)#
Result: warn
Remediation: Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions.
Audit:
5.1.4 Minimize access to create pods (Manual)#
Result: warn
Remediation: Where possible, remove create access to pod objects in the cluster.
Audit:
5.1.5 Ensure that default service accounts are not actively used. (Automated)#
Result: pass
Remediation: Create explicit service accounts wherever a Kubernetes workload requires specific access to the Kubernetes API server. Modify the configuration of each default service account to include this value automountServiceAccountToken: false
Audit:
Expected Result:
Audit Script:
Returned Value:
5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)#
Result: warn
Remediation: Modify the definition of pods and service accounts which do not need to mount service account tokens to disable it.
Audit:
5.2 Pod Security Policies#
5.2.1 Minimize the admission of privileged containers (Manual)#
Result: warn
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.privileged field is omitted or set to false.
Audit:
5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Automated)#
Result: pass
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostPID field is omitted or set to false.
Audit:
Expected Result:
Returned Value:
5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Automated)#
Result: pass
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostIPC field is omitted or set to false.
Audit:
Expected Result:
Returned Value:
5.2.4 Minimize the admission of containers wishing to share the host network namespace (Automated)#
Result: pass
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostNetwork field is omitted or set to false.
Audit:
Expected Result:
Returned Value:
5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Automated)#
Result: pass
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.allowPrivilegeEscalation field is omitted or set to false.
Audit:
Expected Result:
Returned Value:
5.2.6 Minimize the admission of root containers (Manual)#
Result: warn
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.
Audit:
5.2.7 Minimize the admission of containers with the NET_RAW capability (Manual)#
Result: warn
Remediation: Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
Audit:
5.2.8 Minimize the admission of containers with added capabilities (Manual)#
Result: warn
Remediation: Ensure that allowedCapabilities is not present in PSPs for the cluster unless it is set to an empty array.
Audit:
5.2.9 Minimize the admission of containers with capabilities assigned (Manual)#
Result: warn
Remediation: Review the use of capabilites in applications runnning on your cluster. Where a namespace contains applicaions which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities.
Audit:
5.3 Network Policies and CNI#
5.3.1 Ensure that the CNI in use supports Network Policies (Manual)#
Result: warn
Remediation: If the CNI plugin in use does not support network policies, consideration should be given to making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster.
Audit:
5.3.2 Ensure that all Namespaces have Network Policies defined (Automated)#
Result: pass
Remediation: Follow the documentation and create NetworkPolicy objects as you need them.
Audit:
Expected Result:
Audit Script:
Returned Value:
5.4 Secrets Management#
5.4.1 Prefer using secrets as files over secrets as environment variables (Manual)#
Result: warn
Remediation: if possible, rewrite application code to read secrets from mounted secret files, rather than from environment variables.
Audit:
5.4.2 Consider external secret storage (Manual)#
Result: warn
Remediation: Refer to the secrets management options offered by your cloud provider or a third-party secrets management solution.
Audit:
5.5 Extensible Admission Control#
5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)#
Result: warn
Remediation: Follow the Kubernetes documentation and setup image provenance.
Audit:
5.7 General Policies#
5.7.1 Create administrative boundaries between resources using namespaces (Manual)#
Result: warn
Remediation: Follow the documentation and create namespaces for objects in your deployment as you need them.
Audit:
5.7.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)#
Result: warn
Remediation: Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you would need to enable alpha features in the apiserver by passing "--feature- gates=AllAlpha=true" argument. Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS parameter to "--feature-gates=AllAlpha=true" KUBE_API_ARGS="--feature-gates=AllAlpha=true" Based on your system, restart the kube-apiserver service. For example: systemctl restart kube-apiserver.service Use annotations to enable the docker/default seccomp profile in your pod definitions. An example is as below: apiVersion: v1 kind: Pod metadata: name: trustworthy-pod annotations: seccomp.security.alpha.kubernetes.io/pod: docker/default spec: containers: - name: trustworthy-container image: sotrustworthy:latest
Audit:
5.7.3 Apply Security Context to Your Pods and Containers (Manual)#
Result: warn
Remediation: Follow the Kubernetes documentation and apply security contexts to your pods. For a suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker Containers.
Audit:
5.7.4 The default namespace should not be used (Automated)#
Result: pass
Remediation: Ensure that namespaces are created to allow for appropriate segregation of Kubernetes resources and that all new resources are created in a specific namespace.
Audit:
Expected Result:
Audit Script:
Returned Value: